Series comparison

-[Qemu-devel] [PULL 0/2] Block patches
+[PULL v2 00/28] Block patches
-The following changes since commit ca4e667dbf431d4a2a5a619cde79d30dd2ac3eb2:
+The following changes since commit ac793156f650ae2d77834932d72224175ee69086:
-  Merge remote-tracking branch 'remotes/kraxel/tags/usb-20170717-pull-request' into staging (2017-07-17 17:54:17 +0100)
+  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20201020-1' into staging (2020-10-20 21:11:35 +0100)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 8508eee740c78d1465e25dad7c3e06137485dfbc:
+for you to fetch changes up to 32a3fd65e7e3551337fd26bfc0e2f899d70c028c:
-  live-block-ops.txt: Rename, rewrite, and improve it (2017-07-18 00:11:01 -0400)
+  iotests: add commit top->base cases to 274 (2020-10-22 09:55:39 +0100)
 ----------------------------------------------------------------
-Block patches (documentation)
+Pull request
 v2:
  * Fix format string issues on 32-bit hosts [Peter]
  * Fix qemu-nbd.c CONFIG_POSIX ifdef issue [Eric]
  * Fix missing eventfd.h header on macOS [Peter]
  * Drop unreliable vhost-user-blk test (will send a new patch when ready) [Peter]
 This pull request contains the vhost-user-blk server by Coiby Xu along with my
 additions, block/nvme.c alignment and hardware error statistics by Philippe
 Mathieu-Daudé, and bdrv_co_block_status_above() fixes by Vladimir
 Sementsov-Ogievskiy.
 ----------------------------------------------------------------
-Kashyap Chamarthy (2):
+Coiby Xu (6):
-  bitmaps.md: Convert to rST; move it into 'interop' dir
+  libvhost-user: Allow vu_message_read to be replaced
-  live-block-ops.txt: Rename, rewrite, and improve it
+  libvhost-user: remove watch for kick_fd when de-initialize vu-dev
   util/vhost-user-server: generic vhost user server
   block: move logical block size check function to a common utility
     function
   block/export: vhost-user block device backend server
   MAINTAINERS: Add vhost-user block device backend server maintainer
- docs/devel/bitmaps.md                  |  505 ---------------
+Philippe Mathieu-Daudé (1):
- docs/interop/bitmaps.rst               |  555 ++++++++++++++++
+  block/nvme: Add driver statistics for access alignment and hw errors
- docs/interop/live-block-operations.rst | 1088 ++++++++++++++++++++++++++++++++
- docs/live-block-ops.txt                |   72 ---
+Stefan Hajnoczi (16):
-files changed, 1643 insertions(+), 577 deletions(-)
+  util/vhost-user-server: s/fileds/fields/ typo fix
- delete mode 100644 docs/devel/bitmaps.md
+  util/vhost-user-server: drop unnecessary QOM cast
- create mode 100644 docs/interop/bitmaps.rst
+  util/vhost-user-server: drop unnecessary watch deletion
- create mode 100644 docs/interop/live-block-operations.rst
+  block/export: consolidate request structs into VuBlockReq
- delete mode 100644 docs/live-block-ops.txt
+  util/vhost-user-server: drop unused DevicePanicNotifier
   util/vhost-user-server: fix memory leak in vu_message_read()
   util/vhost-user-server: check EOF when reading payload
   util/vhost-user-server: rework vu_client_trip() coroutine lifecycle
   block/export: report flush errors
   block/export: convert vhost-user-blk server to block export API
   util/vhost-user-server: move header to include/
   util/vhost-user-server: use static library in meson.build
   qemu-storage-daemon: avoid compiling blockdev_ss twice
   block: move block exports to libblockdev
   block/export: add iothread and fixed-iothread options
   block/export: add vhost-user-blk multi-queue support
 Vladimir Sementsov-Ogievskiy (5):
   block/io: fix bdrv_co_block_status_above
   block/io: bdrv_common_block_status_above: support include_base
   block/io: bdrv_common_block_status_above: support bs == base
   block/io: fix bdrv_is_allocated_above
   iotests: add commit top->base cases to 274
  MAINTAINERS                                |   9 +
  qapi/block-core.json                       |  24 +-
  qapi/block-export.json                     |  36 +-
  block/coroutines.h                         |   2 +
  block/export/vhost-user-blk-server.h       |  19 +
  contrib/libvhost-user/libvhost-user.h      |  21 +
  include/qemu/vhost-user-server.h           |  65 +++
  util/block-helpers.h                       |  19 +
  block/export/export.c                      |  37 +-
  block/export/vhost-user-blk-server.c       | 431 ++++++++++++++++++++
  block/io.c                                 | 132 +++---
  block/nvme.c                               |  27 ++
  block/qcow2.c                              |  16 +-
  contrib/libvhost-user/libvhost-user-glib.c |   2 +-
  contrib/libvhost-user/libvhost-user.c      |  15 +-
  hw/core/qdev-properties-system.c           |  31 +-
  nbd/server.c                               |   2 -
  qemu-nbd.c                                 |  21 +-
  softmmu/vl.c                               |   4 +
  stubs/blk-exp-close-all.c                  |   7 +
  tests/vhost-user-bridge.c                  |   2 +
  tools/virtiofsd/fuse_virtio.c              |   4 +-
  util/block-helpers.c                       |  46 +++
  util/vhost-user-server.c                   | 446 +++++++++++++++++++++
  block/export/meson.build                   |   3 +-
  contrib/libvhost-user/meson.build          |   1 +
  meson.build                                |  22 +-
  nbd/meson.build                            |   2 +
  storage-daemon/meson.build                 |   3 +-
  stubs/meson.build                          |   1 +
  tests/qemu-iotests/274                     |  20 +
  tests/qemu-iotests/274.out                 |  68 ++++
  util/meson.build                           |   4 +
 files changed, 1420 insertions(+), 122 deletions(-)
  create mode 100644 block/export/vhost-user-blk-server.h
  create mode 100644 include/qemu/vhost-user-server.h
  create mode 100644 util/block-helpers.h
  create mode 100644 block/export/vhost-user-blk-server.c
  create mode 100644 stubs/blk-exp-close-all.c
  create mode 100644 util/block-helpers.c
  create mode 100644 util/vhost-user-server.c
 --
-.9.4
+.26.2

-New patch
+[PULL v2 01/28] block/nvme: Add driver statistics for access alignment and hw errors
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Keep statistics of some hardware errors, and number of
+aligned/unaligned I/O accesses.
+QMP example booting a full RHEL 8.3 aarch64 guest:
+{ "execute": "query-blockstats" }
+{
+    "return": [
+        {
+            "device": "",
+            "node-name": "drive0",
+            "stats": {
+                "flush_total_time_ns": 6026948,
+                "wr_highest_offset": 3383991230464,
+                "wr_total_time_ns": 807450995,
+                "failed_wr_operations": 0,
+                "failed_rd_operations": 0,
+                "wr_merged": 3,
+                "wr_bytes": 50133504,
+                "failed_unmap_operations": 0,
+                "failed_flush_operations": 0,
+                "account_invalid": false,
+                "rd_total_time_ns": 1846979900,
+                "flush_operations": 130,
+                "wr_operations": 659,
+                "rd_merged": 1192,
+                "rd_bytes": 218244096,
+                "account_failed": false,
+                "idle_time_ns": 2678641497,
+                "rd_operations": 7406,
+            },
+            "driver-specific": {
+                "driver": "nvme",
+                "completion-errors": 0,
+                "unaligned-accesses": 2959,
+                "aligned-accesses": 4477
+            },
+            "qdev": "/machine/peripheral-anon/device[0]/virtio-backend"
+        }
+    ]
+}
+Suggested-by: Stefan Hajnoczi <stefanha@gmail.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Acked-by: Markus Armbruster <armbru@redhat.com>
+Message-id: 20201001162939.1567915-1-philmd@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ qapi/block-core.json | 24 +++++++++++++++++++++++-
+ block/nvme.c         | 27 +++++++++++++++++++++++++++
+files changed, 50 insertions(+), 1 deletion(-)
+diff --git a/qapi/block-core.json b/qapi/block-core.json
+index XXXXXXX..XXXXXXX 100644
+--- a/qapi/block-core.json
++++ b/qapi/block-core.json
+@@ -XXX,XX +XXX,XX @@
+       'discard-nb-failed': 'uint64',
+       'discard-bytes-ok': 'uint64' } }
++##
++# @BlockStatsSpecificNvme:
++#
++# NVMe driver statistics
++#
++# @completion-errors: The number of completion errors.
++#
++# @aligned-accesses: The number of aligned accesses performed by
++#                    the driver.
++#
++# @unaligned-accesses: The number of unaligned accesses performed by
++#                      the driver.
++#
++# Since: 5.2
++##
++{ 'struct': 'BlockStatsSpecificNvme',
++  'data': {
++      'completion-errors': 'uint64',
++      'aligned-accesses': 'uint64',
++      'unaligned-accesses': 'uint64' } }
++
+ ##
+ # @BlockStatsSpecific:
+ #
+@@ -XXX,XX +XXX,XX @@
+   'discriminator': 'driver',
+   'data': {
+       'file': 'BlockStatsSpecificFile',
+-      'host_device': 'BlockStatsSpecificFile' } }
++      'host_device': 'BlockStatsSpecificFile',
++      'nvme': 'BlockStatsSpecificNvme' } }
+ ##
+ # @BlockStats:
+diff --git a/block/nvme.c b/block/nvme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/nvme.c
++++ b/block/nvme.c
+@@ -XXX,XX +XXX,XX @@ struct BDRVNVMeState {
+     /* PCI address (required for nvme_refresh_filename()) */
+     char *device;
++
++    struct {
++        uint64_t completion_errors;
++        uint64_t aligned_accesses;
++        uint64_t unaligned_accesses;
++    } stats;
+ };
+ #define NVME_BLOCK_OPT_DEVICE "device"
+@@ -XXX,XX +XXX,XX @@ static bool nvme_process_completion(NVMeQueuePair *q)
+             break;
+         }
+         ret = nvme_translate_error(c);
++        if (ret) {
++            s->stats.completion_errors++;
++        }
+         q->cq.head = (q->cq.head + 1) % NVME_QUEUE_SIZE;
+         if (!q->cq.head) {
+             q->cq_phase = !q->cq_phase;
+@@ -XXX,XX +XXX,XX @@ static int nvme_co_prw(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+     assert(QEMU_IS_ALIGNED(bytes, s->page_size));
+     assert(bytes <= s->max_transfer);
+     if (nvme_qiov_aligned(bs, qiov)) {
++        s->stats.aligned_accesses++;
+         return nvme_co_prw_aligned(bs, offset, bytes, qiov, is_write, flags);
+     }
++    s->stats.unaligned_accesses++;
+     trace_nvme_prw_buffered(s, offset, bytes, qiov->niov, is_write);
+     buf = qemu_try_memalign(s->page_size, bytes);
+@@ -XXX,XX +XXX,XX @@ static void nvme_unregister_buf(BlockDriverState *bs, void *host)
+     qemu_vfio_dma_unmap(s->vfio, host);
+ }
++static BlockStatsSpecific *nvme_get_specific_stats(BlockDriverState *bs)
++{
++    BlockStatsSpecific *stats = g_new(BlockStatsSpecific, 1);
++    BDRVNVMeState *s = bs->opaque;
++
++    stats->driver = BLOCKDEV_DRIVER_NVME;
++    stats->u.nvme = (BlockStatsSpecificNvme) {
++        .completion_errors = s->stats.completion_errors,
++        .aligned_accesses = s->stats.aligned_accesses,
++        .unaligned_accesses = s->stats.unaligned_accesses,
++    };
++
++    return stats;
++}
++
+ static const char *const nvme_strong_runtime_opts[] = {
+     NVME_BLOCK_OPT_DEVICE,
+     NVME_BLOCK_OPT_NAMESPACE,
+@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_nvme = {
+     .bdrv_refresh_filename    = nvme_refresh_filename,
+     .bdrv_refresh_limits      = nvme_refresh_limits,
+     .strong_runtime_opts      = nvme_strong_runtime_opts,
++    .bdrv_get_specific_stats  = nvme_get_specific_stats,
+     .bdrv_detach_aio_context  = nvme_detach_aio_context,
+     .bdrv_attach_aio_context  = nvme_attach_aio_context,
+--
+.26.2

-New patch
+[PULL v2 02/28] libvhost-user: Allow vu_message_read to be replaced
+From: Coiby Xu <coiby.xu@gmail.com>
+Allow vu_message_read to be replaced by one which will make use of the
+QIOChannel functions. Thus reading vhost-user message won't stall the
+guest. For slave channel, we still use the default vu_message_read.
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200918080912.321299-2-coiby.xu@gmail.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ contrib/libvhost-user/libvhost-user.h      | 21 +++++++++++++++++++++
+ contrib/libvhost-user/libvhost-user-glib.c |  2 +-
+ contrib/libvhost-user/libvhost-user.c      | 14 +++++++-------
+ tests/vhost-user-bridge.c                  |  2 ++
+ tools/virtiofsd/fuse_virtio.c              |  4 ++--
+files changed, 33 insertions(+), 10 deletions(-)
+diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/libvhost-user/libvhost-user.h
++++ b/contrib/libvhost-user/libvhost-user.h
+@@ -XXX,XX +XXX,XX @@
+  */
+ #define VHOST_USER_MAX_RAM_SLOTS 32
++#define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64)
++
+ typedef enum VhostSetConfigType {
+     VHOST_SET_CONFIG_TYPE_MASTER = 0,
+     VHOST_SET_CONFIG_TYPE_MIGRATION = 1,
+@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*vu_get_features_cb) (VuDev *dev);
+ typedef void (*vu_set_features_cb) (VuDev *dev, uint64_t features);
+ typedef int (*vu_process_msg_cb) (VuDev *dev, VhostUserMsg *vmsg,
+                                   int *do_reply);
++typedef bool (*vu_read_msg_cb) (VuDev *dev, int sock, VhostUserMsg *vmsg);
+ typedef void (*vu_queue_set_started_cb) (VuDev *dev, int qidx, bool started);
+ typedef bool (*vu_queue_is_processed_in_order_cb) (VuDev *dev, int qidx);
+ typedef int (*vu_get_config_cb) (VuDev *dev, uint8_t *config, uint32_t len);
+@@ -XXX,XX +XXX,XX @@ struct VuDev {
+     bool broken;
+     uint16_t max_queues;
++    /* @read_msg: custom method to read vhost-user message
++     *
++     * Read data from vhost_user socket fd and fill up
++     * the passed VhostUserMsg *vmsg struct.
++     *
++     * If reading fails, it should close the received set of file
++     * descriptors as socket message's auxiliary data.
++     *
++     * For the details, please refer to vu_message_read in libvhost-user.c
++     * which will be used by default if not custom method is provided when
++     * calling vu_init
++     *
++     * Returns: true if vhost-user message successfully received,
++     *          otherwise return false.
++     *
++     */
++    vu_read_msg_cb read_msg;
+     /* @set_watch: add or update the given fd to the watch set,
+      * call cb when condition is met */
+     vu_set_watch_cb set_watch;
+@@ -XXX,XX +XXX,XX @@ bool vu_init(VuDev *dev,
+              uint16_t max_queues,
+              int socket,
+              vu_panic_cb panic,
++             vu_read_msg_cb read_msg,
+              vu_set_watch_cb set_watch,
+              vu_remove_watch_cb remove_watch,
+              const VuDevIface *iface);
+diff --git a/contrib/libvhost-user/libvhost-user-glib.c b/contrib/libvhost-user/libvhost-user-glib.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/libvhost-user/libvhost-user-glib.c
++++ b/contrib/libvhost-user/libvhost-user-glib.c
+@@ -XXX,XX +XXX,XX @@ vug_init(VugDev *dev, uint16_t max_queues, int socket,
+     g_assert(dev);
+     g_assert(iface);
+-    if (!vu_init(&dev->parent, max_queues, socket, panic, set_watch,
++    if (!vu_init(&dev->parent, max_queues, socket, panic, NULL, set_watch,
+                  remove_watch, iface)) {
+         return false;
+     }
+diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/libvhost-user/libvhost-user.c
++++ b/contrib/libvhost-user/libvhost-user.c
+@@ -XXX,XX +XXX,XX @@
+ /* The version of inflight buffer */
+ #define INFLIGHT_VERSION 1
+-#define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64)
+-
+ /* The version of the protocol we support */
+ #define VHOST_USER_VERSION 1
+ #define LIBVHOST_USER_DEBUG 0
+@@ -XXX,XX +XXX,XX @@ have_userfault(void)
+ }
+ static bool
+-vu_message_read(VuDev *dev, int conn_fd, VhostUserMsg *vmsg)
++vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg)
+ {
+     char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {};
+     struct iovec iov = {
+@@ -XXX,XX +XXX,XX @@ vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg)
+         goto out;
+     }
+-    if (!vu_message_read(dev, dev->slave_fd, &msg_reply)) {
++    if (!vu_message_read_default(dev, dev->slave_fd, &msg_reply)) {
+         goto out;
+     }
+@@ -XXX,XX +XXX,XX @@ vu_set_mem_table_exec_postcopy(VuDev *dev, VhostUserMsg *vmsg)
+     /* Wait for QEMU to confirm that it's registered the handler for the
+      * faults.
+      */
+-    if (!vu_message_read(dev, dev->sock, vmsg) ||
++    if (!dev->read_msg(dev, dev->sock, vmsg) ||
+         vmsg->size != sizeof(vmsg->payload.u64) ||
+         vmsg->payload.u64 != 0) {
+         vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table");
+@@ -XXX,XX +XXX,XX @@ vu_dispatch(VuDev *dev)
+     int reply_requested;
+     bool need_reply, success = false;
+-    if (!vu_message_read(dev, dev->sock, &vmsg)) {
++    if (!dev->read_msg(dev, dev->sock, &vmsg)) {
+         goto end;
+     }
+@@ -XXX,XX +XXX,XX @@ vu_init(VuDev *dev,
+         uint16_t max_queues,
+         int socket,
+         vu_panic_cb panic,
++        vu_read_msg_cb read_msg,
+         vu_set_watch_cb set_watch,
+         vu_remove_watch_cb remove_watch,
+         const VuDevIface *iface)
+@@ -XXX,XX +XXX,XX @@ vu_init(VuDev *dev,
+     dev->sock = socket;
+     dev->panic = panic;
++    dev->read_msg = read_msg ? read_msg : vu_message_read_default;
+     dev->set_watch = set_watch;
+     dev->remove_watch = remove_watch;
+     dev->iface = iface;
+@@ -XXX,XX +XXX,XX @@ static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync)
+         vu_message_write(dev, dev->slave_fd, &vmsg);
+         if (ack) {
+-            vu_message_read(dev, dev->slave_fd, &vmsg);
++            vu_message_read_default(dev, dev->slave_fd, &vmsg);
+         }
+         return;
+     }
+diff --git a/tests/vhost-user-bridge.c b/tests/vhost-user-bridge.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/vhost-user-bridge.c
++++ b/tests/vhost-user-bridge.c
+@@ -XXX,XX +XXX,XX @@ vubr_accept_cb(int sock, void *ctx)
+                  VHOST_USER_BRIDGE_MAX_QUEUES,
+                  conn_fd,
+                  vubr_panic,
++                 NULL,
+                  vubr_set_watch,
+                  vubr_remove_watch,
+                  &vuiface)) {
+@@ -XXX,XX +XXX,XX @@ vubr_new(const char *path, bool client)
+                      VHOST_USER_BRIDGE_MAX_QUEUES,
+                      dev->sock,
+                      vubr_panic,
++                     NULL,
+                      vubr_set_watch,
+                      vubr_remove_watch,
+                      &vuiface)) {
+diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tools/virtiofsd/fuse_virtio.c
++++ b/tools/virtiofsd/fuse_virtio.c
+@@ -XXX,XX +XXX,XX @@ int virtio_session_mount(struct fuse_session *se)
+     se->vu_socketfd = data_sock;
+     se->virtio_dev->se = se;
+     pthread_rwlock_init(&se->virtio_dev->vu_dispatch_rwlock, NULL);
+-    vu_init(&se->virtio_dev->dev, 2, se->vu_socketfd, fv_panic, fv_set_watch,
+-            fv_remove_watch, &fv_iface);
++    vu_init(&se->virtio_dev->dev, 2, se->vu_socketfd, fv_panic, NULL,
++            fv_set_watch, fv_remove_watch, &fv_iface);
+     return 0;
+ }
+--
+.26.2

-New patch
+[PULL v2 03/28] libvhost-user: remove watch for kick_fd when de-initialize vu-dev
+From: Coiby Xu <coiby.xu@gmail.com>
+When the client is running in gdb and quit command is run in gdb,
+QEMU will still dispatch the event which will cause segment fault in
+the callback function.
+Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-id: 20200918080912.321299-3-coiby.xu@gmail.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ contrib/libvhost-user/libvhost-user.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/libvhost-user/libvhost-user.c
++++ b/contrib/libvhost-user/libvhost-user.c
+@@ -XXX,XX +XXX,XX @@ vu_deinit(VuDev *dev)
+         }
+         if (vq->kick_fd != -1) {
++            dev->remove_watch(dev, vq->kick_fd);
+             close(vq->kick_fd);
+             vq->kick_fd = -1;
+         }
+--
+.26.2

-New patch
+[PULL v2 04/28] util/vhost-user-server: generic vhost user server
+From: Coiby Xu <coiby.xu@gmail.com>
+Sharing QEMU devices via vhost-user protocol.
+Only one vhost-user client can connect to the server one time.
+Suggested-by: Kevin Wolf <kwolf@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-id: 20200918080912.321299-4-coiby.xu@gmail.com
+[Fixed size_t %lu -> %zu format string compiler error.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.h |  65 ++++++
+ util/vhost-user-server.c | 428 +++++++++++++++++++++++++++++++++++++++
+ util/meson.build         |   1 +
+files changed, 494 insertions(+)
+ create mode 100644 util/vhost-user-server.h
+ create mode 100644 util/vhost-user-server.c
+diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/util/vhost-user-server.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Sharing QEMU devices via vhost-user protocol
++ *
++ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
++ * Copyright (c) 2020 Red Hat, Inc.
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or
++ * later.  See the COPYING file in the top-level directory.
++ */
++
++#ifndef VHOST_USER_SERVER_H
++#define VHOST_USER_SERVER_H
++
++#include "contrib/libvhost-user/libvhost-user.h"
++#include "io/channel-socket.h"
++#include "io/channel-file.h"
++#include "io/net-listener.h"
++#include "qemu/error-report.h"
++#include "qapi/error.h"
++#include "standard-headers/linux/virtio_blk.h"
++
++typedef struct VuFdWatch {
++    VuDev *vu_dev;
++    int fd; /*kick fd*/
++    void *pvt;
++    vu_watch_cb cb;
++    bool processing;
++    QTAILQ_ENTRY(VuFdWatch) next;
++} VuFdWatch;
++
++typedef struct VuServer VuServer;
++typedef void DevicePanicNotifierFn(VuServer *server);
++
++struct VuServer {
++    QIONetListener *listener;
++    AioContext *ctx;
++    DevicePanicNotifierFn *device_panic_notifier;
++    int max_queues;
++    const VuDevIface *vu_iface;
++    VuDev vu_dev;
++    QIOChannel *ioc; /* The I/O channel with the client */
++    QIOChannelSocket *sioc; /* The underlying data channel with the client */
++    /* IOChannel for fd provided via VHOST_USER_SET_SLAVE_REQ_FD */
++    QIOChannel *ioc_slave;
++    QIOChannelSocket *sioc_slave;
++    Coroutine *co_trip; /* coroutine for processing VhostUserMsg */
++    QTAILQ_HEAD(, VuFdWatch) vu_fd_watches;
++    /* restart coroutine co_trip if AIOContext is changed */
++    bool aio_context_changed;
++    bool processing_msg;
++};
++
++bool vhost_user_server_start(VuServer *server,
++                             SocketAddress *unix_socket,
++                             AioContext *ctx,
++                             uint16_t max_queues,
++                             DevicePanicNotifierFn *device_panic_notifier,
++                             const VuDevIface *vu_iface,
++                             Error **errp);
++
++void vhost_user_server_stop(VuServer *server);
++
++void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx);
++
++#endif /* VHOST_USER_SERVER_H */
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Sharing QEMU devices via vhost-user protocol
++ *
++ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
++ * Copyright (c) 2020 Red Hat, Inc.
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or
++ * later.  See the COPYING file in the top-level directory.
++ */
++#include "qemu/osdep.h"
++#include "qemu/main-loop.h"
++#include "vhost-user-server.h"
++
++static void vmsg_close_fds(VhostUserMsg *vmsg)
++{
++    int i;
++    for (i = 0; i < vmsg->fd_num; i++) {
++        close(vmsg->fds[i]);
++    }
++}
++
++static void vmsg_unblock_fds(VhostUserMsg *vmsg)
++{
++    int i;
++    for (i = 0; i < vmsg->fd_num; i++) {
++        qemu_set_nonblock(vmsg->fds[i]);
++    }
++}
++
++static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
++                      gpointer opaque);
++
++static void close_client(VuServer *server)
++{
++    /*
++     * Before closing the client
++     *
++     * 1. Let vu_client_trip stop processing new vhost-user msg
++     *
++     * 2. remove kick_handler
++     *
++     * 3. wait for the kick handler to be finished
++     *
++     * 4. wait for the current vhost-user msg to be finished processing
++     */
++
++    QIOChannelSocket *sioc = server->sioc;
++    /* When this is set vu_client_trip will stop new processing vhost-user message */
++    server->sioc = NULL;
++
++    VuFdWatch *vu_fd_watch, *next;
++    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
++        aio_set_fd_handler(server->ioc->ctx, vu_fd_watch->fd, true, NULL,
++                           NULL, NULL, NULL);
++    }
++
++    while (!QTAILQ_EMPTY(&server->vu_fd_watches)) {
++        QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
++            if (!vu_fd_watch->processing) {
++                QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next);
++                g_free(vu_fd_watch);
++            }
++        }
++    }
++
++    while (server->processing_msg) {
++        if (server->ioc->read_coroutine) {
++            server->ioc->read_coroutine = NULL;
++            qio_channel_set_aio_fd_handler(server->ioc, server->ioc->ctx, NULL,
++                                           NULL, server->ioc);
++            server->processing_msg = false;
++        }
++    }
++
++    vu_deinit(&server->vu_dev);
++    object_unref(OBJECT(sioc));
++    object_unref(OBJECT(server->ioc));
++}
++
++static void panic_cb(VuDev *vu_dev, const char *buf)
++{
++    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
++
++    /* avoid while loop in close_client */
++    server->processing_msg = false;
++
++    if (buf) {
++        error_report("vu_panic: %s", buf);
++    }
++
++    if (server->sioc) {
++        close_client(server);
++    }
++
++    if (server->device_panic_notifier) {
++        server->device_panic_notifier(server);
++    }
++
++    /*
++     * Set the callback function for network listener so another
++     * vhost-user client can connect to this server
++     */
++    qio_net_listener_set_client_func(server->listener,
++                                     vu_accept,
++                                     server,
++                                     NULL);
++}
++
++static bool coroutine_fn
++vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
++{
++    struct iovec iov = {
++        .iov_base = (char *)vmsg,
++        .iov_len = VHOST_USER_HDR_SIZE,
++    };
++    int rc, read_bytes = 0;
++    Error *local_err = NULL;
++    /*
++     * Store fds/nfds returned from qio_channel_readv_full into
++     * temporary variables.
++     *
++     * VhostUserMsg is a packed structure, gcc will complain about passing
++     * pointer to a packed structure member if we pass &VhostUserMsg.fd_num
++     * and &VhostUserMsg.fds directly when calling qio_channel_readv_full,
++     * thus two temporary variables nfds and fds are used here.
++     */
++    size_t nfds = 0, nfds_t = 0;
++    const size_t max_fds = G_N_ELEMENTS(vmsg->fds);
++    int *fds_t = NULL;
++    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
++    QIOChannel *ioc = server->ioc;
++
++    if (!ioc) {
++        error_report_err(local_err);
++        goto fail;
++    }
++
++    assert(qemu_in_coroutine());
++    do {
++        /*
++         * qio_channel_readv_full may have short reads, keeping calling it
++         * until getting VHOST_USER_HDR_SIZE or 0 bytes in total
++         */
++        rc = qio_channel_readv_full(ioc, &iov, 1, &fds_t, &nfds_t, &local_err);
++        if (rc < 0) {
++            if (rc == QIO_CHANNEL_ERR_BLOCK) {
++                qio_channel_yield(ioc, G_IO_IN);
++                continue;
++            } else {
++                error_report_err(local_err);
++                return false;
++            }
++        }
++        read_bytes += rc;
++        if (nfds_t > 0) {
++            if (nfds + nfds_t > max_fds) {
++                error_report("A maximum of %zu fds are allowed, "
++                             "however got %zu fds now",
++                             max_fds, nfds + nfds_t);
++                goto fail;
++            }
++            memcpy(vmsg->fds + nfds, fds_t,
++                   nfds_t *sizeof(vmsg->fds[0]));
++            nfds += nfds_t;
++            g_free(fds_t);
++        }
++        if (read_bytes == VHOST_USER_HDR_SIZE || rc == 0) {
++            break;
++        }
++        iov.iov_base = (char *)vmsg + read_bytes;
++        iov.iov_len = VHOST_USER_HDR_SIZE - read_bytes;
++    } while (true);
++
++    vmsg->fd_num = nfds;
++    /* qio_channel_readv_full will make socket fds blocking, unblock them */
++    vmsg_unblock_fds(vmsg);
++    if (vmsg->size > sizeof(vmsg->payload)) {
++        error_report("Error: too big message request: %d, "
++                     "size: vmsg->size: %u, "
++                     "while sizeof(vmsg->payload) = %zu",
++                     vmsg->request, vmsg->size, sizeof(vmsg->payload));
++        goto fail;
++    }
++
++    struct iovec iov_payload = {
++        .iov_base = (char *)&vmsg->payload,
++        .iov_len = vmsg->size,
++    };
++    if (vmsg->size) {
++        rc = qio_channel_readv_all_eof(ioc, &iov_payload, 1, &local_err);
++        if (rc == -1) {
++            error_report_err(local_err);
++            goto fail;
++        }
++    }
++
++    return true;
++
++fail:
++    vmsg_close_fds(vmsg);
++
++    return false;
++}
++
++
++static void vu_client_start(VuServer *server);
++static coroutine_fn void vu_client_trip(void *opaque)
++{
++    VuServer *server = opaque;
++
++    while (!server->aio_context_changed && server->sioc) {
++        server->processing_msg = true;
++        vu_dispatch(&server->vu_dev);
++        server->processing_msg = false;
++    }
++
++    if (server->aio_context_changed && server->sioc) {
++        server->aio_context_changed = false;
++        vu_client_start(server);
++    }
++}
++
++static void vu_client_start(VuServer *server)
++{
++    server->co_trip = qemu_coroutine_create(vu_client_trip, server);
++    aio_co_enter(server->ctx, server->co_trip);
++}
++
++/*
++ * a wrapper for vu_kick_cb
++ *
++ * since aio_dispatch can only pass one user data pointer to the
++ * callback function, pack VuDev and pvt into a struct. Then unpack it
++ * and pass them to vu_kick_cb
++ */
++static void kick_handler(void *opaque)
++{
++    VuFdWatch *vu_fd_watch = opaque;
++    vu_fd_watch->processing = true;
++    vu_fd_watch->cb(vu_fd_watch->vu_dev, 0, vu_fd_watch->pvt);
++    vu_fd_watch->processing = false;
++}
++
++
++static VuFdWatch *find_vu_fd_watch(VuServer *server, int fd)
++{
++
++    VuFdWatch *vu_fd_watch, *next;
++    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
++        if (vu_fd_watch->fd == fd) {
++            return vu_fd_watch;
++        }
++    }
++    return NULL;
++}
++
++static void
++set_watch(VuDev *vu_dev, int fd, int vu_evt,
++          vu_watch_cb cb, void *pvt)
++{
++
++    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
++    g_assert(vu_dev);
++    g_assert(fd >= 0);
++    g_assert(cb);
++
++    VuFdWatch *vu_fd_watch = find_vu_fd_watch(server, fd);
++
++    if (!vu_fd_watch) {
++        VuFdWatch *vu_fd_watch = g_new0(VuFdWatch, 1);
++
++        QTAILQ_INSERT_TAIL(&server->vu_fd_watches, vu_fd_watch, next);
++
++        vu_fd_watch->fd = fd;
++        vu_fd_watch->cb = cb;
++        qemu_set_nonblock(fd);
++        aio_set_fd_handler(server->ioc->ctx, fd, true, kick_handler,
++                           NULL, NULL, vu_fd_watch);
++        vu_fd_watch->vu_dev = vu_dev;
++        vu_fd_watch->pvt = pvt;
++    }
++}
++
++
++static void remove_watch(VuDev *vu_dev, int fd)
++{
++    VuServer *server;
++    g_assert(vu_dev);
++    g_assert(fd >= 0);
++
++    server = container_of(vu_dev, VuServer, vu_dev);
++
++    VuFdWatch *vu_fd_watch = find_vu_fd_watch(server, fd);
++
++    if (!vu_fd_watch) {
++        return;
++    }
++    aio_set_fd_handler(server->ioc->ctx, fd, true, NULL, NULL, NULL, NULL);
++
++    QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next);
++    g_free(vu_fd_watch);
++}
++
++
++static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
++                      gpointer opaque)
++{
++    VuServer *server = opaque;
++
++    if (server->sioc) {
++        warn_report("Only one vhost-user client is allowed to "
++                    "connect the server one time");
++        return;
++    }
++
++    if (!vu_init(&server->vu_dev, server->max_queues, sioc->fd, panic_cb,
++                 vu_message_read, set_watch, remove_watch, server->vu_iface)) {
++        error_report("Failed to initialize libvhost-user");
++        return;
++    }
++
++    /*
++     * Unset the callback function for network listener to make another
++     * vhost-user client keeping waiting until this client disconnects
++     */
++    qio_net_listener_set_client_func(server->listener,
++                                     NULL,
++                                     NULL,
++                                     NULL);
++    server->sioc = sioc;
++    /*
++     * Increase the object reference, so sioc will not freed by
++     * qio_net_listener_channel_func which will call object_unref(OBJECT(sioc))
++     */
++    object_ref(OBJECT(server->sioc));
++    qio_channel_set_name(QIO_CHANNEL(sioc), "vhost-user client");
++    server->ioc = QIO_CHANNEL(sioc);
++    object_ref(OBJECT(server->ioc));
++    qio_channel_attach_aio_context(server->ioc, server->ctx);
++    qio_channel_set_blocking(QIO_CHANNEL(server->sioc), false, NULL);
++    vu_client_start(server);
++}
++
++
++void vhost_user_server_stop(VuServer *server)
++{
++    if (server->sioc) {
++        close_client(server);
++    }
++
++    if (server->listener) {
++        qio_net_listener_disconnect(server->listener);
++        object_unref(OBJECT(server->listener));
++    }
++
++}
++
++void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx)
++{
++    VuFdWatch *vu_fd_watch, *next;
++    void *opaque = NULL;
++    IOHandler *io_read = NULL;
++    bool attach;
++
++    server->ctx = ctx ? ctx : qemu_get_aio_context();
++
++    if (!server->sioc) {
++        /* not yet serving any client*/
++        return;
++    }
++
++    if (ctx) {
++        qio_channel_attach_aio_context(server->ioc, ctx);
++        server->aio_context_changed = true;
++        io_read = kick_handler;
++        attach = true;
++    } else {
++        qio_channel_detach_aio_context(server->ioc);
++        /* server->ioc->ctx keeps the old AioConext */
++        ctx = server->ioc->ctx;
++        attach = false;
++    }
++
++    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
++        if (vu_fd_watch->cb) {
++            opaque = attach ? vu_fd_watch : NULL;
++            aio_set_fd_handler(ctx, vu_fd_watch->fd, true,
++                               io_read, NULL, NULL,
++                               opaque);
++        }
++    }
++}
++
++
++bool vhost_user_server_start(VuServer *server,
++                             SocketAddress *socket_addr,
++                             AioContext *ctx,
++                             uint16_t max_queues,
++                             DevicePanicNotifierFn *device_panic_notifier,
++                             const VuDevIface *vu_iface,
++                             Error **errp)
++{
++    QIONetListener *listener = qio_net_listener_new();
++    if (qio_net_listener_open_sync(listener, socket_addr, 1,
++                                   errp) < 0) {
++        object_unref(OBJECT(listener));
++        return false;
++    }
++
++    /* zero out unspecified fileds */
++    *server = (VuServer) {
++        .listener              = listener,
++        .vu_iface              = vu_iface,
++        .max_queues            = max_queues,
++        .ctx                   = ctx,
++        .device_panic_notifier = device_panic_notifier,
++    };
++
++    qio_net_listener_set_name(server->listener, "vhost-user-backend-listener");
++
++    qio_net_listener_set_client_func(server->listener,
++                                     vu_accept,
++                                     server,
++                                     NULL);
++
++    QTAILQ_INIT(&server->vu_fd_watches);
++    return true;
++}
+diff --git a/util/meson.build b/util/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/util/meson.build
++++ b/util/meson.build
+@@ -XXX,XX +XXX,XX @@ if have_block
+   util_ss.add(files('main-loop.c'))
+   util_ss.add(files('nvdimm-utils.c'))
+   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
++  util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c'))
+   util_ss.add(files('qemu-coroutine-sleep.c'))
+   util_ss.add(files('qemu-co-shared-resource.c'))
+   util_ss.add(files('thread-pool.c', 'qemu-timer.c'))
+--
+.26.2

-New patch
+[PULL v2 05/28] block: move logical block size check function to a common utility function
+From: Coiby Xu <coiby.xu@gmail.com>
+Move the constants from hw/core/qdev-properties.c to
+util/block-helpers.h so that knowledge of the min/max values is
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Acked-by: Eduardo Habkost <ehabkost@redhat.com>
+Message-id: 20200918080912.321299-5-coiby.xu@gmail.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/block-helpers.h             | 19 +++++++++++++
+ hw/core/qdev-properties-system.c | 31 ++++-----------------
+ util/block-helpers.c             | 46 ++++++++++++++++++++++++++++++++
+ util/meson.build                 |  1 +
+files changed, 71 insertions(+), 26 deletions(-)
+ create mode 100644 util/block-helpers.h
+ create mode 100644 util/block-helpers.c
+diff --git a/util/block-helpers.h b/util/block-helpers.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/util/block-helpers.h
+@@ -XXX,XX +XXX,XX @@
++#ifndef BLOCK_HELPERS_H
++#define BLOCK_HELPERS_H
++
++#include "qemu/units.h"
++
++/* lower limit is sector size */
++#define MIN_BLOCK_SIZE          INT64_C(512)
++#define MIN_BLOCK_SIZE_STR      "512 B"
++/*
++ * upper limit is arbitrary, 2 MiB looks sufficient for all sensible uses, and
++ * matches qcow2 cluster size limit
++ */
++#define MAX_BLOCK_SIZE          (2 * MiB)
++#define MAX_BLOCK_SIZE_STR      "2 MiB"
++
++void check_block_size(const char *id, const char *name, int64_t value,
++                      Error **errp);
++
++#endif /* BLOCK_HELPERS_H */
+diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/core/qdev-properties-system.c
++++ b/hw/core/qdev-properties-system.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/blockdev.h"
+ #include "net/net.h"
+ #include "hw/pci/pci.h"
++#include "util/block-helpers.h"
+ static bool check_prop_still_unset(DeviceState *dev, const char *name,
+                                    const void *old_val, const char *new_val,
+@@ -XXX,XX +XXX,XX @@ const PropertyInfo qdev_prop_losttickpolicy = {
+ /* --- blocksize --- */
+-/* lower limit is sector size */
+-#define MIN_BLOCK_SIZE          512
+-#define MIN_BLOCK_SIZE_STR      "512 B"
+-/*
+- * upper limit is arbitrary, 2 MiB looks sufficient for all sensible uses, and
+- * matches qcow2 cluster size limit
+- */
+-#define MAX_BLOCK_SIZE          (2 * MiB)
+-#define MAX_BLOCK_SIZE_STR      "2 MiB"
+-
+ static void set_blocksize(Object *obj, Visitor *v, const char *name,
+                           void *opaque, Error **errp)
+ {
+@@ -XXX,XX +XXX,XX @@ static void set_blocksize(Object *obj, Visitor *v, const char *name,
+     Property *prop = opaque;
+     uint32_t *ptr = qdev_get_prop_ptr(dev, prop);
+     uint64_t value;
++    Error *local_err = NULL;
+     if (dev->realized) {
+         qdev_prop_set_after_realize(dev, name, errp);
+@@ -XXX,XX +XXX,XX @@ static void set_blocksize(Object *obj, Visitor *v, const char *name,
+     if (!visit_type_size(v, name, &value, errp)) {
+         return;
+     }
+-    /* value of 0 means "unset" */
+-    if (value && (value < MIN_BLOCK_SIZE || value > MAX_BLOCK_SIZE)) {
+-        error_setg(errp,
+-                   "Property %s.%s doesn't take value %" PRIu64
+-                   " (minimum: " MIN_BLOCK_SIZE_STR
+-                   ", maximum: " MAX_BLOCK_SIZE_STR ")",
+-                   dev->id ? : "", name, value);
++    check_block_size(dev->id ? : "", name, value, &local_err);
++    if (local_err) {
++        error_propagate(errp, local_err);
+         return;
+     }
+-
+-    /* We rely on power-of-2 blocksizes for bitmasks */
+-    if ((value & (value - 1)) != 0) {
+-        error_setg(errp,
+-                  "Property %s.%s doesn't take value '%" PRId64 "', "
+-                  "it's not a power of 2", dev->id ?: "", name, (int64_t)value);
+-        return;
+-    }
+-
+     *ptr = value;
+ }
+diff --git a/util/block-helpers.c b/util/block-helpers.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/util/block-helpers.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Block utility functions
++ *
++ * Copyright IBM, Corp. 2011
++ * Copyright (c) 2020 Coiby Xu <coiby.xu@gmail.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/error.h"
++#include "qapi/qmp/qerror.h"
++#include "block-helpers.h"
++
++/**
++ * check_block_size:
++ * @id: The unique ID of the object
++ * @name: The name of the property being validated
++ * @value: The block size in bytes
++ * @errp: A pointer to an area to store an error
++ *
++ * This function checks that the block size meets the following conditions:
++ * 1. At least MIN_BLOCK_SIZE
++ * 2. No larger than MAX_BLOCK_SIZE
++ * 3. A power of 2
++ */
++void check_block_size(const char *id, const char *name, int64_t value,
++                      Error **errp)
++{
++    /* value of 0 means "unset" */
++    if (value && (value < MIN_BLOCK_SIZE || value > MAX_BLOCK_SIZE)) {
++        error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
++                   id, name, value, MIN_BLOCK_SIZE, MAX_BLOCK_SIZE);
++        return;
++    }
++
++    /* We rely on power-of-2 blocksizes for bitmasks */
++    if ((value & (value - 1)) != 0) {
++        error_setg(errp,
++                   "Property %s.%s doesn't take value '%" PRId64
++                   "', it's not a power of 2",
++                   id, name, value);
++        return;
++    }
++}
+diff --git a/util/meson.build b/util/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/util/meson.build
++++ b/util/meson.build
+@@ -XXX,XX +XXX,XX @@ if have_block
+   util_ss.add(files('nvdimm-utils.c'))
+   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
+   util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c'))
++  util_ss.add(files('block-helpers.c'))
+   util_ss.add(files('qemu-coroutine-sleep.c'))
+   util_ss.add(files('qemu-co-shared-resource.c'))
+   util_ss.add(files('thread-pool.c', 'qemu-timer.c'))
+--
+.26.2

-[Qemu-devel] [PULL 2/2] live-block-ops.txt: Rename, rewrite, and improve it
+[PULL v2 06/28] block/export: vhost-user block device backend server
-From: Kashyap Chamarthy <kchamart@redhat.com>
+From: Coiby Xu <coiby.xu@gmail.com>
-This patch documents (including their QMP invocations) all the four
+By making use of libvhost-user, block device drive can be shared to
-major kinds of live block operations:
+the connected vhost-user client. Only one client can connect to the
 server one time.
-  - `block-stream`
+Since vhost-user-server needs a block drive to be created first, delay
-  - `block-commit`
+the creation of this object.
   - `drive-mirror` (& `blockdev-mirror`)
   - `drive-backup` (& `blockdev-backup`)
-Things considered while writing this document:
+Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
 Message-id: 20200918080912.321299-6-coiby.xu@gmail.com
 [Shorten "vhost_user_blk_server" string to "vhost_user_blk" to avoid the
 following compiler warning:
 ../block/export/vhost-user-blk-server.c:178:50: error: ‘%s’ directive output truncated writing 21 bytes into a region of size 20 [-Werror=format-truncation=]
 and fix "Invalid size %ld ..." ssize_t format string arguments for
 -bit hosts.
 --Stefan]
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  block/export/vhost-user-blk-server.h |  36 ++
  block/export/vhost-user-blk-server.c | 661 +++++++++++++++++++++++++++
  softmmu/vl.c                         |   4 +
  block/meson.build                    |   1 +
 files changed, 702 insertions(+)
  create mode 100644 block/export/vhost-user-blk-server.h
  create mode 100644 block/export/vhost-user-blk-server.c
-  - Use reStructuredText as markup language (with the goal of generating
+diff --git a/block/export/vhost-user-blk-server.h b/block/export/vhost-user-blk-server.h
     the HTML output using the Sphinx Documentation Generator).  It is
     gentler on the eye, and can be trivially converted to different
     formats.  (Another reason: upstream QEMU is considering to switch to
     Sphinx, which uses reStructuredText as its markup language.)
   - Raw QMP JSON output vs. 'qmp-shell'.  I debated with myself whether
     to only show raw QMP JSON output (as that is the canonical
     representation), or use 'qmp-shell', which takes key-value pairs.  I
     settled on the approach of: for the first occurrence of a command,
     use raw JSON; for subsequent occurrences, use 'qmp-shell', with an
     occasional exception.
   - Usage of `-blockdev` command-line.
   - Usage of 'node-name' vs. file path to refer to disks.  While we have
     `blockdev-{mirror, backup}` as 'node-name'-alternatives for
     `drive-{mirror, backup}`, the `block-commit` command still operates
     on file names for parameters 'base' and 'top'.  So I added a caveat
     at the beginning to that effect.
     Refer this related thread that I started (where I learnt
     `block-stream` was recently reworked to accept 'node-name' for 'top'
     and 'base' parameters):
     https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg06466.html
     "[RFC] Making 'block-stream', and 'block-commit' accept node-name"
 All commands showed in this document were tested while documenting.
 Thanks: Eric Blake for the section: "A note on points-in-time vs file
 names".  This useful bit was originally articulated by Eric in his
 KVMForum 2015 presentation, so I included that specific bit in this
 document.
 Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20170717105205.32639-3-kchamart@redhat.com
 Signed-off-by: Jeff Cody <jcody@redhat.com>
 ---
  docs/interop/live-block-operations.rst | 1088 ++++++++++++++++++++++++++++++++
  docs/live-block-ops.txt                |   72 ---
 files changed, 1088 insertions(+), 72 deletions(-)
  create mode 100644 docs/interop/live-block-operations.rst
  delete mode 100644 docs/live-block-ops.txt
 diff --git a/docs/interop/live-block-operations.rst b/docs/interop/live-block-operations.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/docs/interop/live-block-operations.rst
++++ b/block/export/vhost-user-blk-server.h
 @@ -XXX,XX +XXX,XX @@
-+..
++/*
-+    Copyright (C) 2017 Red Hat Inc.
++ * Sharing QEMU block devices via vhost-user protocal
-+
++ *
-+    This work is licensed under the terms of the GNU GPL, version 2 or
++ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
-+    later.  See the COPYING file in the top-level directory.
++ * Copyright (c) 2020 Red Hat, Inc.
-+
++ *
-+============================
++ * This work is licensed under the terms of the GNU GPL, version 2 or
-+Live Block Device Operations
++ * later.  See the COPYING file in the top-level directory.
-+============================
++ */
 +
-+QEMU Block Layer currently (as of QEMU 2.9) supports four major kinds of
++#ifndef VHOST_USER_BLK_SERVER_H
-+live block device jobs -- stream, commit, mirror, and backup.  These can
++#define VHOST_USER_BLK_SERVER_H
-+be used to manipulate disk image chains to accomplish certain tasks,
++#include "util/vhost-user-server.h"
-+namely: live copy data from backing files into overlays; shorten long
++
-+disk image chains by merging data from overlays into backing files; live
++typedef struct VuBlockDev VuBlockDev;
-+synchronize data from a disk image chain (including current active disk)
++#define TYPE_VHOST_USER_BLK_SERVER "vhost-user-blk-server"
-+to another target image; and point-in-time (and incremental) backups of
++#define VHOST_USER_BLK_SERVER(obj) \
-+a block device.  Below is a description of the said block (QMP)
++   OBJECT_CHECK(VuBlockDev, obj, TYPE_VHOST_USER_BLK_SERVER)
-+primitives, and some (non-exhaustive list of) examples to illustrate
++
-+their use.
++/* vhost user block device */
-+
++struct VuBlockDev {
-+.. note::
++    Object parent_obj;
-+    The file ``qapi/block-core.json`` in the QEMU source tree has the
++    char *node_name;
-+    canonical QEMU API (QAPI) schema documentation for the QMP
++    SocketAddress *addr;
-+    primitives discussed here.
++    AioContext *ctx;
-+
++    VuServer vu_server;
-+.. todo (kashyapc):: Remove the ".. contents::" directive when Sphinx is
++    bool running;
-+                     integrated.
++    uint32_t blk_size;
-+
++    BlockBackend *backend;
-+.. contents::
++    QIOChannelSocket *sioc;
-+
++    QTAILQ_ENTRY(VuBlockDev) next;
-+Disk image backing chain notation
++    struct virtio_blk_config blkcfg;
-+---------------------------------
++    bool writable;
-+
++};
-+A simple disk image chain.  (This can be created live using QMP
++
-+``blockdev-snapshot-sync``, or offline via ``qemu-img``)::
++#endif /* VHOST_USER_BLK_SERVER_H */
-+
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
-+                   (Live QEMU)
+new file mode 100644
-+                        |
+index XXXXXXX..XXXXXXX
-+                        .
+--- /dev/null
-+                        V
++++ b/block/export/vhost-user-blk-server.c
-+
+@@ -XXX,XX +XXX,XX @@
-+            [A] <----- [B]
++/*
-+
++ * Sharing QEMU block devices via vhost-user protocal
-+    (backing file)    (overlay)
++ *
-+
++ * Parts of the code based on nbd/server.c.
-+The arrow can be read as: Image [A] is the backing file of disk image
++ *
-+[B].  And live QEMU is currently writing to image [B], consequently, it
++ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
-+is also referred to as the "active layer".
++ * Copyright (c) 2020 Red Hat, Inc.
-+
++ *
-+There are two kinds of terminology that are common when referring to
++ * This work is licensed under the terms of the GNU GPL, version 2 or
-+files in a disk image backing chain:
++ * later.  See the COPYING file in the top-level directory.
-+
++ */
-+(1) Directional: 'base' and 'top'.  Given the simple disk image chain
++#include "qemu/osdep.h"
-+    above, image [A] can be referred to as 'base', and image [B] as
++#include "block/block.h"
-+    'top'.  (This terminology can be seen in in QAPI schema file,
++#include "vhost-user-blk-server.h"
-+    block-core.json.)
++#include "qapi/error.h"
-+
++#include "qom/object_interfaces.h"
-+(2) Relational: 'backing file' and 'overlay'.  Again, taking the same
++#include "sysemu/block-backend.h"
-+    simple disk image chain from the above, disk image [A] is referred
++#include "util/block-helpers.h"
-+    to as the backing file, and image [B] as overlay.
++
-+
++enum {
-+   Throughout this document, we will use the relational terminology.
++    VHOST_USER_BLK_MAX_QUEUES = 1,
-+
++};
-+.. important::
++struct virtio_blk_inhdr {
-+    The overlay files can generally be any format that supports a
++    unsigned char status;
-+    backing file, although QCOW2 is the preferred format and the one
++};
-+    used in this document.
++
-+
++typedef struct VuBlockReq {
-+
++    VuVirtqElement *elem;
-+Brief overview of live block QMP primitives
++    int64_t sector_num;
-+-------------------------------------------
++    size_t size;
-+
++    struct virtio_blk_inhdr *in;
-+The following are the four different kinds of live block operations that
++    struct virtio_blk_outhdr out;
-+QEMU block layer supports.
++    VuServer *server;
-+
++    struct VuVirtq *vq;
-+(1) ``block-stream``: Live copy of data from backing files into overlay
++} VuBlockReq;
-+    files.
++
-+
++static void vu_block_req_complete(VuBlockReq *req)
-+    .. note:: Once the 'stream' operation has finished, three things to
++{
-+              note:
++    VuDev *vu_dev = &req->server->vu_dev;
 +
-+                (a) QEMU rewrites the backing chain to remove
++    /* IO size with 1 extra status byte */
-+                    reference to the now-streamed and redundant backing
++    vu_queue_push(vu_dev, req->vq, req->elem, req->size + 1);
-+                    file;
++    vu_queue_notify(vu_dev, req->vq);
 +
-+                (b) the streamed file *itself* won't be removed by QEMU,
++    if (req->elem) {
-+                    and must be explicitly discarded by the user;
++        free(req->elem);
-+
++    }
-+                (c) the streamed file remains valid -- i.e. further
++
-+                    overlays can be created based on it.  Refer the
++    g_free(req);
-+                    ``block-stream`` section further below for more
++}
-+                    details.
++
-+
++static VuBlockDev *get_vu_block_device_by_server(VuServer *server)
-+(2) ``block-commit``: Live merge of data from overlay files into backing
++{
-+    files (with the optional goal of removing the overlay file from the
++    return container_of(server, VuBlockDev, vu_server);
-+    chain).  Since QEMU 2.0, this includes "active ``block-commit``"
++}
-+    (i.e. merge the current active layer into the base image).
++
-+
++static int coroutine_fn
-+    .. note:: Once the 'commit' operation has finished, there are three
++vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
-+              things to note here as well:
++                              uint32_t iovcnt, uint32_t type)
-+
++{
-+                (a) QEMU rewrites the backing chain to remove reference
++    struct virtio_blk_discard_write_zeroes desc;
-+                    to now-redundant overlay images that have been
++    ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
-+                    committed into a backing file;
++    if (unlikely(size != sizeof(desc))) {
-+
++        error_report("Invalid size %zd, expect %zu", size, sizeof(desc));
-+                (b) the committed file *itself* won't be removed by QEMU
++        return -EINVAL;
-+                    -- it ought to be manually removed;
++    }
 +
-+                (c) however, unlike in the case of ``block-stream``, the
++    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
-+                    intermediate images will be rendered invalid -- i.e.
++    uint64_t range[2] = { le64_to_cpu(desc.sector) << 9,
-+                    no more further overlays can be created based on
++                          le32_to_cpu(desc.num_sectors) << 9 };
-+                    them.  Refer the ``block-commit`` section further
++    if (type == VIRTIO_BLK_T_DISCARD) {
-+                    below for more details.
++        if (blk_co_pdiscard(vdev_blk->backend, range[0], range[1]) == 0) {
-+
++            return 0;
 +(3) ``drive-mirror`` (and ``blockdev-mirror``): Synchronize a running
 +    disk to another image.
 +
 +(4) ``drive-backup`` (and ``blockdev-backup``): Point-in-time (live) copy
 +    of a block device to a destination.
 +
 +
 +.. _`Interacting with a QEMU instance`:
 +
 +Interacting with a QEMU instance
 +--------------------------------
 +
 +To show some example invocations of command-line, we will use the
 +following invocation of QEMU, with a QMP server running over UNIX
 +socket::
 +
 +    $ ./x86_64-softmmu/qemu-system-x86_64 -display none -nodefconfig \
 +        -M q35 -nodefaults -m 512 \
 +        -blockdev node-name=node-A,driver=qcow2,file.driver=file,file.node-name=file,file.filename=./a.qcow2 \
 +        -device virtio-blk,drive=node-A,id=virtio0 \
 +        -monitor stdio -qmp unix:/tmp/qmp-sock,server,nowait
 +
 +The ``-blockdev`` command-line option, used above, is available from
 +QEMU 2.9 onwards.  In the above invocation, notice the ``node-name``
 +parameter that is used to refer to the disk image a.qcow2 ('node-A') --
 +this is a cleaner way to refer to a disk image (as opposed to referring
 +to it by spelling out file paths).  So, we will continue to designate a
 +``node-name`` to each further disk image created (either via
 +``blockdev-snapshot-sync``, or ``blockdev-add``) as part of the disk
 +image chain, and continue to refer to the disks using their
 +``node-name`` (where possible, because ``block-commit`` does not yet, as
 +of QEMU 2.9, accept ``node-name`` parameter) when performing various
 +block operations.
 +
 +To interact with the QEMU instance launched above, we will use the
 +``qmp-shell`` utility (located at: ``qemu/scripts/qmp``, as part of the
 +QEMU source directory), which takes key-value pairs for QMP commands.
 +Invoke it as below (which will also print out the complete raw JSON
 +syntax for reference -- examples in the following sections)::
 +
 +    $ ./qmp-shell -v -p /tmp/qmp-sock
 +    (QEMU)
 +
 +.. note::
 +    In the event we have to repeat a certain QMP command, we will: for
 +    the first occurrence of it, show the ``qmp-shell`` invocation, *and*
 +    the corresponding raw JSON QMP syntax; but for subsequent
 +    invocations, present just the ``qmp-shell`` syntax, and omit the
 +    equivalent JSON output.
 +
 +
 +Example disk image chain
 +------------------------
 +
 +We will use the below disk image chain (and occasionally spelling it
 +out where appropriate) when discussing various primitives::
 +
 +    [A] <-- [B] <-- [C] <-- [D]
 +
 +Where [A] is the original base image; [B] and [C] are intermediate
 +overlay images; image [D] is the active layer -- i.e. live QEMU is
 +writing to it.  (The rule of thumb is: live QEMU will always be pointing
 +to the rightmost image in a disk image chain.)
 +
 +The above image chain can be created by invoking
 +``blockdev-snapshot-sync`` commands as following (which shows the
 +creation of overlay image [B]) using the ``qmp-shell`` (our invocation
 +also prints the raw JSON invocation of it)::
 +
 +    (QEMU) blockdev-snapshot-sync node-name=node-A snapshot-file=b.qcow2 snapshot-node-name=node-B format=qcow2
 +    {
 +        "execute": "blockdev-snapshot-sync",
 +        "arguments": {
 +            "node-name": "node-A",
 +            "snapshot-file": "b.qcow2",
 +            "format": "qcow2",
 +            "snapshot-node-name": "node-B"
 +        }
-+    }
++    } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) {
-+
++        if (blk_co_pwrite_zeroes(vdev_blk->backend,
-+Here, "node-A" is the name QEMU internally uses to refer to the base
++                                 range[0], range[1], 0) == 0) {
-+image [A] -- it is the backing file, based on which the overlay image,
++            return 0;
 +[B], is created.
 +
 +To create the rest of the overlay images, [C], and [D] (omitting the raw
 +JSON output for brevity)::
 +
 +    (QEMU) blockdev-snapshot-sync node-name=node-B snapshot-file=c.qcow2 snapshot-node-name=node-C format=qcow2
 +    (QEMU) blockdev-snapshot-sync node-name=node-C snapshot-file=d.qcow2 snapshot-node-name=node-D format=qcow2
 +
 +
 +A note on points-in-time vs file names
 +--------------------------------------
 +
 +In our disk image chain::
 +
 +    [A] <-- [B] <-- [C] <-- [D]
 +
 +We have *three* points in time and an active layer:
 +
 +- Point 1: Guest state when [B] was created is contained in file [A]
 +- Point 2: Guest state when [C] was created is contained in [A] + [B]
 +- Point 3: Guest state when [D] was created is contained in
 +  [A] + [B] + [C]
 +- Active layer: Current guest state is contained in [A] + [B] + [C] +
 +  [D]
 +
 +Therefore, be aware with naming choices:
 +
 +- Naming a file after the time it is created is misleading -- the
 +  guest data for that point in time is *not* contained in that file
 +  (as explained earlier)
 +- Rather, think of files as a *delta* from the backing file
 +
 +
 +Live block streaming --- ``block-stream``
 +-----------------------------------------
 +
 +The ``block-stream`` command allows you to do live copy data from backing
 +files into overlay images.
 +
 +Given our original example disk image chain from earlier::
 +
 +    [A] <-- [B] <-- [C] <-- [D]
 +
 +The disk image chain can be shortened in one of the following different
 +ways (not an exhaustive list).
 +
 +.. _`Case-1`:
 +
 +(1) Merge everything into the active layer: I.e. copy all contents from
 +    the base image, [A], and overlay images, [B] and [C], into [D],
 +    *while* the guest is running.  The resulting chain will be a
 +    standalone image, [D] -- with contents from [A], [B] and [C] merged
 +    into it (where live QEMU writes go to)::
 +
 +        [D]
 +
 +.. _`Case-2`:
 +
 +(2) Taking the same example disk image chain mentioned earlier, merge
 +    only images [B] and [C] into [D], the active layer.  The result will
 +    be contents of images [B] and [C] will be copied into [D], and the
 +    backing file pointer of image [D] will be adjusted to point to image
 +    [A].  The resulting chain will be::
 +
 +        [A] <-- [D]
 +
 +.. _`Case-3`:
 +
 +(3) Intermediate streaming (available since QEMU 2.8): Starting afresh
 +    with the original example disk image chain, with a total of four
 +    images, it is possible to copy contents from image [B] into image
 +    [C].  Once the copy is finished, image [B] can now be (optionally)
 +    discarded; and the backing file pointer of image [C] will be
 +    adjusted to point to [A].  I.e. after performing "intermediate
 +    streaming" of [B] into [C], the resulting image chain will be (where
 +    live QEMU is writing to [D])::
 +
 +        [A] <-- [C] <-- [D]
 +
 +
 +QMP invocation for ``block-stream``
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +For `Case-1`_, to merge contents of all the backing files into the
 +active layer, where 'node-D' is the current active image (by default
 +``block-stream`` will flatten the entire chain); ``qmp-shell`` (and its
 +corresponding JSON output)::
 +
 +    (QEMU) block-stream device=node-D job-id=job0
 +    {
 +        "execute": "block-stream",
 +        "arguments": {
 +            "device": "node-D",
 +            "job-id": "job0"
 +        }
 +    }
 +
-+For `Case-2`_, merge contents of the images [B] and [C] into [D], where
++    return -EINVAL;
-+image [D] ends up referring to image [A] as its backing file::
++}
 +
-+    (QEMU) block-stream device=node-D base-node=node-A job-id=job0
++static void coroutine_fn vu_block_flush(VuBlockReq *req)
-+
++{
-+And for `Case-3`_, of "intermediate" streaming", merge contents of
++    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
-+images [B] into [C], where [C] ends up referring to [A] as its backing
++    BlockBackend *backend = vdev_blk->backend;
-+image::
++    blk_co_flush(backend);
-+
++}
-+    (QEMU) block-stream device=node-C base-node=node-A job-id=job0
++
-+
++struct req_data {
-+Progress of a ``block-stream`` operation can be monitored via the QMP
++    VuServer *server;
-+command::
++    VuVirtq *vq;
-+
++    VuVirtqElement *elem;
-+    (QEMU) query-block-jobs
++};
-+    {
++
-+        "execute": "query-block-jobs",
++static void coroutine_fn vu_block_virtio_process_req(void *opaque)
-+        "arguments": {}
++{
-+    }
++    struct req_data *data = opaque;
-+
++    VuServer *server = data->server;
-+
++    VuVirtq *vq = data->vq;
-+Once the ``block-stream`` operation has completed, QEMU will emit an
++    VuVirtqElement *elem = data->elem;
-+event, ``BLOCK_JOB_COMPLETED``.  The intermediate overlays remain valid,
++    uint32_t type;
-+and can now be (optionally) discarded, or retained to create further
++    VuBlockReq *req;
-+overlays based on them.  Finally, the ``block-stream`` jobs can be
++
-+restarted at anytime.
++    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
-+
++    BlockBackend *backend = vdev_blk->backend;
 +
-+Live block commit --- ``block-commit``
++    struct iovec *in_iov = elem->in_sg;
-+--------------------------------------
++    struct iovec *out_iov = elem->out_sg;
-+
++    unsigned in_num = elem->in_num;
-+The ``block-commit`` command lets you merge live data from overlay
++    unsigned out_num = elem->out_num;
-+images into backing file(s).  Since QEMU 2.0, this includes "live active
++    /* refer to hw/block/virtio_blk.c */
-+commit" (i.e. it is possible to merge the "active layer", the right-most
++    if (elem->out_num < 1 || elem->in_num < 1) {
-+image in a disk image chain where live QEMU will be writing to, into the
++        error_report("virtio-blk request missing headers");
-+base image).  This is analogous to ``block-stream``, but in the opposite
++        free(elem);
-+direction.
++        return;
-+
++    }
-+Again, starting afresh with our example disk image chain, where live
++
-+QEMU is writing to the right-most image in the chain, [D]::
++    req = g_new0(VuBlockReq, 1);
-+
++    req->server = server;
-+    [A] <-- [B] <-- [C] <-- [D]
++    req->vq = vq;
-+
++    req->elem = elem;
-+The disk image chain can be shortened in one of the following ways:
++
-+
++    if (unlikely(iov_to_buf(out_iov, out_num, 0, &req->out,
-+.. _`block-commit_Case-1`:
++                            sizeof(req->out)) != sizeof(req->out))) {
-+
++        error_report("virtio-blk request outhdr too short");
-+(1) Commit content from only image [B] into image [A].  The resulting
++        goto err;
-+    chain is the following, where image [C] is adjusted to point at [A]
++    }
-+    as its new backing file::
++
-+
++    iov_discard_front(&out_iov, &out_num, sizeof(req->out));
-+        [A] <-- [C] <-- [D]
++
-+
++    if (in_iov[in_num - 1].iov_len < sizeof(struct virtio_blk_inhdr)) {
-+(2) Commit content from images [B] and [C] into image [A].  The
++        error_report("virtio-blk request inhdr too short");
-+    resulting chain, where image [D] is adjusted to point to image [A]
++        goto err;
-+    as its new backing file::
++    }
 +
-+        [A] <-- [D]
++    /* We always touch the last byte, so just see how big in_iov is.  */
-+
++    req->in = (void *)in_iov[in_num - 1].iov_base
-+.. _`block-commit_Case-3`:
++              + in_iov[in_num - 1].iov_len
-+
++              - sizeof(struct virtio_blk_inhdr);
-+(3) Commit content from images [B], [C], and the active layer [D] into
++    iov_discard_back(in_iov, &in_num, sizeof(struct virtio_blk_inhdr));
-+    image [A].  The resulting chain (in this case, a consolidated single
++
-+    image)::
++    type = le32_to_cpu(req->out.type);
-+
++    switch (type & ~VIRTIO_BLK_T_BARRIER) {
-+        [A]
++    case VIRTIO_BLK_T_IN:
-+
++    case VIRTIO_BLK_T_OUT: {
-+(4) Commit content from image only image [C] into image [B].  The
++        ssize_t ret = 0;
-+    resulting chain::
++        bool is_write = type & VIRTIO_BLK_T_OUT;
-+
++        req->sector_num = le64_to_cpu(req->out.sector);
-+    [A] <-- [B] <-- [D]
++
-+
++        int64_t offset = req->sector_num * vdev_blk->blk_size;
-+(5) Commit content from image [C] and the active layer [D] into image
++        QEMUIOVector qiov;
-+    [B].  The resulting chain::
++        if (is_write) {
-+
++            qemu_iovec_init_external(&qiov, out_iov, out_num);
-+    [A] <-- [B]
++            ret = blk_co_pwritev(backend, offset, qiov.size,
-+
++                                 &qiov, 0);
-+
++        } else {
-+QMP invocation for ``block-commit``
++            qemu_iovec_init_external(&qiov, in_iov, in_num);
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++            ret = blk_co_preadv(backend, offset, qiov.size,
-+
++                                &qiov, 0);
 +For :ref:`Case-1 <block-commit_Case-1>`, to merge contents only from
 +image [B] into image [A], the invocation is as follows::
 +
 +    (QEMU) block-commit device=node-D base=a.qcow2 top=b.qcow2 job-id=job0
 +    {
 +        "execute": "block-commit",
 +        "arguments": {
 +            "device": "node-D",
 +            "job-id": "job0",
 +            "top": "b.qcow2",
 +            "base": "a.qcow2"
 +        }
-+    }
++        if (ret >= 0) {
-+
++            req->in->status = VIRTIO_BLK_S_OK;
-+Once the above ``block-commit`` operation has completed, a
++        } else {
-+``BLOCK_JOB_COMPLETED`` event will be issued, and no further action is
++            req->in->status = VIRTIO_BLK_S_IOERR;
 +required.  As the end result, the backing file of image [C] is adjusted
 +to point to image [A], and the original 4-image chain will end up being
 +transformed to::
 +
 +    [A] <-- [C] <-- [D]
 +
 +.. note::
 +    The intermediate image [B] is invalid (as in: no more further
 +    overlays based on it can be created).
 +
 +    Reasoning: An intermediate image after a 'stream' operation still
 +    represents that old point-in-time, and may be valid in that context.
 +    However, an intermediate image after a 'commit' operation no longer
 +    represents any point-in-time, and is invalid in any context.
 +
 +
 +However, :ref:`Case-3 <block-commit_Case-3>` (also called: "active
 +``block-commit``") is a *two-phase* operation: In the first phase, the
 +content from the active overlay, along with the intermediate overlays,
 +is copied into the backing file (also called the base image).  In the
 +second phase, adjust the said backing file as the current active image
 +-- possible via issuing the command ``block-job-complete``.  Optionally,
 +the ``block-commit`` operation can be cancelled by issuing the command
 +``block-job-cancel``, but be careful when doing this.
 +
 +Once the ``block-commit`` operation has completed, the event
 +``BLOCK_JOB_READY`` will be emitted, signalling that the synchronization
 +has finished.  Now the job can be gracefully completed by issuing the
 +command ``block-job-complete`` -- until such a command is issued, the
 +'commit' operation remains active.
 +
 +The following is the flow for :ref:`Case-3 <block-commit_Case-3>` to
 +convert a disk image chain such as this::
 +
 +    [A] <-- [B] <-- [C] <-- [D]
 +
 +Into::
 +
 +    [A]
 +
 +Where content from all the subsequent overlays, [B], and [C], including
 +the active layer, [D], is committed back to [A] -- which is where live
 +QEMU is performing all its current writes).
 +
 +Start the "active ``block-commit``" operation::
 +
 +    (QEMU) block-commit device=node-D base=a.qcow2 top=d.qcow2 job-id=job0
 +    {
 +        "execute": "block-commit",
 +        "arguments": {
 +            "device": "node-D",
 +            "job-id": "job0",
 +            "top": "d.qcow2",
 +            "base": "a.qcow2"
 +        }
-+    }
++        break;
-+
++    }
-+
++    case VIRTIO_BLK_T_FLUSH:
-+Once the synchronization has completed, the event ``BLOCK_JOB_READY`` will
++        vu_block_flush(req);
-+be emitted.
++        req->in->status = VIRTIO_BLK_S_OK;
-+
++        break;
-+Then, optionally query for the status of the active block operations.
++    case VIRTIO_BLK_T_GET_ID: {
-+We can see the 'commit' job is now ready to be completed, as indicated
++        size_t size = MIN(iov_size(&elem->in_sg[0], in_num),
-+by the line *"ready": true*::
++                          VIRTIO_BLK_ID_BYTES);
-+
++        snprintf(elem->in_sg[0].iov_base, size, "%s", "vhost_user_blk");
-+    (QEMU) query-block-jobs
++        req->in->status = VIRTIO_BLK_S_OK;
-+    {
++        req->size = elem->in_sg[0].iov_len;
-+        "execute": "query-block-jobs",
++        break;
-+        "arguments": {}
++    }
-+    }
++    case VIRTIO_BLK_T_DISCARD:
-+    {
++    case VIRTIO_BLK_T_WRITE_ZEROES: {
-+        "return": [
++        int rc;
-+            {
++        rc = vu_block_discard_write_zeroes(req, &elem->out_sg[1],
-+                "busy": false,
++                                           out_num, type);
-+                "type": "commit",
++        if (rc == 0) {
-+                "len": 1376256,
++            req->in->status = VIRTIO_BLK_S_OK;
-+                "paused": false,
++        } else {
-+                "ready": true,
++            req->in->status = VIRTIO_BLK_S_IOERR;
 +                "io-status": "ok",
 +                "offset": 1376256,
 +                "device": "job0",
 +                "speed": 0
 +            }
 +        ]
 +    }
 +
 +Gracefully complete the 'commit' block device job::
 +
 +    (QEMU) block-job-complete device=job0
 +    {
 +        "execute": "block-job-complete",
 +        "arguments": {
 +            "device": "job0"
 +        }
-+    }
++        break;
-+    {
++    }
-+        "return": {}
++    default:
-+    }
++        req->in->status = VIRTIO_BLK_S_UNSUPP;
-+
++        break;
-+Finally, once the above job is completed, an event
++    }
-+``BLOCK_JOB_COMPLETED`` will be emitted.
++
-+
++    vu_block_req_complete(req);
-+.. note::
++    return;
-+    The invocation for rest of the cases (2, 4, and 5), discussed in the
++
-+    previous section, is omitted for brevity.
++err:
-+
++    free(elem);
-+
++    g_free(req);
-+Live disk synchronization --- ``drive-mirror`` and ``blockdev-mirror``
++    return;
-+----------------------------------------------------------------------
++}
 +
-+Synchronize a running disk image chain (all or part of it) to a target
++static void vu_block_process_vq(VuDev *vu_dev, int idx)
-+image.
++{
-+
++    VuServer *server;
-+Again, given our familiar disk image chain::
++    VuVirtq *vq;
-+
++    struct req_data *req_data;
-+    [A] <-- [B] <-- [C] <-- [D]
++
-+
++    server = container_of(vu_dev, VuServer, vu_dev);
-+The ``drive-mirror`` (and its newer equivalent ``blockdev-mirror``) allows
++    assert(server);
-+you to copy data from the entire chain into a single target image (which
++
-+can be located on a different host).
++    vq = vu_get_queue(vu_dev, idx);
-+
++    assert(vq);
-+Once a 'mirror' job has started, there are two possible actions while a
++    VuVirtqElement *elem;
-+``drive-mirror`` job is active:
++    while (1) {
-+
++        elem = vu_queue_pop(vu_dev, vq, sizeof(VuVirtqElement) +
-+(1) Issuing the command ``block-job-cancel`` after it emits the event
++                                    sizeof(VuBlockReq));
-+    ``BLOCK_JOB_CANCELLED``: will (after completing synchronization of
++        if (elem) {
-+    the content from the disk image chain to the target image, [E])
++            req_data = g_new0(struct req_data, 1);
-+    create a point-in-time (which is at the time of *triggering* the
++            req_data->server = server;
-+    cancel command) copy, contained in image [E], of the the entire disk
++            req_data->vq = vq;
-+    image chain (or only the top-most image, depending on the ``sync``
++            req_data->elem = elem;
-+    mode).
++            Coroutine *co = qemu_coroutine_create(vu_block_virtio_process_req,
-+
++                                                  req_data);
-+(2) Issuing the command ``block-job-complete`` after it emits the event
++            aio_co_enter(server->ioc->ctx, co);
-+    ``BLOCK_JOB_COMPLETED``: will, after completing synchronization of
++        } else {
-+    the content, adjust the guest device (i.e. live QEMU) to point to
++            break;
 +    the target image, and, causing all the new writes from this point on
 +    to happen there.  One use case for this is live storage migration.
 +
 +About synchronization modes: The synchronization mode determines
 +*which* part of the disk image chain will be copied to the target.
 +Currently, there are four different kinds:
 +
 +(1) ``full`` -- Synchronize the content of entire disk image chain to
 +    the target
 +
 +(2) ``top`` -- Synchronize only the contents of the top-most disk image
 +    in the chain to the target
 +
 +(3) ``none`` -- Synchronize only the new writes from this point on.
 +
 +    .. note:: In the case of ``drive-backup`` (or ``blockdev-backup``),
 +              the behavior of ``none`` synchronization mode is different.
 +              Normally, a ``backup`` job consists of two parts: Anything
 +              that is overwritten by the guest is first copied out to
 +              the backup, and in the background the whole image is
 +              copied from start to end. With ``sync=none``, it's only
 +              the first part.
 +
 +(4) ``incremental`` -- Synchronize content that is described by the
 +    dirty bitmap
 +
 +.. note::
 +    Refer to the :doc:`bitmaps` document in the QEMU source
 +    tree to learn about the detailed workings of the ``incremental``
 +    synchronization mode.
 +
 +
 +QMP invocation for ``drive-mirror``
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +To copy the contents of the entire disk image chain, from [A] all the
 +way to [D], to a new target (``drive-mirror`` will create the destination
 +file, if it doesn't already exist), call it [E]::
 +
 +    (QEMU) drive-mirror device=node-D target=e.qcow2 sync=full job-id=job0
 +    {
 +        "execute": "drive-mirror",
 +        "arguments": {
 +            "device": "node-D",
 +            "job-id": "job0",
 +            "target": "e.qcow2",
 +            "sync": "full"
 +        }
 +    }
-+
++}
-+The ``"sync": "full"``, from the above, means: copy the *entire* chain
++
-+to the destination.
++static void vu_block_queue_set_started(VuDev *vu_dev, int idx, bool started)
-+
++{
-+Following the above, querying for active block jobs will show that a
++    VuVirtq *vq;
-+'mirror' job is "ready" to be completed (and QEMU will also emit an
++
-+event, ``BLOCK_JOB_READY``)::
++    assert(vu_dev);
 +
-+    (QEMU) query-block-jobs
++    vq = vu_get_queue(vu_dev, idx);
-+    {
++    vu_set_queue_handler(vu_dev, vq, started ? vu_block_process_vq : NULL);
-+        "execute": "query-block-jobs",
++}
-+        "arguments": {}
++
-+    }
++static uint64_t vu_block_get_features(VuDev *dev)
-+    {
++{
-+        "return": [
++    uint64_t features;
-+            {
++    VuServer *server = container_of(dev, VuServer, vu_dev);
-+                "busy": false,
++    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
-+                "type": "mirror",
++    features = 1ull << VIRTIO_BLK_F_SIZE_MAX |
-+                "len": 21757952,
++               1ull << VIRTIO_BLK_F_SEG_MAX |
-+                "paused": false,
++               1ull << VIRTIO_BLK_F_TOPOLOGY |
-+                "ready": true,
++               1ull << VIRTIO_BLK_F_BLK_SIZE |
-+                "io-status": "ok",
++               1ull << VIRTIO_BLK_F_FLUSH |
-+                "offset": 21757952,
++               1ull << VIRTIO_BLK_F_DISCARD |
-+                "device": "job0",
++               1ull << VIRTIO_BLK_F_WRITE_ZEROES |
-+                "speed": 0
++               1ull << VIRTIO_BLK_F_CONFIG_WCE |
-+            }
++               1ull << VIRTIO_F_VERSION_1 |
-+        ]
++               1ull << VIRTIO_RING_F_INDIRECT_DESC |
-+    }
++               1ull << VIRTIO_RING_F_EVENT_IDX |
-+
++               1ull << VHOST_USER_F_PROTOCOL_FEATURES;
-+And, as noted in the previous section, there are two possible actions
++
-+at this point:
++    if (!vdev_blk->writable) {
-+
++        features |= 1ull << VIRTIO_BLK_F_RO;
-+(a) Create a point-in-time snapshot by ending the synchronization.  The
++    }
-+    point-in-time is at the time of *ending* the sync.  (The result of
++
-+    the following being: the target image, [E], will be populated with
++    return features;
-+    content from the entire chain, [A] to [D])::
++}
 +
-+        (QEMU) block-job-cancel device=job0
++static uint64_t vu_block_get_protocol_features(VuDev *dev)
-+        {
++{
-+            "execute": "block-job-cancel",
++    return 1ull << VHOST_USER_PROTOCOL_F_CONFIG |
-+            "arguments": {
++           1ull << VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD;
-+                "device": "job0"
++}
-+            }
++
-+        }
++static int
-+
++vu_block_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
-+(b) Or, complete the operation and pivot the live QEMU to the target
++{
-+    copy::
++    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
-+
++    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
-+        (QEMU) block-job-complete device=job0
++    memcpy(config, &vdev_blk->blkcfg, len);
 +
-+In either of the above cases, if you once again run the
++    return 0;
-+`query-block-jobs` command, there should not be any active block
++}
-+operation.
++
-+
++static int
-+Comparing 'commit' and 'mirror': In both then cases, the overlay images
++vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
-+can be discarded.  However, with 'commit', the *existing* base image
++                    uint32_t offset, uint32_t size, uint32_t flags)
-+will be modified (by updating it with contents from overlays); while in
++{
-+the case of 'mirror', a *new* target image is populated with the data
++    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
-+from the disk image chain.
++    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
-+
++    uint8_t wce;
 +
-+QMP invocation for live storage migration with ``drive-mirror`` + NBD
++    /* don't support live migration */
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++    if (flags != VHOST_SET_CONFIG_TYPE_MASTER) {
-+
++        return -EINVAL;
-+Live storage migration (without shared storage setup) is one of the most
++    }
-+common use-cases that takes advantage of the ``drive-mirror`` primitive
++
-+and QEMU's built-in Network Block Device (NBD) server.  Here's a quick
++    if (offset != offsetof(struct virtio_blk_config, wce) ||
-+walk-through of this setup.
++        size != 1) {
-+
++        return -EINVAL;
-+Given the disk image chain::
++    }
 +
-+    [A] <-- [B] <-- [C] <-- [D]
++    wce = *data;
-+
++    vdev_blk->blkcfg.wce = wce;
-+Instead of copying content from the entire chain, synchronize *only* the
++    blk_set_enable_write_cache(vdev_blk->backend, wce);
-+contents of the *top*-most disk image (i.e. the active layer), [D], to a
++    return 0;
-+target, say, [TargetDisk].
++}
 +
-+.. important::
++/*
-+    The destination host must already have the contents of the backing
++ * When the client disconnects, it sends a VHOST_USER_NONE request
-+    chain, involving images [A], [B], and [C], visible via other means
++ * and vu_process_message will simple call exit which cause the VM
-+    -- whether by ``cp``, ``rsync``, or by some storage array-specific
++ * to exit abruptly.
-+    command.)
++ * To avoid this issue,  process VHOST_USER_NONE request ahead
-+
++ * of vu_process_message.
-+Sometimes, this is also referred to as "shallow copy" -- because only
++ *
-+the "active layer", and not the rest of the image chain, is copied to
++ */
-+the destination.
++static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
-+
++{
-+.. note::
++    if (vmsg->request == VHOST_USER_NONE) {
-+    In this example, for the sake of simplicity, we'll be using the same
++        dev->panic(dev, "disconnect");
-+    ``localhost`` as both source and destination.
++        return true;
-+
++    }
-+As noted earlier, on the destination host the contents of the backing
++    return false;
-+chain -- from images [A] to [C] -- are already expected to exist in some
++}
-+form (e.g. in a file called, ``Contents-of-A-B-C.qcow2``).  Now, on the
++
-+destination host, let's create a target overlay image (with the image
++static const VuDevIface vu_block_iface = {
-+``Contents-of-A-B-C.qcow2`` as its backing file), to which the contents
++    .get_features          = vu_block_get_features,
-+of image [D] (from the source QEMU) will be mirrored to::
++    .queue_set_started     = vu_block_queue_set_started,
-+
++    .get_protocol_features = vu_block_get_protocol_features,
-+    $ qemu-img create -f qcow2 -b ./Contents-of-A-B-C.qcow2 \
++    .get_config            = vu_block_get_config,
-+        -F qcow2 ./target-disk.qcow2
++    .set_config            = vu_block_set_config,
-+
++    .process_msg           = vu_block_process_msg,
-+And start the destination QEMU (we already have the source QEMU running
++};
-+-- discussed in the section: `Interacting with a QEMU instance`_)
++
-+instance, with the following invocation.  (As noted earlier, for
++static void blk_aio_attached(AioContext *ctx, void *opaque)
-+simplicity's sake, the destination QEMU is started on the same host, but
++{
-+it could be located elsewhere)::
++    VuBlockDev *vub_dev = opaque;
-+
++    aio_context_acquire(ctx);
-+    $ ./x86_64-softmmu/qemu-system-x86_64 -display none -nodefconfig \
++    vhost_user_server_set_aio_context(&vub_dev->vu_server, ctx);
-+        -M q35 -nodefaults -m 512 \
++    aio_context_release(ctx);
-+        -blockdev node-name=node-TargetDisk,driver=qcow2,file.driver=file,file.node-name=file,file.filename=./target-disk.qcow2 \
++}
-+        -device virtio-blk,drive=node-TargetDisk,id=virtio0 \
++
-+        -S -monitor stdio -qmp unix:./qmp-sock2,server,nowait \
++static void blk_aio_detach(void *opaque)
-+        -incoming tcp:localhost:6666
++{
-+
++    VuBlockDev *vub_dev = opaque;
-+Given the disk image chain on source QEMU::
++    AioContext *ctx = vub_dev->vu_server.ctx;
-+
++    aio_context_acquire(ctx);
-+    [A] <-- [B] <-- [C] <-- [D]
++    vhost_user_server_set_aio_context(&vub_dev->vu_server, NULL);
-+
++    aio_context_release(ctx);
-+On the destination host, it is expected that the contents of the chain
++}
-+``[A] <-- [B] <-- [C]`` are *already* present, and therefore copy *only*
++
-+the content of image [D].
++static void
-+
++vu_block_initialize_config(BlockDriverState *bs,
-+(1) [On *destination* QEMU] As part of the first step, start the
++                           struct virtio_blk_config *config, uint32_t blk_size)
-+    built-in NBD server on a given host (local host, represented by
++{
-+    ``::``)and port::
++    config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
-+
++    config->blk_size = blk_size;
-+        (QEMU) nbd-server-start addr={"type":"inet","data":{"host":"::","port":"49153"}}
++    config->size_max = 0;
-+        {
++    config->seg_max = 128 - 2;
-+            "execute": "nbd-server-start",
++    config->min_io_size = 1;
-+            "arguments": {
++    config->opt_io_size = 1;
-+                "addr": {
++    config->num_queues = VHOST_USER_BLK_MAX_QUEUES;
-+                    "data": {
++    config->max_discard_sectors = 32768;
-+                        "host": "::",
++    config->max_discard_seg = 1;
-+                        "port": "49153"
++    config->discard_sector_alignment = config->blk_size >> 9;
-+                    },
++    config->max_write_zeroes_sectors = 32768;
-+                    "type": "inet"
++    config->max_write_zeroes_seg = 1;
-+                }
++}
-+            }
++
-+        }
++static VuBlockDev *vu_block_init(VuBlockDev *vu_block_device, Error **errp)
-+
++{
-+(2) [On *destination* QEMU] And export the destination disk image using
++
-+    QEMU's built-in NBD server::
++    BlockBackend *blk;
-+
++    Error *local_error = NULL;
-+        (QEMU) nbd-server-add device=node-TargetDisk writable=true
++    const char *node_name = vu_block_device->node_name;
-+        {
++    bool writable = vu_block_device->writable;
-+            "execute": "nbd-server-add",
++    uint64_t perm = BLK_PERM_CONSISTENT_READ;
-+            "arguments": {
++    int ret;
-+                "device": "node-TargetDisk"
++
-+            }
++    AioContext *ctx;
-+        }
++
-+
++    BlockDriverState *bs = bdrv_lookup_bs(node_name, node_name, &local_error);
-+(3) [On *source* QEMU] Then, invoke ``drive-mirror`` (NB: since we're
++
-+    running ``drive-mirror`` with ``mode=existing`` (meaning:
++    if (!bs) {
-+    synchronize to a pre-created file, therefore 'existing', file on the
++        error_propagate(errp, local_error);
-+    target host), with the synchronization mode as 'top' (``"sync:
++        return NULL;
-+    "top"``)::
++    }
 +
-+        (QEMU) drive-mirror device=node-D target=nbd:localhost:49153:exportname=node-TargetDisk sync=top mode=existing job-id=job0
++    if (bdrv_is_read_only(bs)) {
-+        {
++        writable = false;
-+            "execute": "drive-mirror",
++    }
-+            "arguments": {
++
-+                "device": "node-D",
++    if (writable) {
-+                "mode": "existing",
++        perm |= BLK_PERM_WRITE;
-+                "job-id": "job0",
++    }
-+                "target": "nbd:localhost:49153:exportname=node-TargetDisk",
++
-+                "sync": "top"
++    ctx = bdrv_get_aio_context(bs);
-+            }
++    aio_context_acquire(ctx);
-+        }
++    bdrv_invalidate_cache(bs, NULL);
-+
++    aio_context_release(ctx);
-+(4) [On *source* QEMU] Once ``drive-mirror`` copies the entire data, and the
++
-+    event ``BLOCK_JOB_READY`` is emitted, issue ``block-job-cancel`` to
++    /*
-+    gracefully end the synchronization, from source QEMU::
++     * Don't allow resize while the vhost user server is running,
-+
++     * otherwise we don't care what happens with the node.
-+        (QEMU) block-job-cancel device=job0
++     */
-+        {
++    blk = blk_new(bdrv_get_aio_context(bs), perm,
-+            "execute": "block-job-cancel",
++                  BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED |
-+            "arguments": {
++                  BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD);
-+                "device": "job0"
++    ret = blk_insert_bs(blk, bs, errp);
-+            }
++
-+        }
++    if (ret < 0) {
-+
++        goto fail;
-+(5) [On *destination* QEMU] Then, stop the NBD server::
++    }
 +
-+        (QEMU) nbd-server-stop
++    blk_set_enable_write_cache(blk, false);
-+        {
++
-+            "execute": "nbd-server-stop",
++    blk_set_allow_aio_context_change(blk, true);
-+            "arguments": {}
++
-+        }
++    vu_block_device->blkcfg.wce = 0;
-+
++    vu_block_device->backend = blk;
-+(6) [On *destination* QEMU] Finally, resume the guest vCPUs by issuing the
++    if (!vu_block_device->blk_size) {
-+    QMP command `cont`::
++        vu_block_device->blk_size = BDRV_SECTOR_SIZE;
-+
++    }
-+        (QEMU) cont
++    vu_block_device->blkcfg.blk_size = vu_block_device->blk_size;
-+        {
++    blk_set_guest_block_size(blk, vu_block_device->blk_size);
-+            "execute": "cont",
++    vu_block_initialize_config(bs, &vu_block_device->blkcfg,
-+            "arguments": {}
++                                   vu_block_device->blk_size);
-+        }
++    return vu_block_device;
 +
-+.. note::
++fail:
-+    Higher-level libraries (e.g. libvirt) automate the entire above
++    blk_unref(blk);
-+    process (although note that libvirt does not allow same-host
++    return NULL;
-+    migrations to localhost for other reasons).
++}
 +
-+
++static void vu_block_deinit(VuBlockDev *vu_block_device)
-+Notes on ``blockdev-mirror``
++{
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++    if (vu_block_device->backend) {
-+
++        blk_remove_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
-+The ``blockdev-mirror`` command is equivalent in core functionality to
++                                        blk_aio_detach, vu_block_device);
-+``drive-mirror``, except that it operates at node-level in a BDS graph.
++    }
 +
-+Also: for ``blockdev-mirror``, the 'target' image needs to be explicitly
++    blk_unref(vu_block_device->backend);
-+created (using ``qemu-img``) and attach it to live QEMU via
++}
-+``blockdev-add``, which assigns a name to the to-be created target node.
++
-+
++static void vhost_user_blk_server_stop(VuBlockDev *vu_block_device)
-+E.g. the sequence of actions to create a point-in-time backup of an
++{
-+entire disk image chain, to a target, using ``blockdev-mirror`` would be:
++    vhost_user_server_stop(&vu_block_device->vu_server);
-+
++    vu_block_deinit(vu_block_device);
-+(0) Create the QCOW2 overlays, to arrive at a backing chain of desired
++}
-+    depth
++
-+
++static void vhost_user_blk_server_start(VuBlockDev *vu_block_device,
-+(1) Create the target image (using ``qemu-img``), say, ``e.qcow2``
++                                        Error **errp)
-+
++{
-+(2) Attach the above created file (``e.qcow2``), run-time, using
++    AioContext *ctx;
-+    ``blockdev-add`` to QEMU
++    SocketAddress *addr = vu_block_device->addr;
 +
-+(3) Perform ``blockdev-mirror`` (use ``"sync": "full"`` to copy the
++    if (!vu_block_init(vu_block_device, errp)) {
-+    entire chain to the target).  And notice the event
++        return;
-+    ``BLOCK_JOB_READY``
++    }
 +
-+(4) Optionally, query for active block jobs, there should be a 'mirror'
++    ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend));
-+    job ready to be completed
++
-+
++    if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx,
-+(5) Gracefully complete the 'mirror' block device job, and notice the
++                                 VHOST_USER_BLK_MAX_QUEUES,
-+    the event ``BLOCK_JOB_COMPLETED``
++                                 NULL, &vu_block_iface,
-+
++                                 errp)) {
-+(6) Shutdown the guest by issuing the QMP ``quit`` command so that
++        goto error;
-+    caches are flushed
++    }
 +
-+(7) Then, finally, compare the contents of the disk image chain, and
++    blk_add_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
-+    the target copy with ``qemu-img compare``.  You should notice:
++                                 blk_aio_detach, vu_block_device);
-+    "Images are identical"
++    vu_block_device->running = true;
-+
++    return;
 +
-+QMP invocation for ``blockdev-mirror``
++ error:
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++    vu_block_deinit(vu_block_device);
-+
++}
-+Given the disk image chain::
++
-+
++static bool vu_prop_modifiable(VuBlockDev *vus, Error **errp)
-+    [A] <-- [B] <-- [C] <-- [D]
++{
-+
++    if (vus->running) {
-+To copy the contents of the entire disk image chain, from [A] all the
++            error_setg(errp, "The property can't be modified "
-+way to [D], to a new target, call it [E].  The following is the flow.
++                       "while the server is running");
-+
++            return false;
-+Create the overlay images, [B], [C], and [D]::
++    }
-+
++    return true;
-+    (QEMU) blockdev-snapshot-sync node-name=node-A snapshot-file=b.qcow2 snapshot-node-name=node-B format=qcow2
++}
-+    (QEMU) blockdev-snapshot-sync node-name=node-B snapshot-file=c.qcow2 snapshot-node-name=node-C format=qcow2
++
-+    (QEMU) blockdev-snapshot-sync node-name=node-C snapshot-file=d.qcow2 snapshot-node-name=node-D format=qcow2
++static void vu_set_node_name(Object *obj, const char *value, Error **errp)
-+
++{
-+Create the target image, [E]::
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 +
-+    $ qemu-img create -f qcow2 e.qcow2 39M
++    if (!vu_prop_modifiable(vus, errp)) {
-+
++        return;
-+Add the above created target image to QEMU, via ``blockdev-add``::
++    }
 +
-+    (QEMU) blockdev-add driver=qcow2 node-name=node-E file={"driver":"file","filename":"e.qcow2"}
++    if (vus->node_name) {
-+    {
++        g_free(vus->node_name);
-+        "execute": "blockdev-add",
++    }
-+        "arguments": {
++
-+            "node-name": "node-E",
++    vus->node_name = g_strdup(value);
-+            "driver": "qcow2",
++}
-+            "file": {
++
-+                "driver": "file",
++static char *vu_get_node_name(Object *obj, Error **errp)
-+                "filename": "e.qcow2"
++{
-+            }
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-+        }
++    return g_strdup(vus->node_name);
-+    }
++}
 +
-+Perform ``blockdev-mirror``, and notice the event ``BLOCK_JOB_READY``::
++static void free_socket_addr(SocketAddress *addr)
-+
++{
-+    (QEMU) blockdev-mirror device=node-B target=node-E sync=full job-id=job0
++        g_free(addr->u.q_unix.path);
-+    {
++        g_free(addr);
-+        "execute": "blockdev-mirror",
++}
-+        "arguments": {
++
-+            "device": "node-D",
++static void vu_set_unix_socket(Object *obj, const char *value,
-+            "job-id": "job0",
++                               Error **errp)
-+            "target": "node-E",
++{
-+            "sync": "full"
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-+        }
++
-+    }
++    if (!vu_prop_modifiable(vus, errp)) {
-+
++        return;
-+Query for active block jobs, there should be a 'mirror' job ready::
++    }
 +
-+    (QEMU) query-block-jobs
++    if (vus->addr) {
-+    {
++        free_socket_addr(vus->addr);
-+        "execute": "query-block-jobs",
++    }
-+        "arguments": {}
++
-+    }
++    SocketAddress *addr = g_new0(SocketAddress, 1);
-+    {
++    addr->type = SOCKET_ADDRESS_TYPE_UNIX;
-+        "return": [
++    addr->u.q_unix.path = g_strdup(value);
-+            {
++    vus->addr = addr;
-+                "busy": false,
++}
-+                "type": "mirror",
++
-+                "len": 21561344,
++static char *vu_get_unix_socket(Object *obj, Error **errp)
-+                "paused": false,
++{
-+                "ready": true,
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-+                "io-status": "ok",
++    return g_strdup(vus->addr->u.q_unix.path);
-+                "offset": 21561344,
++}
-+                "device": "job0",
++
-+                "speed": 0
++static bool vu_get_block_writable(Object *obj, Error **errp)
-+            }
++{
-+        ]
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-+    }
++    return vus->writable;
-+
++}
-+Gracefully complete the block device job operation, and notice the
++
-+event ``BLOCK_JOB_COMPLETED``::
++static void vu_set_block_writable(Object *obj, bool value, Error **errp)
-+
++{
-+    (QEMU) block-job-complete device=job0
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-+    {
++
-+        "execute": "block-job-complete",
++    if (!vu_prop_modifiable(vus, errp)) {
-+        "arguments": {
++            return;
-+            "device": "job0"
++    }
-+        }
++
-+    }
++    vus->writable = value;
-+    {
++}
-+        "return": {}
++
-+    }
++static void vu_get_blk_size(Object *obj, Visitor *v, const char *name,
-+
++                            void *opaque, Error **errp)
-+Shutdown the guest, by issuing the ``quit`` QMP command::
++{
-+
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-+    (QEMU) quit
++    uint32_t value = vus->blk_size;
-+    {
++
-+        "execute": "quit",
++    visit_type_uint32(v, name, &value, errp);
-+        "arguments": {}
++}
-+    }
++
-+
++static void vu_set_blk_size(Object *obj, Visitor *v, const char *name,
-+
++                            void *opaque, Error **errp)
-+Live disk backup --- ``drive-backup`` and ``blockdev-backup``
++{
-+-------------------------------------------------------------
++    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 +
-+The ``drive-backup`` (and its newer equivalent ``blockdev-backup``) allows
++    Error *local_err = NULL;
-+you to create a point-in-time snapshot.
++    uint32_t value;
 +
-+In this case, the point-in-time is when you *start* the ``drive-backup``
++    if (!vu_prop_modifiable(vus, errp)) {
-+(or its newer equivalent ``blockdev-backup``) command.
++            return;
-+
++    }
 +
-+QMP invocation for ``drive-backup``
++    visit_type_uint32(v, name, &value, &local_err);
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++    if (local_err) {
-+
++        goto out;
-+Yet again, starting afresh with our example disk image chain::
++    }
 +
-+    [A] <-- [B] <-- [C] <-- [D]
++    check_block_size(object_get_typename(obj), name, value, &local_err);
-+
++    if (local_err) {
-+To create a target image [E], with content populated from image [A] to
++        goto out;
-+[D], from the above chain, the following is the syntax.  (If the target
++    }
-+image does not exist, ``drive-backup`` will create it)::
++
-+
++    vus->blk_size = value;
-+    (QEMU) drive-backup device=node-D sync=full target=e.qcow2 job-id=job0
++
-+    {
++out:
-+        "execute": "drive-backup",
++    error_propagate(errp, local_err);
-+        "arguments": {
++}
-+            "device": "node-D",
++
-+            "job-id": "job0",
++static void vhost_user_blk_server_instance_finalize(Object *obj)
-+            "sync": "full",
++{
-+            "target": "e.qcow2"
++    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
-+        }
++
-+    }
++    vhost_user_blk_server_stop(vub);
 +
-+Once the above ``drive-backup`` has completed, a ``BLOCK_JOB_COMPLETED`` event
++    /*
-+will be issued, indicating the live block device job operation has
++     * Unlike object_property_add_str, object_class_property_add_str
-+completed, and no further action is required.
++     * doesn't have a release method. Thus manual memory freeing is
-+
++     * needed.
-+
++     */
-+Notes on ``blockdev-backup``
++    free_socket_addr(vub->addr);
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++    g_free(vub->node_name);
-+
++}
-+The ``blockdev-backup`` command is equivalent in functionality to
++
-+``drive-backup``, except that it operates at node-level in a Block Driver
++static void vhost_user_blk_server_complete(UserCreatable *obj, Error **errp)
-+State (BDS) graph.
++{
-+
++    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
-+E.g. the sequence of actions to create a point-in-time backup
++
-+of an entire disk image chain, to a target, using ``blockdev-backup``
++    vhost_user_blk_server_start(vub, errp);
-+would be:
++}
 +
-+(0) Create the QCOW2 overlays, to arrive at a backing chain of desired
++static void vhost_user_blk_server_class_init(ObjectClass *klass,
-+    depth
++                                             void *class_data)
-+
++{
-+(1) Create the target image (using ``qemu-img``), say, ``e.qcow2``
++    UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
-+
++    ucc->complete = vhost_user_blk_server_complete;
-+(2) Attach the above created file (``e.qcow2``), run-time, using
++
-+    ``blockdev-add`` to QEMU
++    object_class_property_add_bool(klass, "writable",
-+
++                                   vu_get_block_writable,
-+(3) Perform ``blockdev-backup`` (use ``"sync": "full"`` to copy the
++                                   vu_set_block_writable);
-+    entire chain to the target).  And notice the event
++
-+    ``BLOCK_JOB_COMPLETED``
++    object_class_property_add_str(klass, "node-name",
-+
++                                  vu_get_node_name,
-+(4) Shutdown the guest, by issuing the QMP ``quit`` command, so that
++                                  vu_set_node_name);
-+    caches are flushed
++
-+
++    object_class_property_add_str(klass, "unix-socket",
-+(5) Then, finally, compare the contents of the disk image chain, and
++                                  vu_get_unix_socket,
-+    the target copy with ``qemu-img compare``.  You should notice:
++                                  vu_set_unix_socket);
-+    "Images are identical"
++
-+
++    object_class_property_add(klass, "logical-block-size", "uint32",
-+The following section shows an example QMP invocation for
++                              vu_get_blk_size, vu_set_blk_size,
-+``blockdev-backup``.
++                              NULL, NULL);
-+
++}
-+QMP invocation for ``blockdev-backup``
++
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
++static const TypeInfo vhost_user_blk_server_info = {
-+
++    .name = TYPE_VHOST_USER_BLK_SERVER,
-+Given a disk image chain of depth 1 where image [B] is the active
++    .parent = TYPE_OBJECT,
-+overlay (live QEMU is writing to it)::
++    .instance_size = sizeof(VuBlockDev),
-+
++    .instance_finalize = vhost_user_blk_server_instance_finalize,
-+    [A] <-- [B]
++    .class_init = vhost_user_blk_server_class_init,
-+
++    .interfaces = (InterfaceInfo[]) {
-+The following is the procedure to copy the content from the entire chain
++        {TYPE_USER_CREATABLE},
-+to a target image (say, [E]), which has the full content from [A] and
++        {}
-+[B].
++    },
-+
++};
-+Create the overlay [B]::
++
-+
++static void vhost_user_blk_server_register_types(void)
-+    (QEMU) blockdev-snapshot-sync node-name=node-A snapshot-file=b.qcow2 snapshot-node-name=node-B format=qcow2
++{
-+    {
++    type_register_static(&vhost_user_blk_server_info);
-+        "execute": "blockdev-snapshot-sync",
++}
-+        "arguments": {
++
-+            "node-name": "node-A",
++type_init(vhost_user_blk_server_register_types)
-+            "snapshot-file": "b.qcow2",
+diff --git a/softmmu/vl.c b/softmmu/vl.c
-+            "format": "qcow2",
+index XXXXXXX..XXXXXXX 100644
-+            "snapshot-node-name": "node-B"
+--- a/softmmu/vl.c
-+        }
++++ b/softmmu/vl.c
-+    }
+@@ -XXX,XX +XXX,XX @@ static bool object_create_initial(const char *type, QemuOpts *opts)
-+
+     }
-+
+ #endif
-+Create a target image that will contain the copy::
-+
++    /* Reason: vhost-user-blk-server property "node-name" */
-+    $ qemu-img create -f qcow2 e.qcow2 39M
++    if (g_str_equal(type, "vhost-user-blk-server")) {
-+
++        return false;
-+Then add it to QEMU via ``blockdev-add``::
++    }
-+
+     /*
-+    (QEMU) blockdev-add driver=qcow2 node-name=node-E file={"driver":"file","filename":"e.qcow2"}
+      * Reason: filter-* property "netdev" etc.
-+    {
+      */
-+        "execute": "blockdev-add",
+diff --git a/block/meson.build b/block/meson.build
-+        "arguments": {
+index XXXXXXX..XXXXXXX 100644
-+            "node-name": "node-E",
+--- a/block/meson.build
-+            "driver": "qcow2",
++++ b/block/meson.build
-+            "file": {
+@@ -XXX,XX +XXX,XX @@ block_ss.add(when: 'CONFIG_WIN32', if_true: files('file-win32.c', 'win32-aio.c')
-+                "driver": "file",
+ block_ss.add(when: 'CONFIG_POSIX', if_true: [files('file-posix.c'), coref, iokit])
-+                "filename": "e.qcow2"
+ block_ss.add(when: 'CONFIG_LIBISCSI', if_true: files('iscsi-opts.c'))
-+            }
+ block_ss.add(when: 'CONFIG_LINUX', if_true: files('nvme.c'))
-+        }
++block_ss.add(when: 'CONFIG_LINUX', if_true: files('export/vhost-user-blk-server.c', '../contrib/libvhost-user/libvhost-user.c'))
-+    }
+ block_ss.add(when: 'CONFIG_REPLICATION', if_true: files('replication.c'))
-+
+ block_ss.add(when: 'CONFIG_SHEEPDOG', if_true: files('sheepdog.c'))
-+Then invoke ``blockdev-backup`` to copy the contents from the entire
+ block_ss.add(when: ['CONFIG_LINUX_AIO', libaio], if_true: files('linux-aio.c'))
 +image chain, consisting of images [A] and [B] to the target image
 +'e.qcow2'::
 +
 +    (QEMU) blockdev-backup device=node-B target=node-E sync=full job-id=job0
 +    {
 +        "execute": "blockdev-backup",
 +        "arguments": {
 +            "device": "node-B",
 +            "job-id": "job0",
 +            "target": "node-E",
 +            "sync": "full"
 +        }
 +    }
 +
 +Once the above 'backup' operation has completed, the event,
 +``BLOCK_JOB_COMPLETED`` will be emitted, signalling successful
 +completion.
 +
 +Next, query for any active block device jobs (there should be none)::
 +
 +    (QEMU) query-block-jobs
 +    {
 +        "execute": "query-block-jobs",
 +        "arguments": {}
 +    }
 +
 +Shutdown the guest::
 +
 +    (QEMU) quit
 +    {
 +            "execute": "quit",
 +                "arguments": {}
 +    }
 +            "return": {}
 +    }
 +
 +.. note::
 +    The above step is really important; if forgotten, an error, "Failed
 +    to get shared "write" lock on e.qcow2", will be thrown when you do
 +    ``qemu-img compare`` to verify the integrity of the disk image
 +    with the backup content.
 +
 +
 +The end result will be the image 'e.qcow2' containing a
 +point-in-time backup of the disk image chain -- i.e. contents from
 +images [A] and [B] at the time the ``blockdev-backup`` command was
 +initiated.
 +
 +One way to confirm the backup disk image contains the identical content
 +with the disk image chain is to compare the backup and the contents of
 +the chain, you should see "Images are identical".  (NB: this is assuming
 +QEMU was launched with ``-S`` option, which will not start the CPUs at
 +guest boot up)::
 +
 +    $ qemu-img compare b.qcow2 e.qcow2
 +    Warning: Image size mismatch!
 +    Images are identical.
 +
 +NOTE: The "Warning: Image size mismatch!" is expected, as we created the
 +target image (e.qcow2) with 39M size.
 diff --git a/docs/live-block-ops.txt b/docs/live-block-ops.txt
 deleted file mode 100644
 index XXXXXXX..XXXXXXX
 --- a/docs/live-block-ops.txt
 +++ /dev/null
@@ -XXX,XX +XXX,XX @@
 -LIVE BLOCK OPERATIONS
 -=====================
 -
 -High level description of live block operations. Note these are not
 -supported for use with the raw format at the moment.
 -
 -Note also that this document is incomplete and it currently only
 -covers the 'stream' operation. Other operations supported by QEMU such
 -as 'commit', 'mirror' and 'backup' are not described here yet. Please
 -refer to the qapi/block-core.json file for an overview of those.
 -
 -Snapshot live merge
 -===================
 -
 -Given a snapshot chain, described in this document in the following
 -format:
 -
 -[A] <- [B] <- [C] <- [D] <- [E]
 -
 -Where the rightmost object ([E] in the example) described is the current
 -image which the guest OS has write access to. To the left of it is its base
 -image, and so on accordingly until the leftmost image, which has no
 -base.
 -
 -The snapshot live merge operation transforms such a chain into a
 -smaller one with fewer elements, such as this transformation relative
 -to the first example:
 -
 -[A] <- [E]
 -
 -Data is copied in the right direction with destination being the
 -rightmost image, but any other intermediate image can be specified
 -instead. In this example data is copied from [C] into [D], so [D] can
 -be backed by [B]:
 -
 -[A] <- [B] <- [D] <- [E]
 -
 -The operation is implemented in QEMU through image streaming facilities.
 -
 -The basic idea is to execute 'block_stream virtio0' while the guest is
 -running. Progress can be monitored using 'info block-jobs'. When the
 -streaming operation completes it raises a QMP event. 'block_stream'
 -copies data from the backing file(s) into the active image. When finished,
 -it adjusts the backing file pointer.
 -
 -The 'base' parameter specifies an image which data need not be
 -streamed from. This image will be used as the backing file for the
 -destination image when the operation is finished.
 -
 -In the first example above, the command would be:
 -
 -(qemu) block_stream virtio0 file-A.img
 -
 -In order to specify a destination image different from the active
 -(rightmost) one we can use its node name instead.
 -
 -In the second example above, the command would be:
 -
 -(qemu) block_stream node-D file-B.img
 -
 -Live block copy
 -===============
 -
 -To copy an in use image to another destination in the filesystem, one
 -should create a live snapshot in the desired destination, then stream
 -into that image. Example:
 -
 -(qemu) snapshot_blkdev ide0-hd0 /new-path/disk.img qcow2
 -
 -(qemu) block_stream ide0-hd0
 -
 -
 --
-.9.4
+.26.2

-New patch
+[PULL v2 07/28] MAINTAINERS: Add vhost-user block device backend server maintainer
+From: Coiby Xu <coiby.xu@gmail.com>
+Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Message-id: 20200918080912.321299-8-coiby.xu@gmail.com
+[Removed reference to vhost-user-blk-test.c, it will be sent in a
+separate pull request.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ MAINTAINERS | 7 +++++++
+file changed, 7 insertions(+)
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org
+ S: Supported
+ F: tests/image-fuzzer/
++Vhost-user block device backend server
++M: Coiby Xu <Coiby.Xu@gmail.com>
++S: Maintained
++F: block/export/vhost-user-blk-server.c
++F: util/vhost-user-server.c
++F: tests/qtest/libqos/vhost-user-blk.c
++
+ Replication
+ M: Wen Congyang <wencongyang2@huawei.com>
+ M: Xie Changlong <xiechanglong.d@gmail.com>
+--
+.26.2

-New patch
+[PULL v2 08/28] util/vhost-user-server: s/fileds/fields/ typo fix
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-3-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+         return false;
+     }
+-    /* zero out unspecified fileds */
++    /* zero out unspecified fields */
+     *server = (VuServer) {
+         .listener              = listener,
+         .vu_iface              = vu_iface,
+--
+.26.2

-New patch
+[PULL v2 09/28] util/vhost-user-server: drop unnecessary QOM cast
+We already have access to the value with the correct type (ioc and sioc
+are the same QIOChannel).
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-4-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
+     server->ioc = QIO_CHANNEL(sioc);
+     object_ref(OBJECT(server->ioc));
+     qio_channel_attach_aio_context(server->ioc, server->ctx);
+-    qio_channel_set_blocking(QIO_CHANNEL(server->sioc), false, NULL);
++    qio_channel_set_blocking(server->ioc, false, NULL);
+     vu_client_start(server);
+ }
+--
+.26.2

-New patch
+[PULL v2 10/28] util/vhost-user-server: drop unnecessary watch deletion
+Explicitly deleting watches is not necessary since libvhost-user calls
+remove_watch() during vu_deinit(). Add an assertion to check this
+though.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-5-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.c | 19 ++++---------------
+file changed, 4 insertions(+), 15 deletions(-)
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@ static void close_client(VuServer *server)
+     /* When this is set vu_client_trip will stop new processing vhost-user message */
+     server->sioc = NULL;
+-    VuFdWatch *vu_fd_watch, *next;
+-    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+-        aio_set_fd_handler(server->ioc->ctx, vu_fd_watch->fd, true, NULL,
+-                           NULL, NULL, NULL);
+-    }
+-
+-    while (!QTAILQ_EMPTY(&server->vu_fd_watches)) {
+-        QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+-            if (!vu_fd_watch->processing) {
+-                QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next);
+-                g_free(vu_fd_watch);
+-            }
+-        }
+-    }
+-
+     while (server->processing_msg) {
+         if (server->ioc->read_coroutine) {
+             server->ioc->read_coroutine = NULL;
+@@ -XXX,XX +XXX,XX @@ static void close_client(VuServer *server)
+     }
+     vu_deinit(&server->vu_dev);
++
++    /* vu_deinit() should have called remove_watch() */
++    assert(QTAILQ_EMPTY(&server->vu_fd_watches));
++
+     object_unref(OBJECT(sioc));
+     object_unref(OBJECT(server->ioc));
+ }
+--
+.26.2

-New patch
+[PULL v2 11/28] block/export: consolidate request structs into VuBlockReq
+Only one struct is needed per request. Drop req_data and the separate
+VuBlockReq instance. Instead let vu_queue_pop() allocate everything at
+once.
+This fixes the req_data memory leak in vu_block_virtio_process_req().
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-6-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/export/vhost-user-blk-server.c | 68 +++++++++-------------------
+file changed, 21 insertions(+), 47 deletions(-)
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@ struct virtio_blk_inhdr {
+ };
+ typedef struct VuBlockReq {
+-    VuVirtqElement *elem;
++    VuVirtqElement elem;
+     int64_t sector_num;
+     size_t size;
+     struct virtio_blk_inhdr *in;
+@@ -XXX,XX +XXX,XX @@ static void vu_block_req_complete(VuBlockReq *req)
+     VuDev *vu_dev = &req->server->vu_dev;
+     /* IO size with 1 extra status byte */
+-    vu_queue_push(vu_dev, req->vq, req->elem, req->size + 1);
++    vu_queue_push(vu_dev, req->vq, &req->elem, req->size + 1);
+     vu_queue_notify(vu_dev, req->vq);
+-    if (req->elem) {
+-        free(req->elem);
+-    }
+-
+-    g_free(req);
++    free(req);
+ }
+ static VuBlockDev *get_vu_block_device_by_server(VuServer *server)
+@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_flush(VuBlockReq *req)
+     blk_co_flush(backend);
+ }
+-struct req_data {
+-    VuServer *server;
+-    VuVirtq *vq;
+-    VuVirtqElement *elem;
+-};
+-
+ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
+ {
+-    struct req_data *data = opaque;
+-    VuServer *server = data->server;
+-    VuVirtq *vq = data->vq;
+-    VuVirtqElement *elem = data->elem;
++    VuBlockReq *req = opaque;
++    VuServer *server = req->server;
++    VuVirtqElement *elem = &req->elem;
+     uint32_t type;
+-    VuBlockReq *req;
+     VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+     BlockBackend *backend = vdev_blk->backend;
+@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
+     struct iovec *out_iov = elem->out_sg;
+     unsigned in_num = elem->in_num;
+     unsigned out_num = elem->out_num;
++
+     /* refer to hw/block/virtio_blk.c */
+     if (elem->out_num < 1 || elem->in_num < 1) {
+         error_report("virtio-blk request missing headers");
+-        free(elem);
+-        return;
++        goto err;
+     }
+-    req = g_new0(VuBlockReq, 1);
+-    req->server = server;
+-    req->vq = vq;
+-    req->elem = elem;
+-
+     if (unlikely(iov_to_buf(out_iov, out_num, 0, &req->out,
+                             sizeof(req->out)) != sizeof(req->out))) {
+         error_report("virtio-blk request outhdr too short");
+@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
+ err:
+     free(elem);
+-    g_free(req);
+-    return;
+ }
+ static void vu_block_process_vq(VuDev *vu_dev, int idx)
+ {
+-    VuServer *server;
+-    VuVirtq *vq;
+-    struct req_data *req_data;
++    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
++    VuVirtq *vq = vu_get_queue(vu_dev, idx);
+-    server = container_of(vu_dev, VuServer, vu_dev);
+-    assert(server);
+-
+-    vq = vu_get_queue(vu_dev, idx);
+-    assert(vq);
+-    VuVirtqElement *elem;
+     while (1) {
+-        elem = vu_queue_pop(vu_dev, vq, sizeof(VuVirtqElement) +
+-                                    sizeof(VuBlockReq));
+-        if (elem) {
+-            req_data = g_new0(struct req_data, 1);
+-            req_data->server = server;
+-            req_data->vq = vq;
+-            req_data->elem = elem;
+-            Coroutine *co = qemu_coroutine_create(vu_block_virtio_process_req,
+-                                                  req_data);
+-            aio_co_enter(server->ioc->ctx, co);
+-        } else {
++        VuBlockReq *req;
++
++        req = vu_queue_pop(vu_dev, vq, sizeof(VuBlockReq));
++        if (!req) {
+             break;
+         }
++
++        req->server = server;
++        req->vq = vq;
++
++        Coroutine *co =
++            qemu_coroutine_create(vu_block_virtio_process_req, req);
++        qemu_coroutine_enter(co);
+     }
+ }
+--
+.26.2

-New patch
+[PULL v2 12/28] util/vhost-user-server: drop unused DevicePanicNotifier
+The device panic notifier callback is not used. Drop it.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-7-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.h             | 3 ---
+ block/export/vhost-user-blk-server.c | 3 +--
+ util/vhost-user-server.c             | 6 ------
+files changed, 1 insertion(+), 11 deletions(-)
+diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.h
++++ b/util/vhost-user-server.h
+@@ -XXX,XX +XXX,XX @@ typedef struct VuFdWatch {
+ } VuFdWatch;
+ typedef struct VuServer VuServer;
+-typedef void DevicePanicNotifierFn(VuServer *server);
+ struct VuServer {
+     QIONetListener *listener;
+     AioContext *ctx;
+-    DevicePanicNotifierFn *device_panic_notifier;
+     int max_queues;
+     const VuDevIface *vu_iface;
+     VuDev vu_dev;
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+                              SocketAddress *unix_socket,
+                              AioContext *ctx,
+                              uint16_t max_queues,
+-                             DevicePanicNotifierFn *device_panic_notifier,
+                              const VuDevIface *vu_iface,
+                              Error **errp);
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@ static void vhost_user_blk_server_start(VuBlockDev *vu_block_device,
+     ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend));
+     if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx,
+-                                 VHOST_USER_BLK_MAX_QUEUES,
+-                                 NULL, &vu_block_iface,
++                                 VHOST_USER_BLK_MAX_QUEUES, &vu_block_iface,
+                                  errp)) {
+         goto error;
+     }
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@ static void panic_cb(VuDev *vu_dev, const char *buf)
+         close_client(server);
+     }
+-    if (server->device_panic_notifier) {
+-        server->device_panic_notifier(server);
+-    }
+-
+     /*
+      * Set the callback function for network listener so another
+      * vhost-user client can connect to this server
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+                              SocketAddress *socket_addr,
+                              AioContext *ctx,
+                              uint16_t max_queues,
+-                             DevicePanicNotifierFn *device_panic_notifier,
+                              const VuDevIface *vu_iface,
+                              Error **errp)
+ {
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+         .vu_iface              = vu_iface,
+         .max_queues            = max_queues,
+         .ctx                   = ctx,
+-        .device_panic_notifier = device_panic_notifier,
+     };
+     qio_net_listener_set_name(server->listener, "vhost-user-backend-listener");
+--
+.26.2

-New patch
+[PULL v2 13/28] util/vhost-user-server: fix memory leak in vu_message_read()
+fds[] is leaked when qio_channel_readv_full() fails.
+Use vmsg->fds[] instead of keeping a local fds[] array. Then we can
+reuse goto fail to clean up fds. vmsg->fd_num must be zeroed before the
+loop to make this safe.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-8-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.c | 50 ++++++++++++++++++----------------------
+file changed, 23 insertions(+), 27 deletions(-)
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
+     };
+     int rc, read_bytes = 0;
+     Error *local_err = NULL;
+-    /*
+-     * Store fds/nfds returned from qio_channel_readv_full into
+-     * temporary variables.
+-     *
+-     * VhostUserMsg is a packed structure, gcc will complain about passing
+-     * pointer to a packed structure member if we pass &VhostUserMsg.fd_num
+-     * and &VhostUserMsg.fds directly when calling qio_channel_readv_full,
+-     * thus two temporary variables nfds and fds are used here.
+-     */
+-    size_t nfds = 0, nfds_t = 0;
+     const size_t max_fds = G_N_ELEMENTS(vmsg->fds);
+-    int *fds_t = NULL;
+     VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+     QIOChannel *ioc = server->ioc;
++    vmsg->fd_num = 0;
+     if (!ioc) {
+         error_report_err(local_err);
+         goto fail;
+@@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
+     assert(qemu_in_coroutine());
+     do {
++        size_t nfds = 0;
++        int *fds = NULL;
++
+         /*
+          * qio_channel_readv_full may have short reads, keeping calling it
+          * until getting VHOST_USER_HDR_SIZE or 0 bytes in total
+          */
+-        rc = qio_channel_readv_full(ioc, &iov, 1, &fds_t, &nfds_t, &local_err);
++        rc = qio_channel_readv_full(ioc, &iov, 1, &fds, &nfds, &local_err);
+         if (rc < 0) {
+             if (rc == QIO_CHANNEL_ERR_BLOCK) {
++                assert(local_err == NULL);
+                 qio_channel_yield(ioc, G_IO_IN);
+                 continue;
+             } else {
+                 error_report_err(local_err);
+-                return false;
++                goto fail;
+             }
+         }
+-        read_bytes += rc;
+-        if (nfds_t > 0) {
+-            if (nfds + nfds_t > max_fds) {
++
++        if (nfds > 0) {
++            if (vmsg->fd_num + nfds > max_fds) {
+                 error_report("A maximum of %zu fds are allowed, "
+                              "however got %zu fds now",
+-                             max_fds, nfds + nfds_t);
++                             max_fds, vmsg->fd_num + nfds);
++                g_free(fds);
+                 goto fail;
+             }
+-            memcpy(vmsg->fds + nfds, fds_t,
+-                   nfds_t *sizeof(vmsg->fds[0]));
+-            nfds += nfds_t;
+-            g_free(fds_t);
++            memcpy(vmsg->fds + vmsg->fd_num, fds, nfds * sizeof(vmsg->fds[0]));
++            vmsg->fd_num += nfds;
++            g_free(fds);
+         }
+-        if (read_bytes == VHOST_USER_HDR_SIZE || rc == 0) {
+-            break;
++
++        if (rc == 0) { /* socket closed */
++            goto fail;
+         }
+-        iov.iov_base = (char *)vmsg + read_bytes;
+-        iov.iov_len = VHOST_USER_HDR_SIZE - read_bytes;
+-    } while (true);
+-    vmsg->fd_num = nfds;
++        iov.iov_base += rc;
++        iov.iov_len -= rc;
++        read_bytes += rc;
++    } while (read_bytes != VHOST_USER_HDR_SIZE);
++
+     /* qio_channel_readv_full will make socket fds blocking, unblock them */
+     vmsg_unblock_fds(vmsg);
+     if (vmsg->size > sizeof(vmsg->payload)) {
+--
+.26.2

-New patch
+[PULL v2 14/28] util/vhost-user-server: check EOF when reading payload
+Unexpected EOF is an error that must be reported.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-9-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.c | 6 ++++--
+file changed, 4 insertions(+), 2 deletions(-)
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
+     };
+     if (vmsg->size) {
+         rc = qio_channel_readv_all_eof(ioc, &iov_payload, 1, &local_err);
+-        if (rc == -1) {
+-            error_report_err(local_err);
++        if (rc != 1) {
++            if (local_err) {
++                error_report_err(local_err);
++            }
+             goto fail;
+         }
+     }
+--
+.26.2

-New patch
+[PULL v2 15/28] util/vhost-user-server: rework vu_client_trip() coroutine lifecycle
+The vu_client_trip() coroutine is leaked during AioContext switching. It
+is also unsafe to destroy the vu_dev in panic_cb() since its callers
+still access it in some cases.
+Rework the lifecycle to solve these safety issues.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-10-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ util/vhost-user-server.h             |  29 ++--
+ block/export/vhost-user-blk-server.c |   9 +-
+ util/vhost-user-server.c             | 245 +++++++++++++++------------
+files changed, 155 insertions(+), 128 deletions(-)
+diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.h
++++ b/util/vhost-user-server.h
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "standard-headers/linux/virtio_blk.h"
++/* A kick fd that we monitor on behalf of libvhost-user */
+ typedef struct VuFdWatch {
+     VuDev *vu_dev;
+     int fd; /*kick fd*/
+     void *pvt;
+     vu_watch_cb cb;
+-    bool processing;
+     QTAILQ_ENTRY(VuFdWatch) next;
+ } VuFdWatch;
+-typedef struct VuServer VuServer;
+-
+-struct VuServer {
++/**
++ * VuServer:
++ * A vhost-user server instance with user-defined VuDevIface callbacks.
++ * Vhost-user device backends can be implemented using VuServer. VuDevIface
++ * callbacks and virtqueue kicks run in the given AioContext.
++ */
++typedef struct {
+     QIONetListener *listener;
++    QEMUBH *restart_listener_bh;
+     AioContext *ctx;
+     int max_queues;
+     const VuDevIface *vu_iface;
++
++    /* Protected by ctx lock */
+     VuDev vu_dev;
+     QIOChannel *ioc; /* The I/O channel with the client */
+     QIOChannelSocket *sioc; /* The underlying data channel with the client */
+-    /* IOChannel for fd provided via VHOST_USER_SET_SLAVE_REQ_FD */
+-    QIOChannel *ioc_slave;
+-    QIOChannelSocket *sioc_slave;
+-    Coroutine *co_trip; /* coroutine for processing VhostUserMsg */
+     QTAILQ_HEAD(, VuFdWatch) vu_fd_watches;
+-    /* restart coroutine co_trip if AIOContext is changed */
+-    bool aio_context_changed;
+-    bool processing_msg;
+-};
++
++    Coroutine *co_trip; /* coroutine for processing VhostUserMsg */
++} VuServer;
+ bool vhost_user_server_start(VuServer *server,
+                              SocketAddress *unix_socket,
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+ void vhost_user_server_stop(VuServer *server);
+-void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx);
++void vhost_user_server_attach_aio_context(VuServer *server, AioContext *ctx);
++void vhost_user_server_detach_aio_context(VuServer *server);
+ #endif /* VHOST_USER_SERVER_H */
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@ static const VuDevIface vu_block_iface = {
+ static void blk_aio_attached(AioContext *ctx, void *opaque)
+ {
+     VuBlockDev *vub_dev = opaque;
+-    aio_context_acquire(ctx);
+-    vhost_user_server_set_aio_context(&vub_dev->vu_server, ctx);
+-    aio_context_release(ctx);
++    vhost_user_server_attach_aio_context(&vub_dev->vu_server, ctx);
+ }
+ static void blk_aio_detach(void *opaque)
+ {
+     VuBlockDev *vub_dev = opaque;
+-    AioContext *ctx = vub_dev->vu_server.ctx;
+-    aio_context_acquire(ctx);
+-    vhost_user_server_set_aio_context(&vub_dev->vu_server, NULL);
+-    aio_context_release(ctx);
++    vhost_user_server_detach_aio_context(&vub_dev->vu_server);
+ }
+ static void
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+ #include "qemu/main-loop.h"
++#include "block/aio-wait.h"
+ #include "vhost-user-server.h"
++/*
++ * Theory of operation:
++ *
++ * VuServer is started and stopped by vhost_user_server_start() and
++ * vhost_user_server_stop() from the main loop thread. Starting the server
++ * opens a vhost-user UNIX domain socket and listens for incoming connections.
++ * Only one connection is allowed at a time.
++ *
++ * The connection is handled by the vu_client_trip() coroutine in the
++ * VuServer->ctx AioContext. The coroutine consists of a vu_dispatch() loop
++ * where libvhost-user calls vu_message_read() to receive the next vhost-user
++ * protocol messages over the UNIX domain socket.
++ *
++ * When virtqueues are set up libvhost-user calls set_watch() to monitor kick
++ * fds. These fds are also handled in the VuServer->ctx AioContext.
++ *
++ * Both vu_client_trip() and kick fd monitoring can be stopped by shutting down
++ * the socket connection. Shutting down the socket connection causes
++ * vu_message_read() to fail since no more data can be received from the socket.
++ * After vu_dispatch() fails, vu_client_trip() calls vu_deinit() to stop
++ * libvhost-user before terminating the coroutine. vu_deinit() calls
++ * remove_watch() to stop monitoring kick fds and this stops virtqueue
++ * processing.
++ *
++ * When vu_client_trip() has finished cleaning up it schedules a BH in the main
++ * loop thread to accept the next client connection.
++ *
++ * When libvhost-user detects an error it calls panic_cb() and sets the
++ * dev->broken flag. Both vu_client_trip() and kick fd processing stop when
++ * the dev->broken flag is set.
++ *
++ * It is possible to switch AioContexts using
++ * vhost_user_server_detach_aio_context() and
++ * vhost_user_server_attach_aio_context(). They stop monitoring fds in the old
++ * AioContext and resume monitoring in the new AioContext. The vu_client_trip()
++ * coroutine remains in a yielded state during the switch. This is made
++ * possible by QIOChannel's support for spurious coroutine re-entry in
++ * qio_channel_yield(). The coroutine will restart I/O when re-entered from the
++ * new AioContext.
++ */
++
+ static void vmsg_close_fds(VhostUserMsg *vmsg)
+ {
+     int i;
+@@ -XXX,XX +XXX,XX @@ static void vmsg_unblock_fds(VhostUserMsg *vmsg)
+     }
+ }
+-static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
+-                      gpointer opaque);
+-
+-static void close_client(VuServer *server)
+-{
+-    /*
+-     * Before closing the client
+-     *
+-     * 1. Let vu_client_trip stop processing new vhost-user msg
+-     *
+-     * 2. remove kick_handler
+-     *
+-     * 3. wait for the kick handler to be finished
+-     *
+-     * 4. wait for the current vhost-user msg to be finished processing
+-     */
+-
+-    QIOChannelSocket *sioc = server->sioc;
+-    /* When this is set vu_client_trip will stop new processing vhost-user message */
+-    server->sioc = NULL;
+-
+-    while (server->processing_msg) {
+-        if (server->ioc->read_coroutine) {
+-            server->ioc->read_coroutine = NULL;
+-            qio_channel_set_aio_fd_handler(server->ioc, server->ioc->ctx, NULL,
+-                                           NULL, server->ioc);
+-            server->processing_msg = false;
+-        }
+-    }
+-
+-    vu_deinit(&server->vu_dev);
+-
+-    /* vu_deinit() should have called remove_watch() */
+-    assert(QTAILQ_EMPTY(&server->vu_fd_watches));
+-
+-    object_unref(OBJECT(sioc));
+-    object_unref(OBJECT(server->ioc));
+-}
+-
+ static void panic_cb(VuDev *vu_dev, const char *buf)
+ {
+-    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+-
+-    /* avoid while loop in close_client */
+-    server->processing_msg = false;
+-
+-    if (buf) {
+-        error_report("vu_panic: %s", buf);
+-    }
+-
+-    if (server->sioc) {
+-        close_client(server);
+-    }
+-
+-    /*
+-     * Set the callback function for network listener so another
+-     * vhost-user client can connect to this server
+-     */
+-    qio_net_listener_set_client_func(server->listener,
+-                                     vu_accept,
+-                                     server,
+-                                     NULL);
++    error_report("vu_panic: %s", buf);
+ }
+ static bool coroutine_fn
+@@ -XXX,XX +XXX,XX @@ fail:
+     return false;
+ }
+-
+-static void vu_client_start(VuServer *server);
+ static coroutine_fn void vu_client_trip(void *opaque)
+ {
+     VuServer *server = opaque;
++    VuDev *vu_dev = &server->vu_dev;
+-    while (!server->aio_context_changed && server->sioc) {
+-        server->processing_msg = true;
+-        vu_dispatch(&server->vu_dev);
+-        server->processing_msg = false;
++    while (!vu_dev->broken && vu_dispatch(vu_dev)) {
++        /* Keep running */
+     }
+-    if (server->aio_context_changed && server->sioc) {
+-        server->aio_context_changed = false;
+-        vu_client_start(server);
+-    }
+-}
++    vu_deinit(vu_dev);
++
++    /* vu_deinit() should have called remove_watch() */
++    assert(QTAILQ_EMPTY(&server->vu_fd_watches));
++
++    object_unref(OBJECT(server->sioc));
++    server->sioc = NULL;
+-static void vu_client_start(VuServer *server)
+-{
+-    server->co_trip = qemu_coroutine_create(vu_client_trip, server);
+-    aio_co_enter(server->ctx, server->co_trip);
++    object_unref(OBJECT(server->ioc));
++    server->ioc = NULL;
++
++    server->co_trip = NULL;
++    if (server->restart_listener_bh) {
++        qemu_bh_schedule(server->restart_listener_bh);
++    }
++    aio_wait_kick();
+ }
+ /*
+@@ -XXX,XX +XXX,XX @@ static void vu_client_start(VuServer *server)
+ static void kick_handler(void *opaque)
+ {
+     VuFdWatch *vu_fd_watch = opaque;
+-    vu_fd_watch->processing = true;
+-    vu_fd_watch->cb(vu_fd_watch->vu_dev, 0, vu_fd_watch->pvt);
+-    vu_fd_watch->processing = false;
++    VuDev *vu_dev = vu_fd_watch->vu_dev;
++
++    vu_fd_watch->cb(vu_dev, 0, vu_fd_watch->pvt);
++
++    /* Stop vu_client_trip() if an error occurred in vu_fd_watch->cb() */
++    if (vu_dev->broken) {
++        VuServer *server = container_of(vu_dev, VuServer, vu_dev);
++
++        qio_channel_shutdown(server->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
++    }
+ }
+-
+ static VuFdWatch *find_vu_fd_watch(VuServer *server, int fd)
+ {
+@@ -XXX,XX +XXX,XX @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
+     qio_channel_set_name(QIO_CHANNEL(sioc), "vhost-user client");
+     server->ioc = QIO_CHANNEL(sioc);
+     object_ref(OBJECT(server->ioc));
+-    qio_channel_attach_aio_context(server->ioc, server->ctx);
++
++    /* TODO vu_message_write() spins if non-blocking! */
+     qio_channel_set_blocking(server->ioc, false, NULL);
+-    vu_client_start(server);
++
++    server->co_trip = qemu_coroutine_create(vu_client_trip, server);
++
++    aio_context_acquire(server->ctx);
++    vhost_user_server_attach_aio_context(server, server->ctx);
++    aio_context_release(server->ctx);
+ }
+-
+ void vhost_user_server_stop(VuServer *server)
+ {
++    aio_context_acquire(server->ctx);
++
++    qemu_bh_delete(server->restart_listener_bh);
++    server->restart_listener_bh = NULL;
++
+     if (server->sioc) {
+-        close_client(server);
++        VuFdWatch *vu_fd_watch;
++
++        QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) {
++            aio_set_fd_handler(server->ctx, vu_fd_watch->fd, true,
++                               NULL, NULL, NULL, vu_fd_watch);
++        }
++
++        qio_channel_shutdown(server->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
++
++        AIO_WAIT_WHILE(server->ctx, server->co_trip);
+     }
++    aio_context_release(server->ctx);
++
+     if (server->listener) {
+         qio_net_listener_disconnect(server->listener);
+         object_unref(OBJECT(server->listener));
+     }
++}
++
++/*
++ * Allow the next client to connect to the server. Called from a BH in the main
++ * loop.
++ */
++static void restart_listener_bh(void *opaque)
++{
++    VuServer *server = opaque;
++    qio_net_listener_set_client_func(server->listener, vu_accept, server,
++                                     NULL);
+ }
+-void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx)
++/* Called with ctx acquired */
++void vhost_user_server_attach_aio_context(VuServer *server, AioContext *ctx)
+ {
+-    VuFdWatch *vu_fd_watch, *next;
+-    void *opaque = NULL;
+-    IOHandler *io_read = NULL;
+-    bool attach;
++    VuFdWatch *vu_fd_watch;
+-    server->ctx = ctx ? ctx : qemu_get_aio_context();
++    server->ctx = ctx;
+     if (!server->sioc) {
+-        /* not yet serving any client*/
+         return;
+     }
+-    if (ctx) {
+-        qio_channel_attach_aio_context(server->ioc, ctx);
+-        server->aio_context_changed = true;
+-        io_read = kick_handler;
+-        attach = true;
+-    } else {
++    qio_channel_attach_aio_context(server->ioc, ctx);
++
++    QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) {
++        aio_set_fd_handler(ctx, vu_fd_watch->fd, true, kick_handler, NULL,
++                           NULL, vu_fd_watch);
++    }
++
++    aio_co_schedule(ctx, server->co_trip);
++}
++
++/* Called with server->ctx acquired */
++void vhost_user_server_detach_aio_context(VuServer *server)
++{
++    if (server->sioc) {
++        VuFdWatch *vu_fd_watch;
++
++        QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) {
++            aio_set_fd_handler(server->ctx, vu_fd_watch->fd, true,
++                               NULL, NULL, NULL, vu_fd_watch);
++        }
++
+         qio_channel_detach_aio_context(server->ioc);
+-        /* server->ioc->ctx keeps the old AioConext */
+-        ctx = server->ioc->ctx;
+-        attach = false;
+     }
+-    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+-        if (vu_fd_watch->cb) {
+-            opaque = attach ? vu_fd_watch : NULL;
+-            aio_set_fd_handler(ctx, vu_fd_watch->fd, true,
+-                               io_read, NULL, NULL,
+-                               opaque);
+-        }
+-    }
++    server->ctx = NULL;
+ }
+-
+ bool vhost_user_server_start(VuServer *server,
+                              SocketAddress *socket_addr,
+                              AioContext *ctx,
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+                              const VuDevIface *vu_iface,
+                              Error **errp)
+ {
++    QEMUBH *bh;
+     QIONetListener *listener = qio_net_listener_new();
+     if (qio_net_listener_open_sync(listener, socket_addr, 1,
+                                    errp) < 0) {
+@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
+         return false;
+     }
++    bh = qemu_bh_new(restart_listener_bh, server);
++
+     /* zero out unspecified fields */
+     *server = (VuServer) {
+         .listener              = listener,
++        .restart_listener_bh   = bh,
+         .vu_iface              = vu_iface,
+         .max_queues            = max_queues,
+         .ctx                   = ctx,
+--
+.26.2

-New patch
+[PULL v2 16/28] block/export: report flush errors
+Propagate the flush return value since errors are possible.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-11-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/export/vhost-user-blk-server.c | 11 +++++++----
+file changed, 7 insertions(+), 4 deletions(-)
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
+     return -EINVAL;
+ }
+-static void coroutine_fn vu_block_flush(VuBlockReq *req)
++static int coroutine_fn vu_block_flush(VuBlockReq *req)
+ {
+     VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
+     BlockBackend *backend = vdev_blk->backend;
+-    blk_co_flush(backend);
++    return blk_co_flush(backend);
+ }
+ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
+         break;
+     }
+     case VIRTIO_BLK_T_FLUSH:
+-        vu_block_flush(req);
+-        req->in->status = VIRTIO_BLK_S_OK;
++        if (vu_block_flush(req) == 0) {
++            req->in->status = VIRTIO_BLK_S_OK;
++        } else {
++            req->in->status = VIRTIO_BLK_S_IOERR;
++        }
+         break;
+     case VIRTIO_BLK_T_GET_ID: {
+         size_t size = MIN(iov_size(&elem->in_sg[0], in_num),
+--
+.26.2

-New patch
+[PULL v2 17/28] block/export: convert vhost-user-blk server to block export API
+Use the new QAPI block exports API instead of defining our own QOM
 objects.
 This is a large change because the lifecycle of VuBlockDev needs to
 follow BlockExportDriver. QOM properties are replaced by QAPI options
 objects.
 VuBlockDev is renamed VuBlkExport and contains a BlockExport field.
 Several fields can be dropped since BlockExport already has equivalents.
 The file names and meson build integration will be adjusted in a future
 patch. libvhost-user should probably be built as a static library that
 is linked into QEMU instead of as a .c file that results in duplicate
 compilation.
 The new command-line syntax is:
   $ qemu-storage-daemon \
       --blockdev file,node-name=drive0,filename=test.img \
       --export vhost-user-blk,node-name=drive0,id=export0,unix-socket=/tmp/vhost-user-blk.sock
 Note that unix-socket is optional because we may wish to accept chardevs
 too in the future.
 Markus noted that supported address families are not explicit in the
 QAPI schema. It is unlikely that support for more address families will
 be added since file descriptor passing is required and few address
 families support it. If a new address family needs to be added, then the
 QAPI 'features' syntax can be used to advertize them.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Acked-by: Markus Armbruster <armbru@redhat.com>
 Message-id: 20200924151549.913737-12-stefanha@redhat.com
 [Skip test on big-endian host architectures because this device doesn't
 support them yet (as already mentioned in a code comment).
 --Stefan]
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  qapi/block-export.json               |  21 +-
  block/export/vhost-user-blk-server.h |  23 +-
  block/export/export.c                |   6 +
  block/export/vhost-user-blk-server.c | 452 +++++++--------------------
  util/vhost-user-server.c             |  10 +-
  block/export/meson.build             |   1 +
  block/meson.build                    |   1 -
 files changed, 156 insertions(+), 358 deletions(-)
 diff --git a/qapi/block-export.json b/qapi/block-export.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-export.json
 +++ b/qapi/block-export.json
@@ -XXX,XX +XXX,XX @@
    'data': { '*name': 'str', '*description': 'str',
              '*bitmap': 'str' } }
 +##
 +# @BlockExportOptionsVhostUserBlk:
 +#
 +# A vhost-user-blk block export.
 +#
 +# @addr: The vhost-user socket on which to listen. Both 'unix' and 'fd'
 +#        SocketAddress types are supported. Passed fds must be UNIX domain
 +#        sockets.
 +# @logical-block-size: Logical block size in bytes. Defaults to 512 bytes.
 +#
 +# Since: 5.2
 +##
 +{ 'struct': 'BlockExportOptionsVhostUserBlk',
 +  'data': { 'addr': 'SocketAddress', '*logical-block-size': 'size' } }
 +
  ##
  # @NbdServerAddOptions:
  #
@@ -XXX,XX +XXX,XX @@
  # An enumeration of block export types
  #
  # @nbd: NBD export
 +# @vhost-user-blk: vhost-user-blk export (since 5.2)
  #
  # Since: 4.2
  ##
  { 'enum': 'BlockExportType',
 -  'data': [ 'nbd' ] }
 +  'data': [ 'nbd', 'vhost-user-blk' ] }
  ##
  # @BlockExportOptions:
@@ -XXX,XX +XXX,XX @@
              '*writethrough': 'bool' },
    'discriminator': 'type',
    'data': {
 -      'nbd': 'BlockExportOptionsNbd'
 +      'nbd': 'BlockExportOptionsNbd',
 +      'vhost-user-blk': 'BlockExportOptionsVhostUserBlk'
     } }
  ##
 diff --git a/block/export/vhost-user-blk-server.h b/block/export/vhost-user-blk-server.h
 index XXXXXXX..XXXXXXX 100644
 --- a/block/export/vhost-user-blk-server.h
 +++ b/block/export/vhost-user-blk-server.h
@@ -XXX,XX +XXX,XX @@
  #ifndef VHOST_USER_BLK_SERVER_H
  #define VHOST_USER_BLK_SERVER_H
 -#include "util/vhost-user-server.h"
 -typedef struct VuBlockDev VuBlockDev;
 -#define TYPE_VHOST_USER_BLK_SERVER "vhost-user-blk-server"
 -#define VHOST_USER_BLK_SERVER(obj) \
 -   OBJECT_CHECK(VuBlockDev, obj, TYPE_VHOST_USER_BLK_SERVER)
 +#include "block/export.h"
 -/* vhost user block device */
 -struct VuBlockDev {
 -    Object parent_obj;
 -    char *node_name;
 -    SocketAddress *addr;
 -    AioContext *ctx;
 -    VuServer vu_server;
 -    bool running;
 -    uint32_t blk_size;
 -    BlockBackend *backend;
 -    QIOChannelSocket *sioc;
 -    QTAILQ_ENTRY(VuBlockDev) next;
 -    struct virtio_blk_config blkcfg;
 -    bool writable;
 -};
 +/* For block/export/export.c */
 +extern const BlockExportDriver blk_exp_vhost_user_blk;
  #endif /* VHOST_USER_BLK_SERVER_H */
 diff --git a/block/export/export.c b/block/export/export.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/export/export.c
 +++ b/block/export/export.c
@@ -XXX,XX +XXX,XX @@
  #include "sysemu/block-backend.h"
  #include "block/export.h"
  #include "block/nbd.h"
 +#if CONFIG_LINUX
 +#include "block/export/vhost-user-blk-server.h"
 +#endif
  #include "qapi/error.h"
  #include "qapi/qapi-commands-block-export.h"
  #include "qapi/qapi-events-block-export.h"
@@ -XXX,XX +XXX,XX @@
  static const BlockExportDriver *blk_exp_drivers[] = {
      &blk_exp_nbd,
 +#if CONFIG_LINUX
 +    &blk_exp_vhost_user_blk,
 +#endif
  };
  /* Only accessed from the main thread */
 diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/export/vhost-user-blk-server.c
 +++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
  #include "block/block.h"
 +#include "contrib/libvhost-user/libvhost-user.h"
 +#include "standard-headers/linux/virtio_blk.h"
 +#include "util/vhost-user-server.h"
  #include "vhost-user-blk-server.h"
  #include "qapi/error.h"
  #include "qom/object_interfaces.h"
@@ -XXX,XX +XXX,XX @@ struct virtio_blk_inhdr {
      unsigned char status;
  };
 -typedef struct VuBlockReq {
 +typedef struct VuBlkReq {
      VuVirtqElement elem;
      int64_t sector_num;
      size_t size;
@@ -XXX,XX +XXX,XX @@ typedef struct VuBlockReq {
      struct virtio_blk_outhdr out;
      VuServer *server;
      struct VuVirtq *vq;
 -} VuBlockReq;
 +} VuBlkReq;
 -static void vu_block_req_complete(VuBlockReq *req)
 +/* vhost user block device */
 +typedef struct {
 +    BlockExport export;
 +    VuServer vu_server;
 +    uint32_t blk_size;
 +    QIOChannelSocket *sioc;
 +    struct virtio_blk_config blkcfg;
 +    bool writable;
 +} VuBlkExport;
 +
 +static void vu_blk_req_complete(VuBlkReq *req)
  {
      VuDev *vu_dev = &req->server->vu_dev;
@@ -XXX,XX +XXX,XX @@ static void vu_block_req_complete(VuBlockReq *req)
      free(req);
  }
 -static VuBlockDev *get_vu_block_device_by_server(VuServer *server)
 -{
 -    return container_of(server, VuBlockDev, vu_server);
 -}
 -
  static int coroutine_fn
 -vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
 -                              uint32_t iovcnt, uint32_t type)
 +vu_blk_discard_write_zeroes(BlockBackend *blk, struct iovec *iov,
 +                            uint32_t iovcnt, uint32_t type)
  {
      struct virtio_blk_discard_write_zeroes desc;
      ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
@@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
          return -EINVAL;
      }
 -    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
      uint64_t range[2] = { le64_to_cpu(desc.sector) << 9,
                            le32_to_cpu(desc.num_sectors) << 9 };
      if (type == VIRTIO_BLK_T_DISCARD) {
 -        if (blk_co_pdiscard(vdev_blk->backend, range[0], range[1]) == 0) {
 +        if (blk_co_pdiscard(blk, range[0], range[1]) == 0) {
              return 0;
          }
      } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) {
 -        if (blk_co_pwrite_zeroes(vdev_blk->backend,
 -                                 range[0], range[1], 0) == 0) {
 +        if (blk_co_pwrite_zeroes(blk, range[0], range[1], 0) == 0) {
              return 0;
          }
      }
@@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
      return -EINVAL;
  }
 -static int coroutine_fn vu_block_flush(VuBlockReq *req)
 +static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
  {
 -    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
 -    BlockBackend *backend = vdev_blk->backend;
 -    return blk_co_flush(backend);
 -}
 -
 -static void coroutine_fn vu_block_virtio_process_req(void *opaque)
 -{
 -    VuBlockReq *req = opaque;
 +    VuBlkReq *req = opaque;
      VuServer *server = req->server;
      VuVirtqElement *elem = &req->elem;
      uint32_t type;
 -    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
 -    BlockBackend *backend = vdev_blk->backend;
 +    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
 +    BlockBackend *blk = vexp->export.blk;
      struct iovec *in_iov = elem->in_sg;
      struct iovec *out_iov = elem->out_sg;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
          bool is_write = type & VIRTIO_BLK_T_OUT;
          req->sector_num = le64_to_cpu(req->out.sector);
 -        int64_t offset = req->sector_num * vdev_blk->blk_size;
 +        if (is_write && !vexp->writable) {
 +            req->in->status = VIRTIO_BLK_S_IOERR;
 +            break;
 +        }
 +
 +        int64_t offset = req->sector_num * vexp->blk_size;
          QEMUIOVector qiov;
          if (is_write) {
              qemu_iovec_init_external(&qiov, out_iov, out_num);
 -            ret = blk_co_pwritev(backend, offset, qiov.size,
 -                                 &qiov, 0);
 +            ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0);
          } else {
              qemu_iovec_init_external(&qiov, in_iov, in_num);
 -            ret = blk_co_preadv(backend, offset, qiov.size,
 -                                &qiov, 0);
 +            ret = blk_co_preadv(blk, offset, qiov.size, &qiov, 0);
          }
          if (ret >= 0) {
              req->in->status = VIRTIO_BLK_S_OK;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
          break;
      }
      case VIRTIO_BLK_T_FLUSH:
 -        if (vu_block_flush(req) == 0) {
 +        if (blk_co_flush(blk) == 0) {
              req->in->status = VIRTIO_BLK_S_OK;
          } else {
              req->in->status = VIRTIO_BLK_S_IOERR;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
      case VIRTIO_BLK_T_DISCARD:
      case VIRTIO_BLK_T_WRITE_ZEROES: {
          int rc;
 -        rc = vu_block_discard_write_zeroes(req, &elem->out_sg[1],
 -                                           out_num, type);
 +
 +        if (!vexp->writable) {
 +            req->in->status = VIRTIO_BLK_S_IOERR;
 +            break;
 +        }
 +
 +        rc = vu_blk_discard_write_zeroes(blk, &elem->out_sg[1], out_num, type);
          if (rc == 0) {
              req->in->status = VIRTIO_BLK_S_OK;
          } else {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
          break;
      }
 -    vu_block_req_complete(req);
 +    vu_blk_req_complete(req);
      return;
  err:
 -    free(elem);
 +    free(req);
  }
 -static void vu_block_process_vq(VuDev *vu_dev, int idx)
 +static void vu_blk_process_vq(VuDev *vu_dev, int idx)
  {
      VuServer *server = container_of(vu_dev, VuServer, vu_dev);
      VuVirtq *vq = vu_get_queue(vu_dev, idx);
      while (1) {
 -        VuBlockReq *req;
 +        VuBlkReq *req;
 -        req = vu_queue_pop(vu_dev, vq, sizeof(VuBlockReq));
 +        req = vu_queue_pop(vu_dev, vq, sizeof(VuBlkReq));
          if (!req) {
              break;
          }
@@ -XXX,XX +XXX,XX @@ static void vu_block_process_vq(VuDev *vu_dev, int idx)
          req->vq = vq;
          Coroutine *co =
 -            qemu_coroutine_create(vu_block_virtio_process_req, req);
 +            qemu_coroutine_create(vu_blk_virtio_process_req, req);
          qemu_coroutine_enter(co);
      }
  }
 -static void vu_block_queue_set_started(VuDev *vu_dev, int idx, bool started)
 +static void vu_blk_queue_set_started(VuDev *vu_dev, int idx, bool started)
  {
      VuVirtq *vq;
      assert(vu_dev);
      vq = vu_get_queue(vu_dev, idx);
 -    vu_set_queue_handler(vu_dev, vq, started ? vu_block_process_vq : NULL);
 +    vu_set_queue_handler(vu_dev, vq, started ? vu_blk_process_vq : NULL);
  }
 -static uint64_t vu_block_get_features(VuDev *dev)
 +static uint64_t vu_blk_get_features(VuDev *dev)
  {
      uint64_t features;
      VuServer *server = container_of(dev, VuServer, vu_dev);
 -    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
 +    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
      features = 1ull << VIRTIO_BLK_F_SIZE_MAX |
 ull << VIRTIO_BLK_F_SEG_MAX |
 ull << VIRTIO_BLK_F_TOPOLOGY |
@@ -XXX,XX +XXX,XX @@ static uint64_t vu_block_get_features(VuDev *dev)
 ull << VIRTIO_RING_F_EVENT_IDX |
 ull << VHOST_USER_F_PROTOCOL_FEATURES;
 -    if (!vdev_blk->writable) {
 +    if (!vexp->writable) {
          features |= 1ull << VIRTIO_BLK_F_RO;
      }
      return features;
  }
 -static uint64_t vu_block_get_protocol_features(VuDev *dev)
 +static uint64_t vu_blk_get_protocol_features(VuDev *dev)
  {
      return 1ull << VHOST_USER_PROTOCOL_F_CONFIG |
 ull << VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD;
  }
  static int
 -vu_block_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
 +vu_blk_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
  {
 +    /* TODO blkcfg must be little-endian for VIRTIO 1.0 */
      VuServer *server = container_of(vu_dev, VuServer, vu_dev);
 -    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
 -    memcpy(config, &vdev_blk->blkcfg, len);
 -
 +    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
 +    memcpy(config, &vexp->blkcfg, len);
      return 0;
  }
  static int
 -vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
 +vu_blk_set_config(VuDev *vu_dev, const uint8_t *data,
                      uint32_t offset, uint32_t size, uint32_t flags)
  {
      VuServer *server = container_of(vu_dev, VuServer, vu_dev);
 -    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
 +    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
      uint8_t wce;
      /* don't support live migration */
@@ -XXX,XX +XXX,XX @@ vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
      }
      wce = *data;
 -    vdev_blk->blkcfg.wce = wce;
 -    blk_set_enable_write_cache(vdev_blk->backend, wce);
 +    vexp->blkcfg.wce = wce;
 +    blk_set_enable_write_cache(vexp->export.blk, wce);
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
   * of vu_process_message.
   *
   */
 -static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
 +static int vu_blk_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
  {
      if (vmsg->request == VHOST_USER_NONE) {
          dev->panic(dev, "disconnect");
@@ -XXX,XX +XXX,XX @@ static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
      return false;
  }
 -static const VuDevIface vu_block_iface = {
 -    .get_features          = vu_block_get_features,
 -    .queue_set_started     = vu_block_queue_set_started,
 -    .get_protocol_features = vu_block_get_protocol_features,
 -    .get_config            = vu_block_get_config,
 -    .set_config            = vu_block_set_config,
 -    .process_msg           = vu_block_process_msg,
 +static const VuDevIface vu_blk_iface = {
 +    .get_features          = vu_blk_get_features,
 +    .queue_set_started     = vu_blk_queue_set_started,
 +    .get_protocol_features = vu_blk_get_protocol_features,
 +    .get_config            = vu_blk_get_config,
 +    .set_config            = vu_blk_set_config,
 +    .process_msg           = vu_blk_process_msg,
  };
  static void blk_aio_attached(AioContext *ctx, void *opaque)
  {
 -    VuBlockDev *vub_dev = opaque;
 -    vhost_user_server_attach_aio_context(&vub_dev->vu_server, ctx);
 +    VuBlkExport *vexp = opaque;
 +    vhost_user_server_attach_aio_context(&vexp->vu_server, ctx);
  }
  static void blk_aio_detach(void *opaque)
  {
 -    VuBlockDev *vub_dev = opaque;
 -    vhost_user_server_detach_aio_context(&vub_dev->vu_server);
 +    VuBlkExport *vexp = opaque;
 +    vhost_user_server_detach_aio_context(&vexp->vu_server);
  }
  static void
 -vu_block_initialize_config(BlockDriverState *bs,
 +vu_blk_initialize_config(BlockDriverState *bs,
                             struct virtio_blk_config *config, uint32_t blk_size)
  {
      config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
@@ -XXX,XX +XXX,XX @@ vu_block_initialize_config(BlockDriverState *bs,
      config->max_write_zeroes_seg = 1;
  }
 -static VuBlockDev *vu_block_init(VuBlockDev *vu_block_device, Error **errp)
 +static void vu_blk_exp_request_shutdown(BlockExport *exp)
  {
 +    VuBlkExport *vexp = container_of(exp, VuBlkExport, export);
 -    BlockBackend *blk;
 -    Error *local_error = NULL;
 -    const char *node_name = vu_block_device->node_name;
 -    bool writable = vu_block_device->writable;
 -    uint64_t perm = BLK_PERM_CONSISTENT_READ;
 -    int ret;
 -
 -    AioContext *ctx;
 -
 -    BlockDriverState *bs = bdrv_lookup_bs(node_name, node_name, &local_error);
 -
 -    if (!bs) {
 -        error_propagate(errp, local_error);
 -        return NULL;
 -    }
 -
 -    if (bdrv_is_read_only(bs)) {
 -        writable = false;
 -    }
 -
 -    if (writable) {
 -        perm |= BLK_PERM_WRITE;
 -    }
 -
 -    ctx = bdrv_get_aio_context(bs);
 -    aio_context_acquire(ctx);
 -    bdrv_invalidate_cache(bs, NULL);
 -    aio_context_release(ctx);
 -
 -    /*
 -     * Don't allow resize while the vhost user server is running,
 -     * otherwise we don't care what happens with the node.
 -     */
 -    blk = blk_new(bdrv_get_aio_context(bs), perm,
 -                  BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED |
 -                  BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD);
 -    ret = blk_insert_bs(blk, bs, errp);
 -
 -    if (ret < 0) {
 -        goto fail;
 -    }
 -
 -    blk_set_enable_write_cache(blk, false);
 -
 -    blk_set_allow_aio_context_change(blk, true);
 -
 -    vu_block_device->blkcfg.wce = 0;
 -    vu_block_device->backend = blk;
 -    if (!vu_block_device->blk_size) {
 -        vu_block_device->blk_size = BDRV_SECTOR_SIZE;
 -    }
 -    vu_block_device->blkcfg.blk_size = vu_block_device->blk_size;
 -    blk_set_guest_block_size(blk, vu_block_device->blk_size);
 -    vu_block_initialize_config(bs, &vu_block_device->blkcfg,
 -                                   vu_block_device->blk_size);
 -    return vu_block_device;
 -
 -fail:
 -    blk_unref(blk);
 -    return NULL;
 -}
 -
 -static void vu_block_deinit(VuBlockDev *vu_block_device)
 -{
 -    if (vu_block_device->backend) {
 -        blk_remove_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
 -                                        blk_aio_detach, vu_block_device);
 -    }
 -
 -    blk_unref(vu_block_device->backend);
 -}
 -
 -static void vhost_user_blk_server_stop(VuBlockDev *vu_block_device)
 -{
 -    vhost_user_server_stop(&vu_block_device->vu_server);
 -    vu_block_deinit(vu_block_device);
 -}
 -
 -static void vhost_user_blk_server_start(VuBlockDev *vu_block_device,
 -                                        Error **errp)
 -{
 -    AioContext *ctx;
 -    SocketAddress *addr = vu_block_device->addr;
 -
 -    if (!vu_block_init(vu_block_device, errp)) {
 -        return;
 -    }
 -
 -    ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend));
 -
 -    if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx,
 -                                 VHOST_USER_BLK_MAX_QUEUES, &vu_block_iface,
 -                                 errp)) {
 -        goto error;
 -    }
 -
 -    blk_add_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
 -                                 blk_aio_detach, vu_block_device);
 -    vu_block_device->running = true;
 -    return;
 -
 - error:
 -    vu_block_deinit(vu_block_device);
 -}
 -
 -static bool vu_prop_modifiable(VuBlockDev *vus, Error **errp)
 -{
 -    if (vus->running) {
 -            error_setg(errp, "The property can't be modified "
 -                       "while the server is running");
 -            return false;
 -    }
 -    return true;
 -}
 -
 -static void vu_set_node_name(Object *obj, const char *value, Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -
 -    if (!vu_prop_modifiable(vus, errp)) {
 -        return;
 -    }
 -
 -    if (vus->node_name) {
 -        g_free(vus->node_name);
 -    }
 -
 -    vus->node_name = g_strdup(value);
 -}
 -
 -static char *vu_get_node_name(Object *obj, Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -    return g_strdup(vus->node_name);
 -}
 -
 -static void free_socket_addr(SocketAddress *addr)
 -{
 -        g_free(addr->u.q_unix.path);
 -        g_free(addr);
 -}
 -
 -static void vu_set_unix_socket(Object *obj, const char *value,
 -                               Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -
 -    if (!vu_prop_modifiable(vus, errp)) {
 -        return;
 -    }
 -
 -    if (vus->addr) {
 -        free_socket_addr(vus->addr);
 -    }
 -
 -    SocketAddress *addr = g_new0(SocketAddress, 1);
 -    addr->type = SOCKET_ADDRESS_TYPE_UNIX;
 -    addr->u.q_unix.path = g_strdup(value);
 -    vus->addr = addr;
 +    vhost_user_server_stop(&vexp->vu_server);
  }
 -static char *vu_get_unix_socket(Object *obj, Error **errp)
 +static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
 +                             Error **errp)
  {
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -    return g_strdup(vus->addr->u.q_unix.path);
 -}
 -
 -static bool vu_get_block_writable(Object *obj, Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -    return vus->writable;
 -}
 -
 -static void vu_set_block_writable(Object *obj, bool value, Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -
 -    if (!vu_prop_modifiable(vus, errp)) {
 -            return;
 -    }
 -
 -    vus->writable = value;
 -}
 -
 -static void vu_get_blk_size(Object *obj, Visitor *v, const char *name,
 -                            void *opaque, Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -    uint32_t value = vus->blk_size;
 -
 -    visit_type_uint32(v, name, &value, errp);
 -}
 -
 -static void vu_set_blk_size(Object *obj, Visitor *v, const char *name,
 -                            void *opaque, Error **errp)
 -{
 -    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
 -
 +    VuBlkExport *vexp = container_of(exp, VuBlkExport, export);
 +    BlockExportOptionsVhostUserBlk *vu_opts = &opts->u.vhost_user_blk;
      Error *local_err = NULL;
 -    uint32_t value;
 +    uint64_t logical_block_size;
 -    if (!vu_prop_modifiable(vus, errp)) {
 -            return;
 -    }
 +    vexp->writable = opts->writable;
 +    vexp->blkcfg.wce = 0;
 -    visit_type_uint32(v, name, &value, &local_err);
 -    if (local_err) {
 -        goto out;
 +    if (vu_opts->has_logical_block_size) {
 +        logical_block_size = vu_opts->logical_block_size;
 +    } else {
 +        logical_block_size = BDRV_SECTOR_SIZE;
      }
 -
 -    check_block_size(object_get_typename(obj), name, value, &local_err);
 +    check_block_size(exp->id, "logical-block-size", logical_block_size,
 +                     &local_err);
      if (local_err) {
 -        goto out;
 +        error_propagate(errp, local_err);
 +        return -EINVAL;
 +    }
 +    vexp->blk_size = logical_block_size;
 +    blk_set_guest_block_size(exp->blk, logical_block_size);
 +    vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg,
 +                               logical_block_size);
 +
 +    blk_set_allow_aio_context_change(exp->blk, true);
 +    blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
 +                                 vexp);
 +
 +    if (!vhost_user_server_start(&vexp->vu_server, vu_opts->addr, exp->ctx,
 +                                 VHOST_USER_BLK_MAX_QUEUES, &vu_blk_iface,
 +                                 errp)) {
 +        blk_remove_aio_context_notifier(exp->blk, blk_aio_attached,
 +                                        blk_aio_detach, vexp);
 +        return -EADDRNOTAVAIL;
      }
 -    vus->blk_size = value;
 -
 -out:
 -    error_propagate(errp, local_err);
 -}
 -
 -static void vhost_user_blk_server_instance_finalize(Object *obj)
 -{
 -    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
 -
 -    vhost_user_blk_server_stop(vub);
 -
 -    /*
 -     * Unlike object_property_add_str, object_class_property_add_str
 -     * doesn't have a release method. Thus manual memory freeing is
 -     * needed.
 -     */
 -    free_socket_addr(vub->addr);
 -    g_free(vub->node_name);
 -}
 -
 -static void vhost_user_blk_server_complete(UserCreatable *obj, Error **errp)
 -{
 -    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
 -
 -    vhost_user_blk_server_start(vub, errp);
 +    return 0;
  }
 -static void vhost_user_blk_server_class_init(ObjectClass *klass,
 -                                             void *class_data)
 +static void vu_blk_exp_delete(BlockExport *exp)
  {
 -    UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
 -    ucc->complete = vhost_user_blk_server_complete;
 -
 -    object_class_property_add_bool(klass, "writable",
 -                                   vu_get_block_writable,
 -                                   vu_set_block_writable);
 -
 -    object_class_property_add_str(klass, "node-name",
 -                                  vu_get_node_name,
 -                                  vu_set_node_name);
 -
 -    object_class_property_add_str(klass, "unix-socket",
 -                                  vu_get_unix_socket,
 -                                  vu_set_unix_socket);
 +    VuBlkExport *vexp = container_of(exp, VuBlkExport, export);
 -    object_class_property_add(klass, "logical-block-size", "uint32",
 -                              vu_get_blk_size, vu_set_blk_size,
 -                              NULL, NULL);
 +    blk_remove_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
 +                                    vexp);
  }
 -static const TypeInfo vhost_user_blk_server_info = {
 -    .name = TYPE_VHOST_USER_BLK_SERVER,
 -    .parent = TYPE_OBJECT,
 -    .instance_size = sizeof(VuBlockDev),
 -    .instance_finalize = vhost_user_blk_server_instance_finalize,
 -    .class_init = vhost_user_blk_server_class_init,
 -    .interfaces = (InterfaceInfo[]) {
 -        {TYPE_USER_CREATABLE},
 -        {}
 -    },
 +const BlockExportDriver blk_exp_vhost_user_blk = {
 +    .type               = BLOCK_EXPORT_TYPE_VHOST_USER_BLK,
 +    .instance_size      = sizeof(VuBlkExport),
 +    .create             = vu_blk_exp_create,
 +    .delete             = vu_blk_exp_delete,
 +    .request_shutdown   = vu_blk_exp_request_shutdown,
  };
 -
 -static void vhost_user_blk_server_register_types(void)
 -{
 -    type_register_static(&vhost_user_blk_server_info);
 -}
 -
 -type_init(vhost_user_blk_server_register_types)
 diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/vhost-user-server.c
 +++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
                               Error **errp)
  {
      QEMUBH *bh;
 -    QIONetListener *listener = qio_net_listener_new();
 +    QIONetListener *listener;
 +
 +    if (socket_addr->type != SOCKET_ADDRESS_TYPE_UNIX &&
 +        socket_addr->type != SOCKET_ADDRESS_TYPE_FD) {
 +        error_setg(errp, "Only socket address types 'unix' and 'fd' are supported");
 +        return false;
 +    }
 +
 +    listener = qio_net_listener_new();
      if (qio_net_listener_open_sync(listener, socket_addr, 1,
                                     errp) < 0) {
          object_unref(OBJECT(listener));
 diff --git a/block/export/meson.build b/block/export/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/block/export/meson.build
 +++ b/block/export/meson.build
@@ -1 +1,2 @@
  block_ss.add(files('export.c'))
 +block_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-blk-server.c', '../../contrib/libvhost-user/libvhost-user.c'))
 diff --git a/block/meson.build b/block/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(when: 'CONFIG_WIN32', if_true: files('file-win32.c', 'win32-aio.c')
  block_ss.add(when: 'CONFIG_POSIX', if_true: [files('file-posix.c'), coref, iokit])
  block_ss.add(when: 'CONFIG_LIBISCSI', if_true: files('iscsi-opts.c'))
  block_ss.add(when: 'CONFIG_LINUX', if_true: files('nvme.c'))
 -block_ss.add(when: 'CONFIG_LINUX', if_true: files('export/vhost-user-blk-server.c', '../contrib/libvhost-user/libvhost-user.c'))
  block_ss.add(when: 'CONFIG_REPLICATION', if_true: files('replication.c'))
  block_ss.add(when: 'CONFIG_SHEEPDOG', if_true: files('sheepdog.c'))
  block_ss.add(when: ['CONFIG_LINUX_AIO', libaio], if_true: files('linux-aio.c'))
 --
 .26.2

-New patch
+[PULL v2 18/28] util/vhost-user-server: move header to include/
+Headers used by other subsystems are located in include/. Also add the
+vhost-user-server and vhost-user-blk-server headers to MAINTAINERS.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-13-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ MAINTAINERS                                | 4 +++-
+ {util => include/qemu}/vhost-user-server.h | 0
+ block/export/vhost-user-blk-server.c       | 2 +-
+ util/vhost-user-server.c                   | 2 +-
+files changed, 5 insertions(+), 3 deletions(-)
+ rename {util => include/qemu}/vhost-user-server.h (100%)
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ Vhost-user block device backend server
+ M: Coiby Xu <Coiby.Xu@gmail.com>
+ S: Maintained
+ F: block/export/vhost-user-blk-server.c
+-F: util/vhost-user-server.c
++F: block/export/vhost-user-blk-server.h
++F: include/qemu/vhost-user-server.h
+ F: tests/qtest/libqos/vhost-user-blk.c
++F: util/vhost-user-server.c
+ Replication
+ M: Wen Congyang <wencongyang2@huawei.com>
+diff --git a/util/vhost-user-server.h b/include/qemu/vhost-user-server.h
+similarity index 100%
+rename from util/vhost-user-server.h
+rename to include/qemu/vhost-user-server.h
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@
+ #include "block/block.h"
+ #include "contrib/libvhost-user/libvhost-user.h"
+ #include "standard-headers/linux/virtio_blk.h"
+-#include "util/vhost-user-server.h"
++#include "qemu/vhost-user-server.h"
+ #include "vhost-user-blk-server.h"
+ #include "qapi/error.h"
+ #include "qom/object_interfaces.h"
+diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/vhost-user-server.c
++++ b/util/vhost-user-server.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
+ #include "qemu/main-loop.h"
++#include "qemu/vhost-user-server.h"
+ #include "block/aio-wait.h"
+-#include "vhost-user-server.h"
+ /*
+  * Theory of operation:
+--
+.26.2

-New patch
+[PULL v2 19/28] util/vhost-user-server: use static library in meson.build
+Don't compile contrib/libvhost-user/libvhost-user.c again. Instead build
+the static library once and then reuse it throughout QEMU.
+Also switch from CONFIG_LINUX to CONFIG_VHOST_USER, which is what the
+vhost-user tools (vhost-user-gpu, etc) do.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200924151549.913737-14-stefanha@redhat.com
+[Added CONFIG_LINUX again because libvhost-user doesn't build on macOS.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/export/export.c             | 8 ++++----
+ block/export/meson.build          | 2 +-
+ contrib/libvhost-user/meson.build | 1 +
+ meson.build                       | 6 +++++-
+ util/meson.build                  | 4 +++-
+files changed, 14 insertions(+), 7 deletions(-)
+diff --git a/block/export/export.c b/block/export/export.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/export.c
++++ b/block/export/export.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/block-backend.h"
+ #include "block/export.h"
+ #include "block/nbd.h"
+-#if CONFIG_LINUX
+-#include "block/export/vhost-user-blk-server.h"
+-#endif
+ #include "qapi/error.h"
+ #include "qapi/qapi-commands-block-export.h"
+ #include "qapi/qapi-events-block-export.h"
+ #include "qemu/id.h"
++#ifdef CONFIG_VHOST_USER
++#include "vhost-user-blk-server.h"
++#endif
+ static const BlockExportDriver *blk_exp_drivers[] = {
+     &blk_exp_nbd,
+-#if CONFIG_LINUX
++#ifdef CONFIG_VHOST_USER
+     &blk_exp_vhost_user_blk,
+ #endif
+ };
+diff --git a/block/export/meson.build b/block/export/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/meson.build
++++ b/block/export/meson.build
+@@ -XXX,XX +XXX,XX @@
+ block_ss.add(files('export.c'))
+-block_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-blk-server.c', '../../contrib/libvhost-user/libvhost-user.c'))
++block_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c'))
+diff --git a/contrib/libvhost-user/meson.build b/contrib/libvhost-user/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/contrib/libvhost-user/meson.build
++++ b/contrib/libvhost-user/meson.build
+@@ -XXX,XX +XXX,XX @@
+ libvhost_user = static_library('vhost-user',
+                                files('libvhost-user.c', 'libvhost-user-glib.c'),
+                                build_by_default: false)
++vhost_user = declare_dependency(link_with: libvhost_user)
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ trace_events_subdirs += [
+   'util',
+ ]
++vhost_user = not_found
++if 'CONFIG_VHOST_USER' in config_host
++  subdir('contrib/libvhost-user')
++endif
++
+ subdir('qapi')
+ subdir('qobject')
+ subdir('stubs')
+@@ -XXX,XX +XXX,XX @@ if have_tools
+              install: true)
+   if 'CONFIG_VHOST_USER' in config_host
+-    subdir('contrib/libvhost-user')
+     subdir('contrib/vhost-user-blk')
+     subdir('contrib/vhost-user-gpu')
+     subdir('contrib/vhost-user-input')
+diff --git a/util/meson.build b/util/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/util/meson.build
++++ b/util/meson.build
+@@ -XXX,XX +XXX,XX @@ if have_block
+   util_ss.add(files('main-loop.c'))
+   util_ss.add(files('nvdimm-utils.c'))
+   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
+-  util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c'))
++  util_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: [
++    files('vhost-user-server.c'), vhost_user
++  ])
+   util_ss.add(files('block-helpers.c'))
+   util_ss.add(files('qemu-coroutine-sleep.c'))
+   util_ss.add(files('qemu-co-shared-resource.c'))
+--
+.26.2

-New patch
+[PULL v2 20/28] qemu-storage-daemon: avoid compiling blockdev_ss twice
+Introduce libblkdev.fa to avoid recompiling blockdev_ss twice.
+Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200929125516.186715-3-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ meson.build                | 12 ++++++++++--
+ storage-daemon/meson.build |  3 +--
+files changed, 11 insertions(+), 4 deletions(-)
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ blockdev_ss.add(files(
+ # os-win32.c does not
+ blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))
+ softmmu_ss.add(when: 'CONFIG_WIN32', if_true: [files('os-win32.c')])
+-softmmu_ss.add_all(blockdev_ss)
+ common_ss.add(files('cpus-common.c'))
+@@ -XXX,XX +XXX,XX @@ block = declare_dependency(link_whole: [libblock],
+                            link_args: '@block.syms',
+                            dependencies: [crypto, io])
++blockdev_ss = blockdev_ss.apply(config_host, strict: false)
++libblockdev = static_library('blockdev', blockdev_ss.sources() + genh,
++                             dependencies: blockdev_ss.dependencies(),
++                             name_suffix: 'fa',
++                             build_by_default: false)
++
++blockdev = declare_dependency(link_whole: [libblockdev],
++                              dependencies: [block])
++
+ qmp_ss = qmp_ss.apply(config_host, strict: false)
+ libqmp = static_library('qmp', qmp_ss.sources() + genh,
+                         dependencies: qmp_ss.dependencies(),
+@@ -XXX,XX +XXX,XX @@ foreach m : block_mods + softmmu_mods
+                 install_dir: config_host['qemu_moddir'])
+ endforeach
+-softmmu_ss.add(authz, block, chardev, crypto, io, qmp)
++softmmu_ss.add(authz, blockdev, chardev, crypto, io, qmp)
+ common_ss.add(qom, qemuutil)
+ common_ss.add_all(when: 'CONFIG_SOFTMMU', if_true: [softmmu_ss])
+diff --git a/storage-daemon/meson.build b/storage-daemon/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/storage-daemon/meson.build
++++ b/storage-daemon/meson.build
+@@ -XXX,XX +XXX,XX @@
+ qsd_ss = ss.source_set()
+ qsd_ss.add(files('qemu-storage-daemon.c'))
+-qsd_ss.add(block, chardev, qmp, qom, qemuutil)
+-qsd_ss.add_all(blockdev_ss)
++qsd_ss.add(blockdev, chardev, qmp, qom, qemuutil)
+ subdir('qapi')
+--
+.26.2

-New patch
+[PULL v2 21/28] block: move block exports to libblockdev
+Block exports are used by softmmu, qemu-storage-daemon, and qemu-nbd.
+They are not used by other programs and are not otherwise needed in
+libblock.
+Undo the recent move of blockdev-nbd.c from blockdev_ss into block_ss.
+Since bdrv_close_all() (libblock) calls blk_exp_close_all()
+(libblockdev) a stub function is required..
+Make qemu-nbd.c use signal handling utility functions instead of
+duplicating the code. This helps because os-posix.c is in libblockdev
+and it depends on a qemu_system_killed() symbol that qemu-nbd.c lacks.
+Once we use the signal handling utility functions we also end up
+providing the necessary symbol.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20200929125516.186715-4-stefanha@redhat.com
+[Fixed s/ndb/nbd/ typo in commit description as suggested by Eric Blake
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ qemu-nbd.c                | 21 ++++++++-------------
+ stubs/blk-exp-close-all.c |  7 +++++++
+ block/export/meson.build  |  4 ++--
+ meson.build               |  4 ++--
+ nbd/meson.build           |  2 ++
+ stubs/meson.build         |  1 +
+files changed, 22 insertions(+), 17 deletions(-)
+ create mode 100644 stubs/blk-exp-close-all.c
+diff --git a/qemu-nbd.c b/qemu-nbd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/qemu-nbd.c
++++ b/qemu-nbd.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/error.h"
+ #include "qemu/cutils.h"
+ #include "sysemu/block-backend.h"
++#include "sysemu/runstate.h" /* for qemu_system_killed() prototype */
+ #include "block/block_int.h"
+ #include "block/nbd.h"
+ #include "qemu/main-loop.h"
+@@ -XXX,XX +XXX,XX @@ QEMU_COPYRIGHT "\n"
+ }
+ #ifdef CONFIG_POSIX
+-static void termsig_handler(int signum)
++/*
++ * The client thread uses SIGTERM to interrupt the server.  A signal
++ * handler ensures that "qemu-nbd -v -c" exits with a nice status code.
++ */
++void qemu_system_killed(int signum, pid_t pid)
+ {
+     qatomic_cmpxchg(&state, RUNNING, TERMINATE);
+     qemu_notify_event();
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
+     BlockExportOptions *export_opts;
+ #ifdef CONFIG_POSIX
+-    /*
+-     * Exit gracefully on various signals, which includes SIGTERM used
+-     * by 'qemu-nbd -v -c'.
+-     */
+-    struct sigaction sa_sigterm;
+-    memset(&sa_sigterm, 0, sizeof(sa_sigterm));
+-    sa_sigterm.sa_handler = termsig_handler;
+-    sigaction(SIGTERM, &sa_sigterm, NULL);
+-    sigaction(SIGINT, &sa_sigterm, NULL);
+-    sigaction(SIGHUP, &sa_sigterm, NULL);
+-
+-    signal(SIGPIPE, SIG_IGN);
++    os_setup_early_signal_handling();
++    os_setup_signal_handling();
+ #endif
+     socket_init();
+diff --git a/stubs/blk-exp-close-all.c b/stubs/blk-exp-close-all.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/stubs/blk-exp-close-all.c
+@@ -XXX,XX +XXX,XX @@
++#include "qemu/osdep.h"
++#include "block/export.h"
++
++/* Only used in programs that support block exports (libblockdev.fa) */
++void blk_exp_close_all(void)
++{
++}
+diff --git a/block/export/meson.build b/block/export/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/meson.build
++++ b/block/export/meson.build
+@@ -XXX,XX +XXX,XX @@
+-block_ss.add(files('export.c'))
+-block_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c'))
++blockdev_ss.add(files('export.c'))
++blockdev_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c'))
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ subdir('dump')
+ block_ss.add(files(
+   'block.c',
+-  'blockdev-nbd.c',
+   'blockjob.c',
+   'job.c',
+   'qemu-io-cmds.c',
+@@ -XXX,XX +XXX,XX @@ subdir('block')
+ blockdev_ss.add(files(
+   'blockdev.c',
++  'blockdev-nbd.c',
+   'iothread.c',
+   'job-qmp.c',
+ ))
+@@ -XXX,XX +XXX,XX @@ if have_tools
+   qemu_io = executable('qemu-io', files('qemu-io.c'),
+              dependencies: [block, qemuutil], install: true)
+   qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'),
+-               dependencies: [block, qemuutil], install: true)
++               dependencies: [blockdev, qemuutil], install: true)
+   subdir('storage-daemon')
+   subdir('contrib/rdmacm-mux')
+diff --git a/nbd/meson.build b/nbd/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/nbd/meson.build
++++ b/nbd/meson.build
+@@ -XXX,XX +XXX,XX @@
+ block_ss.add(files(
+   'client.c',
+   'common.c',
++))
++blockdev_ss.add(files(
+   'server.c',
+ ))
+diff --git a/stubs/meson.build b/stubs/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/stubs/meson.build
++++ b/stubs/meson.build
+@@ -XXX,XX +XXX,XX @@
+ stub_ss.add(files('arch_type.c'))
+ stub_ss.add(files('bdrv-next-monitor-owned.c'))
+ stub_ss.add(files('blk-commit-all.c'))
++stub_ss.add(files('blk-exp-close-all.c'))
+ stub_ss.add(files('blockdev-close-all-bdrv-states.c'))
+ stub_ss.add(files('change-state-handler.c'))
+ stub_ss.add(files('cmos.c'))
+--
+.26.2

-New patch
+[PULL v2 22/28] block/export: add iothread and fixed-iothread options
+Make it possible to specify the iothread where the export will run. By
+default the block node can be moved to other AioContexts later and the
+export will follow. The fixed-iothread option forces strict behavior
+that prevents changing AioContext while the export is active. See the
+QAPI docs for details.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20200929125516.186715-5-stefanha@redhat.com
+[Fix stray '#' character in block-export.json and add missing "(since:
+.2)" as suggested by Eric Blake.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ qapi/block-export.json               | 11 ++++++++++
+ block/export/export.c                | 31 +++++++++++++++++++++++++++-
+ block/export/vhost-user-blk-server.c |  5 ++++-
+ nbd/server.c                         |  2 --
+files changed, 45 insertions(+), 4 deletions(-)
+diff --git a/qapi/block-export.json b/qapi/block-export.json
+index XXXXXXX..XXXXXXX 100644
+--- a/qapi/block-export.json
++++ b/qapi/block-export.json
+@@ -XXX,XX +XXX,XX @@
+ #                export before completion is signalled. (since: 5.2;
+ #                default: false)
+ #
++# @iothread: The name of the iothread object where the export will run. The
++#            default is to use the thread currently associated with the
++#            block node. (since: 5.2)
++#
++# @fixed-iothread: True prevents the block node from being moved to another
++#                  thread while the export is active. If true and @iothread is
++#                  given, export creation fails if the block node cannot be
++#                  moved to the iothread. The default is false. (since: 5.2)
++#
+ # Since: 4.2
+ ##
+ { 'union': 'BlockExportOptions',
+   'base': { 'type': 'BlockExportType',
+             'id': 'str',
++        '*fixed-iothread': 'bool',
++        '*iothread': 'str',
+             'node-name': 'str',
+             '*writable': 'bool',
+             '*writethrough': 'bool' },
+diff --git a/block/export/export.c b/block/export/export.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/export.c
++++ b/block/export/export.c
+@@ -XXX,XX +XXX,XX @@
+ #include "block/block.h"
+ #include "sysemu/block-backend.h"
++#include "sysemu/iothread.h"
+ #include "block/export.h"
+ #include "block/nbd.h"
+ #include "qapi/error.h"
+@@ -XXX,XX +XXX,XX @@ static const BlockExportDriver *blk_exp_find_driver(BlockExportType type)
+ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
+ {
++    bool fixed_iothread = export->has_fixed_iothread && export->fixed_iothread;
+     const BlockExportDriver *drv;
+     BlockExport *exp = NULL;
+     BlockDriverState *bs;
+-    BlockBackend *blk;
++    BlockBackend *blk = NULL;
+     AioContext *ctx;
+     uint64_t perm;
+     int ret;
+@@ -XXX,XX +XXX,XX @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
+     ctx = bdrv_get_aio_context(bs);
+     aio_context_acquire(ctx);
++    if (export->has_iothread) {
++        IOThread *iothread;
++        AioContext *new_ctx;
++
++        iothread = iothread_by_id(export->iothread);
++        if (!iothread) {
++            error_setg(errp, "iothread \"%s\" not found", export->iothread);
++            goto fail;
++        }
++
++        new_ctx = iothread_get_aio_context(iothread);
++
++        ret = bdrv_try_set_aio_context(bs, new_ctx, errp);
++        if (ret == 0) {
++            aio_context_release(ctx);
++            aio_context_acquire(new_ctx);
++            ctx = new_ctx;
++        } else if (fixed_iothread) {
++            goto fail;
++        }
++    }
++
+     /*
+      * Block exports are used for non-shared storage migration. Make sure
+      * that BDRV_O_INACTIVE is cleared and the image is ready for write
+@@ -XXX,XX +XXX,XX @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
+     }
+     blk = blk_new(ctx, perm, BLK_PERM_ALL);
++
++    if (!fixed_iothread) {
++        blk_set_allow_aio_context_change(blk, true);
++    }
++
+     ret = blk_insert_bs(blk, bs, errp);
+     if (ret < 0) {
+         goto fail;
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@ static const VuDevIface vu_blk_iface = {
+ static void blk_aio_attached(AioContext *ctx, void *opaque)
+ {
+     VuBlkExport *vexp = opaque;
++
++    vexp->export.ctx = ctx;
+     vhost_user_server_attach_aio_context(&vexp->vu_server, ctx);
+ }
+ static void blk_aio_detach(void *opaque)
+ {
+     VuBlkExport *vexp = opaque;
++
+     vhost_user_server_detach_aio_context(&vexp->vu_server);
++    vexp->export.ctx = NULL;
+ }
+ static void
+@@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
+     vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg,
+                                logical_block_size);
+-    blk_set_allow_aio_context_change(exp->blk, true);
+     blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
+                                  vexp);
+diff --git a/nbd/server.c b/nbd/server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/nbd/server.c
++++ b/nbd/server.c
+@@ -XXX,XX +XXX,XX @@ static int nbd_export_create(BlockExport *blk_exp, BlockExportOptions *exp_args,
+         return ret;
+     }
+-    blk_set_allow_aio_context_change(blk, true);
+-
+     QTAILQ_INIT(&exp->clients);
+     exp->name = g_strdup(arg->name);
+     exp->description = g_strdup(arg->description);
+--
+.26.2

-New patch
+[PULL v2 23/28] block/export: add vhost-user-blk multi-queue support
+Allow the number of queues to be configured using --export
+vhost-user-blk,num-queues=N. This setting should match the QEMU --device
+vhost-user-blk-pci,num-queues=N setting but QEMU vhost-user-blk.c lowers
+its own value if the vhost-user-blk backend offers fewer queues than
+QEMU.
+The vhost-user-blk-server.c code is already capable of multi-queue. All
+virtqueue processing runs in the same AioContext. No new locking is
+needed.
+Add the num-queues=N option and set the VIRTIO_BLK_F_MQ feature bit.
+Note that the feature bit only announces the presence of the num_queues
+configuration space field. It does not promise that there is more than 1
+virtqueue, so we can set it unconditionally.
+I tested multi-queue by running a random read fio test with numjobs=4 on
+an -smp 4 guest. After the benchmark finished the guest /proc/interrupts
+file showed activity on all 4 virtio-blk MSI-X. The /sys/block/vda/mq/
+directory shows that Linux blk-mq has 4 queues configured.
+An automated test is included in the next commit.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Acked-by: Markus Armbruster <armbru@redhat.com>
+Message-id: 20201001144604.559733-2-stefanha@redhat.com
+[Fixed accidental tab characters as suggested by Markus Armbruster
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ qapi/block-export.json               | 10 +++++++---
+ block/export/vhost-user-blk-server.c | 24 ++++++++++++++++++------
+files changed, 25 insertions(+), 9 deletions(-)
+diff --git a/qapi/block-export.json b/qapi/block-export.json
+index XXXXXXX..XXXXXXX 100644
+--- a/qapi/block-export.json
++++ b/qapi/block-export.json
+@@ -XXX,XX +XXX,XX @@
+ #        SocketAddress types are supported. Passed fds must be UNIX domain
+ #        sockets.
+ # @logical-block-size: Logical block size in bytes. Defaults to 512 bytes.
++# @num-queues: Number of request virtqueues. Must be greater than 0. Defaults
++#              to 1.
+ #
+ # Since: 5.2
+ ##
+ { 'struct': 'BlockExportOptionsVhostUserBlk',
+-  'data': { 'addr': 'SocketAddress', '*logical-block-size': 'size' } }
++  'data': { 'addr': 'SocketAddress',
++        '*logical-block-size': 'size',
++            '*num-queues': 'uint16'} }
+ ##
+ # @NbdServerAddOptions:
+@@ -XXX,XX +XXX,XX @@
+ { 'union': 'BlockExportOptions',
+   'base': { 'type': 'BlockExportType',
+             'id': 'str',
+-        '*fixed-iothread': 'bool',
+-        '*iothread': 'str',
++            '*fixed-iothread': 'bool',
++            '*iothread': 'str',
+             'node-name': 'str',
+             '*writable': 'bool',
+             '*writethrough': 'bool' },
+diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/vhost-user-blk-server.c
++++ b/block/export/vhost-user-blk-server.c
+@@ -XXX,XX +XXX,XX @@
+ #include "util/block-helpers.h"
+ enum {
+-    VHOST_USER_BLK_MAX_QUEUES = 1,
++    VHOST_USER_BLK_NUM_QUEUES_DEFAULT = 1,
+ };
+ struct virtio_blk_inhdr {
+     unsigned char status;
+@@ -XXX,XX +XXX,XX @@ static uint64_t vu_blk_get_features(VuDev *dev)
+ull << VIRTIO_BLK_F_DISCARD |
+ull << VIRTIO_BLK_F_WRITE_ZEROES |
+ull << VIRTIO_BLK_F_CONFIG_WCE |
++               1ull << VIRTIO_BLK_F_MQ |
+ull << VIRTIO_F_VERSION_1 |
+ull << VIRTIO_RING_F_INDIRECT_DESC |
+ull << VIRTIO_RING_F_EVENT_IDX |
+@@ -XXX,XX +XXX,XX @@ static void blk_aio_detach(void *opaque)
+ static void
+ vu_blk_initialize_config(BlockDriverState *bs,
+-                           struct virtio_blk_config *config, uint32_t blk_size)
++                         struct virtio_blk_config *config,
++                         uint32_t blk_size,
++                         uint16_t num_queues)
+ {
+     config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
+     config->blk_size = blk_size;
+@@ -XXX,XX +XXX,XX @@ vu_blk_initialize_config(BlockDriverState *bs,
+     config->seg_max = 128 - 2;
+     config->min_io_size = 1;
+     config->opt_io_size = 1;
+-    config->num_queues = VHOST_USER_BLK_MAX_QUEUES;
++    config->num_queues = num_queues;
+     config->max_discard_sectors = 32768;
+     config->max_discard_seg = 1;
+     config->discard_sector_alignment = config->blk_size >> 9;
+@@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
+     BlockExportOptionsVhostUserBlk *vu_opts = &opts->u.vhost_user_blk;
+     Error *local_err = NULL;
+     uint64_t logical_block_size;
++    uint16_t num_queues = VHOST_USER_BLK_NUM_QUEUES_DEFAULT;
+     vexp->writable = opts->writable;
+     vexp->blkcfg.wce = 0;
+@@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
+     }
+     vexp->blk_size = logical_block_size;
+     blk_set_guest_block_size(exp->blk, logical_block_size);
++
++    if (vu_opts->has_num_queues) {
++        num_queues = vu_opts->num_queues;
++    }
++    if (num_queues == 0) {
++        error_setg(errp, "num-queues must be greater than 0");
++        return -EINVAL;
++    }
++
+     vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg,
+-                               logical_block_size);
++                             logical_block_size, num_queues);
+     blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
+                                  vexp);
+     if (!vhost_user_server_start(&vexp->vu_server, vu_opts->addr, exp->ctx,
+-                                 VHOST_USER_BLK_MAX_QUEUES, &vu_blk_iface,
+-                                 errp)) {
++                                 num_queues, &vu_blk_iface, errp)) {
+         blk_remove_aio_context_notifier(exp->blk, blk_aio_attached,
+                                         blk_aio_detach, vexp);
+         return -EADDRNOTAVAIL;
+--
+.26.2

-[Qemu-devel] [PULL 1/2] bitmaps.md: Convert to rST; move it into 'interop' dir
+[PULL v2 24/28] block/io: fix bdrv_co_block_status_above
-From: Kashyap Chamarthy <kchamart@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-This is part of the on-going effort to convert QEMU upstream
+bdrv_co_block_status_above has several design problems with handling
-documentation syntax to reStructuredText (rST).
+short backing files:
-The conversion to rST was done using:
+. With want_zeros=true, it may return ret with BDRV_BLOCK_ZERO but
 without BDRV_BLOCK_ALLOCATED flag, when actually short backing file
 which produces these after-EOF zeros is inside requested backing
 sequence.
-    $ pandoc -f markdown -t rst bitmaps.md -o bitmaps.rst
+. With want_zero=false, it may return pnum=0 prior to actual EOF,
 because of EOF of short backing file.
-Then, make a couple of small syntactical adjustments.  While at it,
+Fix these things, making logic about short backing files clearer.
 reword a statement to avoid ambiguity.  Addressing the feedback from
 this thread:
-    https://lists.nongnu.org/archive/html/qemu-devel/2017-06/msg05428.html
+With fixed bdrv_block_status_above we also have to improve is_zero in
 qcow2 code, otherwise iotest 154 will fail, because with this patch we
 stop to merge zeros of different types (produced by fully unallocated
 in the whole backing chain regions vs produced by short backing files).
-Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
+Note also, that this patch leaves for another day the general problem
-Reviewed-by: John Snow <jsnow@redhat.com>
+around block-status: misuse of BDRV_BLOCK_ALLOCATED as is-fs-allocated
 vs go-to-backing.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Alberto Garcia <berto@igalia.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20170717105205.32639-2-kchamart@redhat.com
+Message-id: 20200924194003.22080-2-vsementsov@virtuozzo.com
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+[Fix s/comes/come/ as suggested by Eric Blake
 --Stefan]
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- docs/devel/bitmaps.md    | 505 ------------------------------------------
+ block/io.c    | 68 ++++++++++++++++++++++++++++++++++++++++-----------
- docs/interop/bitmaps.rst | 555 +++++++++++++++++++++++++++++++++++++++++++++++
+ block/qcow2.c | 16 ++++++++++--
-files changed, 555 insertions(+), 505 deletions(-)
+files changed, 68 insertions(+), 16 deletions(-)
  delete mode 100644 docs/devel/bitmaps.md
  create mode 100644 docs/interop/bitmaps.rst
-diff --git a/docs/devel/bitmaps.md b/docs/devel/bitmaps.md
+diff --git a/block/io.c b/block/io.c
-deleted file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/block/io.c
---- a/docs/devel/bitmaps.md
++++ b/block/io.c
-+++ /dev/null
+@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
-@@ -XXX,XX +XXX,XX @@
+                                   int64_t *map,
--<!--
+                                   BlockDriverState **file)
--Copyright 2015 John Snow <jsnow@redhat.com> and Red Hat, Inc.
+ {
--All rights reserved.
++    int ret;
--
+     BlockDriverState *p;
--This file is licensed via The FreeBSD Documentation License, the full text of
+-    int ret = 0;
--which is included at the end of this document.
+-    bool first = true;
---->
++    int64_t eof = 0;
--
--# Dirty Bitmaps and Incremental Backup
+     assert(bs != base);
--
+-    for (p = bs; p != base; p = bdrv_filter_or_cow_bs(p)) {
 -* Dirty Bitmaps are objects that track which data needs to be backed up for the
 -  next incremental backup.
 -
 -* Dirty bitmaps can be created at any time and attached to any node
 -  (not just complete drives.)
 -
 -## Dirty Bitmap Names
 -
 -* A dirty bitmap's name is unique to the node, but bitmaps attached to different
 -  nodes can share the same name.
 -
 -* Dirty bitmaps created for internal use by QEMU may be anonymous and have no
 -  name, but any user-created bitmaps may not be. There can be any number of
 -  anonymous bitmaps per node.
 -
 -* The name of a user-created bitmap must not be empty ("").
 -
 -## Bitmap Modes
 -
 -* A Bitmap can be "frozen," which means that it is currently in-use by a backup
 -  operation and cannot be deleted, renamed, written to, reset,
 -  etc.
 -
 -* The normal operating mode for a bitmap is "active."
 -
 -## Basic QMP Usage
 -
 -### Supported Commands ###
 -
 -* block-dirty-bitmap-add
 -* block-dirty-bitmap-remove
 -* block-dirty-bitmap-clear
 -
 -### Creation
 -
 -* To create a new bitmap, enabled, on the drive with id=drive0:
 -
 -```json
 -{ "execute": "block-dirty-bitmap-add",
 -  "arguments": {
 -    "node": "drive0",
 -    "name": "bitmap0"
 -  }
 -}
 -```
 -
 -* This bitmap will have a default granularity that matches the cluster size of
 -  its associated drive, if available, clamped to between [4KiB, 64KiB].
 -  The current default for qcow2 is 64KiB.
 -
 -* To create a new bitmap that tracks changes in 32KiB segments:
 -
 -```json
 -{ "execute": "block-dirty-bitmap-add",
 -  "arguments": {
 -    "node": "drive0",
 -    "name": "bitmap0",
 -    "granularity": 32768
 -  }
 -}
 -```
 -
 -### Deletion
 -
 -* Bitmaps that are frozen cannot be deleted.
 -
 -* Deleting the bitmap does not impact any other bitmaps attached to the same
 -  node, nor does it affect any backups already created from this node.
 -
 -* Because bitmaps are only unique to the node to which they are attached,
 -  you must specify the node/drive name here, too.
 -
 -```json
 -{ "execute": "block-dirty-bitmap-remove",
 -  "arguments": {
 -    "node": "drive0",
 -    "name": "bitmap0"
 -  }
 -}
 -```
 -
 -### Resetting
 -
 -* Resetting a bitmap will clear all information it holds.
 -
 -* An incremental backup created from an empty bitmap will copy no data,
 -  as if nothing has changed.
 -
 -```json
 -{ "execute": "block-dirty-bitmap-clear",
 -  "arguments": {
 -    "node": "drive0",
 -    "name": "bitmap0"
 -  }
 -}
 -```
 -
 -## Transactions
 -
 -### Justification
 -
 -Bitmaps can be safely modified when the VM is paused or halted by using
 -the basic QMP commands. For instance, you might perform the following actions:
 -
 -1. Boot the VM in a paused state.
 -2. Create a full drive backup of drive0.
 -3. Create a new bitmap attached to drive0.
 -4. Resume execution of the VM.
 -5. Incremental backups are ready to be created.
 -
 -At this point, the bitmap and drive backup would be correctly in sync,
 -and incremental backups made from this point forward would be correctly aligned
 -to the full drive backup.
 -
 -This is not particularly useful if we decide we want to start incremental
 -backups after the VM has been running for a while, for which we will need to
 -perform actions such as the following:
 -
 -1. Boot the VM and begin execution.
 -2. Using a single transaction, perform the following operations:
 -    * Create bitmap0.
 -    * Create a full drive backup of drive0.
 -3. Incremental backups are now ready to be created.
 -
 -### Supported Bitmap Transactions
 -
 -* block-dirty-bitmap-add
 -* block-dirty-bitmap-clear
 -
 -The usages are identical to their respective QMP commands, but see below
 -for examples.
 -
 -### Example: New Incremental Backup
 -
 -As outlined in the justification, perhaps we want to create a new incremental
 -backup chain attached to a drive.
 -
 -```json
 -{ "execute": "transaction",
 -  "arguments": {
 -    "actions": [
 -      {"type": "block-dirty-bitmap-add",
 -       "data": {"node": "drive0", "name": "bitmap0"} },
 -      {"type": "drive-backup",
 -       "data": {"device": "drive0", "target": "/path/to/full_backup.img",
 -                "sync": "full", "format": "qcow2"} }
 -    ]
 -  }
 -}
 -```
 -
 -### Example: New Incremental Backup Anchor Point
 -
 -Maybe we just want to create a new full backup with an existing bitmap and
 -want to reset the bitmap to track the new chain.
 -
 -```json
 -{ "execute": "transaction",
 -  "arguments": {
 -    "actions": [
 -      {"type": "block-dirty-bitmap-clear",
 -       "data": {"node": "drive0", "name": "bitmap0"} },
 -      {"type": "drive-backup",
 -       "data": {"device": "drive0", "target": "/path/to/new_full_backup.img",
 -                "sync": "full", "format": "qcow2"} }
 -    ]
 -  }
 -}
 -```
 -
 -## Incremental Backups
 -
 -The star of the show.
 -
 -**Nota Bene!** Only incremental backups of entire drives are supported for now.
 -So despite the fact that you can attach a bitmap to any arbitrary node, they are
 -only currently useful when attached to the root node. This is because
 -drive-backup only supports drives/devices instead of arbitrary nodes.
 -
 -### Example: First Incremental Backup
 -
 -1. Create a full backup and sync it to the dirty bitmap, as in the transactional
 -examples above; or with the VM offline, manually create a full copy and then
 -create a new bitmap before the VM begins execution.
 -
 -    * Let's assume the full backup is named 'full_backup.img'.
 -    * Let's assume the bitmap you created is 'bitmap0' attached to 'drive0'.
 -
 -2. Create a destination image for the incremental backup that utilizes the
 -full backup as a backing image.
 -
 -    * Let's assume it is named 'incremental.0.img'.
 -
 -    ```sh
 -    # qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
 -    ```
 -
 -3. Issue the incremental backup command:
 -
 -    ```json
 -    { "execute": "drive-backup",
 -      "arguments": {
 -        "device": "drive0",
 -        "bitmap": "bitmap0",
 -        "target": "incremental.0.img",
 -        "format": "qcow2",
 -        "sync": "incremental",
 -        "mode": "existing"
 -      }
 -    }
 -    ```
 -
 -### Example: Second Incremental Backup
 -
 -1. Create a new destination image for the incremental backup that points to the
 -   previous one, e.g.: 'incremental.1.img'
 -
 -    ```sh
 -    # qemu-img create -f qcow2 incremental.1.img -b incremental.0.img -F qcow2
 -    ```
 -
 -2. Issue a new incremental backup command. The only difference here is that we
 -   have changed the target image below.
 -
 -    ```json
 -    { "execute": "drive-backup",
 -      "arguments": {
 -        "device": "drive0",
 -        "bitmap": "bitmap0",
 -        "target": "incremental.1.img",
 -        "format": "qcow2",
 -        "sync": "incremental",
 -        "mode": "existing"
 -      }
 -    }
 -    ```
 -
 -## Errors
 -
 -* In the event of an error that occurs after a backup job is successfully
 -  launched, either by a direct QMP command or a QMP transaction, the user
 -  will receive a BLOCK_JOB_COMPLETE event with a failure message, accompanied
 -  by a BLOCK_JOB_ERROR event.
 -
 -* In the case of an event being cancelled, the user will receive a
 -  BLOCK_JOB_CANCELLED event instead of a pair of COMPLETE and ERROR events.
 -
 -* In either case, the incremental backup data contained within the bitmap is
 -  safely rolled back, and the data within the bitmap is not lost. The image
 -  file created for the failed attempt can be safely deleted.
 -
 -* Once the underlying problem is fixed (e.g. more storage space is freed up),
 -  you can simply retry the incremental backup command with the same bitmap.
 -
 -### Example
 -
 -1. Create a target image:
 -
 -    ```sh
 -    # qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
 -    ```
 -
 -2. Attempt to create an incremental backup via QMP:
 -
 -    ```json
 -    { "execute": "drive-backup",
 -      "arguments": {
 -        "device": "drive0",
 -        "bitmap": "bitmap0",
 -        "target": "incremental.0.img",
 -        "format": "qcow2",
 -        "sync": "incremental",
 -        "mode": "existing"
 -      }
 -    }
 -    ```
 -
 -3. Receive an event notifying us of failure:
 -
 -    ```json
 -    { "timestamp": { "seconds": 1424709442, "microseconds": 844524 },
 -      "data": { "speed": 0, "offset": 0, "len": 67108864,
 -                "error": "No space left on device",
 -                "device": "drive1", "type": "backup" },
 -      "event": "BLOCK_JOB_COMPLETED" }
 -    ```
 -
 -4. Delete the failed incremental, and re-create the image.
 -
 -    ```sh
 -    # rm incremental.0.img
 -    # qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
 -    ```
 -
 -5. Retry the command after fixing the underlying problem,
 -   such as freeing up space on the backup volume:
 -
 -    ```json
 -    { "execute": "drive-backup",
 -      "arguments": {
 -        "device": "drive0",
 -        "bitmap": "bitmap0",
 -        "target": "incremental.0.img",
 -        "format": "qcow2",
 -        "sync": "incremental",
 -        "mode": "existing"
 -      }
 -    }
 -    ```
 -
 -6. Receive confirmation that the job completed successfully:
 -
 -    ```json
 -    { "timestamp": { "seconds": 1424709668, "microseconds": 526525 },
 -      "data": { "device": "drive1", "type": "backup",
 -                "speed": 0, "len": 67108864, "offset": 67108864},
 -      "event": "BLOCK_JOB_COMPLETED" }
 -    ```
 -
 -### Partial Transactional Failures
 -
 -* Sometimes, a transaction will succeed in launching and return success,
 -  but then later the backup jobs themselves may fail. It is possible that
 -  a management application may have to deal with a partial backup failure
 -  after a successful transaction.
 -
 -* If multiple backup jobs are specified in a single transaction, when one of
 -  them fails, it will not interact with the other backup jobs in any way.
 -
 -* The job(s) that succeeded will clear the dirty bitmap associated with the
 -  operation, but the job(s) that failed will not. It is not "safe" to delete
 -  any incremental backups that were created successfully in this scenario,
 -  even though others failed.
 -
 -#### Example
 -
 -* QMP example highlighting two backup jobs:
 -
 -    ```json
 -    { "execute": "transaction",
 -      "arguments": {
 -        "actions": [
 -          { "type": "drive-backup",
 -            "data": { "device": "drive0", "bitmap": "bitmap0",
 -                      "format": "qcow2", "mode": "existing",
 -                      "sync": "incremental", "target": "d0-incr-1.qcow2" } },
 -          { "type": "drive-backup",
 -            "data": { "device": "drive1", "bitmap": "bitmap1",
 -                      "format": "qcow2", "mode": "existing",
 -                      "sync": "incremental", "target": "d1-incr-1.qcow2" } },
 -        ]
 -      }
 -    }
 -    ```
 -
 -* QMP example response, highlighting one success and one failure:
 -    * Acknowledgement that the Transaction was accepted and jobs were launched:
 -        ```json
 -        { "return": {} }
 -        ```
 -
 -    * Later, QEMU sends notice that the first job was completed:
 -        ```json
 -        { "timestamp": { "seconds": 1447192343, "microseconds": 615698 },
 -          "data": { "device": "drive0", "type": "backup",
 -                     "speed": 0, "len": 67108864, "offset": 67108864 },
 -          "event": "BLOCK_JOB_COMPLETED"
 -        }
 -        ```
 -
 -    * Later yet, QEMU sends notice that the second job has failed:
 -        ```json
 -        { "timestamp": { "seconds": 1447192399, "microseconds": 683015 },
 -          "data": { "device": "drive1", "action": "report",
 -                    "operation": "read" },
 -          "event": "BLOCK_JOB_ERROR" }
 -        ```
 -
 -        ```json
 -        { "timestamp": { "seconds": 1447192399, "microseconds": 685853 },
 -          "data": { "speed": 0, "offset": 0, "len": 67108864,
 -                    "error": "Input/output error",
 -                    "device": "drive1", "type": "backup" },
 -          "event": "BLOCK_JOB_COMPLETED" }
 -
 -* In the above example, "d0-incr-1.qcow2" is valid and must be kept,
 -  but "d1-incr-1.qcow2" is invalid and should be deleted. If a VM-wide
 -  incremental backup of all drives at a point-in-time is to be made,
 -  new backups for both drives will need to be made, taking into account
 -  that a new incremental backup for drive0 needs to be based on top of
 -  "d0-incr-1.qcow2."
 -
 -### Grouped Completion Mode
 -
 -* While jobs launched by transactions normally complete or fail on their own,
 -  it is possible to instruct them to complete or fail together as a group.
 -
 -* QMP transactions take an optional properties structure that can affect
 -  the semantics of the transaction.
 -
 -* The "completion-mode" transaction property can be either "individual"
 -  which is the default, legacy behavior described above, or "grouped,"
 -  a new behavior detailed below.
 -
 -* Delayed Completion: In grouped completion mode, no jobs will report
 -  success until all jobs are ready to report success.
 -
 -* Grouped failure: If any job fails in grouped completion mode, all remaining
 -  jobs will be cancelled. Any incremental backups will restore their dirty
 -  bitmap objects as if no backup command was ever issued.
 -
 -    * Regardless of if QEMU reports a particular incremental backup job as
 -      CANCELLED or as an ERROR, the in-memory bitmap will be restored.
 -
 -#### Example
 -
 -* Here's the same example scenario from above with the new property:
 -
 -    ```json
 -    { "execute": "transaction",
 -      "arguments": {
 -        "actions": [
 -          { "type": "drive-backup",
 -            "data": { "device": "drive0", "bitmap": "bitmap0",
 -                      "format": "qcow2", "mode": "existing",
 -                      "sync": "incremental", "target": "d0-incr-1.qcow2" } },
 -          { "type": "drive-backup",
 -            "data": { "device": "drive1", "bitmap": "bitmap1",
 -                      "format": "qcow2", "mode": "existing",
 -                      "sync": "incremental", "target": "d1-incr-1.qcow2" } },
 -        ],
 -        "properties": {
 -          "completion-mode": "grouped"
 -        }
 -      }
 -    }
 -    ```
 -
 -* QMP example response, highlighting a failure for drive2:
 -    * Acknowledgement that the Transaction was accepted and jobs were launched:
 -        ```json
 -        { "return": {} }
 -        ```
 -
 -    * Later, QEMU sends notice that the second job has errored out,
 -      but that the first job was also cancelled:
 -        ```json
 -        { "timestamp": { "seconds": 1447193702, "microseconds": 632377 },
 -          "data": { "device": "drive1", "action": "report",
 -                    "operation": "read" },
 -          "event": "BLOCK_JOB_ERROR" }
 -        ```
 -
 -        ```json
 -        { "timestamp": { "seconds": 1447193702, "microseconds": 640074 },
 -          "data": { "speed": 0, "offset": 0, "len": 67108864,
 -                    "error": "Input/output error",
 -                    "device": "drive1", "type": "backup" },
 -          "event": "BLOCK_JOB_COMPLETED" }
 -        ```
 -
 -        ```json
 -        { "timestamp": { "seconds": 1447193702, "microseconds": 640163 },
 -          "data": { "device": "drive0", "type": "backup", "speed": 0,
 -                    "len": 67108864, "offset": 16777216 },
 -          "event": "BLOCK_JOB_CANCELLED" }
 -        ```
 -
 -<!--
 -The FreeBSD Documentation License
 -
 -Redistribution and use in source (Markdown) and 'compiled' forms (SGML, HTML,
 -PDF, PostScript, RTF and so forth) with or without modification, are permitted
 -provided that the following conditions are met:
 -
 -Redistributions of source code (Markdown) must retain the above copyright
 -notice, this list of conditions and the following disclaimer of this file
 -unmodified.
 -
 -Redistributions in compiled form (transformed to other DTDs, converted to PDF,
 -PostScript, RTF and other formats) must reproduce the above copyright notice,
 -this list of conditions and the following disclaimer in the documentation and/or
 -other materials provided with the distribution.
 -
 -THIS DOCUMENTATION IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 -AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 -IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR  PURPOSE ARE
 -DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS  BE LIABLE
 -FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 -DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 -SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 -CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 -OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 -THIS DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 --->
 diff --git a/docs/interop/bitmaps.rst b/docs/interop/bitmaps.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/interop/bitmaps.rst
@@ -XXX,XX +XXX,XX @@
 +..
 +   Copyright 2015 John Snow <jsnow@redhat.com> and Red Hat, Inc.
 +   All rights reserved.
 +
-+   This file is licensed via The FreeBSD Documentation License, the full
++    ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
-+   text of which is included at the end of this document.
++    if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED) {
-+
++        return ret;
 +====================================
 +Dirty Bitmaps and Incremental Backup
 +====================================
 +
 +-  Dirty Bitmaps are objects that track which data needs to be backed up
 +   for the next incremental backup.
 +
 +-  Dirty bitmaps can be created at any time and attached to any node
 +   (not just complete drives).
 +
 +.. contents::
 +
 +Dirty Bitmap Names
 +------------------
 +
 +-  A dirty bitmap's name is unique to the node, but bitmaps attached to
 +   different nodes can share the same name.
 +
 +-  Dirty bitmaps created for internal use by QEMU may be anonymous and
 +   have no name, but any user-created bitmaps must have a name. There
 +   can be any number of anonymous bitmaps per node.
 +
 +-  The name of a user-created bitmap must not be empty ("").
 +
 +Bitmap Modes
 +------------
 +
 +-  A bitmap can be "frozen," which means that it is currently in-use by
 +   a backup operation and cannot be deleted, renamed, written to, reset,
 +   etc.
 +
 +-  The normal operating mode for a bitmap is "active."
 +
 +Basic QMP Usage
 +---------------
 +
 +Supported Commands
 +~~~~~~~~~~~~~~~~~~
 +
 +- ``block-dirty-bitmap-add``
 +- ``block-dirty-bitmap-remove``
 +- ``block-dirty-bitmap-clear``
 +
 +Creation
 +~~~~~~~~
 +
 +-  To create a new bitmap, enabled, on the drive with id=drive0:
 +
 +.. code:: json
 +
 +    { "execute": "block-dirty-bitmap-add",
 +      "arguments": {
 +        "node": "drive0",
 +        "name": "bitmap0"
 +      }
 +    }
 +
-+-  This bitmap will have a default granularity that matches the cluster
++    if (ret & BDRV_BLOCK_EOF) {
-+   size of its associated drive, if available, clamped to between [4KiB,
++        eof = offset + *pnum;
 +   64KiB]. The current default for qcow2 is 64KiB.
 +
 +-  To create a new bitmap that tracks changes in 32KiB segments:
 +
 +.. code:: json
 +
 +    { "execute": "block-dirty-bitmap-add",
 +      "arguments": {
 +        "node": "drive0",
 +        "name": "bitmap0",
 +        "granularity": 32768
 +      }
 +    }
 +
-+Deletion
++    assert(*pnum <= bytes);
-+~~~~~~~~
++    bytes = *pnum;
 +
-+-  Bitmaps that are frozen cannot be deleted.
++    for (p = bdrv_filter_or_cow_bs(bs); p != base;
 +         p = bdrv_filter_or_cow_bs(p))
 +    {
          ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map,
                                     file);
          if (ret < 0) {
 -            break;
 +            return ret;
          }
 -        if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) {
 +        if (*pnum == 0) {
              /*
 -             * Reading beyond the end of the file continues to read
 -             * zeroes, but we can only widen the result to the
 -             * unallocated length we learned from an earlier
 -             * iteration.
 +             * The top layer deferred to this layer, and because this layer is
 +             * short, any zeroes that we synthesize beyond EOF behave as if they
 +             * were allocated at this layer.
 +             *
 +             * We don't include BDRV_BLOCK_EOF into ret, as upper layer may be
 +             * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see
 +             * below.
               */
 +            assert(ret & BDRV_BLOCK_EOF);
              *pnum = bytes;
 +            if (file) {
 +                *file = p;
 +            }
 +            ret = BDRV_BLOCK_ZERO | BDRV_BLOCK_ALLOCATED;
 +            break;
          }
 -        if (ret & (BDRV_BLOCK_ZERO | BDRV_BLOCK_DATA)) {
 +        if (ret & BDRV_BLOCK_ALLOCATED) {
 +            /*
 +             * We've found the node and the status, we must break.
 +             *
 +             * Drop BDRV_BLOCK_EOF, as it's not for upper layer, which may be
 +             * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see
 +             * below.
 +             */
 +            ret &= ~BDRV_BLOCK_EOF;
              break;
          }
 -        /* [offset, pnum] unallocated on this layer, which could be only
 -         * the first part of [offset, bytes].  */
 -        bytes = MIN(bytes, *pnum);
 -        first = false;
 +
-+-  Deleting the bitmap does not impact any other bitmaps attached to the
++        /*
-+   same node, nor does it affect any backups already created from this
++         * OK, [offset, offset + *pnum) region is unallocated on this layer,
-+   node.
++         * let's continue the diving.
-+
++         */
-+-  Because bitmaps are only unique to the node to which they are
++        assert(*pnum <= bytes);
-+   attached, you must specify the node/drive name here, too.
++        bytes = *pnum;
 +
 +.. code:: json
 +
 +    { "execute": "block-dirty-bitmap-remove",
 +      "arguments": {
 +        "node": "drive0",
 +        "name": "bitmap0"
 +      }
 +    }
 +
-+Resetting
++    if (offset + *pnum == eof) {
-+~~~~~~~~~
++        ret |= BDRV_BLOCK_EOF;
      }
 +
-+-  Resetting a bitmap will clear all information it holds.
+     return ret;
  }
 diff --git a/block/qcow2.c b/block/qcow2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
      if (!bytes) {
          return true;
      }
 -    res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
 -    return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
 +
-+-  An incremental backup created from an empty bitmap will copy no data,
++    /*
-+   as if nothing has changed.
++     * bdrv_block_status_above doesn't merge different types of zeros, for
 +     * example, zeros which come from the region which is unallocated in
 +     * the whole backing chain, and zeros which come because of a short
 +     * backing file. So, we need a loop.
 +     */
 +    do {
 +        res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
 +        offset += nr;
 +        bytes -= nr;
 +    } while (res >= 0 && (res & BDRV_BLOCK_ZERO) && nr && bytes);
 +
-+.. code:: json
++    return res >= 0 && (res & BDRV_BLOCK_ZERO) && bytes == 0;
-+
+ }
-+    { "execute": "block-dirty-bitmap-clear",
-+      "arguments": {
+ static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
 +        "node": "drive0",
 +        "name": "bitmap0"
 +      }
 +    }
 +
 +Transactions
 +------------
 +
 +Justification
 +~~~~~~~~~~~~~
 +
 +Bitmaps can be safely modified when the VM is paused or halted by using
 +the basic QMP commands. For instance, you might perform the following
 +actions:
 +
 +1. Boot the VM in a paused state.
 +2. Create a full drive backup of drive0.
 +3. Create a new bitmap attached to drive0.
 +4. Resume execution of the VM.
 +5. Incremental backups are ready to be created.
 +
 +At this point, the bitmap and drive backup would be correctly in sync,
 +and incremental backups made from this point forward would be correctly
 +aligned to the full drive backup.
 +
 +This is not particularly useful if we decide we want to start
 +incremental backups after the VM has been running for a while, for which
 +we will need to perform actions such as the following:
 +
 +1. Boot the VM and begin execution.
 +2. Using a single transaction, perform the following operations:
 +
 +   -  Create ``bitmap0``.
 +   -  Create a full drive backup of ``drive0``.
 +
 +3. Incremental backups are now ready to be created.
 +
 +Supported Bitmap Transactions
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +-  ``block-dirty-bitmap-add``
 +-  ``block-dirty-bitmap-clear``
 +
 +The usages are identical to their respective QMP commands, but see below
 +for examples.
 +
 +Example: New Incremental Backup
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +As outlined in the justification, perhaps we want to create a new
 +incremental backup chain attached to a drive.
 +
 +.. code:: json
 +
 +    { "execute": "transaction",
 +      "arguments": {
 +        "actions": [
 +          {"type": "block-dirty-bitmap-add",
 +           "data": {"node": "drive0", "name": "bitmap0"} },
 +          {"type": "drive-backup",
 +           "data": {"device": "drive0", "target": "/path/to/full_backup.img",
 +                    "sync": "full", "format": "qcow2"} }
 +        ]
 +      }
 +    }
 +
 +Example: New Incremental Backup Anchor Point
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +Maybe we just want to create a new full backup with an existing bitmap
 +and want to reset the bitmap to track the new chain.
 +
 +.. code:: json
 +
 +    { "execute": "transaction",
 +      "arguments": {
 +        "actions": [
 +          {"type": "block-dirty-bitmap-clear",
 +           "data": {"node": "drive0", "name": "bitmap0"} },
 +          {"type": "drive-backup",
 +           "data": {"device": "drive0", "target": "/path/to/new_full_backup.img",
 +                    "sync": "full", "format": "qcow2"} }
 +        ]
 +      }
 +    }
 +
 +Incremental Backups
 +-------------------
 +
 +The star of the show.
 +
 +**Nota Bene!** Only incremental backups of entire drives are supported
 +for now. So despite the fact that you can attach a bitmap to any
 +arbitrary node, they are only currently useful when attached to the root
 +node. This is because drive-backup only supports drives/devices instead
 +of arbitrary nodes.
 +
 +Example: First Incremental Backup
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +1. Create a full backup and sync it to the dirty bitmap, as in the
 +   transactional examples above; or with the VM offline, manually create
 +   a full copy and then create a new bitmap before the VM begins
 +   execution.
 +
 +   -  Let's assume the full backup is named ``full_backup.img``.
 +   -  Let's assume the bitmap you created is ``bitmap0`` attached to
 +      ``drive0``.
 +
 +2. Create a destination image for the incremental backup that utilizes
 +   the full backup as a backing image.
 +
 +   -  Let's assume the new incremental image is named
 +      ``incremental.0.img``.
 +
 +   .. code:: bash
 +
 +       $ qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
 +
 +3. Issue the incremental backup command:
 +
 +   .. code:: json
 +
 +       { "execute": "drive-backup",
 +         "arguments": {
 +           "device": "drive0",
 +           "bitmap": "bitmap0",
 +           "target": "incremental.0.img",
 +           "format": "qcow2",
 +           "sync": "incremental",
 +           "mode": "existing"
 +         }
 +       }
 +
 +Example: Second Incremental Backup
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +1. Create a new destination image for the incremental backup that points
 +   to the previous one, e.g.: ``incremental.1.img``
 +
 +   .. code:: bash
 +
 +       $ qemu-img create -f qcow2 incremental.1.img -b incremental.0.img -F qcow2
 +
 +2. Issue a new incremental backup command. The only difference here is
 +   that we have changed the target image below.
 +
 +   .. code:: json
 +
 +       { "execute": "drive-backup",
 +         "arguments": {
 +           "device": "drive0",
 +           "bitmap": "bitmap0",
 +           "target": "incremental.1.img",
 +           "format": "qcow2",
 +           "sync": "incremental",
 +           "mode": "existing"
 +         }
 +       }
 +
 +Errors
 +------
 +
 +-  In the event of an error that occurs after a backup job is
 +   successfully launched, either by a direct QMP command or a QMP
 +   transaction, the user will receive a ``BLOCK_JOB_COMPLETE`` event with
 +   a failure message, accompanied by a ``BLOCK_JOB_ERROR`` event.
 +
 +-  In the case of an event being cancelled, the user will receive a
 +   ``BLOCK_JOB_CANCELLED`` event instead of a pair of COMPLETE and ERROR
 +   events.
 +
 +-  In either case, the incremental backup data contained within the
 +   bitmap is safely rolled back, and the data within the bitmap is not
 +   lost. The image file created for the failed attempt can be safely
 +   deleted.
 +
 +-  Once the underlying problem is fixed (e.g. more storage space is
 +   freed up), you can simply retry the incremental backup command with
 +   the same bitmap.
 +
 +Example
 +~~~~~~~
 +
 +1. Create a target image:
 +
 +   .. code:: bash
 +
 +       $ qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
 +
 +2. Attempt to create an incremental backup via QMP:
 +
 +   .. code:: json
 +
 +       { "execute": "drive-backup",
 +         "arguments": {
 +           "device": "drive0",
 +           "bitmap": "bitmap0",
 +           "target": "incremental.0.img",
 +           "format": "qcow2",
 +           "sync": "incremental",
 +           "mode": "existing"
 +         }
 +       }
 +
 +3. Receive an event notifying us of failure:
 +
 +   .. code:: json
 +
 +       { "timestamp": { "seconds": 1424709442, "microseconds": 844524 },
 +         "data": { "speed": 0, "offset": 0, "len": 67108864,
 +                   "error": "No space left on device",
 +                   "device": "drive1", "type": "backup" },
 +         "event": "BLOCK_JOB_COMPLETED" }
 +
 +4. Delete the failed incremental, and re-create the image.
 +
 +   .. code:: bash
 +
 +       $ rm incremental.0.img
 +       $ qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
 +
 +5. Retry the command after fixing the underlying problem, such as
 +   freeing up space on the backup volume:
 +
 +   .. code:: json
 +
 +       { "execute": "drive-backup",
 +         "arguments": {
 +           "device": "drive0",
 +           "bitmap": "bitmap0",
 +           "target": "incremental.0.img",
 +           "format": "qcow2",
 +           "sync": "incremental",
 +           "mode": "existing"
 +         }
 +       }
 +
 +6. Receive confirmation that the job completed successfully:
 +
 +   .. code:: json
 +
 +       { "timestamp": { "seconds": 1424709668, "microseconds": 526525 },
 +         "data": { "device": "drive1", "type": "backup",
 +                   "speed": 0, "len": 67108864, "offset": 67108864},
 +         "event": "BLOCK_JOB_COMPLETED" }
 +
 +Partial Transactional Failures
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +-  Sometimes, a transaction will succeed in launching and return
 +   success, but then later the backup jobs themselves may fail. It is
 +   possible that a management application may have to deal with a
 +   partial backup failure after a successful transaction.
 +
 +-  If multiple backup jobs are specified in a single transaction, when
 +   one of them fails, it will not interact with the other backup jobs in
 +   any way.
 +
 +-  The job(s) that succeeded will clear the dirty bitmap associated with
 +   the operation, but the job(s) that failed will not. It is not "safe"
 +   to delete any incremental backups that were created successfully in
 +   this scenario, even though others failed.
 +
 +Example
 +^^^^^^^
 +
 +-  QMP example highlighting two backup jobs:
 +
 +   .. code:: json
 +
 +       { "execute": "transaction",
 +         "arguments": {
 +           "actions": [
 +             { "type": "drive-backup",
 +               "data": { "device": "drive0", "bitmap": "bitmap0",
 +                         "format": "qcow2", "mode": "existing",
 +                         "sync": "incremental", "target": "d0-incr-1.qcow2" } },
 +             { "type": "drive-backup",
 +               "data": { "device": "drive1", "bitmap": "bitmap1",
 +                         "format": "qcow2", "mode": "existing",
 +                         "sync": "incremental", "target": "d1-incr-1.qcow2" } },
 +           ]
 +         }
 +       }
 +
 +-  QMP example response, highlighting one success and one failure:
 +
 +   -  Acknowledgement that the Transaction was accepted and jobs were
 +      launched:
 +
 +      .. code:: json
 +
 +          { "return": {} }
 +
 +   -  Later, QEMU sends notice that the first job was completed:
 +
 +      .. code:: json
 +
 +          { "timestamp": { "seconds": 1447192343, "microseconds": 615698 },
 +            "data": { "device": "drive0", "type": "backup",
 +                       "speed": 0, "len": 67108864, "offset": 67108864 },
 +            "event": "BLOCK_JOB_COMPLETED"
 +          }
 +
 +   -  Later yet, QEMU sends notice that the second job has failed:
 +
 +      .. code:: json
 +
 +          { "timestamp": { "seconds": 1447192399, "microseconds": 683015 },
 +            "data": { "device": "drive1", "action": "report",
 +                      "operation": "read" },
 +            "event": "BLOCK_JOB_ERROR" }
 +
 +      .. code:: json
 +
 +          { "timestamp": { "seconds": 1447192399, "microseconds":
 +          685853 }, "data": { "speed": 0, "offset": 0, "len": 67108864,
 +          "error": "Input/output error", "device": "drive1", "type":
 +          "backup" }, "event": "BLOCK_JOB_COMPLETED" }
 +
 +-  In the above example, ``d0-incr-1.qcow2`` is valid and must be kept,
 +   but ``d1-incr-1.qcow2`` is invalid and should be deleted. If a VM-wide
 +   incremental backup of all drives at a point-in-time is to be made,
 +   new backups for both drives will need to be made, taking into account
 +   that a new incremental backup for drive0 needs to be based on top of
 +   ``d0-incr-1.qcow2``.
 +
 +Grouped Completion Mode
 +~~~~~~~~~~~~~~~~~~~~~~~
 +
 +-  While jobs launched by transactions normally complete or fail on
 +   their own, it is possible to instruct them to complete or fail
 +   together as a group.
 +
 +-  QMP transactions take an optional properties structure that can
 +   affect the semantics of the transaction.
 +
 +-  The "completion-mode" transaction property can be either "individual"
 +   which is the default, legacy behavior described above, or "grouped,"
 +   a new behavior detailed below.
 +
 +-  Delayed Completion: In grouped completion mode, no jobs will report
 +   success until all jobs are ready to report success.
 +
 +-  Grouped failure: If any job fails in grouped completion mode, all
 +   remaining jobs will be cancelled. Any incremental backups will
 +   restore their dirty bitmap objects as if no backup command was ever
 +   issued.
 +
 +   -  Regardless of if QEMU reports a particular incremental backup job
 +      as CANCELLED or as an ERROR, the in-memory bitmap will be
 +      restored.
 +
 +Example
 +^^^^^^^
 +
 +-  Here's the same example scenario from above with the new property:
 +
 +   .. code:: json
 +
 +       { "execute": "transaction",
 +         "arguments": {
 +           "actions": [
 +             { "type": "drive-backup",
 +               "data": { "device": "drive0", "bitmap": "bitmap0",
 +                         "format": "qcow2", "mode": "existing",
 +                         "sync": "incremental", "target": "d0-incr-1.qcow2" } },
 +             { "type": "drive-backup",
 +               "data": { "device": "drive1", "bitmap": "bitmap1",
 +                         "format": "qcow2", "mode": "existing",
 +                         "sync": "incremental", "target": "d1-incr-1.qcow2" } },
 +           ],
 +           "properties": {
 +             "completion-mode": "grouped"
 +           }
 +         }
 +       }
 +
 +-  QMP example response, highlighting a failure for ``drive2``:
 +
 +   -  Acknowledgement that the Transaction was accepted and jobs were
 +      launched:
 +
 +      .. code:: json
 +
 +          { "return": {} }
 +
 +   -  Later, QEMU sends notice that the second job has errored out, but
 +      that the first job was also cancelled:
 +
 +      .. code:: json
 +
 +          { "timestamp": { "seconds": 1447193702, "microseconds": 632377 },
 +            "data": { "device": "drive1", "action": "report",
 +                      "operation": "read" },
 +            "event": "BLOCK_JOB_ERROR" }
 +
 +      .. code:: json
 +
 +          { "timestamp": { "seconds": 1447193702, "microseconds": 640074 },
 +            "data": { "speed": 0, "offset": 0, "len": 67108864,
 +                      "error": "Input/output error",
 +                      "device": "drive1", "type": "backup" },
 +            "event": "BLOCK_JOB_COMPLETED" }
 +
 +      .. code:: json
 +
 +          { "timestamp": { "seconds": 1447193702, "microseconds": 640163 },
 +            "data": { "device": "drive0", "type": "backup", "speed": 0,
 +                      "len": 67108864, "offset": 16777216 },
 +            "event": "BLOCK_JOB_CANCELLED" }
 +
 +.. raw:: html
 +
 +   <!--
 +   The FreeBSD Documentation License
 +
 +   Redistribution and use in source (Markdown) and 'compiled' forms (SGML, HTML,
 +   PDF, PostScript, RTF and so forth) with or without modification, are permitted
 +   provided that the following conditions are met:
 +
 +   Redistributions of source code (Markdown) must retain the above copyright
 +   notice, this list of conditions and the following disclaimer of this file
 +   unmodified.
 +
 +   Redistributions in compiled form (transformed to other DTDs, converted to PDF,
 +   PostScript, RTF and other formats) must reproduce the above copyright notice,
 +   this list of conditions and the following disclaimer in the documentation and/or
 +   other materials provided with the distribution.
 +
 +   THIS DOCUMENTATION IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS"
 +   AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
 +   IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR  PURPOSE ARE
 +   DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT HOLDER OR CONTRIBUTORS  BE LIABLE
 +   FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
 +   DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 +   SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER
 +   CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY,
 +   OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF
 +   THIS DOCUMENTATION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 +   -->
 --
-.9.4
+.26.2

-New patch
+[PULL v2 25/28] block/io: bdrv_common_block_status_above: support include_base
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+In order to reuse bdrv_common_block_status_above in
+bdrv_is_allocated_above, let's support include_base parameter.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20200924194003.22080-3-vsementsov@virtuozzo.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/coroutines.h |  2 ++
+ block/io.c         | 21 ++++++++++++++-------
+files changed, 16 insertions(+), 7 deletions(-)
+diff --git a/block/coroutines.h b/block/coroutines.h
+index XXXXXXX..XXXXXXX 100644
+--- a/block/coroutines.h
++++ b/block/coroutines.h
+@@ -XXX,XX +XXX,XX @@ bdrv_pwritev(BdrvChild *child, int64_t offset, unsigned int bytes,
+ int coroutine_fn
+ bdrv_co_common_block_status_above(BlockDriverState *bs,
+                                   BlockDriverState *base,
++                                  bool include_base,
+                                   bool want_zero,
+                                   int64_t offset,
+                                   int64_t bytes,
+@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
+ int generated_co_wrapper
+ bdrv_common_block_status_above(BlockDriverState *bs,
+                                BlockDriverState *base,
++                               bool include_base,
+                                bool want_zero,
+                                int64_t offset,
+                                int64_t bytes,
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ early_out:
+ int coroutine_fn
+ bdrv_co_common_block_status_above(BlockDriverState *bs,
+                                   BlockDriverState *base,
++                                  bool include_base,
+                                   bool want_zero,
+                                   int64_t offset,
+                                   int64_t bytes,
+@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
+     BlockDriverState *p;
+     int64_t eof = 0;
+-    assert(bs != base);
++    assert(include_base || bs != base);
++    assert(!include_base || base); /* Can't include NULL base */
+     ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
+-    if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED) {
++    if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
+         return ret;
+     }
+@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
+     assert(*pnum <= bytes);
+     bytes = *pnum;
+-    for (p = bdrv_filter_or_cow_bs(bs); p != base;
++    for (p = bdrv_filter_or_cow_bs(bs); include_base || p != base;
+          p = bdrv_filter_or_cow_bs(p))
+     {
+         ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map,
+@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
+             break;
+         }
++        if (p == base) {
++            assert(include_base);
++            break;
++        }
++
+         /*
+          * OK, [offset, offset + *pnum) region is unallocated on this layer,
+          * let's continue the diving.
+@@ -XXX,XX +XXX,XX @@ int bdrv_block_status_above(BlockDriverState *bs, BlockDriverState *base,
+                             int64_t offset, int64_t bytes, int64_t *pnum,
+                             int64_t *map, BlockDriverState **file)
+ {
+-    return bdrv_common_block_status_above(bs, base, true, offset, bytes,
++    return bdrv_common_block_status_above(bs, base, false, true, offset, bytes,
+                                           pnum, map, file);
+ }
+@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset,
+     int ret;
+     int64_t dummy;
+-    ret = bdrv_common_block_status_above(bs, bdrv_filter_or_cow_bs(bs), false,
+-                                         offset, bytes, pnum ? pnum : &dummy,
+-                                         NULL, NULL);
++    ret = bdrv_common_block_status_above(bs, bs, true, false, offset,
++                                         bytes, pnum ? pnum : &dummy, NULL,
++                                         NULL);
+     if (ret < 0) {
+         return ret;
+     }
+--
+.26.2

-New patch
+[PULL v2 26/28] block/io: bdrv_common_block_status_above: support bs == base
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+We are going to reuse bdrv_common_block_status_above in
+bdrv_is_allocated_above. bdrv_is_allocated_above may be called with
+include_base == false and still bs == base (for ex. from img_rebase()).
+So, support this corner case.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Message-id: 20200924194003.22080-4-vsementsov@virtuozzo.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/io.c | 6 +++++-
+file changed, 5 insertions(+), 1 deletion(-)
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
+     BlockDriverState *p;
+     int64_t eof = 0;
+-    assert(include_base || bs != base);
+     assert(!include_base || base); /* Can't include NULL base */
++    if (!include_base && bs == base) {
++        *pnum = bytes;
++        return 0;
++    }
++
+     ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
+     if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
+         return ret;
+--
+.26.2

-New patch
+[PULL v2 27/28] block/io: fix bdrv_is_allocated_above
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+bdrv_is_allocated_above wrongly handles short backing files: it reports
+after-EOF space as UNALLOCATED which is wrong, as on read the data is
+generated on the level of short backing file (if all overlays have
+unallocated areas at that place).
+Reusing bdrv_common_block_status_above fixes the issue and unifies code
+path.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Message-id: 20200924194003.22080-5-vsementsov@virtuozzo.com
+[Fix s/has/have/ as suggested by Eric Blake. Fix s/area/areas/.
+--Stefan]
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ block/io.c | 43 +++++--------------------------------------
+file changed, 5 insertions(+), 38 deletions(-)
+diff --git a/block/io.c b/block/io.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/io.c
++++ b/block/io.c
+@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset,
+  * at 'offset + *pnum' may return the same allocation status (in other
+  * words, the result is not necessarily the maximum possible range);
+  * but 'pnum' will only be 0 when end of file is reached.
+- *
+  */
+ int bdrv_is_allocated_above(BlockDriverState *top,
+                             BlockDriverState *base,
+                             bool include_base, int64_t offset,
+                             int64_t bytes, int64_t *pnum)
+ {
+-    BlockDriverState *intermediate;
+-    int ret;
+-    int64_t n = bytes;
+-
+-    assert(base || !include_base);
+-
+-    intermediate = top;
+-    while (include_base || intermediate != base) {
+-        int64_t pnum_inter;
+-        int64_t size_inter;
+-
+-        assert(intermediate);
+-        ret = bdrv_is_allocated(intermediate, offset, bytes, &pnum_inter);
+-        if (ret < 0) {
+-            return ret;
+-        }
+-        if (ret) {
+-            *pnum = pnum_inter;
+-            return 1;
+-        }
+-
+-        size_inter = bdrv_getlength(intermediate);
+-        if (size_inter < 0) {
+-            return size_inter;
+-        }
+-        if (n > pnum_inter &&
+-            (intermediate == top || offset + pnum_inter < size_inter)) {
+-            n = pnum_inter;
+-        }
+-
+-        if (intermediate == base) {
+-            break;
+-        }
+-
+-        intermediate = bdrv_filter_or_cow_bs(intermediate);
++    int ret = bdrv_common_block_status_above(top, base, include_base, false,
++                                             offset, bytes, pnum, NULL, NULL);
++    if (ret < 0) {
++        return ret;
+     }
+-    *pnum = n;
+-    return 0;
++    return !!(ret & BDRV_BLOCK_ALLOCATED);
+ }
+ int coroutine_fn
+--
+.26.2

-New patch
+[PULL v2 28/28] iotests: add commit top->base cases to 274
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+These cases are fixed by previous patches around block_status and
+is_allocated.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Message-id: 20200924194003.22080-6-vsementsov@virtuozzo.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ tests/qemu-iotests/274     | 20 +++++++++++
+ tests/qemu-iotests/274.out | 68 ++++++++++++++++++++++++++++++++++++++
+files changed, 88 insertions(+)
+diff --git a/tests/qemu-iotests/274 b/tests/qemu-iotests/274
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/274
++++ b/tests/qemu-iotests/274
+@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('base') as base, \
+     iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
+     iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
++    iotests.log('=== Testing qemu-img commit (top -> base) ===')
++
++    create_chain()
++    iotests.qemu_img_log('commit', '-b', base, top)
++    iotests.img_info_log(base)
++    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, base)
++    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), base)
++
++    iotests.log('=== Testing QMP active commit (top -> base) ===')
++
++    create_chain()
++    with create_vm() as vm:
++        vm.launch()
++        vm.qmp_log('block-commit', device='top', base_node='base',
++                   job_id='job0', auto_dismiss=False)
++        vm.run_job('job0', wait=5)
++
++    iotests.img_info_log(mid)
++    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, base)
++    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), base)
+     iotests.log('== Resize tests ==')
+diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/274.out
++++ b/tests/qemu-iotests/274.out
+@@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 0
+ read 1048576/1048576 bytes at offset 1048576
+MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++=== Testing qemu-img commit (top -> base) ===
++Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 lazy_refcounts=off refcount_bits=16
++
++Formatting 'TEST_DIR/PID-mid', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=1048576 backing_file=TEST_DIR/PID-base backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
++
++Formatting 'TEST_DIR/PID-top', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 backing_file=TEST_DIR/PID-mid backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
++
++wrote 2097152/2097152 bytes at offset 0
++2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
++Image committed.
++
++image: TEST_IMG
++file format: IMGFMT
++virtual size: 2 MiB (2097152 bytes)
++cluster_size: 65536
++Format specific information:
++    compat: 1.1
++    compression type: zlib
++    lazy refcounts: false
++    refcount bits: 16
++    corrupt: false
++    extended l2: false
++
++read 1048576/1048576 bytes at offset 0
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
++read 1048576/1048576 bytes at offset 1048576
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
++=== Testing QMP active commit (top -> base) ===
++Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 lazy_refcounts=off refcount_bits=16
++
++Formatting 'TEST_DIR/PID-mid', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=1048576 backing_file=TEST_DIR/PID-base backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
++
++Formatting 'TEST_DIR/PID-top', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 backing_file=TEST_DIR/PID-mid backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
++
++wrote 2097152/2097152 bytes at offset 0
++2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
++{"execute": "block-commit", "arguments": {"auto-dismiss": false, "base-node": "base", "device": "top", "job-id": "job0"}}
++{"return": {}}
++{"execute": "job-complete", "arguments": {"id": "job0"}}
++{"return": {}}
++{"data": {"device": "job0", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
++{"data": {"device": "job0", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
++{"execute": "job-dismiss", "arguments": {"id": "job0"}}
++{"return": {}}
++image: TEST_IMG
++file format: IMGFMT
++virtual size: 1 MiB (1048576 bytes)
++cluster_size: 65536
++backing file: TEST_DIR/PID-base
++backing file format: IMGFMT
++Format specific information:
++    compat: 1.1
++    compression type: zlib
++    lazy refcounts: false
++    refcount bits: 16
++    corrupt: false
++    extended l2: false
++
++read 1048576/1048576 bytes at offset 0
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
++read 1048576/1048576 bytes at offset 1048576
++1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
+ == Resize tests ==
+ === preallocation=off ===
+ Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=6442450944 lazy_refcounts=off refcount_bits=16
+--
+.26.2

The following changes since commit ca4e667dbf431d4a2a5a619cde79d30dd2ac3eb2:

Merge remote-tracking branch 'remotes/kraxel/tags/usb-20170717-pull-request' into staging (2017-07-17 17:54:17 +0100)

are available in the git repository at:

git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request

for you to fetch changes up to 8508eee740c78d1465e25dad7c3e06137485dfbc:

live-block-ops.txt: Rename, rewrite, and improve it (2017-07-18 00:11:01 -0400)

----------------------------------------------------------------
Block patches (documentation)
----------------------------------------------------------------

Kashyap Chamarthy (2):
  bitmaps.md: Convert to rST; move it into 'interop' dir
  live-block-ops.txt: Rename, rewrite, and improve it

docs/devel/bitmaps.md                  |  505 ---------------
 docs/interop/bitmaps.rst               |  555 ++++++++++++++++
 docs/interop/live-block-operations.rst | 1088 ++++++++++++++++++++++++++++++++
 docs/live-block-ops.txt                |   72 ---
 4 files changed, 1643 insertions(+), 577 deletions(-)
 delete mode 100644 docs/devel/bitmaps.md
 create mode 100644 docs/interop/bitmaps.rst
 create mode 100644 docs/interop/live-block-operations.rst
 delete mode 100644 docs/live-block-ops.txt

-- 
2.9.4

From: Kashyap Chamarthy <kchamart@redhat.com>

This is part of the on-going effort to convert QEMU upstream
documentation syntax to reStructuredText (rST).

The conversion to rST was done using:

$ pandoc -f markdown -t rst bitmaps.md -o bitmaps.rst

Then, make a couple of small syntactical adjustments.  While at it,
reword a statement to avoid ambiguity.  Addressing the feedback from
this thread:

https://lists.nongnu.org/archive/html/qemu-devel/2017-06/msg05428.html

Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: John Snow <jsnow@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20170717105205.32639-2-kchamart@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 docs/devel/bitmaps.md    | 505 ------------------------------------------
 docs/interop/bitmaps.rst | 555 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 555 insertions(+), 505 deletions(-)
 delete mode 100644 docs/devel/bitmaps.md
 create mode 100644 docs/interop/bitmaps.rst

diff --git a/docs/devel/bitmaps.md b/docs/devel/bitmaps.md
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/devel/bitmaps.md
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-
-
-# Dirty Bitmaps and Incremental Backup
-
-* Dirty Bitmaps are objects that track which data needs to be backed up for the
-  next incremental backup.
-
-* Dirty bitmaps can be created at any time and attached to any node
-  (not just complete drives.)
-
-## Dirty Bitmap Names
-
-* A dirty bitmap's name is unique to the node, but bitmaps attached to different
-  nodes can share the same name.
-
-* Dirty bitmaps created for internal use by QEMU may be anonymous and have no
-  name, but any user-created bitmaps may not be. There can be any number of
-  anonymous bitmaps per node.
-
-* The name of a user-created bitmap must not be empty ("").
-
-## Bitmap Modes
-
-* A Bitmap can be "frozen," which means that it is currently in-use by a backup
-  operation and cannot be deleted, renamed, written to, reset,
-  etc.
-
-* The normal operating mode for a bitmap is "active."
-
-## Basic QMP Usage
-
-### Supported Commands ###
-
-* block-dirty-bitmap-add
-* block-dirty-bitmap-remove
-* block-dirty-bitmap-clear
-
-### Creation
-
-* To create a new bitmap, enabled, on the drive with id=drive0:
-
-```json
-{ "execute": "block-dirty-bitmap-add",
-  "arguments": {
-    "node": "drive0",
-    "name": "bitmap0"
-  }
-}
-```
-
-* This bitmap will have a default granularity that matches the cluster size of
-  its associated drive, if available, clamped to between [4KiB, 64KiB].
-  The current default for qcow2 is 64KiB.
-
-* To create a new bitmap that tracks changes in 32KiB segments:
-
-```json
-{ "execute": "block-dirty-bitmap-add",
-  "arguments": {
-    "node": "drive0",
-    "name": "bitmap0",
-    "granularity": 32768
-  }
-}
-```
-
-### Deletion
-
-* Bitmaps that are frozen cannot be deleted.
-
-* Deleting the bitmap does not impact any other bitmaps attached to the same
-  node, nor does it affect any backups already created from this node.
-
-* Because bitmaps are only unique to the node to which they are attached,
-  you must specify the node/drive name here, too.
-
-```json
-{ "execute": "block-dirty-bitmap-remove",
-  "arguments": {
-    "node": "drive0",
-    "name": "bitmap0"
-  }
-}
-```
-
-### Resetting
-
-* Resetting a bitmap will clear all information it holds.
-
-* An incremental backup created from an empty bitmap will copy no data,
-  as if nothing has changed.
-
-```json
-{ "execute": "block-dirty-bitmap-clear",
-  "arguments": {
-    "node": "drive0",
-    "name": "bitmap0"
-  }
-}
-```
-
-## Transactions
-
-### Justification
-
-Bitmaps can be safely modified when the VM is paused or halted by using
-the basic QMP commands. For instance, you might perform the following actions:
-
-1. Boot the VM in a paused state.
-2. Create a full drive backup of drive0.
-3. Create a new bitmap attached to drive0.
-4. Resume execution of the VM.
-5. Incremental backups are ready to be created.
-
-At this point, the bitmap and drive backup would be correctly in sync,
-and incremental backups made from this point forward would be correctly aligned
-to the full drive backup.
-
-This is not particularly useful if we decide we want to start incremental
-backups after the VM has been running for a while, for which we will need to
-perform actions such as the following:
-
-1. Boot the VM and begin execution.
-2. Using a single transaction, perform the following operations:
-    * Create bitmap0.
-    * Create a full drive backup of drive0.
-3. Incremental backups are now ready to be created.
-
-### Supported Bitmap Transactions
-
-* block-dirty-bitmap-add
-* block-dirty-bitmap-clear
-
-The usages are identical to their respective QMP commands, but see below
-for examples.
-
-### Example: New Incremental Backup
-
-As outlined in the justification, perhaps we want to create a new incremental
-backup chain attached to a drive.
-
-```json
-{ "execute": "transaction",
-  "arguments": {
-    "actions": [
-      {"type": "block-dirty-bitmap-add",
-       "data": {"node": "drive0", "name": "bitmap0"} },
-      {"type": "drive-backup",
-       "data": {"device": "drive0", "target": "/path/to/full_backup.img",
-                "sync": "full", "format": "qcow2"} }
-    ]
-  }
-}
-```
-
-### Example: New Incremental Backup Anchor Point
-
-Maybe we just want to create a new full backup with an existing bitmap and
-want to reset the bitmap to track the new chain.
-
-```json
-{ "execute": "transaction",
-  "arguments": {
-    "actions": [
-      {"type": "block-dirty-bitmap-clear",
-       "data": {"node": "drive0", "name": "bitmap0"} },
-      {"type": "drive-backup",
-       "data": {"device": "drive0", "target": "/path/to/new_full_backup.img",
-                "sync": "full", "format": "qcow2"} }
-    ]
-  }
-}
-```
-
-## Incremental Backups
-
-The star of the show.
-
-**Nota Bene!** Only incremental backups of entire drives are supported for now.
-So despite the fact that you can attach a bitmap to any arbitrary node, they are
-only currently useful when attached to the root node. This is because
-drive-backup only supports drives/devices instead of arbitrary nodes.
-
-### Example: First Incremental Backup
-
-1. Create a full backup and sync it to the dirty bitmap, as in the transactional
-examples above; or with the VM offline, manually create a full copy and then
-create a new bitmap before the VM begins execution.
-
-    * Let's assume the full backup is named 'full_backup.img'.
-    * Let's assume the bitmap you created is 'bitmap0' attached to 'drive0'.
-
-2. Create a destination image for the incremental backup that utilizes the
-full backup as a backing image.
-
-    * Let's assume it is named 'incremental.0.img'.
-
-    ```sh
-    # qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
-    ```
-
-3. Issue the incremental backup command:
-
-    ```json
-    { "execute": "drive-backup",
-      "arguments": {
-        "device": "drive0",
-        "bitmap": "bitmap0",
-        "target": "incremental.0.img",
-        "format": "qcow2",
-        "sync": "incremental",
-        "mode": "existing"
-      }
-    }
-    ```
-
-### Example: Second Incremental Backup
-
-1. Create a new destination image for the incremental backup that points to the
-   previous one, e.g.: 'incremental.1.img'
-
-    ```sh
-    # qemu-img create -f qcow2 incremental.1.img -b incremental.0.img -F qcow2
-    ```
-
-2. Issue a new incremental backup command. The only difference here is that we
-   have changed the target image below.
-
-    ```json
-    { "execute": "drive-backup",
-      "arguments": {
-        "device": "drive0",
-        "bitmap": "bitmap0",
-        "target": "incremental.1.img",
-        "format": "qcow2",
-        "sync": "incremental",
-        "mode": "existing"
-      }
-    }
-    ```
-
-## Errors
-
-* In the event of an error that occurs after a backup job is successfully
-  launched, either by a direct QMP command or a QMP transaction, the user
-  will receive a BLOCK_JOB_COMPLETE event with a failure message, accompanied
-  by a BLOCK_JOB_ERROR event.
-
-* In the case of an event being cancelled, the user will receive a
-  BLOCK_JOB_CANCELLED event instead of a pair of COMPLETE and ERROR events.
-
-* In either case, the incremental backup data contained within the bitmap is
-  safely rolled back, and the data within the bitmap is not lost. The image
-  file created for the failed attempt can be safely deleted.
-
-* Once the underlying problem is fixed (e.g. more storage space is freed up),
-  you can simply retry the incremental backup command with the same bitmap.
-
-### Example
-
-1. Create a target image:
-
-    ```sh
-    # qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
-    ```
-
-2. Attempt to create an incremental backup via QMP:
-
-    ```json
-    { "execute": "drive-backup",
-      "arguments": {
-        "device": "drive0",
-        "bitmap": "bitmap0",
-        "target": "incremental.0.img",
-        "format": "qcow2",
-        "sync": "incremental",
-        "mode": "existing"
-      }
-    }
-    ```
-
-3. Receive an event notifying us of failure:
-
-    ```json
-    { "timestamp": { "seconds": 1424709442, "microseconds": 844524 },
-      "data": { "speed": 0, "offset": 0, "len": 67108864,
-                "error": "No space left on device",
-                "device": "drive1", "type": "backup" },
-      "event": "BLOCK_JOB_COMPLETED" }
-    ```
-
-4. Delete the failed incremental, and re-create the image.
-
-    ```sh
-    # rm incremental.0.img
-    # qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
-    ```
-
-5. Retry the command after fixing the underlying problem,
-   such as freeing up space on the backup volume:
-
-    ```json
-    { "execute": "drive-backup",
-      "arguments": {
-        "device": "drive0",
-        "bitmap": "bitmap0",
-        "target": "incremental.0.img",
-        "format": "qcow2",
-        "sync": "incremental",
-        "mode": "existing"
-      }
-    }
-    ```
-
-6. Receive confirmation that the job completed successfully:
-
-    ```json
-    { "timestamp": { "seconds": 1424709668, "microseconds": 526525 },
-      "data": { "device": "drive1", "type": "backup",
-                "speed": 0, "len": 67108864, "offset": 67108864},
-      "event": "BLOCK_JOB_COMPLETED" }
-    ```
-
-### Partial Transactional Failures
-
-* Sometimes, a transaction will succeed in launching and return success,
-  but then later the backup jobs themselves may fail. It is possible that
-  a management application may have to deal with a partial backup failure
-  after a successful transaction.
-
-* If multiple backup jobs are specified in a single transaction, when one of
-  them fails, it will not interact with the other backup jobs in any way.
-
-* The job(s) that succeeded will clear the dirty bitmap associated with the
-  operation, but the job(s) that failed will not. It is not "safe" to delete
-  any incremental backups that were created successfully in this scenario,
-  even though others failed.
-
-#### Example
-
-* QMP example highlighting two backup jobs:
-
-    ```json
-    { "execute": "transaction",
-      "arguments": {
-        "actions": [
-          { "type": "drive-backup",
-            "data": { "device": "drive0", "bitmap": "bitmap0",
-                      "format": "qcow2", "mode": "existing",
-                      "sync": "incremental", "target": "d0-incr-1.qcow2" } },
-          { "type": "drive-backup",
-            "data": { "device": "drive1", "bitmap": "bitmap1",
-                      "format": "qcow2", "mode": "existing",
-                      "sync": "incremental", "target": "d1-incr-1.qcow2" } },
-        ]
-      }
-    }
-    ```
-
-* QMP example response, highlighting one success and one failure:
-    * Acknowledgement that the Transaction was accepted and jobs were launched:
-        ```json
-        { "return": {} }
-        ```
-
-    * Later, QEMU sends notice that the first job was completed:
-        ```json
-        { "timestamp": { "seconds": 1447192343, "microseconds": 615698 },
-          "data": { "device": "drive0", "type": "backup",
-                     "speed": 0, "len": 67108864, "offset": 67108864 },
-          "event": "BLOCK_JOB_COMPLETED"
-        }
-        ```
-
-    * Later yet, QEMU sends notice that the second job has failed:
-        ```json
-        { "timestamp": { "seconds": 1447192399, "microseconds": 683015 },
-          "data": { "device": "drive1", "action": "report",
-                    "operation": "read" },
-          "event": "BLOCK_JOB_ERROR" }
-        ```
-
-        ```json
-        { "timestamp": { "seconds": 1447192399, "microseconds": 685853 },
-          "data": { "speed": 0, "offset": 0, "len": 67108864,
-                    "error": "Input/output error",
-                    "device": "drive1", "type": "backup" },
-          "event": "BLOCK_JOB_COMPLETED" }
-
-* In the above example, "d0-incr-1.qcow2" is valid and must be kept,
-  but "d1-incr-1.qcow2" is invalid and should be deleted. If a VM-wide
-  incremental backup of all drives at a point-in-time is to be made,
-  new backups for both drives will need to be made, taking into account
-  that a new incremental backup for drive0 needs to be based on top of
-  "d0-incr-1.qcow2."
-
-### Grouped Completion Mode
-
-* While jobs launched by transactions normally complete or fail on their own,
-  it is possible to instruct them to complete or fail together as a group.
-
-* QMP transactions take an optional properties structure that can affect
-  the semantics of the transaction.
-
-* The "completion-mode" transaction property can be either "individual"
-  which is the default, legacy behavior described above, or "grouped,"
-  a new behavior detailed below.
-
-* Delayed Completion: In grouped completion mode, no jobs will report
-  success until all jobs are ready to report success.
-
-* Grouped failure: If any job fails in grouped completion mode, all remaining
-  jobs will be cancelled. Any incremental backups will restore their dirty
-  bitmap objects as if no backup command was ever issued.
-
-    * Regardless of if QEMU reports a particular incremental backup job as
-      CANCELLED or as an ERROR, the in-memory bitmap will be restored.
-
-#### Example
-
-* Here's the same example scenario from above with the new property:
-
-    ```json
-    { "execute": "transaction",
-      "arguments": {
-        "actions": [
-          { "type": "drive-backup",
-            "data": { "device": "drive0", "bitmap": "bitmap0",
-                      "format": "qcow2", "mode": "existing",
-                      "sync": "incremental", "target": "d0-incr-1.qcow2" } },
-          { "type": "drive-backup",
-            "data": { "device": "drive1", "bitmap": "bitmap1",
-                      "format": "qcow2", "mode": "existing",
-                      "sync": "incremental", "target": "d1-incr-1.qcow2" } },
-        ],
-        "properties": {
-          "completion-mode": "grouped"
-        }
-      }
-    }
-    ```
-
-* QMP example response, highlighting a failure for drive2:
-    * Acknowledgement that the Transaction was accepted and jobs were launched:
-        ```json
-        { "return": {} }
-        ```
-
-    * Later, QEMU sends notice that the second job has errored out,
-      but that the first job was also cancelled:
-        ```json
-        { "timestamp": { "seconds": 1447193702, "microseconds": 632377 },
-          "data": { "device": "drive1", "action": "report",
-                    "operation": "read" },
-          "event": "BLOCK_JOB_ERROR" }
-        ```
-
-        ```json
-        { "timestamp": { "seconds": 1447193702, "microseconds": 640074 },
-          "data": { "speed": 0, "offset": 0, "len": 67108864,
-                    "error": "Input/output error",
-                    "device": "drive1", "type": "backup" },
-          "event": "BLOCK_JOB_COMPLETED" }
-        ```
-
-        ```json
-        { "timestamp": { "seconds": 1447193702, "microseconds": 640163 },
-          "data": { "device": "drive0", "type": "backup", "speed": 0,
-                    "len": 67108864, "offset": 16777216 },
-          "event": "BLOCK_JOB_CANCELLED" }
-        ```
-
-
diff --git a/docs/interop/bitmaps.rst b/docs/interop/bitmaps.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/bitmaps.rst
@@ -XXX,XX +XXX,XX @@
+..
+   Copyright 2015 John Snow <jsnow@redhat.com> and Red Hat, Inc.
+   All rights reserved.
+
+   This file is licensed via The FreeBSD Documentation License, the full
+   text of which is included at the end of this document.
+
+====================================
+Dirty Bitmaps and Incremental Backup
+====================================
+
+-  Dirty Bitmaps are objects that track which data needs to be backed up
+   for the next incremental backup.
+
+-  Dirty bitmaps can be created at any time and attached to any node
+   (not just complete drives).
+
+.. contents::
+
+Dirty Bitmap Names
+------------------
+
+-  A dirty bitmap's name is unique to the node, but bitmaps attached to
+   different nodes can share the same name.
+
+-  Dirty bitmaps created for internal use by QEMU may be anonymous and
+   have no name, but any user-created bitmaps must have a name. There
+   can be any number of anonymous bitmaps per node.
+
+-  The name of a user-created bitmap must not be empty ("").
+
+Bitmap Modes
+------------
+
+-  A bitmap can be "frozen," which means that it is currently in-use by
+   a backup operation and cannot be deleted, renamed, written to, reset,
+   etc.
+
+-  The normal operating mode for a bitmap is "active."
+
+Basic QMP Usage
+---------------
+
+Supported Commands
+~~~~~~~~~~~~~~~~~~
+
+- ``block-dirty-bitmap-add``
+- ``block-dirty-bitmap-remove``
+- ``block-dirty-bitmap-clear``
+
+Creation
+~~~~~~~~
+
+-  To create a new bitmap, enabled, on the drive with id=drive0:
+
+.. code:: json
+
+    { "execute": "block-dirty-bitmap-add",
+      "arguments": {
+        "node": "drive0",
+        "name": "bitmap0"
+      }
+    }
+
+-  This bitmap will have a default granularity that matches the cluster
+   size of its associated drive, if available, clamped to between [4KiB,
+   64KiB]. The current default for qcow2 is 64KiB.
+
+-  To create a new bitmap that tracks changes in 32KiB segments:
+
+.. code:: json
+
+    { "execute": "block-dirty-bitmap-add",
+      "arguments": {
+        "node": "drive0",
+        "name": "bitmap0",
+        "granularity": 32768
+      }
+    }
+
+Deletion
+~~~~~~~~
+
+-  Bitmaps that are frozen cannot be deleted.
+
+-  Deleting the bitmap does not impact any other bitmaps attached to the
+   same node, nor does it affect any backups already created from this
+   node.
+
+-  Because bitmaps are only unique to the node to which they are
+   attached, you must specify the node/drive name here, too.
+
+.. code:: json
+
+    { "execute": "block-dirty-bitmap-remove",
+      "arguments": {
+        "node": "drive0",
+        "name": "bitmap0"
+      }
+    }
+
+Resetting
+~~~~~~~~~
+
+-  Resetting a bitmap will clear all information it holds.
+
+-  An incremental backup created from an empty bitmap will copy no data,
+   as if nothing has changed.
+
+.. code:: json
+
+    { "execute": "block-dirty-bitmap-clear",
+      "arguments": {
+        "node": "drive0",
+        "name": "bitmap0"
+      }
+    }
+
+Transactions
+------------
+
+Justification
+~~~~~~~~~~~~~
+
+Bitmaps can be safely modified when the VM is paused or halted by using
+the basic QMP commands. For instance, you might perform the following
+actions:
+
+1. Boot the VM in a paused state.
+2. Create a full drive backup of drive0.
+3. Create a new bitmap attached to drive0.
+4. Resume execution of the VM.
+5. Incremental backups are ready to be created.
+
+At this point, the bitmap and drive backup would be correctly in sync,
+and incremental backups made from this point forward would be correctly
+aligned to the full drive backup.
+
+This is not particularly useful if we decide we want to start
+incremental backups after the VM has been running for a while, for which
+we will need to perform actions such as the following:
+
+1. Boot the VM and begin execution.
+2. Using a single transaction, perform the following operations:
+
+   -  Create ``bitmap0``.
+   -  Create a full drive backup of ``drive0``.
+
+3. Incremental backups are now ready to be created.
+
+Supported Bitmap Transactions
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+-  ``block-dirty-bitmap-add``
+-  ``block-dirty-bitmap-clear``
+
+The usages are identical to their respective QMP commands, but see below
+for examples.
+
+Example: New Incremental Backup
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+As outlined in the justification, perhaps we want to create a new
+incremental backup chain attached to a drive.
+
+.. code:: json
+
+    { "execute": "transaction",
+      "arguments": {
+        "actions": [
+          {"type": "block-dirty-bitmap-add",
+           "data": {"node": "drive0", "name": "bitmap0"} },
+          {"type": "drive-backup",
+           "data": {"device": "drive0", "target": "/path/to/full_backup.img",
+                    "sync": "full", "format": "qcow2"} }
+        ]
+      }
+    }
+
+Example: New Incremental Backup Anchor Point
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Maybe we just want to create a new full backup with an existing bitmap
+and want to reset the bitmap to track the new chain.
+
+.. code:: json
+
+    { "execute": "transaction",
+      "arguments": {
+        "actions": [
+          {"type": "block-dirty-bitmap-clear",
+           "data": {"node": "drive0", "name": "bitmap0"} },
+          {"type": "drive-backup",
+           "data": {"device": "drive0", "target": "/path/to/new_full_backup.img",
+                    "sync": "full", "format": "qcow2"} }
+        ]
+      }
+    }
+
+Incremental Backups
+-------------------
+
+The star of the show.
+
+**Nota Bene!** Only incremental backups of entire drives are supported
+for now. So despite the fact that you can attach a bitmap to any
+arbitrary node, they are only currently useful when attached to the root
+node. This is because drive-backup only supports drives/devices instead
+of arbitrary nodes.
+
+Example: First Incremental Backup
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+1. Create a full backup and sync it to the dirty bitmap, as in the
+   transactional examples above; or with the VM offline, manually create
+   a full copy and then create a new bitmap before the VM begins
+   execution.
+
+   -  Let's assume the full backup is named ``full_backup.img``.
+   -  Let's assume the bitmap you created is ``bitmap0`` attached to
+      ``drive0``.
+
+2. Create a destination image for the incremental backup that utilizes
+   the full backup as a backing image.
+
+   -  Let's assume the new incremental image is named
+      ``incremental.0.img``.
+
+   .. code:: bash
+
+       $ qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
+
+3. Issue the incremental backup command:
+
+   .. code:: json
+
+       { "execute": "drive-backup",
+         "arguments": {
+           "device": "drive0",
+           "bitmap": "bitmap0",
+           "target": "incremental.0.img",
+           "format": "qcow2",
+           "sync": "incremental",
+           "mode": "existing"
+         }
+       }
+
+Example: Second Incremental Backup
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+1. Create a new destination image for the incremental backup that points
+   to the previous one, e.g.: ``incremental.1.img``
+
+   .. code:: bash
+
+       $ qemu-img create -f qcow2 incremental.1.img -b incremental.0.img -F qcow2
+
+2. Issue a new incremental backup command. The only difference here is
+   that we have changed the target image below.
+
+   .. code:: json
+
+       { "execute": "drive-backup",
+         "arguments": {
+           "device": "drive0",
+           "bitmap": "bitmap0",
+           "target": "incremental.1.img",
+           "format": "qcow2",
+           "sync": "incremental",
+           "mode": "existing"
+         }
+       }
+
+Errors
+------
+
+-  In the event of an error that occurs after a backup job is
+   successfully launched, either by a direct QMP command or a QMP
+   transaction, the user will receive a ``BLOCK_JOB_COMPLETE`` event with
+   a failure message, accompanied by a ``BLOCK_JOB_ERROR`` event.
+
+-  In the case of an event being cancelled, the user will receive a
+   ``BLOCK_JOB_CANCELLED`` event instead of a pair of COMPLETE and ERROR
+   events.
+
+-  In either case, the incremental backup data contained within the
+   bitmap is safely rolled back, and the data within the bitmap is not
+   lost. The image file created for the failed attempt can be safely
+   deleted.
+
+-  Once the underlying problem is fixed (e.g. more storage space is
+   freed up), you can simply retry the incremental backup command with
+   the same bitmap.
+
+Example
+~~~~~~~
+
+1. Create a target image:
+
+   .. code:: bash
+
+       $ qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
+
+2. Attempt to create an incremental backup via QMP:
+
+   .. code:: json
+
+       { "execute": "drive-backup",
+         "arguments": {
+           "device": "drive0",
+           "bitmap": "bitmap0",
+           "target": "incremental.0.img",
+           "format": "qcow2",
+           "sync": "incremental",
+           "mode": "existing"
+         }
+       }
+
+3. Receive an event notifying us of failure:
+
+   .. code:: json
+
+       { "timestamp": { "seconds": 1424709442, "microseconds": 844524 },
+         "data": { "speed": 0, "offset": 0, "len": 67108864,
+                   "error": "No space left on device",
+                   "device": "drive1", "type": "backup" },
+         "event": "BLOCK_JOB_COMPLETED" }
+
+4. Delete the failed incremental, and re-create the image.
+
+   .. code:: bash
+
+       $ rm incremental.0.img
+       $ qemu-img create -f qcow2 incremental.0.img -b full_backup.img -F qcow2
+
+5. Retry the command after fixing the underlying problem, such as
+   freeing up space on the backup volume:
+
+   .. code:: json
+
+       { "execute": "drive-backup",
+         "arguments": {
+           "device": "drive0",
+           "bitmap": "bitmap0",
+           "target": "incremental.0.img",
+           "format": "qcow2",
+           "sync": "incremental",
+           "mode": "existing"
+         }
+       }
+
+6. Receive confirmation that the job completed successfully:
+
+   .. code:: json
+
+       { "timestamp": { "seconds": 1424709668, "microseconds": 526525 },
+         "data": { "device": "drive1", "type": "backup",
+                   "speed": 0, "len": 67108864, "offset": 67108864},
+         "event": "BLOCK_JOB_COMPLETED" }
+
+Partial Transactional Failures
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+-  Sometimes, a transaction will succeed in launching and return
+   success, but then later the backup jobs themselves may fail. It is
+   possible that a management application may have to deal with a
+   partial backup failure after a successful transaction.
+
+-  If multiple backup jobs are specified in a single transaction, when
+   one of them fails, it will not interact with the other backup jobs in
+   any way.
+
+-  The job(s) that succeeded will clear the dirty bitmap associated with
+   the operation, but the job(s) that failed will not. It is not "safe"
+   to delete any incremental backups that were created successfully in
+   this scenario, even though others failed.
+
+Example
+^^^^^^^
+
+-  QMP example highlighting two backup jobs:
+
+   .. code:: json
+
+       { "execute": "transaction",
+         "arguments": {
+           "actions": [
+             { "type": "drive-backup",
+               "data": { "device": "drive0", "bitmap": "bitmap0",
+                         "format": "qcow2", "mode": "existing",
+                         "sync": "incremental", "target": "d0-incr-1.qcow2" } },
+             { "type": "drive-backup",
+               "data": { "device": "drive1", "bitmap": "bitmap1",
+                         "format": "qcow2", "mode": "existing",
+                         "sync": "incremental", "target": "d1-incr-1.qcow2" } },
+           ]
+         }
+       }
+
+-  QMP example response, highlighting one success and one failure:
+
+   -  Acknowledgement that the Transaction was accepted and jobs were
+      launched:
+
+      .. code:: json
+
+          { "return": {} }
+
+   -  Later, QEMU sends notice that the first job was completed:
+
+      .. code:: json
+
+          { "timestamp": { "seconds": 1447192343, "microseconds": 615698 },
+            "data": { "device": "drive0", "type": "backup",
+                       "speed": 0, "len": 67108864, "offset": 67108864 },
+            "event": "BLOCK_JOB_COMPLETED"
+          }
+
+   -  Later yet, QEMU sends notice that the second job has failed:
+
+      .. code:: json
+
+          { "timestamp": { "seconds": 1447192399, "microseconds": 683015 },
+            "data": { "device": "drive1", "action": "report",
+                      "operation": "read" },
+            "event": "BLOCK_JOB_ERROR" }
+
+      .. code:: json
+
+          { "timestamp": { "seconds": 1447192399, "microseconds":
+          685853 }, "data": { "speed": 0, "offset": 0, "len": 67108864,
+          "error": "Input/output error", "device": "drive1", "type":
+          "backup" }, "event": "BLOCK_JOB_COMPLETED" }
+
+-  In the above example, ``d0-incr-1.qcow2`` is valid and must be kept,
+   but ``d1-incr-1.qcow2`` is invalid and should be deleted. If a VM-wide
+   incremental backup of all drives at a point-in-time is to be made,
+   new backups for both drives will need to be made, taking into account
+   that a new incremental backup for drive0 needs to be based on top of
+   ``d0-incr-1.qcow2``.
+
+Grouped Completion Mode
+~~~~~~~~~~~~~~~~~~~~~~~
+
+-  While jobs launched by transactions normally complete or fail on
+   their own, it is possible to instruct them to complete or fail
+   together as a group.
+
+-  QMP transactions take an optional properties structure that can
+   affect the semantics of the transaction.
+
+-  The "completion-mode" transaction property can be either "individual"
+   which is the default, legacy behavior described above, or "grouped,"
+   a new behavior detailed below.
+
+-  Delayed Completion: In grouped completion mode, no jobs will report
+   success until all jobs are ready to report success.
+
+-  Grouped failure: If any job fails in grouped completion mode, all
+   remaining jobs will be cancelled. Any incremental backups will
+   restore their dirty bitmap objects as if no backup command was ever
+   issued.
+
+   -  Regardless of if QEMU reports a particular incremental backup job
+      as CANCELLED or as an ERROR, the in-memory bitmap will be
+      restored.
+
+Example
+^^^^^^^
+
+-  Here's the same example scenario from above with the new property:
+
+   .. code:: json
+
+       { "execute": "transaction",
+         "arguments": {
+           "actions": [
+             { "type": "drive-backup",
+               "data": { "device": "drive0", "bitmap": "bitmap0",
+                         "format": "qcow2", "mode": "existing",
+                         "sync": "incremental", "target": "d0-incr-1.qcow2" } },
+             { "type": "drive-backup",
+               "data": { "device": "drive1", "bitmap": "bitmap1",
+                         "format": "qcow2", "mode": "existing",
+                         "sync": "incremental", "target": "d1-incr-1.qcow2" } },
+           ],
+           "properties": {
+             "completion-mode": "grouped"
+           }
+         }
+       }
+
+-  QMP example response, highlighting a failure for ``drive2``:
+
+   -  Acknowledgement that the Transaction was accepted and jobs were
+      launched:
+
+      .. code:: json
+
+          { "return": {} }
+
+   -  Later, QEMU sends notice that the second job has errored out, but
+      that the first job was also cancelled:
+
+      .. code:: json
+
+          { "timestamp": { "seconds": 1447193702, "microseconds": 632377 },
+            "data": { "device": "drive1", "action": "report",
+                      "operation": "read" },
+            "event": "BLOCK_JOB_ERROR" }
+
+      .. code:: json
+
+          { "timestamp": { "seconds": 1447193702, "microseconds": 640074 },
+            "data": { "speed": 0, "offset": 0, "len": 67108864,
+                      "error": "Input/output error",
+                      "device": "drive1", "type": "backup" },
+            "event": "BLOCK_JOB_COMPLETED" }
+
+      .. code:: json
+
+          { "timestamp": { "seconds": 1447193702, "microseconds": 640163 },
+            "data": { "device": "drive0", "type": "backup", "speed": 0,
+                      "len": 67108864, "offset": 16777216 },
+            "event": "BLOCK_JOB_CANCELLED" }
+
+.. raw:: html
+
+   
-- 
2.9.4

From: Kashyap Chamarthy <kchamart@redhat.com>

This patch documents (including their QMP invocations) all the four
major kinds of live block operations:

- `block-stream`
  - `block-commit`
  - `drive-mirror` (& `blockdev-mirror`)
  - `drive-backup` (& `blockdev-backup`)

Things considered while writing this document:

- Use reStructuredText as markup language (with the goal of generating
    the HTML output using the Sphinx Documentation Generator).  It is
    gentler on the eye, and can be trivially converted to different
    formats.  (Another reason: upstream QEMU is considering to switch to
    Sphinx, which uses reStructuredText as its markup language.)

- Raw QMP JSON output vs. 'qmp-shell'.  I debated with myself whether
    to only show raw QMP JSON output (as that is the canonical
    representation), or use 'qmp-shell', which takes key-value pairs.  I
    settled on the approach of: for the first occurrence of a command,
    use raw JSON; for subsequent occurrences, use 'qmp-shell', with an
    occasional exception.

- Usage of `-blockdev` command-line.

- Usage of 'node-name' vs. file path to refer to disks.  While we have
    `blockdev-{mirror, backup}` as 'node-name'-alternatives for
    `drive-{mirror, backup}`, the `block-commit` command still operates
    on file names for parameters 'base' and 'top'.  So I added a caveat
    at the beginning to that effect.

Refer this related thread that I started (where I learnt
    `block-stream` was recently reworked to accept 'node-name' for 'top'
    and 'base' parameters):
    https://lists.nongnu.org/archive/html/qemu-devel/2017-05/msg06466.html
    "[RFC] Making 'block-stream', and 'block-commit' accept node-name"

All commands showed in this document were tested while documenting.

Thanks: Eric Blake for the section: "A note on points-in-time vs file
names".  This useful bit was originally articulated by Eric in his
KVMForum 2015 presentation, so I included that specific bit in this
document.

Signed-off-by: Kashyap Chamarthy <kchamart@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20170717105205.32639-3-kchamart@redhat.com
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 docs/interop/live-block-operations.rst | 1088 ++++++++++++++++++++++++++++++++
 docs/live-block-ops.txt                |   72 ---
 2 files changed, 1088 insertions(+), 72 deletions(-)
 create mode 100644 docs/interop/live-block-operations.rst
 delete mode 100644 docs/live-block-ops.txt

diff --git a/docs/interop/live-block-operations.rst b/docs/interop/live-block-operations.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/live-block-operations.rst
@@ -XXX,XX +XXX,XX @@
+..
+    Copyright (C) 2017 Red Hat Inc.
+
+    This work is licensed under the terms of the GNU GPL, version 2 or
+    later.  See the COPYING file in the top-level directory.
+
+============================
+Live Block Device Operations
+============================
+
+QEMU Block Layer currently (as of QEMU 2.9) supports four major kinds of
+live block device jobs -- stream, commit, mirror, and backup.  These can
+be used to manipulate disk image chains to accomplish certain tasks,
+namely: live copy data from backing files into overlays; shorten long
+disk image chains by merging data from overlays into backing files; live
+synchronize data from a disk image chain (including current active disk)
+to another target image; and point-in-time (and incremental) backups of
+a block device.  Below is a description of the said block (QMP)
+primitives, and some (non-exhaustive list of) examples to illustrate
+their use.
+
+.. note::
+    The file ``qapi/block-core.json`` in the QEMU source tree has the
+    canonical QEMU API (QAPI) schema documentation for the QMP
+    primitives discussed here.
+
+.. todo (kashyapc):: Remove the ".. contents::" directive when Sphinx is
+                     integrated.
+
+.. contents::
+
+Disk image backing chain notation
+---------------------------------
+
+A simple disk image chain.  (This can be created live using QMP
+``blockdev-snapshot-sync``, or offline via ``qemu-img``)::
+
+                   (Live QEMU)
+                        |
+                        .
+                        V
+
+            [A] <----- [B]
+
+    (backing file)    (overlay)
+
+The arrow can be read as: Image [A] is the backing file of disk image
+[B].  And live QEMU is currently writing to image [B], consequently, it
+is also referred to as the "active layer".
+
+There are two kinds of terminology that are common when referring to
+files in a disk image backing chain:
+
+(1) Directional: 'base' and 'top'.  Given the simple disk image chain
+    above, image [A] can be referred to as 'base', and image [B] as
+    'top'.  (This terminology can be seen in in QAPI schema file,
+    block-core.json.)
+
+(2) Relational: 'backing file' and 'overlay'.  Again, taking the same
+    simple disk image chain from the above, disk image [A] is referred
+    to as the backing file, and image [B] as overlay.
+
+   Throughout this document, we will use the relational terminology.
+
+.. important::
+    The overlay files can generally be any format that supports a
+    backing file, although QCOW2 is the preferred format and the one
+    used in this document.
+
+
+Brief overview of live block QMP primitives
+-------------------------------------------
+
+The following are the four different kinds of live block operations that
+QEMU block layer supports.
+
+(1) ``block-stream``: Live copy of data from backing files into overlay
+    files.
+
+    .. note:: Once the 'stream' operation has finished, three things to
+              note:
+
+                (a) QEMU rewrites the backing chain to remove
+                    reference to the now-streamed and redundant backing
+                    file;
+
+                (b) the streamed file *itself* won't be removed by QEMU,
+                    and must be explicitly discarded by the user;
+
+                (c) the streamed file remains valid -- i.e. further
+                    overlays can be created based on it.  Refer the
+                    ``block-stream`` section further below for more
+                    details.
+
+(2) ``block-commit``: Live merge of data from overlay files into backing
+    files (with the optional goal of removing the overlay file from the
+    chain).  Since QEMU 2.0, this includes "active ``block-commit``"
+    (i.e. merge the current active layer into the base image).
+
+    .. note:: Once the 'commit' operation has finished, there are three
+              things to note here as well:
+
+                (a) QEMU rewrites the backing chain to remove reference
+                    to now-redundant overlay images that have been
+                    committed into a backing file;
+
+                (b) the committed file *itself* won't be removed by QEMU
+                    -- it ought to be manually removed;
+
+                (c) however, unlike in the case of ``block-stream``, the
+                    intermediate images will be rendered invalid -- i.e.
+                    no more further overlays can be created based on
+                    them.  Refer the ``block-commit`` section further
+                    below for more details.
+
+(3) ``drive-mirror`` (and ``blockdev-mirror``): Synchronize a running
+    disk to another image.
+
+(4) ``drive-backup`` (and ``blockdev-backup``): Point-in-time (live) copy
+    of a block device to a destination.
+
+
+.. _`Interacting with a QEMU instance`:
+
+Interacting with a QEMU instance
+--------------------------------
+
+To show some example invocations of command-line, we will use the
+following invocation of QEMU, with a QMP server running over UNIX
+socket::
+
+    $ ./x86_64-softmmu/qemu-system-x86_64 -display none -nodefconfig \
+        -M q35 -nodefaults -m 512 \
+        -blockdev node-name=node-A,driver=qcow2,file.driver=file,file.node-name=file,file.filename=./a.qcow2 \
+        -device virtio-blk,drive=node-A,id=virtio0 \
+        -monitor stdio -qmp unix:/tmp/qmp-sock,server,nowait
+
+The ``-blockdev`` command-line option, used above, is available from
+QEMU 2.9 onwards.  In the above invocation, notice the ``node-name``
+parameter that is used to refer to the disk image a.qcow2 ('node-A') --
+this is a cleaner way to refer to a disk image (as opposed to referring
+to it by spelling out file paths).  So, we will continue to designate a
+``node-name`` to each further disk image created (either via
+``blockdev-snapshot-sync``, or ``blockdev-add``) as part of the disk
+image chain, and continue to refer to the disks using their
+``node-name`` (where possible, because ``block-commit`` does not yet, as
+of QEMU 2.9, accept ``node-name`` parameter) when performing various
+block operations.
+
+To interact with the QEMU instance launched above, we will use the
+``qmp-shell`` utility (located at: ``qemu/scripts/qmp``, as part of the
+QEMU source directory), which takes key-value pairs for QMP commands.
+Invoke it as below (which will also print out the complete raw JSON
+syntax for reference -- examples in the following sections)::
+
+    $ ./qmp-shell -v -p /tmp/qmp-sock
+    (QEMU)
+
+.. note::
+    In the event we have to repeat a certain QMP command, we will: for
+    the first occurrence of it, show the ``qmp-shell`` invocation, *and*
+    the corresponding raw JSON QMP syntax; but for subsequent
+    invocations, present just the ``qmp-shell`` syntax, and omit the
+    equivalent JSON output.
+
+
+Example disk image chain
+------------------------
+
+We will use the below disk image chain (and occasionally spelling it
+out where appropriate) when discussing various primitives::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+Where [A] is the original base image; [B] and [C] are intermediate
+overlay images; image [D] is the active layer -- i.e. live QEMU is
+writing to it.  (The rule of thumb is: live QEMU will always be pointing
+to the rightmost image in a disk image chain.)
+
+The above image chain can be created by invoking
+``blockdev-snapshot-sync`` commands as following (which shows the
+creation of overlay image [B]) using the ``qmp-shell`` (our invocation
+also prints the raw JSON invocation of it)::
+
+    (QEMU) blockdev-snapshot-sync node-name=node-A snapshot-file=b.qcow2 snapshot-node-name=node-B format=qcow2
+    {
+        "execute": "blockdev-snapshot-sync",
+        "arguments": {
+            "node-name": "node-A",
+            "snapshot-file": "b.qcow2",
+            "format": "qcow2",
+            "snapshot-node-name": "node-B"
+        }
+    }
+
+Here, "node-A" is the name QEMU internally uses to refer to the base
+image [A] -- it is the backing file, based on which the overlay image,
+[B], is created.
+
+To create the rest of the overlay images, [C], and [D] (omitting the raw
+JSON output for brevity)::
+
+    (QEMU) blockdev-snapshot-sync node-name=node-B snapshot-file=c.qcow2 snapshot-node-name=node-C format=qcow2
+    (QEMU) blockdev-snapshot-sync node-name=node-C snapshot-file=d.qcow2 snapshot-node-name=node-D format=qcow2
+
+
+A note on points-in-time vs file names
+--------------------------------------
+
+In our disk image chain::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+We have *three* points in time and an active layer:
+
+- Point 1: Guest state when [B] was created is contained in file [A]
+- Point 2: Guest state when [C] was created is contained in [A] + [B]
+- Point 3: Guest state when [D] was created is contained in
+  [A] + [B] + [C]
+- Active layer: Current guest state is contained in [A] + [B] + [C] +
+  [D]
+
+Therefore, be aware with naming choices:
+
+- Naming a file after the time it is created is misleading -- the
+  guest data for that point in time is *not* contained in that file
+  (as explained earlier)
+- Rather, think of files as a *delta* from the backing file
+
+
+Live block streaming --- ``block-stream``
+-----------------------------------------
+
+The ``block-stream`` command allows you to do live copy data from backing
+files into overlay images.
+
+Given our original example disk image chain from earlier::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+The disk image chain can be shortened in one of the following different
+ways (not an exhaustive list).
+
+.. _`Case-1`:
+
+(1) Merge everything into the active layer: I.e. copy all contents from
+    the base image, [A], and overlay images, [B] and [C], into [D],
+    *while* the guest is running.  The resulting chain will be a
+    standalone image, [D] -- with contents from [A], [B] and [C] merged
+    into it (where live QEMU writes go to)::
+
+        [D]
+
+.. _`Case-2`:
+
+(2) Taking the same example disk image chain mentioned earlier, merge
+    only images [B] and [C] into [D], the active layer.  The result will
+    be contents of images [B] and [C] will be copied into [D], and the
+    backing file pointer of image [D] will be adjusted to point to image
+    [A].  The resulting chain will be::
+
+        [A] <-- [D]
+
+.. _`Case-3`:
+
+(3) Intermediate streaming (available since QEMU 2.8): Starting afresh
+    with the original example disk image chain, with a total of four
+    images, it is possible to copy contents from image [B] into image
+    [C].  Once the copy is finished, image [B] can now be (optionally)
+    discarded; and the backing file pointer of image [C] will be
+    adjusted to point to [A].  I.e. after performing "intermediate
+    streaming" of [B] into [C], the resulting image chain will be (where
+    live QEMU is writing to [D])::
+
+        [A] <-- [C] <-- [D]
+
+
+QMP invocation for ``block-stream``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For `Case-1`_, to merge contents of all the backing files into the
+active layer, where 'node-D' is the current active image (by default
+``block-stream`` will flatten the entire chain); ``qmp-shell`` (and its
+corresponding JSON output)::
+
+    (QEMU) block-stream device=node-D job-id=job0
+    {
+        "execute": "block-stream",
+        "arguments": {
+            "device": "node-D",
+            "job-id": "job0"
+        }
+    }
+
+For `Case-2`_, merge contents of the images [B] and [C] into [D], where
+image [D] ends up referring to image [A] as its backing file::
+
+    (QEMU) block-stream device=node-D base-node=node-A job-id=job0
+
+And for `Case-3`_, of "intermediate" streaming", merge contents of
+images [B] into [C], where [C] ends up referring to [A] as its backing
+image::
+
+    (QEMU) block-stream device=node-C base-node=node-A job-id=job0
+
+Progress of a ``block-stream`` operation can be monitored via the QMP
+command::
+
+    (QEMU) query-block-jobs
+    {
+        "execute": "query-block-jobs",
+        "arguments": {}
+    }
+
+
+Once the ``block-stream`` operation has completed, QEMU will emit an
+event, ``BLOCK_JOB_COMPLETED``.  The intermediate overlays remain valid,
+and can now be (optionally) discarded, or retained to create further
+overlays based on them.  Finally, the ``block-stream`` jobs can be
+restarted at anytime.
+
+
+Live block commit --- ``block-commit``
+--------------------------------------
+
+The ``block-commit`` command lets you merge live data from overlay
+images into backing file(s).  Since QEMU 2.0, this includes "live active
+commit" (i.e. it is possible to merge the "active layer", the right-most
+image in a disk image chain where live QEMU will be writing to, into the
+base image).  This is analogous to ``block-stream``, but in the opposite
+direction.
+
+Again, starting afresh with our example disk image chain, where live
+QEMU is writing to the right-most image in the chain, [D]::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+The disk image chain can be shortened in one of the following ways:
+
+.. _`block-commit_Case-1`:
+
+(1) Commit content from only image [B] into image [A].  The resulting
+    chain is the following, where image [C] is adjusted to point at [A]
+    as its new backing file::
+
+        [A] <-- [C] <-- [D]
+
+(2) Commit content from images [B] and [C] into image [A].  The
+    resulting chain, where image [D] is adjusted to point to image [A]
+    as its new backing file::
+
+        [A] <-- [D]
+
+.. _`block-commit_Case-3`:
+
+(3) Commit content from images [B], [C], and the active layer [D] into
+    image [A].  The resulting chain (in this case, a consolidated single
+    image)::
+
+        [A]
+
+(4) Commit content from image only image [C] into image [B].  The
+    resulting chain::
+
+	[A] <-- [B] <-- [D]
+
+(5) Commit content from image [C] and the active layer [D] into image
+    [B].  The resulting chain::
+
+	[A] <-- [B]
+
+
+QMP invocation for ``block-commit``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For :ref:`Case-1 <block-commit_Case-1>`, to merge contents only from
+image [B] into image [A], the invocation is as follows::
+
+    (QEMU) block-commit device=node-D base=a.qcow2 top=b.qcow2 job-id=job0
+    {
+        "execute": "block-commit",
+        "arguments": {
+            "device": "node-D",
+            "job-id": "job0",
+            "top": "b.qcow2",
+            "base": "a.qcow2"
+        }
+    }
+
+Once the above ``block-commit`` operation has completed, a
+``BLOCK_JOB_COMPLETED`` event will be issued, and no further action is
+required.  As the end result, the backing file of image [C] is adjusted
+to point to image [A], and the original 4-image chain will end up being
+transformed to::
+
+    [A] <-- [C] <-- [D]
+
+.. note::
+    The intermediate image [B] is invalid (as in: no more further
+    overlays based on it can be created).
+
+    Reasoning: An intermediate image after a 'stream' operation still
+    represents that old point-in-time, and may be valid in that context.
+    However, an intermediate image after a 'commit' operation no longer
+    represents any point-in-time, and is invalid in any context.
+
+
+However, :ref:`Case-3 <block-commit_Case-3>` (also called: "active
+``block-commit``") is a *two-phase* operation: In the first phase, the
+content from the active overlay, along with the intermediate overlays,
+is copied into the backing file (also called the base image).  In the
+second phase, adjust the said backing file as the current active image
+-- possible via issuing the command ``block-job-complete``.  Optionally,
+the ``block-commit`` operation can be cancelled by issuing the command
+``block-job-cancel``, but be careful when doing this.
+
+Once the ``block-commit`` operation has completed, the event
+``BLOCK_JOB_READY`` will be emitted, signalling that the synchronization
+has finished.  Now the job can be gracefully completed by issuing the
+command ``block-job-complete`` -- until such a command is issued, the
+'commit' operation remains active.
+
+The following is the flow for :ref:`Case-3 <block-commit_Case-3>` to
+convert a disk image chain such as this::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+Into::
+
+    [A]
+
+Where content from all the subsequent overlays, [B], and [C], including
+the active layer, [D], is committed back to [A] -- which is where live
+QEMU is performing all its current writes).
+
+Start the "active ``block-commit``" operation::
+
+    (QEMU) block-commit device=node-D base=a.qcow2 top=d.qcow2 job-id=job0
+    {
+        "execute": "block-commit",
+        "arguments": {
+            "device": "node-D",
+            "job-id": "job0",
+            "top": "d.qcow2",
+            "base": "a.qcow2"
+        }
+    }
+
+
+Once the synchronization has completed, the event ``BLOCK_JOB_READY`` will
+be emitted.
+
+Then, optionally query for the status of the active block operations.
+We can see the 'commit' job is now ready to be completed, as indicated
+by the line *"ready": true*::
+
+    (QEMU) query-block-jobs
+    {
+        "execute": "query-block-jobs",
+        "arguments": {}
+    }
+    {
+        "return": [
+            {
+                "busy": false,
+                "type": "commit",
+                "len": 1376256,
+                "paused": false,
+                "ready": true,
+                "io-status": "ok",
+                "offset": 1376256,
+                "device": "job0",
+                "speed": 0
+            }
+        ]
+    }
+
+Gracefully complete the 'commit' block device job::
+
+    (QEMU) block-job-complete device=job0
+    {
+        "execute": "block-job-complete",
+        "arguments": {
+            "device": "job0"
+        }
+    }
+    {
+        "return": {}
+    }
+
+Finally, once the above job is completed, an event
+``BLOCK_JOB_COMPLETED`` will be emitted.
+
+.. note::
+    The invocation for rest of the cases (2, 4, and 5), discussed in the
+    previous section, is omitted for brevity.
+
+
+Live disk synchronization --- ``drive-mirror`` and ``blockdev-mirror``
+----------------------------------------------------------------------
+
+Synchronize a running disk image chain (all or part of it) to a target
+image.
+
+Again, given our familiar disk image chain::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+The ``drive-mirror`` (and its newer equivalent ``blockdev-mirror``) allows
+you to copy data from the entire chain into a single target image (which
+can be located on a different host).
+
+Once a 'mirror' job has started, there are two possible actions while a
+``drive-mirror`` job is active:
+
+(1) Issuing the command ``block-job-cancel`` after it emits the event
+    ``BLOCK_JOB_CANCELLED``: will (after completing synchronization of
+    the content from the disk image chain to the target image, [E])
+    create a point-in-time (which is at the time of *triggering* the
+    cancel command) copy, contained in image [E], of the the entire disk
+    image chain (or only the top-most image, depending on the ``sync``
+    mode).
+
+(2) Issuing the command ``block-job-complete`` after it emits the event
+    ``BLOCK_JOB_COMPLETED``: will, after completing synchronization of
+    the content, adjust the guest device (i.e. live QEMU) to point to
+    the target image, and, causing all the new writes from this point on
+    to happen there.  One use case for this is live storage migration.
+
+About synchronization modes: The synchronization mode determines
+*which* part of the disk image chain will be copied to the target.
+Currently, there are four different kinds:
+
+(1) ``full`` -- Synchronize the content of entire disk image chain to
+    the target
+
+(2) ``top`` -- Synchronize only the contents of the top-most disk image
+    in the chain to the target
+
+(3) ``none`` -- Synchronize only the new writes from this point on.
+
+    .. note:: In the case of ``drive-backup`` (or ``blockdev-backup``),
+              the behavior of ``none`` synchronization mode is different.
+              Normally, a ``backup`` job consists of two parts: Anything
+              that is overwritten by the guest is first copied out to
+              the backup, and in the background the whole image is
+              copied from start to end. With ``sync=none``, it's only
+              the first part.
+
+(4) ``incremental`` -- Synchronize content that is described by the
+    dirty bitmap
+
+.. note::
+    Refer to the :doc:`bitmaps` document in the QEMU source
+    tree to learn about the detailed workings of the ``incremental``
+    synchronization mode.
+
+
+QMP invocation for ``drive-mirror``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+To copy the contents of the entire disk image chain, from [A] all the
+way to [D], to a new target (``drive-mirror`` will create the destination
+file, if it doesn't already exist), call it [E]::
+
+    (QEMU) drive-mirror device=node-D target=e.qcow2 sync=full job-id=job0
+    {
+        "execute": "drive-mirror",
+        "arguments": {
+            "device": "node-D",
+            "job-id": "job0",
+            "target": "e.qcow2",
+            "sync": "full"
+        }
+    }
+
+The ``"sync": "full"``, from the above, means: copy the *entire* chain
+to the destination.
+
+Following the above, querying for active block jobs will show that a
+'mirror' job is "ready" to be completed (and QEMU will also emit an
+event, ``BLOCK_JOB_READY``)::
+
+    (QEMU) query-block-jobs
+    {
+        "execute": "query-block-jobs",
+        "arguments": {}
+    }
+    {
+        "return": [
+            {
+                "busy": false,
+                "type": "mirror",
+                "len": 21757952,
+                "paused": false,
+                "ready": true,
+                "io-status": "ok",
+                "offset": 21757952,
+                "device": "job0",
+                "speed": 0
+            }
+        ]
+    }
+
+And, as noted in the previous section, there are two possible actions
+at this point:
+
+(a) Create a point-in-time snapshot by ending the synchronization.  The
+    point-in-time is at the time of *ending* the sync.  (The result of
+    the following being: the target image, [E], will be populated with
+    content from the entire chain, [A] to [D])::
+
+        (QEMU) block-job-cancel device=job0
+        {
+            "execute": "block-job-cancel",
+            "arguments": {
+                "device": "job0"
+            }
+        }
+
+(b) Or, complete the operation and pivot the live QEMU to the target
+    copy::
+
+        (QEMU) block-job-complete device=job0
+
+In either of the above cases, if you once again run the
+`query-block-jobs` command, there should not be any active block
+operation.
+
+Comparing 'commit' and 'mirror': In both then cases, the overlay images
+can be discarded.  However, with 'commit', the *existing* base image
+will be modified (by updating it with contents from overlays); while in
+the case of 'mirror', a *new* target image is populated with the data
+from the disk image chain.
+
+
+QMP invocation for live storage migration with ``drive-mirror`` + NBD
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Live storage migration (without shared storage setup) is one of the most
+common use-cases that takes advantage of the ``drive-mirror`` primitive
+and QEMU's built-in Network Block Device (NBD) server.  Here's a quick
+walk-through of this setup.
+
+Given the disk image chain::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+Instead of copying content from the entire chain, synchronize *only* the
+contents of the *top*-most disk image (i.e. the active layer), [D], to a
+target, say, [TargetDisk].
+
+.. important::
+    The destination host must already have the contents of the backing
+    chain, involving images [A], [B], and [C], visible via other means
+    -- whether by ``cp``, ``rsync``, or by some storage array-specific
+    command.)
+
+Sometimes, this is also referred to as "shallow copy" -- because only
+the "active layer", and not the rest of the image chain, is copied to
+the destination.
+
+.. note::
+    In this example, for the sake of simplicity, we'll be using the same
+    ``localhost`` as both source and destination.
+
+As noted earlier, on the destination host the contents of the backing
+chain -- from images [A] to [C] -- are already expected to exist in some
+form (e.g. in a file called, ``Contents-of-A-B-C.qcow2``).  Now, on the
+destination host, let's create a target overlay image (with the image
+``Contents-of-A-B-C.qcow2`` as its backing file), to which the contents
+of image [D] (from the source QEMU) will be mirrored to::
+
+    $ qemu-img create -f qcow2 -b ./Contents-of-A-B-C.qcow2 \
+        -F qcow2 ./target-disk.qcow2
+
+And start the destination QEMU (we already have the source QEMU running
+-- discussed in the section: `Interacting with a QEMU instance`_)
+instance, with the following invocation.  (As noted earlier, for
+simplicity's sake, the destination QEMU is started on the same host, but
+it could be located elsewhere)::
+
+    $ ./x86_64-softmmu/qemu-system-x86_64 -display none -nodefconfig \
+        -M q35 -nodefaults -m 512 \
+        -blockdev node-name=node-TargetDisk,driver=qcow2,file.driver=file,file.node-name=file,file.filename=./target-disk.qcow2 \
+        -device virtio-blk,drive=node-TargetDisk,id=virtio0 \
+        -S -monitor stdio -qmp unix:./qmp-sock2,server,nowait \
+        -incoming tcp:localhost:6666
+
+Given the disk image chain on source QEMU::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+On the destination host, it is expected that the contents of the chain
+``[A] <-- [B] <-- [C]`` are *already* present, and therefore copy *only*
+the content of image [D].
+
+(1) [On *destination* QEMU] As part of the first step, start the
+    built-in NBD server on a given host (local host, represented by
+    ``::``)and port::
+
+        (QEMU) nbd-server-start addr={"type":"inet","data":{"host":"::","port":"49153"}}
+        {
+            "execute": "nbd-server-start",
+            "arguments": {
+                "addr": {
+                    "data": {
+                        "host": "::",
+                        "port": "49153"
+                    },
+                    "type": "inet"
+                }
+            }
+        }
+
+(2) [On *destination* QEMU] And export the destination disk image using
+    QEMU's built-in NBD server::
+
+        (QEMU) nbd-server-add device=node-TargetDisk writable=true
+        {
+            "execute": "nbd-server-add",
+            "arguments": {
+                "device": "node-TargetDisk"
+            }
+        }
+
+(3) [On *source* QEMU] Then, invoke ``drive-mirror`` (NB: since we're
+    running ``drive-mirror`` with ``mode=existing`` (meaning:
+    synchronize to a pre-created file, therefore 'existing', file on the
+    target host), with the synchronization mode as 'top' (``"sync:
+    "top"``)::
+
+        (QEMU) drive-mirror device=node-D target=nbd:localhost:49153:exportname=node-TargetDisk sync=top mode=existing job-id=job0
+        {
+            "execute": "drive-mirror",
+            "arguments": {
+                "device": "node-D",
+                "mode": "existing",
+                "job-id": "job0",
+                "target": "nbd:localhost:49153:exportname=node-TargetDisk",
+                "sync": "top"
+            }
+        }
+
+(4) [On *source* QEMU] Once ``drive-mirror`` copies the entire data, and the
+    event ``BLOCK_JOB_READY`` is emitted, issue ``block-job-cancel`` to
+    gracefully end the synchronization, from source QEMU::
+
+        (QEMU) block-job-cancel device=job0
+        {
+            "execute": "block-job-cancel",
+            "arguments": {
+                "device": "job0"
+            }
+        }
+
+(5) [On *destination* QEMU] Then, stop the NBD server::
+
+        (QEMU) nbd-server-stop
+        {
+            "execute": "nbd-server-stop",
+            "arguments": {}
+        }
+
+(6) [On *destination* QEMU] Finally, resume the guest vCPUs by issuing the
+    QMP command `cont`::
+
+        (QEMU) cont
+        {
+            "execute": "cont",
+            "arguments": {}
+        }
+
+.. note::
+    Higher-level libraries (e.g. libvirt) automate the entire above
+    process (although note that libvirt does not allow same-host
+    migrations to localhost for other reasons).
+
+
+Notes on ``blockdev-mirror``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The ``blockdev-mirror`` command is equivalent in core functionality to
+``drive-mirror``, except that it operates at node-level in a BDS graph.
+
+Also: for ``blockdev-mirror``, the 'target' image needs to be explicitly
+created (using ``qemu-img``) and attach it to live QEMU via
+``blockdev-add``, which assigns a name to the to-be created target node.
+
+E.g. the sequence of actions to create a point-in-time backup of an
+entire disk image chain, to a target, using ``blockdev-mirror`` would be:
+
+(0) Create the QCOW2 overlays, to arrive at a backing chain of desired
+    depth
+
+(1) Create the target image (using ``qemu-img``), say, ``e.qcow2``
+
+(2) Attach the above created file (``e.qcow2``), run-time, using
+    ``blockdev-add`` to QEMU
+
+(3) Perform ``blockdev-mirror`` (use ``"sync": "full"`` to copy the
+    entire chain to the target).  And notice the event
+    ``BLOCK_JOB_READY``
+
+(4) Optionally, query for active block jobs, there should be a 'mirror'
+    job ready to be completed
+
+(5) Gracefully complete the 'mirror' block device job, and notice the
+    the event ``BLOCK_JOB_COMPLETED``
+
+(6) Shutdown the guest by issuing the QMP ``quit`` command so that
+    caches are flushed
+
+(7) Then, finally, compare the contents of the disk image chain, and
+    the target copy with ``qemu-img compare``.  You should notice:
+    "Images are identical"
+
+
+QMP invocation for ``blockdev-mirror``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Given the disk image chain::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+To copy the contents of the entire disk image chain, from [A] all the
+way to [D], to a new target, call it [E].  The following is the flow.
+
+Create the overlay images, [B], [C], and [D]::
+
+    (QEMU) blockdev-snapshot-sync node-name=node-A snapshot-file=b.qcow2 snapshot-node-name=node-B format=qcow2
+    (QEMU) blockdev-snapshot-sync node-name=node-B snapshot-file=c.qcow2 snapshot-node-name=node-C format=qcow2
+    (QEMU) blockdev-snapshot-sync node-name=node-C snapshot-file=d.qcow2 snapshot-node-name=node-D format=qcow2
+
+Create the target image, [E]::
+
+    $ qemu-img create -f qcow2 e.qcow2 39M
+
+Add the above created target image to QEMU, via ``blockdev-add``::
+
+    (QEMU) blockdev-add driver=qcow2 node-name=node-E file={"driver":"file","filename":"e.qcow2"}
+    {
+        "execute": "blockdev-add",
+        "arguments": {
+            "node-name": "node-E",
+            "driver": "qcow2",
+            "file": {
+                "driver": "file",
+                "filename": "e.qcow2"
+            }
+        }
+    }
+
+Perform ``blockdev-mirror``, and notice the event ``BLOCK_JOB_READY``::
+
+    (QEMU) blockdev-mirror device=node-B target=node-E sync=full job-id=job0
+    {
+        "execute": "blockdev-mirror",
+        "arguments": {
+            "device": "node-D",
+            "job-id": "job0",
+            "target": "node-E",
+            "sync": "full"
+        }
+    }
+
+Query for active block jobs, there should be a 'mirror' job ready::
+
+    (QEMU) query-block-jobs
+    {
+        "execute": "query-block-jobs",
+        "arguments": {}
+    }
+    {
+        "return": [
+            {
+                "busy": false,
+                "type": "mirror",
+                "len": 21561344,
+                "paused": false,
+                "ready": true,
+                "io-status": "ok",
+                "offset": 21561344,
+                "device": "job0",
+                "speed": 0
+            }
+        ]
+    }
+
+Gracefully complete the block device job operation, and notice the
+event ``BLOCK_JOB_COMPLETED``::
+
+    (QEMU) block-job-complete device=job0
+    {
+        "execute": "block-job-complete",
+        "arguments": {
+            "device": "job0"
+        }
+    }
+    {
+        "return": {}
+    }
+
+Shutdown the guest, by issuing the ``quit`` QMP command::
+
+    (QEMU) quit
+    {
+        "execute": "quit",
+        "arguments": {}
+    }
+
+
+Live disk backup --- ``drive-backup`` and ``blockdev-backup``
+-------------------------------------------------------------
+
+The ``drive-backup`` (and its newer equivalent ``blockdev-backup``) allows
+you to create a point-in-time snapshot.
+
+In this case, the point-in-time is when you *start* the ``drive-backup``
+(or its newer equivalent ``blockdev-backup``) command.
+
+
+QMP invocation for ``drive-backup``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Yet again, starting afresh with our example disk image chain::
+
+    [A] <-- [B] <-- [C] <-- [D]
+
+To create a target image [E], with content populated from image [A] to
+[D], from the above chain, the following is the syntax.  (If the target
+image does not exist, ``drive-backup`` will create it)::
+
+    (QEMU) drive-backup device=node-D sync=full target=e.qcow2 job-id=job0
+    {
+        "execute": "drive-backup",
+        "arguments": {
+            "device": "node-D",
+            "job-id": "job0",
+            "sync": "full",
+            "target": "e.qcow2"
+        }
+    }
+
+Once the above ``drive-backup`` has completed, a ``BLOCK_JOB_COMPLETED`` event
+will be issued, indicating the live block device job operation has
+completed, and no further action is required.
+
+
+Notes on ``blockdev-backup``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+The ``blockdev-backup`` command is equivalent in functionality to
+``drive-backup``, except that it operates at node-level in a Block Driver
+State (BDS) graph.
+
+E.g. the sequence of actions to create a point-in-time backup
+of an entire disk image chain, to a target, using ``blockdev-backup``
+would be:
+
+(0) Create the QCOW2 overlays, to arrive at a backing chain of desired
+    depth
+
+(1) Create the target image (using ``qemu-img``), say, ``e.qcow2``
+
+(2) Attach the above created file (``e.qcow2``), run-time, using
+    ``blockdev-add`` to QEMU
+
+(3) Perform ``blockdev-backup`` (use ``"sync": "full"`` to copy the
+    entire chain to the target).  And notice the event
+    ``BLOCK_JOB_COMPLETED``
+
+(4) Shutdown the guest, by issuing the QMP ``quit`` command, so that
+    caches are flushed
+
+(5) Then, finally, compare the contents of the disk image chain, and
+    the target copy with ``qemu-img compare``.  You should notice:
+    "Images are identical"
+
+The following section shows an example QMP invocation for
+``blockdev-backup``.
+
+QMP invocation for ``blockdev-backup``
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+Given a disk image chain of depth 1 where image [B] is the active
+overlay (live QEMU is writing to it)::
+
+    [A] <-- [B]
+
+The following is the procedure to copy the content from the entire chain
+to a target image (say, [E]), which has the full content from [A] and
+[B].
+
+Create the overlay [B]::
+
+    (QEMU) blockdev-snapshot-sync node-name=node-A snapshot-file=b.qcow2 snapshot-node-name=node-B format=qcow2
+    {
+        "execute": "blockdev-snapshot-sync",
+        "arguments": {
+            "node-name": "node-A",
+            "snapshot-file": "b.qcow2",
+            "format": "qcow2",
+            "snapshot-node-name": "node-B"
+        }
+    }
+
+
+Create a target image that will contain the copy::
+
+    $ qemu-img create -f qcow2 e.qcow2 39M
+
+Then add it to QEMU via ``blockdev-add``::
+
+    (QEMU) blockdev-add driver=qcow2 node-name=node-E file={"driver":"file","filename":"e.qcow2"}
+    {
+        "execute": "blockdev-add",
+        "arguments": {
+            "node-name": "node-E",
+            "driver": "qcow2",
+            "file": {
+                "driver": "file",
+                "filename": "e.qcow2"
+            }
+        }
+    }
+
+Then invoke ``blockdev-backup`` to copy the contents from the entire
+image chain, consisting of images [A] and [B] to the target image
+'e.qcow2'::
+
+    (QEMU) blockdev-backup device=node-B target=node-E sync=full job-id=job0
+    {
+        "execute": "blockdev-backup",
+        "arguments": {
+            "device": "node-B",
+            "job-id": "job0",
+            "target": "node-E",
+            "sync": "full"
+        }
+    }
+
+Once the above 'backup' operation has completed, the event,
+``BLOCK_JOB_COMPLETED`` will be emitted, signalling successful
+completion.
+
+Next, query for any active block device jobs (there should be none)::
+
+    (QEMU) query-block-jobs
+    {
+        "execute": "query-block-jobs",
+        "arguments": {}
+    }
+
+Shutdown the guest::
+
+    (QEMU) quit
+    {
+            "execute": "quit",
+                "arguments": {}
+    }
+            "return": {}
+    }
+
+.. note::
+    The above step is really important; if forgotten, an error, "Failed
+    to get shared "write" lock on e.qcow2", will be thrown when you do
+    ``qemu-img compare`` to verify the integrity of the disk image
+    with the backup content.
+
+
+The end result will be the image 'e.qcow2' containing a
+point-in-time backup of the disk image chain -- i.e. contents from
+images [A] and [B] at the time the ``blockdev-backup`` command was
+initiated.
+
+One way to confirm the backup disk image contains the identical content
+with the disk image chain is to compare the backup and the contents of
+the chain, you should see "Images are identical".  (NB: this is assuming
+QEMU was launched with ``-S`` option, which will not start the CPUs at
+guest boot up)::
+
+    $ qemu-img compare b.qcow2 e.qcow2
+    Warning: Image size mismatch!
+    Images are identical.
+
+NOTE: The "Warning: Image size mismatch!" is expected, as we created the
+target image (e.qcow2) with 39M size.
diff --git a/docs/live-block-ops.txt b/docs/live-block-ops.txt
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/docs/live-block-ops.txt
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-LIVE BLOCK OPERATIONS
-=====================
-
-High level description of live block operations. Note these are not
-supported for use with the raw format at the moment.
-
-Note also that this document is incomplete and it currently only
-covers the 'stream' operation. Other operations supported by QEMU such
-as 'commit', 'mirror' and 'backup' are not described here yet. Please
-refer to the qapi/block-core.json file for an overview of those.
-
-Snapshot live merge
-===================
-
-Given a snapshot chain, described in this document in the following
-format:
-
-[A] <- [B] <- [C] <- [D] <- [E]
-
-Where the rightmost object ([E] in the example) described is the current
-image which the guest OS has write access to. To the left of it is its base
-image, and so on accordingly until the leftmost image, which has no
-base.
-
-The snapshot live merge operation transforms such a chain into a
-smaller one with fewer elements, such as this transformation relative
-to the first example:
-
-[A] <- [E]
-
-Data is copied in the right direction with destination being the
-rightmost image, but any other intermediate image can be specified
-instead. In this example data is copied from [C] into [D], so [D] can
-be backed by [B]:
-
-[A] <- [B] <- [D] <- [E]
-
-The operation is implemented in QEMU through image streaming facilities.
-
-The basic idea is to execute 'block_stream virtio0' while the guest is
-running. Progress can be monitored using 'info block-jobs'. When the
-streaming operation completes it raises a QMP event. 'block_stream'
-copies data from the backing file(s) into the active image. When finished,
-it adjusts the backing file pointer.
-
-The 'base' parameter specifies an image which data need not be
-streamed from. This image will be used as the backing file for the
-destination image when the operation is finished.
-
-In the first example above, the command would be:
-
-(qemu) block_stream virtio0 file-A.img
-
-In order to specify a destination image different from the active
-(rightmost) one we can use its node name instead.
-
-In the second example above, the command would be:
-
-(qemu) block_stream node-D file-B.img
-
-Live block copy
-===============
-
-To copy an in use image to another destination in the filesystem, one
-should create a live snapshot in the desired destination, then stream
-into that image. Example:
-
-(qemu) snapshot_blkdev ide0-hd0 /new-path/disk.img qcow2
-
-(qemu) block_stream ide0-hd0
-
-
-- 
2.9.4

The following changes since commit ac793156f650ae2d77834932d72224175ee69086:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20201020-1' into staging (2020-10-20 21:11:35 +0100)

are available in the Git repository at:

https://gitlab.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 32a3fd65e7e3551337fd26bfc0e2f899d70c028c:

iotests: add commit top->base cases to 274 (2020-10-22 09:55:39 +0100)

----------------------------------------------------------------
Pull request

v2:
 * Fix format string issues on 32-bit hosts [Peter]
 * Fix qemu-nbd.c CONFIG_POSIX ifdef issue [Eric]
 * Fix missing eventfd.h header on macOS [Peter]
 * Drop unreliable vhost-user-blk test (will send a new patch when ready) [Peter]

This pull request contains the vhost-user-blk server by Coiby Xu along with my
additions, block/nvme.c alignment and hardware error statistics by Philippe
Mathieu-Daudé, and bdrv_co_block_status_above() fixes by Vladimir
Sementsov-Ogievskiy.

----------------------------------------------------------------

Coiby Xu (6):
  libvhost-user: Allow vu_message_read to be replaced
  libvhost-user: remove watch for kick_fd when de-initialize vu-dev
  util/vhost-user-server: generic vhost user server
  block: move logical block size check function to a common utility
    function
  block/export: vhost-user block device backend server
  MAINTAINERS: Add vhost-user block device backend server maintainer

Philippe Mathieu-Daudé (1):
  block/nvme: Add driver statistics for access alignment and hw errors

Stefan Hajnoczi (16):
  util/vhost-user-server: s/fileds/fields/ typo fix
  util/vhost-user-server: drop unnecessary QOM cast
  util/vhost-user-server: drop unnecessary watch deletion
  block/export: consolidate request structs into VuBlockReq
  util/vhost-user-server: drop unused DevicePanicNotifier
  util/vhost-user-server: fix memory leak in vu_message_read()
  util/vhost-user-server: check EOF when reading payload
  util/vhost-user-server: rework vu_client_trip() coroutine lifecycle
  block/export: report flush errors
  block/export: convert vhost-user-blk server to block export API
  util/vhost-user-server: move header to include/
  util/vhost-user-server: use static library in meson.build
  qemu-storage-daemon: avoid compiling blockdev_ss twice
  block: move block exports to libblockdev
  block/export: add iothread and fixed-iothread options
  block/export: add vhost-user-blk multi-queue support

Vladimir Sementsov-Ogievskiy (5):
  block/io: fix bdrv_co_block_status_above
  block/io: bdrv_common_block_status_above: support include_base
  block/io: bdrv_common_block_status_above: support bs == base
  block/io: fix bdrv_is_allocated_above
  iotests: add commit top->base cases to 274

-- 
2.26.2

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Keep statistics of some hardware errors, and number of
aligned/unaligned I/O accesses.

QMP example booting a full RHEL 8.3 aarch64 guest:

{ "execute": "query-blockstats" }
{
    "return": [
        {
            "device": "",
            "node-name": "drive0",
            "stats": {
                "flush_total_time_ns": 6026948,
                "wr_highest_offset": 3383991230464,
                "wr_total_time_ns": 807450995,
                "failed_wr_operations": 0,
                "failed_rd_operations": 0,
                "wr_merged": 3,
                "wr_bytes": 50133504,
                "failed_unmap_operations": 0,
                "failed_flush_operations": 0,
                "account_invalid": false,
                "rd_total_time_ns": 1846979900,
                "flush_operations": 130,
                "wr_operations": 659,
                "rd_merged": 1192,
                "rd_bytes": 218244096,
                "account_failed": false,
                "idle_time_ns": 2678641497,
                "rd_operations": 7406,
            },
            "driver-specific": {
                "driver": "nvme",
                "completion-errors": 0,
                "unaligned-accesses": 2959,
                "aligned-accesses": 4477
            },
            "qdev": "/machine/peripheral-anon/device[0]/virtio-backend"
        }
    ]
}

Suggested-by: Stefan Hajnoczi <stefanha@gmail.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20201001162939.1567915-1-philmd@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-core.json | 24 +++++++++++++++++++++++-
 block/nvme.c         | 27 +++++++++++++++++++++++++++
 2 files changed, 50 insertions(+), 1 deletion(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
       'discard-nb-failed': 'uint64',
       'discard-bytes-ok': 'uint64' } }
 
+##
+# @BlockStatsSpecificNvme:
+#
+# NVMe driver statistics
+#
+# @completion-errors: The number of completion errors.
+#
+# @aligned-accesses: The number of aligned accesses performed by
+#                    the driver.
+#
+# @unaligned-accesses: The number of unaligned accesses performed by
+#                      the driver.
+#
+# Since: 5.2
+##
+{ 'struct': 'BlockStatsSpecificNvme',
+  'data': {
+      'completion-errors': 'uint64',
+      'aligned-accesses': 'uint64',
+      'unaligned-accesses': 'uint64' } }
+
 ##
 # @BlockStatsSpecific:
 #
@@ -XXX,XX +XXX,XX @@
   'discriminator': 'driver',
   'data': {
       'file': 'BlockStatsSpecificFile',
-      'host_device': 'BlockStatsSpecificFile' } }
+      'host_device': 'BlockStatsSpecificFile',
+      'nvme': 'BlockStatsSpecificNvme' } }
 
 ##
 # @BlockStats:
diff --git a/block/nvme.c b/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -XXX,XX +XXX,XX @@ struct BDRVNVMeState {
 
     /* PCI address (required for nvme_refresh_filename()) */
     char *device;
+
+    struct {
+        uint64_t completion_errors;
+        uint64_t aligned_accesses;
+        uint64_t unaligned_accesses;
+    } stats;
 };
 
 #define NVME_BLOCK_OPT_DEVICE "device"
@@ -XXX,XX +XXX,XX @@ static bool nvme_process_completion(NVMeQueuePair *q)
             break;
         }
         ret = nvme_translate_error(c);
+        if (ret) {
+            s->stats.completion_errors++;
+        }
         q->cq.head = (q->cq.head + 1) % NVME_QUEUE_SIZE;
         if (!q->cq.head) {
             q->cq_phase = !q->cq_phase;
@@ -XXX,XX +XXX,XX @@ static int nvme_co_prw(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     assert(QEMU_IS_ALIGNED(bytes, s->page_size));
     assert(bytes <= s->max_transfer);
     if (nvme_qiov_aligned(bs, qiov)) {
+        s->stats.aligned_accesses++;
         return nvme_co_prw_aligned(bs, offset, bytes, qiov, is_write, flags);
     }
+    s->stats.unaligned_accesses++;
     trace_nvme_prw_buffered(s, offset, bytes, qiov->niov, is_write);
     buf = qemu_try_memalign(s->page_size, bytes);
 
@@ -XXX,XX +XXX,XX @@ static void nvme_unregister_buf(BlockDriverState *bs, void *host)
     qemu_vfio_dma_unmap(s->vfio, host);
 }
 
+static BlockStatsSpecific *nvme_get_specific_stats(BlockDriverState *bs)
+{
+    BlockStatsSpecific *stats = g_new(BlockStatsSpecific, 1);
+    BDRVNVMeState *s = bs->opaque;
+
+    stats->driver = BLOCKDEV_DRIVER_NVME;
+    stats->u.nvme = (BlockStatsSpecificNvme) {
+        .completion_errors = s->stats.completion_errors,
+        .aligned_accesses = s->stats.aligned_accesses,
+        .unaligned_accesses = s->stats.unaligned_accesses,
+    };
+
+    return stats;
+}
+
 static const char *const nvme_strong_runtime_opts[] = {
     NVME_BLOCK_OPT_DEVICE,
     NVME_BLOCK_OPT_NAMESPACE,
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_nvme = {
     .bdrv_refresh_filename    = nvme_refresh_filename,
     .bdrv_refresh_limits      = nvme_refresh_limits,
     .strong_runtime_opts      = nvme_strong_runtime_opts,
+    .bdrv_get_specific_stats  = nvme_get_specific_stats,
 
     .bdrv_detach_aio_context  = nvme_detach_aio_context,
     .bdrv_attach_aio_context  = nvme_attach_aio_context,
-- 
2.26.2

From: Coiby Xu <coiby.xu@gmail.com>

Allow vu_message_read to be replaced by one which will make use of the
QIOChannel functions. Thus reading vhost-user message won't stall the
guest. For slave channel, we still use the default vu_message_read.

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200918080912.321299-2-coiby.xu@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 contrib/libvhost-user/libvhost-user.h      | 21 +++++++++++++++++++++
 contrib/libvhost-user/libvhost-user-glib.c |  2 +-
 contrib/libvhost-user/libvhost-user.c      | 14 +++++++-------
 tests/vhost-user-bridge.c                  |  2 ++
 tools/virtiofsd/fuse_virtio.c              |  4 ++--
 5 files changed, 33 insertions(+), 10 deletions(-)

diff --git a/contrib/libvhost-user/libvhost-user.h b/contrib/libvhost-user/libvhost-user.h
index XXXXXXX..XXXXXXX 100644
--- a/contrib/libvhost-user/libvhost-user.h
+++ b/contrib/libvhost-user/libvhost-user.h
@@ -XXX,XX +XXX,XX @@
  */
 #define VHOST_USER_MAX_RAM_SLOTS 32
 
+#define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64)
+
 typedef enum VhostSetConfigType {
     VHOST_SET_CONFIG_TYPE_MASTER = 0,
     VHOST_SET_CONFIG_TYPE_MIGRATION = 1,
@@ -XXX,XX +XXX,XX @@ typedef uint64_t (*vu_get_features_cb) (VuDev *dev);
 typedef void (*vu_set_features_cb) (VuDev *dev, uint64_t features);
 typedef int (*vu_process_msg_cb) (VuDev *dev, VhostUserMsg *vmsg,
                                   int *do_reply);
+typedef bool (*vu_read_msg_cb) (VuDev *dev, int sock, VhostUserMsg *vmsg);
 typedef void (*vu_queue_set_started_cb) (VuDev *dev, int qidx, bool started);
 typedef bool (*vu_queue_is_processed_in_order_cb) (VuDev *dev, int qidx);
 typedef int (*vu_get_config_cb) (VuDev *dev, uint8_t *config, uint32_t len);
@@ -XXX,XX +XXX,XX @@ struct VuDev {
     bool broken;
     uint16_t max_queues;
 
+    /* @read_msg: custom method to read vhost-user message
+     *
+     * Read data from vhost_user socket fd and fill up
+     * the passed VhostUserMsg *vmsg struct.
+     *
+     * If reading fails, it should close the received set of file
+     * descriptors as socket message's auxiliary data.
+     *
+     * For the details, please refer to vu_message_read in libvhost-user.c
+     * which will be used by default if not custom method is provided when
+     * calling vu_init
+     *
+     * Returns: true if vhost-user message successfully received,
+     *          otherwise return false.
+     *
+     */
+    vu_read_msg_cb read_msg;
     /* @set_watch: add or update the given fd to the watch set,
      * call cb when condition is met */
     vu_set_watch_cb set_watch;
@@ -XXX,XX +XXX,XX @@ bool vu_init(VuDev *dev,
              uint16_t max_queues,
              int socket,
              vu_panic_cb panic,
+             vu_read_msg_cb read_msg,
              vu_set_watch_cb set_watch,
              vu_remove_watch_cb remove_watch,
              const VuDevIface *iface);
diff --git a/contrib/libvhost-user/libvhost-user-glib.c b/contrib/libvhost-user/libvhost-user-glib.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/libvhost-user/libvhost-user-glib.c
+++ b/contrib/libvhost-user/libvhost-user-glib.c
@@ -XXX,XX +XXX,XX @@ vug_init(VugDev *dev, uint16_t max_queues, int socket,
     g_assert(dev);
     g_assert(iface);
 
-    if (!vu_init(&dev->parent, max_queues, socket, panic, set_watch,
+    if (!vu_init(&dev->parent, max_queues, socket, panic, NULL, set_watch,
                  remove_watch, iface)) {
         return false;
     }
diff --git a/contrib/libvhost-user/libvhost-user.c b/contrib/libvhost-user/libvhost-user.c
index XXXXXXX..XXXXXXX 100644
--- a/contrib/libvhost-user/libvhost-user.c
+++ b/contrib/libvhost-user/libvhost-user.c
@@ -XXX,XX +XXX,XX @@
 /* The version of inflight buffer */
 #define INFLIGHT_VERSION 1
 
-#define VHOST_USER_HDR_SIZE offsetof(VhostUserMsg, payload.u64)
-
 /* The version of the protocol we support */
 #define VHOST_USER_VERSION 1
 #define LIBVHOST_USER_DEBUG 0
@@ -XXX,XX +XXX,XX @@ have_userfault(void)
 }
 
 static bool
-vu_message_read(VuDev *dev, int conn_fd, VhostUserMsg *vmsg)
+vu_message_read_default(VuDev *dev, int conn_fd, VhostUserMsg *vmsg)
 {
     char control[CMSG_SPACE(VHOST_MEMORY_BASELINE_NREGIONS * sizeof(int))] = {};
     struct iovec iov = {
@@ -XXX,XX +XXX,XX @@ vu_process_message_reply(VuDev *dev, const VhostUserMsg *vmsg)
         goto out;
     }
 
-    if (!vu_message_read(dev, dev->slave_fd, &msg_reply)) {
+    if (!vu_message_read_default(dev, dev->slave_fd, &msg_reply)) {
         goto out;
     }
 
@@ -XXX,XX +XXX,XX @@ vu_set_mem_table_exec_postcopy(VuDev *dev, VhostUserMsg *vmsg)
     /* Wait for QEMU to confirm that it's registered the handler for the
      * faults.
      */
-    if (!vu_message_read(dev, dev->sock, vmsg) ||
+    if (!dev->read_msg(dev, dev->sock, vmsg) ||
         vmsg->size != sizeof(vmsg->payload.u64) ||
         vmsg->payload.u64 != 0) {
         vu_panic(dev, "failed to receive valid ack for postcopy set-mem-table");
@@ -XXX,XX +XXX,XX @@ vu_dispatch(VuDev *dev)
     int reply_requested;
     bool need_reply, success = false;
 
-    if (!vu_message_read(dev, dev->sock, &vmsg)) {
+    if (!dev->read_msg(dev, dev->sock, &vmsg)) {
         goto end;
     }
 
@@ -XXX,XX +XXX,XX @@ vu_init(VuDev *dev,
         uint16_t max_queues,
         int socket,
         vu_panic_cb panic,
+        vu_read_msg_cb read_msg,
         vu_set_watch_cb set_watch,
         vu_remove_watch_cb remove_watch,
         const VuDevIface *iface)
@@ -XXX,XX +XXX,XX @@ vu_init(VuDev *dev,
 
     dev->sock = socket;
     dev->panic = panic;
+    dev->read_msg = read_msg ? read_msg : vu_message_read_default;
     dev->set_watch = set_watch;
     dev->remove_watch = remove_watch;
     dev->iface = iface;
@@ -XXX,XX +XXX,XX @@ static void _vu_queue_notify(VuDev *dev, VuVirtq *vq, bool sync)
 
         vu_message_write(dev, dev->slave_fd, &vmsg);
         if (ack) {
-            vu_message_read(dev, dev->slave_fd, &vmsg);
+            vu_message_read_default(dev, dev->slave_fd, &vmsg);
         }
         return;
     }
diff --git a/tests/vhost-user-bridge.c b/tests/vhost-user-bridge.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/vhost-user-bridge.c
+++ b/tests/vhost-user-bridge.c
@@ -XXX,XX +XXX,XX @@ vubr_accept_cb(int sock, void *ctx)
                  VHOST_USER_BRIDGE_MAX_QUEUES,
                  conn_fd,
                  vubr_panic,
+                 NULL,
                  vubr_set_watch,
                  vubr_remove_watch,
                  &vuiface)) {
@@ -XXX,XX +XXX,XX @@ vubr_new(const char *path, bool client)
                      VHOST_USER_BRIDGE_MAX_QUEUES,
                      dev->sock,
                      vubr_panic,
+                     NULL,
                      vubr_set_watch,
                      vubr_remove_watch,
                      &vuiface)) {
diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
index XXXXXXX..XXXXXXX 100644
--- a/tools/virtiofsd/fuse_virtio.c
+++ b/tools/virtiofsd/fuse_virtio.c
@@ -XXX,XX +XXX,XX @@ int virtio_session_mount(struct fuse_session *se)
     se->vu_socketfd = data_sock;
     se->virtio_dev->se = se;
     pthread_rwlock_init(&se->virtio_dev->vu_dispatch_rwlock, NULL);
-    vu_init(&se->virtio_dev->dev, 2, se->vu_socketfd, fv_panic, fv_set_watch,
-            fv_remove_watch, &fv_iface);
+    vu_init(&se->virtio_dev->dev, 2, se->vu_socketfd, fv_panic, NULL,
+            fv_set_watch, fv_remove_watch, &fv_iface);
 
     return 0;
 }
-- 
2.26.2

From: Coiby Xu <coiby.xu@gmail.com>

Sharing QEMU devices via vhost-user protocol.

Only one vhost-user client can connect to the server one time.

diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/vhost-user-server.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Sharing QEMU devices via vhost-user protocol
+ *
+ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
+ * Copyright (c) 2020 Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
+#ifndef VHOST_USER_SERVER_H
+#define VHOST_USER_SERVER_H
+
+#include "contrib/libvhost-user/libvhost-user.h"
+#include "io/channel-socket.h"
+#include "io/channel-file.h"
+#include "io/net-listener.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+#include "standard-headers/linux/virtio_blk.h"
+
+typedef struct VuFdWatch {
+    VuDev *vu_dev;
+    int fd; /*kick fd*/
+    void *pvt;
+    vu_watch_cb cb;
+    bool processing;
+    QTAILQ_ENTRY(VuFdWatch) next;
+} VuFdWatch;
+
+typedef struct VuServer VuServer;
+typedef void DevicePanicNotifierFn(VuServer *server);
+
+struct VuServer {
+    QIONetListener *listener;
+    AioContext *ctx;
+    DevicePanicNotifierFn *device_panic_notifier;
+    int max_queues;
+    const VuDevIface *vu_iface;
+    VuDev vu_dev;
+    QIOChannel *ioc; /* The I/O channel with the client */
+    QIOChannelSocket *sioc; /* The underlying data channel with the client */
+    /* IOChannel for fd provided via VHOST_USER_SET_SLAVE_REQ_FD */
+    QIOChannel *ioc_slave;
+    QIOChannelSocket *sioc_slave;
+    Coroutine *co_trip; /* coroutine for processing VhostUserMsg */
+    QTAILQ_HEAD(, VuFdWatch) vu_fd_watches;
+    /* restart coroutine co_trip if AIOContext is changed */
+    bool aio_context_changed;
+    bool processing_msg;
+};
+
+bool vhost_user_server_start(VuServer *server,
+                             SocketAddress *unix_socket,
+                             AioContext *ctx,
+                             uint16_t max_queues,
+                             DevicePanicNotifierFn *device_panic_notifier,
+                             const VuDevIface *vu_iface,
+                             Error **errp);
+
+void vhost_user_server_stop(VuServer *server);
+
+void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx);
+
+#endif /* VHOST_USER_SERVER_H */
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Sharing QEMU devices via vhost-user protocol
+ *
+ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
+ * Copyright (c) 2020 Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+#include "vhost-user-server.h"
+
+static void vmsg_close_fds(VhostUserMsg *vmsg)
+{
+    int i;
+    for (i = 0; i < vmsg->fd_num; i++) {
+        close(vmsg->fds[i]);
+    }
+}
+
+static void vmsg_unblock_fds(VhostUserMsg *vmsg)
+{
+    int i;
+    for (i = 0; i < vmsg->fd_num; i++) {
+        qemu_set_nonblock(vmsg->fds[i]);
+    }
+}
+
+static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
+                      gpointer opaque);
+
+static void close_client(VuServer *server)
+{
+    /*
+     * Before closing the client
+     *
+     * 1. Let vu_client_trip stop processing new vhost-user msg
+     *
+     * 2. remove kick_handler
+     *
+     * 3. wait for the kick handler to be finished
+     *
+     * 4. wait for the current vhost-user msg to be finished processing
+     */
+
+    QIOChannelSocket *sioc = server->sioc;
+    /* When this is set vu_client_trip will stop new processing vhost-user message */
+    server->sioc = NULL;
+
+    VuFdWatch *vu_fd_watch, *next;
+    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+        aio_set_fd_handler(server->ioc->ctx, vu_fd_watch->fd, true, NULL,
+                           NULL, NULL, NULL);
+    }
+
+    while (!QTAILQ_EMPTY(&server->vu_fd_watches)) {
+        QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+            if (!vu_fd_watch->processing) {
+                QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next);
+                g_free(vu_fd_watch);
+            }
+        }
+    }
+
+    while (server->processing_msg) {
+        if (server->ioc->read_coroutine) {
+            server->ioc->read_coroutine = NULL;
+            qio_channel_set_aio_fd_handler(server->ioc, server->ioc->ctx, NULL,
+                                           NULL, server->ioc);
+            server->processing_msg = false;
+        }
+    }
+
+    vu_deinit(&server->vu_dev);
+    object_unref(OBJECT(sioc));
+    object_unref(OBJECT(server->ioc));
+}
+
+static void panic_cb(VuDev *vu_dev, const char *buf)
+{
+    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+
+    /* avoid while loop in close_client */
+    server->processing_msg = false;
+
+    if (buf) {
+        error_report("vu_panic: %s", buf);
+    }
+
+    if (server->sioc) {
+        close_client(server);
+    }
+
+    if (server->device_panic_notifier) {
+        server->device_panic_notifier(server);
+    }
+
+    /*
+     * Set the callback function for network listener so another
+     * vhost-user client can connect to this server
+     */
+    qio_net_listener_set_client_func(server->listener,
+                                     vu_accept,
+                                     server,
+                                     NULL);
+}
+
+static bool coroutine_fn
+vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
+{
+    struct iovec iov = {
+        .iov_base = (char *)vmsg,
+        .iov_len = VHOST_USER_HDR_SIZE,
+    };
+    int rc, read_bytes = 0;
+    Error *local_err = NULL;
+    /*
+     * Store fds/nfds returned from qio_channel_readv_full into
+     * temporary variables.
+     *
+     * VhostUserMsg is a packed structure, gcc will complain about passing
+     * pointer to a packed structure member if we pass &VhostUserMsg.fd_num
+     * and &VhostUserMsg.fds directly when calling qio_channel_readv_full,
+     * thus two temporary variables nfds and fds are used here.
+     */
+    size_t nfds = 0, nfds_t = 0;
+    const size_t max_fds = G_N_ELEMENTS(vmsg->fds);
+    int *fds_t = NULL;
+    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+    QIOChannel *ioc = server->ioc;
+
+    if (!ioc) {
+        error_report_err(local_err);
+        goto fail;
+    }
+
+    assert(qemu_in_coroutine());
+    do {
+        /*
+         * qio_channel_readv_full may have short reads, keeping calling it
+         * until getting VHOST_USER_HDR_SIZE or 0 bytes in total
+         */
+        rc = qio_channel_readv_full(ioc, &iov, 1, &fds_t, &nfds_t, &local_err);
+        if (rc < 0) {
+            if (rc == QIO_CHANNEL_ERR_BLOCK) {
+                qio_channel_yield(ioc, G_IO_IN);
+                continue;
+            } else {
+                error_report_err(local_err);
+                return false;
+            }
+        }
+        read_bytes += rc;
+        if (nfds_t > 0) {
+            if (nfds + nfds_t > max_fds) {
+                error_report("A maximum of %zu fds are allowed, "
+                             "however got %zu fds now",
+                             max_fds, nfds + nfds_t);
+                goto fail;
+            }
+            memcpy(vmsg->fds + nfds, fds_t,
+                   nfds_t *sizeof(vmsg->fds[0]));
+            nfds += nfds_t;
+            g_free(fds_t);
+        }
+        if (read_bytes == VHOST_USER_HDR_SIZE || rc == 0) {
+            break;
+        }
+        iov.iov_base = (char *)vmsg + read_bytes;
+        iov.iov_len = VHOST_USER_HDR_SIZE - read_bytes;
+    } while (true);
+
+    vmsg->fd_num = nfds;
+    /* qio_channel_readv_full will make socket fds blocking, unblock them */
+    vmsg_unblock_fds(vmsg);
+    if (vmsg->size > sizeof(vmsg->payload)) {
+        error_report("Error: too big message request: %d, "
+                     "size: vmsg->size: %u, "
+                     "while sizeof(vmsg->payload) = %zu",
+                     vmsg->request, vmsg->size, sizeof(vmsg->payload));
+        goto fail;
+    }
+
+    struct iovec iov_payload = {
+        .iov_base = (char *)&vmsg->payload,
+        .iov_len = vmsg->size,
+    };
+    if (vmsg->size) {
+        rc = qio_channel_readv_all_eof(ioc, &iov_payload, 1, &local_err);
+        if (rc == -1) {
+            error_report_err(local_err);
+            goto fail;
+        }
+    }
+
+    return true;
+
+fail:
+    vmsg_close_fds(vmsg);
+
+    return false;
+}
+
+
+static void vu_client_start(VuServer *server);
+static coroutine_fn void vu_client_trip(void *opaque)
+{
+    VuServer *server = opaque;
+
+    while (!server->aio_context_changed && server->sioc) {
+        server->processing_msg = true;
+        vu_dispatch(&server->vu_dev);
+        server->processing_msg = false;
+    }
+
+    if (server->aio_context_changed && server->sioc) {
+        server->aio_context_changed = false;
+        vu_client_start(server);
+    }
+}
+
+static void vu_client_start(VuServer *server)
+{
+    server->co_trip = qemu_coroutine_create(vu_client_trip, server);
+    aio_co_enter(server->ctx, server->co_trip);
+}
+
+/*
+ * a wrapper for vu_kick_cb
+ *
+ * since aio_dispatch can only pass one user data pointer to the
+ * callback function, pack VuDev and pvt into a struct. Then unpack it
+ * and pass them to vu_kick_cb
+ */
+static void kick_handler(void *opaque)
+{
+    VuFdWatch *vu_fd_watch = opaque;
+    vu_fd_watch->processing = true;
+    vu_fd_watch->cb(vu_fd_watch->vu_dev, 0, vu_fd_watch->pvt);
+    vu_fd_watch->processing = false;
+}
+
+
+static VuFdWatch *find_vu_fd_watch(VuServer *server, int fd)
+{
+
+    VuFdWatch *vu_fd_watch, *next;
+    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+        if (vu_fd_watch->fd == fd) {
+            return vu_fd_watch;
+        }
+    }
+    return NULL;
+}
+
+static void
+set_watch(VuDev *vu_dev, int fd, int vu_evt,
+          vu_watch_cb cb, void *pvt)
+{
+
+    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+    g_assert(vu_dev);
+    g_assert(fd >= 0);
+    g_assert(cb);
+
+    VuFdWatch *vu_fd_watch = find_vu_fd_watch(server, fd);
+
+    if (!vu_fd_watch) {
+        VuFdWatch *vu_fd_watch = g_new0(VuFdWatch, 1);
+
+        QTAILQ_INSERT_TAIL(&server->vu_fd_watches, vu_fd_watch, next);
+
+        vu_fd_watch->fd = fd;
+        vu_fd_watch->cb = cb;
+        qemu_set_nonblock(fd);
+        aio_set_fd_handler(server->ioc->ctx, fd, true, kick_handler,
+                           NULL, NULL, vu_fd_watch);
+        vu_fd_watch->vu_dev = vu_dev;
+        vu_fd_watch->pvt = pvt;
+    }
+}
+
+
+static void remove_watch(VuDev *vu_dev, int fd)
+{
+    VuServer *server;
+    g_assert(vu_dev);
+    g_assert(fd >= 0);
+
+    server = container_of(vu_dev, VuServer, vu_dev);
+
+    VuFdWatch *vu_fd_watch = find_vu_fd_watch(server, fd);
+
+    if (!vu_fd_watch) {
+        return;
+    }
+    aio_set_fd_handler(server->ioc->ctx, fd, true, NULL, NULL, NULL, NULL);
+
+    QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next);
+    g_free(vu_fd_watch);
+}
+
+
+static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
+                      gpointer opaque)
+{
+    VuServer *server = opaque;
+
+    if (server->sioc) {
+        warn_report("Only one vhost-user client is allowed to "
+                    "connect the server one time");
+        return;
+    }
+
+    if (!vu_init(&server->vu_dev, server->max_queues, sioc->fd, panic_cb,
+                 vu_message_read, set_watch, remove_watch, server->vu_iface)) {
+        error_report("Failed to initialize libvhost-user");
+        return;
+    }
+
+    /*
+     * Unset the callback function for network listener to make another
+     * vhost-user client keeping waiting until this client disconnects
+     */
+    qio_net_listener_set_client_func(server->listener,
+                                     NULL,
+                                     NULL,
+                                     NULL);
+    server->sioc = sioc;
+    /*
+     * Increase the object reference, so sioc will not freed by
+     * qio_net_listener_channel_func which will call object_unref(OBJECT(sioc))
+     */
+    object_ref(OBJECT(server->sioc));
+    qio_channel_set_name(QIO_CHANNEL(sioc), "vhost-user client");
+    server->ioc = QIO_CHANNEL(sioc);
+    object_ref(OBJECT(server->ioc));
+    qio_channel_attach_aio_context(server->ioc, server->ctx);
+    qio_channel_set_blocking(QIO_CHANNEL(server->sioc), false, NULL);
+    vu_client_start(server);
+}
+
+
+void vhost_user_server_stop(VuServer *server)
+{
+    if (server->sioc) {
+        close_client(server);
+    }
+
+    if (server->listener) {
+        qio_net_listener_disconnect(server->listener);
+        object_unref(OBJECT(server->listener));
+    }
+
+}
+
+void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx)
+{
+    VuFdWatch *vu_fd_watch, *next;
+    void *opaque = NULL;
+    IOHandler *io_read = NULL;
+    bool attach;
+
+    server->ctx = ctx ? ctx : qemu_get_aio_context();
+
+    if (!server->sioc) {
+        /* not yet serving any client*/
+        return;
+    }
+
+    if (ctx) {
+        qio_channel_attach_aio_context(server->ioc, ctx);
+        server->aio_context_changed = true;
+        io_read = kick_handler;
+        attach = true;
+    } else {
+        qio_channel_detach_aio_context(server->ioc);
+        /* server->ioc->ctx keeps the old AioConext */
+        ctx = server->ioc->ctx;
+        attach = false;
+    }
+
+    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
+        if (vu_fd_watch->cb) {
+            opaque = attach ? vu_fd_watch : NULL;
+            aio_set_fd_handler(ctx, vu_fd_watch->fd, true,
+                               io_read, NULL, NULL,
+                               opaque);
+        }
+    }
+}
+
+
+bool vhost_user_server_start(VuServer *server,
+                             SocketAddress *socket_addr,
+                             AioContext *ctx,
+                             uint16_t max_queues,
+                             DevicePanicNotifierFn *device_panic_notifier,
+                             const VuDevIface *vu_iface,
+                             Error **errp)
+{
+    QIONetListener *listener = qio_net_listener_new();
+    if (qio_net_listener_open_sync(listener, socket_addr, 1,
+                                   errp) < 0) {
+        object_unref(OBJECT(listener));
+        return false;
+    }
+
+    /* zero out unspecified fileds */
+    *server = (VuServer) {
+        .listener              = listener,
+        .vu_iface              = vu_iface,
+        .max_queues            = max_queues,
+        .ctx                   = ctx,
+        .device_panic_notifier = device_panic_notifier,
+    };
+
+    qio_net_listener_set_name(server->listener, "vhost-user-backend-listener");
+
+    qio_net_listener_set_client_func(server->listener,
+                                     vu_accept,
+                                     server,
+                                     NULL);
+
+    QTAILQ_INIT(&server->vu_fd_watches);
+    return true;
+}
diff --git a/util/meson.build b/util/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ if have_block
   util_ss.add(files('main-loop.c'))
   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
+  util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c'))
   util_ss.add(files('qemu-coroutine-sleep.c'))
   util_ss.add(files('qemu-co-shared-resource.c'))
   util_ss.add(files('thread-pool.c', 'qemu-timer.c'))
-- 
2.26.2

From: Coiby Xu <coiby.xu@gmail.com>

Move the constants from hw/core/qdev-properties.c to
util/block-helpers.h so that knowledge of the min/max values is

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Acked-by: Eduardo Habkost <ehabkost@redhat.com>
Message-id: 20200918080912.321299-5-coiby.xu@gmail.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/block-helpers.h             | 19 +++++++++++++
 hw/core/qdev-properties-system.c | 31 ++++-----------------
 util/block-helpers.c             | 46 ++++++++++++++++++++++++++++++++
 util/meson.build                 |  1 +
 4 files changed, 71 insertions(+), 26 deletions(-)
 create mode 100644 util/block-helpers.h
 create mode 100644 util/block-helpers.c

diff --git a/util/block-helpers.h b/util/block-helpers.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/block-helpers.h
@@ -XXX,XX +XXX,XX @@
+#ifndef BLOCK_HELPERS_H
+#define BLOCK_HELPERS_H
+
+#include "qemu/units.h"
+
+/* lower limit is sector size */
+#define MIN_BLOCK_SIZE          INT64_C(512)
+#define MIN_BLOCK_SIZE_STR      "512 B"
+/*
+ * upper limit is arbitrary, 2 MiB looks sufficient for all sensible uses, and
+ * matches qcow2 cluster size limit
+ */
+#define MAX_BLOCK_SIZE          (2 * MiB)
+#define MAX_BLOCK_SIZE_STR      "2 MiB"
+
+void check_block_size(const char *id, const char *name, int64_t value,
+                      Error **errp);
+
+#endif /* BLOCK_HELPERS_H */
diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/qdev-properties-system.c
+++ b/hw/core/qdev-properties-system.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/blockdev.h"
 #include "net/net.h"
 #include "hw/pci/pci.h"
+#include "util/block-helpers.h"
 
 static bool check_prop_still_unset(DeviceState *dev, const char *name,
                                    const void *old_val, const char *new_val,
@@ -XXX,XX +XXX,XX @@ const PropertyInfo qdev_prop_losttickpolicy = {
 
 /* --- blocksize --- */
 
-/* lower limit is sector size */
-#define MIN_BLOCK_SIZE          512
-#define MIN_BLOCK_SIZE_STR      "512 B"
-/*
- * upper limit is arbitrary, 2 MiB looks sufficient for all sensible uses, and
- * matches qcow2 cluster size limit
- */
-#define MAX_BLOCK_SIZE          (2 * MiB)
-#define MAX_BLOCK_SIZE_STR      "2 MiB"
-
 static void set_blocksize(Object *obj, Visitor *v, const char *name,
                           void *opaque, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void set_blocksize(Object *obj, Visitor *v, const char *name,
     Property *prop = opaque;
     uint32_t *ptr = qdev_get_prop_ptr(dev, prop);
     uint64_t value;
+    Error *local_err = NULL;
 
     if (dev->realized) {
         qdev_prop_set_after_realize(dev, name, errp);
@@ -XXX,XX +XXX,XX @@ static void set_blocksize(Object *obj, Visitor *v, const char *name,
     if (!visit_type_size(v, name, &value, errp)) {
         return;
     }
-    /* value of 0 means "unset" */
-    if (value && (value < MIN_BLOCK_SIZE || value > MAX_BLOCK_SIZE)) {
-        error_setg(errp,
-                   "Property %s.%s doesn't take value %" PRIu64
-                   " (minimum: " MIN_BLOCK_SIZE_STR
-                   ", maximum: " MAX_BLOCK_SIZE_STR ")",
-                   dev->id ? : "", name, value);
+    check_block_size(dev->id ? : "", name, value, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
         return;
     }
-
-    /* We rely on power-of-2 blocksizes for bitmasks */
-    if ((value & (value - 1)) != 0) {
-        error_setg(errp,
-                  "Property %s.%s doesn't take value '%" PRId64 "', "
-                  "it's not a power of 2", dev->id ?: "", name, (int64_t)value);
-        return;
-    }
-
     *ptr = value;
 }
 
diff --git a/util/block-helpers.c b/util/block-helpers.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/block-helpers.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Block utility functions
+ *
+ * Copyright IBM, Corp. 2011
+ * Copyright (c) 2020 Coiby Xu <coiby.xu@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qapi/qmp/qerror.h"
+#include "block-helpers.h"
+
+/**
+ * check_block_size:
+ * @id: The unique ID of the object
+ * @name: The name of the property being validated
+ * @value: The block size in bytes
+ * @errp: A pointer to an area to store an error
+ *
+ * This function checks that the block size meets the following conditions:
+ * 1. At least MIN_BLOCK_SIZE
+ * 2. No larger than MAX_BLOCK_SIZE
+ * 3. A power of 2
+ */
+void check_block_size(const char *id, const char *name, int64_t value,
+                      Error **errp)
+{
+    /* value of 0 means "unset" */
+    if (value && (value < MIN_BLOCK_SIZE || value > MAX_BLOCK_SIZE)) {
+        error_setg(errp, QERR_PROPERTY_VALUE_OUT_OF_RANGE,
+                   id, name, value, MIN_BLOCK_SIZE, MAX_BLOCK_SIZE);
+        return;
+    }
+
+    /* We rely on power-of-2 blocksizes for bitmasks */
+    if ((value & (value - 1)) != 0) {
+        error_setg(errp,
+                   "Property %s.%s doesn't take value '%" PRId64
+                   "', it's not a power of 2",
+                   id, name, value);
+        return;
+    }
+}
diff --git a/util/meson.build b/util/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ if have_block
   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
   util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c'))
+  util_ss.add(files('block-helpers.c'))
   util_ss.add(files('qemu-coroutine-sleep.c'))
   util_ss.add(files('qemu-co-shared-resource.c'))
   util_ss.add(files('thread-pool.c', 'qemu-timer.c'))
-- 
2.26.2

From: Coiby Xu <coiby.xu@gmail.com>

By making use of libvhost-user, block device drive can be shared to
the connected vhost-user client. Only one client can connect to the
server one time.

Since vhost-user-server needs a block drive to be created first, delay
the creation of this object.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20200918080912.321299-6-coiby.xu@gmail.com
[Shorten "vhost_user_blk_server" string to "vhost_user_blk" to avoid the
following compiler warning:
../block/export/vhost-user-blk-server.c:178:50: error: ‘%s’ directive output truncated writing 21 bytes into a region of size 20 [-Werror=format-truncation=]
and fix "Invalid size %ld ..." ssize_t format string arguments for
32-bit hosts.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/export/vhost-user-blk-server.h |  36 ++
 block/export/vhost-user-blk-server.c | 661 +++++++++++++++++++++++++++
 softmmu/vl.c                         |   4 +
 block/meson.build                    |   1 +
 4 files changed, 702 insertions(+)
 create mode 100644 block/export/vhost-user-blk-server.h
 create mode 100644 block/export/vhost-user-blk-server.c

diff --git a/block/export/vhost-user-blk-server.h b/block/export/vhost-user-blk-server.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/export/vhost-user-blk-server.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Sharing QEMU block devices via vhost-user protocal
+ *
+ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
+ * Copyright (c) 2020 Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+
+#ifndef VHOST_USER_BLK_SERVER_H
+#define VHOST_USER_BLK_SERVER_H
+#include "util/vhost-user-server.h"
+
+typedef struct VuBlockDev VuBlockDev;
+#define TYPE_VHOST_USER_BLK_SERVER "vhost-user-blk-server"
+#define VHOST_USER_BLK_SERVER(obj) \
+   OBJECT_CHECK(VuBlockDev, obj, TYPE_VHOST_USER_BLK_SERVER)
+
+/* vhost user block device */
+struct VuBlockDev {
+    Object parent_obj;
+    char *node_name;
+    SocketAddress *addr;
+    AioContext *ctx;
+    VuServer vu_server;
+    bool running;
+    uint32_t blk_size;
+    BlockBackend *backend;
+    QIOChannelSocket *sioc;
+    QTAILQ_ENTRY(VuBlockDev) next;
+    struct virtio_blk_config blkcfg;
+    bool writable;
+};
+
+#endif /* VHOST_USER_BLK_SERVER_H */
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Sharing QEMU block devices via vhost-user protocal
+ *
+ * Parts of the code based on nbd/server.c.
+ *
+ * Copyright (c) Coiby Xu <coiby.xu@gmail.com>.
+ * Copyright (c) 2020 Red Hat, Inc.
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or
+ * later.  See the COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "block/block.h"
+#include "vhost-user-blk-server.h"
+#include "qapi/error.h"
+#include "qom/object_interfaces.h"
+#include "sysemu/block-backend.h"
+#include "util/block-helpers.h"
+
+enum {
+    VHOST_USER_BLK_MAX_QUEUES = 1,
+};
+struct virtio_blk_inhdr {
+    unsigned char status;
+};
+
+typedef struct VuBlockReq {
+    VuVirtqElement *elem;
+    int64_t sector_num;
+    size_t size;
+    struct virtio_blk_inhdr *in;
+    struct virtio_blk_outhdr out;
+    VuServer *server;
+    struct VuVirtq *vq;
+} VuBlockReq;
+
+static void vu_block_req_complete(VuBlockReq *req)
+{
+    VuDev *vu_dev = &req->server->vu_dev;
+
+    /* IO size with 1 extra status byte */
+    vu_queue_push(vu_dev, req->vq, req->elem, req->size + 1);
+    vu_queue_notify(vu_dev, req->vq);
+
+    if (req->elem) {
+        free(req->elem);
+    }
+
+    g_free(req);
+}
+
+static VuBlockDev *get_vu_block_device_by_server(VuServer *server)
+{
+    return container_of(server, VuBlockDev, vu_server);
+}
+
+static int coroutine_fn
+vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
+                              uint32_t iovcnt, uint32_t type)
+{
+    struct virtio_blk_discard_write_zeroes desc;
+    ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
+    if (unlikely(size != sizeof(desc))) {
+        error_report("Invalid size %zd, expect %zu", size, sizeof(desc));
+        return -EINVAL;
+    }
+
+    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
+    uint64_t range[2] = { le64_to_cpu(desc.sector) << 9,
+                          le32_to_cpu(desc.num_sectors) << 9 };
+    if (type == VIRTIO_BLK_T_DISCARD) {
+        if (blk_co_pdiscard(vdev_blk->backend, range[0], range[1]) == 0) {
+            return 0;
+        }
+    } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) {
+        if (blk_co_pwrite_zeroes(vdev_blk->backend,
+                                 range[0], range[1], 0) == 0) {
+            return 0;
+        }
+    }
+
+    return -EINVAL;
+}
+
+static void coroutine_fn vu_block_flush(VuBlockReq *req)
+{
+    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
+    BlockBackend *backend = vdev_blk->backend;
+    blk_co_flush(backend);
+}
+
+struct req_data {
+    VuServer *server;
+    VuVirtq *vq;
+    VuVirtqElement *elem;
+};
+
+static void coroutine_fn vu_block_virtio_process_req(void *opaque)
+{
+    struct req_data *data = opaque;
+    VuServer *server = data->server;
+    VuVirtq *vq = data->vq;
+    VuVirtqElement *elem = data->elem;
+    uint32_t type;
+    VuBlockReq *req;
+
+    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+    BlockBackend *backend = vdev_blk->backend;
+
+    struct iovec *in_iov = elem->in_sg;
+    struct iovec *out_iov = elem->out_sg;
+    unsigned in_num = elem->in_num;
+    unsigned out_num = elem->out_num;
+    /* refer to hw/block/virtio_blk.c */
+    if (elem->out_num < 1 || elem->in_num < 1) {
+        error_report("virtio-blk request missing headers");
+        free(elem);
+        return;
+    }
+
+    req = g_new0(VuBlockReq, 1);
+    req->server = server;
+    req->vq = vq;
+    req->elem = elem;
+
+    if (unlikely(iov_to_buf(out_iov, out_num, 0, &req->out,
+                            sizeof(req->out)) != sizeof(req->out))) {
+        error_report("virtio-blk request outhdr too short");
+        goto err;
+    }
+
+    iov_discard_front(&out_iov, &out_num, sizeof(req->out));
+
+    if (in_iov[in_num - 1].iov_len < sizeof(struct virtio_blk_inhdr)) {
+        error_report("virtio-blk request inhdr too short");
+        goto err;
+    }
+
+    /* We always touch the last byte, so just see how big in_iov is.  */
+    req->in = (void *)in_iov[in_num - 1].iov_base
+              + in_iov[in_num - 1].iov_len
+              - sizeof(struct virtio_blk_inhdr);
+    iov_discard_back(in_iov, &in_num, sizeof(struct virtio_blk_inhdr));
+
+    type = le32_to_cpu(req->out.type);
+    switch (type & ~VIRTIO_BLK_T_BARRIER) {
+    case VIRTIO_BLK_T_IN:
+    case VIRTIO_BLK_T_OUT: {
+        ssize_t ret = 0;
+        bool is_write = type & VIRTIO_BLK_T_OUT;
+        req->sector_num = le64_to_cpu(req->out.sector);
+
+        int64_t offset = req->sector_num * vdev_blk->blk_size;
+        QEMUIOVector qiov;
+        if (is_write) {
+            qemu_iovec_init_external(&qiov, out_iov, out_num);
+            ret = blk_co_pwritev(backend, offset, qiov.size,
+                                 &qiov, 0);
+        } else {
+            qemu_iovec_init_external(&qiov, in_iov, in_num);
+            ret = blk_co_preadv(backend, offset, qiov.size,
+                                &qiov, 0);
+        }
+        if (ret >= 0) {
+            req->in->status = VIRTIO_BLK_S_OK;
+        } else {
+            req->in->status = VIRTIO_BLK_S_IOERR;
+        }
+        break;
+    }
+    case VIRTIO_BLK_T_FLUSH:
+        vu_block_flush(req);
+        req->in->status = VIRTIO_BLK_S_OK;
+        break;
+    case VIRTIO_BLK_T_GET_ID: {
+        size_t size = MIN(iov_size(&elem->in_sg[0], in_num),
+                          VIRTIO_BLK_ID_BYTES);
+        snprintf(elem->in_sg[0].iov_base, size, "%s", "vhost_user_blk");
+        req->in->status = VIRTIO_BLK_S_OK;
+        req->size = elem->in_sg[0].iov_len;
+        break;
+    }
+    case VIRTIO_BLK_T_DISCARD:
+    case VIRTIO_BLK_T_WRITE_ZEROES: {
+        int rc;
+        rc = vu_block_discard_write_zeroes(req, &elem->out_sg[1],
+                                           out_num, type);
+        if (rc == 0) {
+            req->in->status = VIRTIO_BLK_S_OK;
+        } else {
+            req->in->status = VIRTIO_BLK_S_IOERR;
+        }
+        break;
+    }
+    default:
+        req->in->status = VIRTIO_BLK_S_UNSUPP;
+        break;
+    }
+
+    vu_block_req_complete(req);
+    return;
+
+err:
+    free(elem);
+    g_free(req);
+    return;
+}
+
+static void vu_block_process_vq(VuDev *vu_dev, int idx)
+{
+    VuServer *server;
+    VuVirtq *vq;
+    struct req_data *req_data;
+
+    server = container_of(vu_dev, VuServer, vu_dev);
+    assert(server);
+
+    vq = vu_get_queue(vu_dev, idx);
+    assert(vq);
+    VuVirtqElement *elem;
+    while (1) {
+        elem = vu_queue_pop(vu_dev, vq, sizeof(VuVirtqElement) +
+                                    sizeof(VuBlockReq));
+        if (elem) {
+            req_data = g_new0(struct req_data, 1);
+            req_data->server = server;
+            req_data->vq = vq;
+            req_data->elem = elem;
+            Coroutine *co = qemu_coroutine_create(vu_block_virtio_process_req,
+                                                  req_data);
+            aio_co_enter(server->ioc->ctx, co);
+        } else {
+            break;
+        }
+    }
+}
+
+static void vu_block_queue_set_started(VuDev *vu_dev, int idx, bool started)
+{
+    VuVirtq *vq;
+
+    assert(vu_dev);
+
+    vq = vu_get_queue(vu_dev, idx);
+    vu_set_queue_handler(vu_dev, vq, started ? vu_block_process_vq : NULL);
+}
+
+static uint64_t vu_block_get_features(VuDev *dev)
+{
+    uint64_t features;
+    VuServer *server = container_of(dev, VuServer, vu_dev);
+    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+    features = 1ull << VIRTIO_BLK_F_SIZE_MAX |
+               1ull << VIRTIO_BLK_F_SEG_MAX |
+               1ull << VIRTIO_BLK_F_TOPOLOGY |
+               1ull << VIRTIO_BLK_F_BLK_SIZE |
+               1ull << VIRTIO_BLK_F_FLUSH |
+               1ull << VIRTIO_BLK_F_DISCARD |
+               1ull << VIRTIO_BLK_F_WRITE_ZEROES |
+               1ull << VIRTIO_BLK_F_CONFIG_WCE |
+               1ull << VIRTIO_F_VERSION_1 |
+               1ull << VIRTIO_RING_F_INDIRECT_DESC |
+               1ull << VIRTIO_RING_F_EVENT_IDX |
+               1ull << VHOST_USER_F_PROTOCOL_FEATURES;
+
+    if (!vdev_blk->writable) {
+        features |= 1ull << VIRTIO_BLK_F_RO;
+    }
+
+    return features;
+}
+
+static uint64_t vu_block_get_protocol_features(VuDev *dev)
+{
+    return 1ull << VHOST_USER_PROTOCOL_F_CONFIG |
+           1ull << VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD;
+}
+
+static int
+vu_block_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
+{
+    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+    memcpy(config, &vdev_blk->blkcfg, len);
+
+    return 0;
+}
+
+static int
+vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
+                    uint32_t offset, uint32_t size, uint32_t flags)
+{
+    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+    uint8_t wce;
+
+    /* don't support live migration */
+    if (flags != VHOST_SET_CONFIG_TYPE_MASTER) {
+        return -EINVAL;
+    }
+
+    if (offset != offsetof(struct virtio_blk_config, wce) ||
+        size != 1) {
+        return -EINVAL;
+    }
+
+    wce = *data;
+    vdev_blk->blkcfg.wce = wce;
+    blk_set_enable_write_cache(vdev_blk->backend, wce);
+    return 0;
+}
+
+/*
+ * When the client disconnects, it sends a VHOST_USER_NONE request
+ * and vu_process_message will simple call exit which cause the VM
+ * to exit abruptly.
+ * To avoid this issue,  process VHOST_USER_NONE request ahead
+ * of vu_process_message.
+ *
+ */
+static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
+{
+    if (vmsg->request == VHOST_USER_NONE) {
+        dev->panic(dev, "disconnect");
+        return true;
+    }
+    return false;
+}
+
+static const VuDevIface vu_block_iface = {
+    .get_features          = vu_block_get_features,
+    .queue_set_started     = vu_block_queue_set_started,
+    .get_protocol_features = vu_block_get_protocol_features,
+    .get_config            = vu_block_get_config,
+    .set_config            = vu_block_set_config,
+    .process_msg           = vu_block_process_msg,
+};
+
+static void blk_aio_attached(AioContext *ctx, void *opaque)
+{
+    VuBlockDev *vub_dev = opaque;
+    aio_context_acquire(ctx);
+    vhost_user_server_set_aio_context(&vub_dev->vu_server, ctx);
+    aio_context_release(ctx);
+}
+
+static void blk_aio_detach(void *opaque)
+{
+    VuBlockDev *vub_dev = opaque;
+    AioContext *ctx = vub_dev->vu_server.ctx;
+    aio_context_acquire(ctx);
+    vhost_user_server_set_aio_context(&vub_dev->vu_server, NULL);
+    aio_context_release(ctx);
+}
+
+static void
+vu_block_initialize_config(BlockDriverState *bs,
+                           struct virtio_blk_config *config, uint32_t blk_size)
+{
+    config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
+    config->blk_size = blk_size;
+    config->size_max = 0;
+    config->seg_max = 128 - 2;
+    config->min_io_size = 1;
+    config->opt_io_size = 1;
+    config->num_queues = VHOST_USER_BLK_MAX_QUEUES;
+    config->max_discard_sectors = 32768;
+    config->max_discard_seg = 1;
+    config->discard_sector_alignment = config->blk_size >> 9;
+    config->max_write_zeroes_sectors = 32768;
+    config->max_write_zeroes_seg = 1;
+}
+
+static VuBlockDev *vu_block_init(VuBlockDev *vu_block_device, Error **errp)
+{
+
+    BlockBackend *blk;
+    Error *local_error = NULL;
+    const char *node_name = vu_block_device->node_name;
+    bool writable = vu_block_device->writable;
+    uint64_t perm = BLK_PERM_CONSISTENT_READ;
+    int ret;
+
+    AioContext *ctx;
+
+    BlockDriverState *bs = bdrv_lookup_bs(node_name, node_name, &local_error);
+
+    if (!bs) {
+        error_propagate(errp, local_error);
+        return NULL;
+    }
+
+    if (bdrv_is_read_only(bs)) {
+        writable = false;
+    }
+
+    if (writable) {
+        perm |= BLK_PERM_WRITE;
+    }
+
+    ctx = bdrv_get_aio_context(bs);
+    aio_context_acquire(ctx);
+    bdrv_invalidate_cache(bs, NULL);
+    aio_context_release(ctx);
+
+    /*
+     * Don't allow resize while the vhost user server is running,
+     * otherwise we don't care what happens with the node.
+     */
+    blk = blk_new(bdrv_get_aio_context(bs), perm,
+                  BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED |
+                  BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD);
+    ret = blk_insert_bs(blk, bs, errp);
+
+    if (ret < 0) {
+        goto fail;
+    }
+
+    blk_set_enable_write_cache(blk, false);
+
+    blk_set_allow_aio_context_change(blk, true);
+
+    vu_block_device->blkcfg.wce = 0;
+    vu_block_device->backend = blk;
+    if (!vu_block_device->blk_size) {
+        vu_block_device->blk_size = BDRV_SECTOR_SIZE;
+    }
+    vu_block_device->blkcfg.blk_size = vu_block_device->blk_size;
+    blk_set_guest_block_size(blk, vu_block_device->blk_size);
+    vu_block_initialize_config(bs, &vu_block_device->blkcfg,
+                                   vu_block_device->blk_size);
+    return vu_block_device;
+
+fail:
+    blk_unref(blk);
+    return NULL;
+}
+
+static void vu_block_deinit(VuBlockDev *vu_block_device)
+{
+    if (vu_block_device->backend) {
+        blk_remove_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
+                                        blk_aio_detach, vu_block_device);
+    }
+
+    blk_unref(vu_block_device->backend);
+}
+
+static void vhost_user_blk_server_stop(VuBlockDev *vu_block_device)
+{
+    vhost_user_server_stop(&vu_block_device->vu_server);
+    vu_block_deinit(vu_block_device);
+}
+
+static void vhost_user_blk_server_start(VuBlockDev *vu_block_device,
+                                        Error **errp)
+{
+    AioContext *ctx;
+    SocketAddress *addr = vu_block_device->addr;
+
+    if (!vu_block_init(vu_block_device, errp)) {
+        return;
+    }
+
+    ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend));
+
+    if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx,
+                                 VHOST_USER_BLK_MAX_QUEUES,
+                                 NULL, &vu_block_iface,
+                                 errp)) {
+        goto error;
+    }
+
+    blk_add_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
+                                 blk_aio_detach, vu_block_device);
+    vu_block_device->running = true;
+    return;
+
+ error:
+    vu_block_deinit(vu_block_device);
+}
+
+static bool vu_prop_modifiable(VuBlockDev *vus, Error **errp)
+{
+    if (vus->running) {
+            error_setg(errp, "The property can't be modified "
+                       "while the server is running");
+            return false;
+    }
+    return true;
+}
+
+static void vu_set_node_name(Object *obj, const char *value, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+
+    if (!vu_prop_modifiable(vus, errp)) {
+        return;
+    }
+
+    if (vus->node_name) {
+        g_free(vus->node_name);
+    }
+
+    vus->node_name = g_strdup(value);
+}
+
+static char *vu_get_node_name(Object *obj, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+    return g_strdup(vus->node_name);
+}
+
+static void free_socket_addr(SocketAddress *addr)
+{
+        g_free(addr->u.q_unix.path);
+        g_free(addr);
+}
+
+static void vu_set_unix_socket(Object *obj, const char *value,
+                               Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+
+    if (!vu_prop_modifiable(vus, errp)) {
+        return;
+    }
+
+    if (vus->addr) {
+        free_socket_addr(vus->addr);
+    }
+
+    SocketAddress *addr = g_new0(SocketAddress, 1);
+    addr->type = SOCKET_ADDRESS_TYPE_UNIX;
+    addr->u.q_unix.path = g_strdup(value);
+    vus->addr = addr;
+}
+
+static char *vu_get_unix_socket(Object *obj, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+    return g_strdup(vus->addr->u.q_unix.path);
+}
+
+static bool vu_get_block_writable(Object *obj, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+    return vus->writable;
+}
+
+static void vu_set_block_writable(Object *obj, bool value, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+
+    if (!vu_prop_modifiable(vus, errp)) {
+            return;
+    }
+
+    vus->writable = value;
+}
+
+static void vu_get_blk_size(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+    uint32_t value = vus->blk_size;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
+static void vu_set_blk_size(Object *obj, Visitor *v, const char *name,
+                            void *opaque, Error **errp)
+{
+    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
+
+    Error *local_err = NULL;
+    uint32_t value;
+
+    if (!vu_prop_modifiable(vus, errp)) {
+            return;
+    }
+
+    visit_type_uint32(v, name, &value, &local_err);
+    if (local_err) {
+        goto out;
+    }
+
+    check_block_size(object_get_typename(obj), name, value, &local_err);
+    if (local_err) {
+        goto out;
+    }
+
+    vus->blk_size = value;
+
+out:
+    error_propagate(errp, local_err);
+}
+
+static void vhost_user_blk_server_instance_finalize(Object *obj)
+{
+    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
+
+    vhost_user_blk_server_stop(vub);
+
+    /*
+     * Unlike object_property_add_str, object_class_property_add_str
+     * doesn't have a release method. Thus manual memory freeing is
+     * needed.
+     */
+    free_socket_addr(vub->addr);
+    g_free(vub->node_name);
+}
+
+static void vhost_user_blk_server_complete(UserCreatable *obj, Error **errp)
+{
+    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
+
+    vhost_user_blk_server_start(vub, errp);
+}
+
+static void vhost_user_blk_server_class_init(ObjectClass *klass,
+                                             void *class_data)
+{
+    UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
+    ucc->complete = vhost_user_blk_server_complete;
+
+    object_class_property_add_bool(klass, "writable",
+                                   vu_get_block_writable,
+                                   vu_set_block_writable);
+
+    object_class_property_add_str(klass, "node-name",
+                                  vu_get_node_name,
+                                  vu_set_node_name);
+
+    object_class_property_add_str(klass, "unix-socket",
+                                  vu_get_unix_socket,
+                                  vu_set_unix_socket);
+
+    object_class_property_add(klass, "logical-block-size", "uint32",
+                              vu_get_blk_size, vu_set_blk_size,
+                              NULL, NULL);
+}
+
+static const TypeInfo vhost_user_blk_server_info = {
+    .name = TYPE_VHOST_USER_BLK_SERVER,
+    .parent = TYPE_OBJECT,
+    .instance_size = sizeof(VuBlockDev),
+    .instance_finalize = vhost_user_blk_server_instance_finalize,
+    .class_init = vhost_user_blk_server_class_init,
+    .interfaces = (InterfaceInfo[]) {
+        {TYPE_USER_CREATABLE},
+        {}
+    },
+};
+
+static void vhost_user_blk_server_register_types(void)
+{
+    type_register_static(&vhost_user_blk_server_info);
+}
+
+type_init(vhost_user_blk_server_register_types)
diff --git a/softmmu/vl.c b/softmmu/vl.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/vl.c
+++ b/softmmu/vl.c
@@ -XXX,XX +XXX,XX @@ static bool object_create_initial(const char *type, QemuOpts *opts)
     }
 #endif
 
+    /* Reason: vhost-user-blk-server property "node-name" */
+    if (g_str_equal(type, "vhost-user-blk-server")) {
+        return false;
+    }
     /*
      * Reason: filter-* property "netdev" etc.
      */
diff --git a/block/meson.build b/block/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(when: 'CONFIG_WIN32', if_true: files('file-win32.c', 'win32-aio.c')
 block_ss.add(when: 'CONFIG_POSIX', if_true: [files('file-posix.c'), coref, iokit])
 block_ss.add(when: 'CONFIG_LIBISCSI', if_true: files('iscsi-opts.c'))
 block_ss.add(when: 'CONFIG_LINUX', if_true: files('nvme.c'))
+block_ss.add(when: 'CONFIG_LINUX', if_true: files('export/vhost-user-blk-server.c', '../contrib/libvhost-user/libvhost-user.c'))
 block_ss.add(when: 'CONFIG_REPLICATION', if_true: files('replication.c'))
 block_ss.add(when: 'CONFIG_SHEEPDOG', if_true: files('sheepdog.c'))
 block_ss.add(when: ['CONFIG_LINUX_AIO', libaio], if_true: files('linux-aio.c'))
-- 
2.26.2

From: Coiby Xu <coiby.xu@gmail.com>

Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Coiby Xu <coiby.xu@gmail.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Message-id: 20200918080912.321299-8-coiby.xu@gmail.com
[Removed reference to vhost-user-blk-test.c, it will be sent in a
separate pull request.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 MAINTAINERS | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org
 S: Supported
 F: tests/image-fuzzer/
 
+Vhost-user block device backend server
+M: Coiby Xu <Coiby.Xu@gmail.com>
+S: Maintained
+F: block/export/vhost-user-blk-server.c
+F: util/vhost-user-server.c
+F: tests/qtest/libqos/vhost-user-blk.c
+
 Replication
 M: Wen Congyang <wencongyang2@huawei.com>
 M: Xie Changlong <xiechanglong.d@gmail.com>
-- 
2.26.2

Explicitly deleting watches is not necessary since libvhost-user calls
remove_watch() during vu_deinit(). Add an assertion to check this
though.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-5-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/vhost-user-server.c | 19 ++++---------------
 1 file changed, 4 insertions(+), 15 deletions(-)

diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@ static void close_client(VuServer *server)
     /* When this is set vu_client_trip will stop new processing vhost-user message */
     server->sioc = NULL;
 
-    VuFdWatch *vu_fd_watch, *next;
-    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
-        aio_set_fd_handler(server->ioc->ctx, vu_fd_watch->fd, true, NULL,
-                           NULL, NULL, NULL);
-    }
-
-    while (!QTAILQ_EMPTY(&server->vu_fd_watches)) {
-        QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
-            if (!vu_fd_watch->processing) {
-                QTAILQ_REMOVE(&server->vu_fd_watches, vu_fd_watch, next);
-                g_free(vu_fd_watch);
-            }
-        }
-    }
-
     while (server->processing_msg) {
         if (server->ioc->read_coroutine) {
             server->ioc->read_coroutine = NULL;
@@ -XXX,XX +XXX,XX @@ static void close_client(VuServer *server)
     }
 
     vu_deinit(&server->vu_dev);
+
+    /* vu_deinit() should have called remove_watch() */
+    assert(QTAILQ_EMPTY(&server->vu_fd_watches));
+
     object_unref(OBJECT(sioc));
     object_unref(OBJECT(server->ioc));
 }
-- 
2.26.2

Only one struct is needed per request. Drop req_data and the separate
VuBlockReq instance. Instead let vu_queue_pop() allocate everything at
once.

This fixes the req_data memory leak in vu_block_virtio_process_req().

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-6-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/export/vhost-user-blk-server.c | 68 +++++++++-------------------
 1 file changed, 21 insertions(+), 47 deletions(-)

diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@ struct virtio_blk_inhdr {
 };
 
 typedef struct VuBlockReq {
-    VuVirtqElement *elem;
+    VuVirtqElement elem;
     int64_t sector_num;
     size_t size;
     struct virtio_blk_inhdr *in;
@@ -XXX,XX +XXX,XX @@ static void vu_block_req_complete(VuBlockReq *req)
     VuDev *vu_dev = &req->server->vu_dev;
 
     /* IO size with 1 extra status byte */
-    vu_queue_push(vu_dev, req->vq, req->elem, req->size + 1);
+    vu_queue_push(vu_dev, req->vq, &req->elem, req->size + 1);
     vu_queue_notify(vu_dev, req->vq);
 
-    if (req->elem) {
-        free(req->elem);
-    }
-
-    g_free(req);
+    free(req);
 }
 
 static VuBlockDev *get_vu_block_device_by_server(VuServer *server)
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_flush(VuBlockReq *req)
     blk_co_flush(backend);
 }
 
-struct req_data {
-    VuServer *server;
-    VuVirtq *vq;
-    VuVirtqElement *elem;
-};
-
 static void coroutine_fn vu_block_virtio_process_req(void *opaque)
 {
-    struct req_data *data = opaque;
-    VuServer *server = data->server;
-    VuVirtq *vq = data->vq;
-    VuVirtqElement *elem = data->elem;
+    VuBlockReq *req = opaque;
+    VuServer *server = req->server;
+    VuVirtqElement *elem = &req->elem;
     uint32_t type;
-    VuBlockReq *req;
 
     VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
     BlockBackend *backend = vdev_blk->backend;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
     struct iovec *out_iov = elem->out_sg;
     unsigned in_num = elem->in_num;
     unsigned out_num = elem->out_num;
+
     /* refer to hw/block/virtio_blk.c */
     if (elem->out_num < 1 || elem->in_num < 1) {
         error_report("virtio-blk request missing headers");
-        free(elem);
-        return;
+        goto err;
     }
 
-    req = g_new0(VuBlockReq, 1);
-    req->server = server;
-    req->vq = vq;
-    req->elem = elem;
-
     if (unlikely(iov_to_buf(out_iov, out_num, 0, &req->out,
                             sizeof(req->out)) != sizeof(req->out))) {
         error_report("virtio-blk request outhdr too short");
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
 
 err:
     free(elem);
-    g_free(req);
-    return;
 }
 
 static void vu_block_process_vq(VuDev *vu_dev, int idx)
 {
-    VuServer *server;
-    VuVirtq *vq;
-    struct req_data *req_data;
+    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+    VuVirtq *vq = vu_get_queue(vu_dev, idx);
 
-    server = container_of(vu_dev, VuServer, vu_dev);
-    assert(server);
-
-    vq = vu_get_queue(vu_dev, idx);
-    assert(vq);
-    VuVirtqElement *elem;
     while (1) {
-        elem = vu_queue_pop(vu_dev, vq, sizeof(VuVirtqElement) +
-                                    sizeof(VuBlockReq));
-        if (elem) {
-            req_data = g_new0(struct req_data, 1);
-            req_data->server = server;
-            req_data->vq = vq;
-            req_data->elem = elem;
-            Coroutine *co = qemu_coroutine_create(vu_block_virtio_process_req,
-                                                  req_data);
-            aio_co_enter(server->ioc->ctx, co);
-        } else {
+        VuBlockReq *req;
+
+        req = vu_queue_pop(vu_dev, vq, sizeof(VuBlockReq));
+        if (!req) {
             break;
         }
+
+        req->server = server;
+        req->vq = vq;
+
+        Coroutine *co =
+            qemu_coroutine_create(vu_block_virtio_process_req, req);
+        qemu_coroutine_enter(co);
     }
 }
 
-- 
2.26.2

The device panic notifier callback is not used. Drop it.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-7-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/vhost-user-server.h             | 3 ---
 block/export/vhost-user-blk-server.c | 3 +--
 util/vhost-user-server.c             | 6 ------
 3 files changed, 1 insertion(+), 11 deletions(-)

diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.h
+++ b/util/vhost-user-server.h
@@ -XXX,XX +XXX,XX @@ typedef struct VuFdWatch {
 } VuFdWatch;
 
 typedef struct VuServer VuServer;
-typedef void DevicePanicNotifierFn(VuServer *server);
 
 struct VuServer {
     QIONetListener *listener;
     AioContext *ctx;
-    DevicePanicNotifierFn *device_panic_notifier;
     int max_queues;
     const VuDevIface *vu_iface;
     VuDev vu_dev;
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
                              SocketAddress *unix_socket,
                              AioContext *ctx,
                              uint16_t max_queues,
-                             DevicePanicNotifierFn *device_panic_notifier,
                              const VuDevIface *vu_iface,
                              Error **errp);
 
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@ static void vhost_user_blk_server_start(VuBlockDev *vu_block_device,
     ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend));
 
     if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx,
-                                 VHOST_USER_BLK_MAX_QUEUES,
-                                 NULL, &vu_block_iface,
+                                 VHOST_USER_BLK_MAX_QUEUES, &vu_block_iface,
                                  errp)) {
         goto error;
     }
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@ static void panic_cb(VuDev *vu_dev, const char *buf)
         close_client(server);
     }
 
-    if (server->device_panic_notifier) {
-        server->device_panic_notifier(server);
-    }
-
     /*
      * Set the callback function for network listener so another
      * vhost-user client can connect to this server
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
                              SocketAddress *socket_addr,
                              AioContext *ctx,
                              uint16_t max_queues,
-                             DevicePanicNotifierFn *device_panic_notifier,
                              const VuDevIface *vu_iface,
                              Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
         .vu_iface              = vu_iface,
         .max_queues            = max_queues,
         .ctx                   = ctx,
-        .device_panic_notifier = device_panic_notifier,
     };
 
     qio_net_listener_set_name(server->listener, "vhost-user-backend-listener");
-- 
2.26.2

fds[] is leaked when qio_channel_readv_full() fails.

Use vmsg->fds[] instead of keeping a local fds[] array. Then we can
reuse goto fail to clean up fds. vmsg->fd_num must be zeroed before the
loop to make this safe.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-8-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/vhost-user-server.c | 50 ++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 27 deletions(-)

diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
     };
     int rc, read_bytes = 0;
     Error *local_err = NULL;
-    /*
-     * Store fds/nfds returned from qio_channel_readv_full into
-     * temporary variables.
-     *
-     * VhostUserMsg is a packed structure, gcc will complain about passing
-     * pointer to a packed structure member if we pass &VhostUserMsg.fd_num
-     * and &VhostUserMsg.fds directly when calling qio_channel_readv_full,
-     * thus two temporary variables nfds and fds are used here.
-     */
-    size_t nfds = 0, nfds_t = 0;
     const size_t max_fds = G_N_ELEMENTS(vmsg->fds);
-    int *fds_t = NULL;
     VuServer *server = container_of(vu_dev, VuServer, vu_dev);
     QIOChannel *ioc = server->ioc;
 
+    vmsg->fd_num = 0;
     if (!ioc) {
         error_report_err(local_err);
         goto fail;
@@ -XXX,XX +XXX,XX @@ vu_message_read(VuDev *vu_dev, int conn_fd, VhostUserMsg *vmsg)
 
     assert(qemu_in_coroutine());
     do {
+        size_t nfds = 0;
+        int *fds = NULL;
+
         /*
          * qio_channel_readv_full may have short reads, keeping calling it
          * until getting VHOST_USER_HDR_SIZE or 0 bytes in total
          */
-        rc = qio_channel_readv_full(ioc, &iov, 1, &fds_t, &nfds_t, &local_err);
+        rc = qio_channel_readv_full(ioc, &iov, 1, &fds, &nfds, &local_err);
         if (rc < 0) {
             if (rc == QIO_CHANNEL_ERR_BLOCK) {
+                assert(local_err == NULL);
                 qio_channel_yield(ioc, G_IO_IN);
                 continue;
             } else {
                 error_report_err(local_err);
-                return false;
+                goto fail;
             }
         }
-        read_bytes += rc;
-        if (nfds_t > 0) {
-            if (nfds + nfds_t > max_fds) {
+
+        if (nfds > 0) {
+            if (vmsg->fd_num + nfds > max_fds) {
                 error_report("A maximum of %zu fds are allowed, "
                              "however got %zu fds now",
-                             max_fds, nfds + nfds_t);
+                             max_fds, vmsg->fd_num + nfds);
+                g_free(fds);
                 goto fail;
             }
-            memcpy(vmsg->fds + nfds, fds_t,
-                   nfds_t *sizeof(vmsg->fds[0]));
-            nfds += nfds_t;
-            g_free(fds_t);
+            memcpy(vmsg->fds + vmsg->fd_num, fds, nfds * sizeof(vmsg->fds[0]));
+            vmsg->fd_num += nfds;
+            g_free(fds);
         }
-        if (read_bytes == VHOST_USER_HDR_SIZE || rc == 0) {
-            break;
+
+        if (rc == 0) { /* socket closed */
+            goto fail;
         }
-        iov.iov_base = (char *)vmsg + read_bytes;
-        iov.iov_len = VHOST_USER_HDR_SIZE - read_bytes;
-    } while (true);
 
-    vmsg->fd_num = nfds;
+        iov.iov_base += rc;
+        iov.iov_len -= rc;
+        read_bytes += rc;
+    } while (read_bytes != VHOST_USER_HDR_SIZE);
+
     /* qio_channel_readv_full will make socket fds blocking, unblock them */
     vmsg_unblock_fds(vmsg);
     if (vmsg->size > sizeof(vmsg->payload)) {
-- 
2.26.2

The vu_client_trip() coroutine is leaked during AioContext switching. It
is also unsafe to destroy the vu_dev in panic_cb() since its callers
still access it in some cases.

Rework the lifecycle to solve these safety issues.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-10-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/vhost-user-server.h             |  29 ++--
 block/export/vhost-user-blk-server.c |   9 +-
 util/vhost-user-server.c             | 245 +++++++++++++++------------
 3 files changed, 155 insertions(+), 128 deletions(-)

diff --git a/util/vhost-user-server.h b/util/vhost-user-server.h
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.h
+++ b/util/vhost-user-server.h
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "standard-headers/linux/virtio_blk.h"
 
+/* A kick fd that we monitor on behalf of libvhost-user */
 typedef struct VuFdWatch {
     VuDev *vu_dev;
     int fd; /*kick fd*/
     void *pvt;
     vu_watch_cb cb;
-    bool processing;
     QTAILQ_ENTRY(VuFdWatch) next;
 } VuFdWatch;
 
-typedef struct VuServer VuServer;
-
-struct VuServer {
+/**
+ * VuServer:
+ * A vhost-user server instance with user-defined VuDevIface callbacks.
+ * Vhost-user device backends can be implemented using VuServer. VuDevIface
+ * callbacks and virtqueue kicks run in the given AioContext.
+ */
+typedef struct {
     QIONetListener *listener;
+    QEMUBH *restart_listener_bh;
     AioContext *ctx;
     int max_queues;
     const VuDevIface *vu_iface;
+
+    /* Protected by ctx lock */
     VuDev vu_dev;
     QIOChannel *ioc; /* The I/O channel with the client */
     QIOChannelSocket *sioc; /* The underlying data channel with the client */
-    /* IOChannel for fd provided via VHOST_USER_SET_SLAVE_REQ_FD */
-    QIOChannel *ioc_slave;
-    QIOChannelSocket *sioc_slave;
-    Coroutine *co_trip; /* coroutine for processing VhostUserMsg */
     QTAILQ_HEAD(, VuFdWatch) vu_fd_watches;
-    /* restart coroutine co_trip if AIOContext is changed */
-    bool aio_context_changed;
-    bool processing_msg;
-};
+
+    Coroutine *co_trip; /* coroutine for processing VhostUserMsg */
+} VuServer;
 
 bool vhost_user_server_start(VuServer *server,
                              SocketAddress *unix_socket,
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
 
 void vhost_user_server_stop(VuServer *server);
 
-void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx);
+void vhost_user_server_attach_aio_context(VuServer *server, AioContext *ctx);
+void vhost_user_server_detach_aio_context(VuServer *server);
 
 #endif /* VHOST_USER_SERVER_H */
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@ static const VuDevIface vu_block_iface = {
 static void blk_aio_attached(AioContext *ctx, void *opaque)
 {
     VuBlockDev *vub_dev = opaque;
-    aio_context_acquire(ctx);
-    vhost_user_server_set_aio_context(&vub_dev->vu_server, ctx);
-    aio_context_release(ctx);
+    vhost_user_server_attach_aio_context(&vub_dev->vu_server, ctx);
 }
 
 static void blk_aio_detach(void *opaque)
 {
     VuBlockDev *vub_dev = opaque;
-    AioContext *ctx = vub_dev->vu_server.ctx;
-    aio_context_acquire(ctx);
-    vhost_user_server_set_aio_context(&vub_dev->vu_server, NULL);
-    aio_context_release(ctx);
+    vhost_user_server_detach_aio_context(&vub_dev->vu_server);
 }
 
 static void
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
+#include "block/aio-wait.h"
 #include "vhost-user-server.h"
 
+/*
+ * Theory of operation:
+ *
+ * VuServer is started and stopped by vhost_user_server_start() and
+ * vhost_user_server_stop() from the main loop thread. Starting the server
+ * opens a vhost-user UNIX domain socket and listens for incoming connections.
+ * Only one connection is allowed at a time.
+ *
+ * The connection is handled by the vu_client_trip() coroutine in the
+ * VuServer->ctx AioContext. The coroutine consists of a vu_dispatch() loop
+ * where libvhost-user calls vu_message_read() to receive the next vhost-user
+ * protocol messages over the UNIX domain socket.
+ *
+ * When virtqueues are set up libvhost-user calls set_watch() to monitor kick
+ * fds. These fds are also handled in the VuServer->ctx AioContext.
+ *
+ * Both vu_client_trip() and kick fd monitoring can be stopped by shutting down
+ * the socket connection. Shutting down the socket connection causes
+ * vu_message_read() to fail since no more data can be received from the socket.
+ * After vu_dispatch() fails, vu_client_trip() calls vu_deinit() to stop
+ * libvhost-user before terminating the coroutine. vu_deinit() calls
+ * remove_watch() to stop monitoring kick fds and this stops virtqueue
+ * processing.
+ *
+ * When vu_client_trip() has finished cleaning up it schedules a BH in the main
+ * loop thread to accept the next client connection.
+ *
+ * When libvhost-user detects an error it calls panic_cb() and sets the
+ * dev->broken flag. Both vu_client_trip() and kick fd processing stop when
+ * the dev->broken flag is set.
+ *
+ * It is possible to switch AioContexts using
+ * vhost_user_server_detach_aio_context() and
+ * vhost_user_server_attach_aio_context(). They stop monitoring fds in the old
+ * AioContext and resume monitoring in the new AioContext. The vu_client_trip()
+ * coroutine remains in a yielded state during the switch. This is made
+ * possible by QIOChannel's support for spurious coroutine re-entry in
+ * qio_channel_yield(). The coroutine will restart I/O when re-entered from the
+ * new AioContext.
+ */
+
 static void vmsg_close_fds(VhostUserMsg *vmsg)
 {
     int i;
@@ -XXX,XX +XXX,XX @@ static void vmsg_unblock_fds(VhostUserMsg *vmsg)
     }
 }
 
-static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
-                      gpointer opaque);
-
-static void close_client(VuServer *server)
-{
-    /*
-     * Before closing the client
-     *
-     * 1. Let vu_client_trip stop processing new vhost-user msg
-     *
-     * 2. remove kick_handler
-     *
-     * 3. wait for the kick handler to be finished
-     *
-     * 4. wait for the current vhost-user msg to be finished processing
-     */
-
-    QIOChannelSocket *sioc = server->sioc;
-    /* When this is set vu_client_trip will stop new processing vhost-user message */
-    server->sioc = NULL;
-
-    while (server->processing_msg) {
-        if (server->ioc->read_coroutine) {
-            server->ioc->read_coroutine = NULL;
-            qio_channel_set_aio_fd_handler(server->ioc, server->ioc->ctx, NULL,
-                                           NULL, server->ioc);
-            server->processing_msg = false;
-        }
-    }
-
-    vu_deinit(&server->vu_dev);
-
-    /* vu_deinit() should have called remove_watch() */
-    assert(QTAILQ_EMPTY(&server->vu_fd_watches));
-
-    object_unref(OBJECT(sioc));
-    object_unref(OBJECT(server->ioc));
-}
-
 static void panic_cb(VuDev *vu_dev, const char *buf)
 {
-    VuServer *server = container_of(vu_dev, VuServer, vu_dev);
-
-    /* avoid while loop in close_client */
-    server->processing_msg = false;
-
-    if (buf) {
-        error_report("vu_panic: %s", buf);
-    }
-
-    if (server->sioc) {
-        close_client(server);
-    }
-
-    /*
-     * Set the callback function for network listener so another
-     * vhost-user client can connect to this server
-     */
-    qio_net_listener_set_client_func(server->listener,
-                                     vu_accept,
-                                     server,
-                                     NULL);
+    error_report("vu_panic: %s", buf);
 }
 
 static bool coroutine_fn
@@ -XXX,XX +XXX,XX @@ fail:
     return false;
 }
 
-
-static void vu_client_start(VuServer *server);
 static coroutine_fn void vu_client_trip(void *opaque)
 {
     VuServer *server = opaque;
+    VuDev *vu_dev = &server->vu_dev;
 
-    while (!server->aio_context_changed && server->sioc) {
-        server->processing_msg = true;
-        vu_dispatch(&server->vu_dev);
-        server->processing_msg = false;
+    while (!vu_dev->broken && vu_dispatch(vu_dev)) {
+        /* Keep running */
     }
 
-    if (server->aio_context_changed && server->sioc) {
-        server->aio_context_changed = false;
-        vu_client_start(server);
-    }
-}
+    vu_deinit(vu_dev);
+
+    /* vu_deinit() should have called remove_watch() */
+    assert(QTAILQ_EMPTY(&server->vu_fd_watches));
+
+    object_unref(OBJECT(server->sioc));
+    server->sioc = NULL;
 
-static void vu_client_start(VuServer *server)
-{
-    server->co_trip = qemu_coroutine_create(vu_client_trip, server);
-    aio_co_enter(server->ctx, server->co_trip);
+    object_unref(OBJECT(server->ioc));
+    server->ioc = NULL;
+
+    server->co_trip = NULL;
+    if (server->restart_listener_bh) {
+        qemu_bh_schedule(server->restart_listener_bh);
+    }
+    aio_wait_kick();
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void vu_client_start(VuServer *server)
 static void kick_handler(void *opaque)
 {
     VuFdWatch *vu_fd_watch = opaque;
-    vu_fd_watch->processing = true;
-    vu_fd_watch->cb(vu_fd_watch->vu_dev, 0, vu_fd_watch->pvt);
-    vu_fd_watch->processing = false;
+    VuDev *vu_dev = vu_fd_watch->vu_dev;
+
+    vu_fd_watch->cb(vu_dev, 0, vu_fd_watch->pvt);
+
+    /* Stop vu_client_trip() if an error occurred in vu_fd_watch->cb() */
+    if (vu_dev->broken) {
+        VuServer *server = container_of(vu_dev, VuServer, vu_dev);
+
+        qio_channel_shutdown(server->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
+    }
 }
 
-
 static VuFdWatch *find_vu_fd_watch(VuServer *server, int fd)
 {
 
@@ -XXX,XX +XXX,XX @@ static void vu_accept(QIONetListener *listener, QIOChannelSocket *sioc,
     qio_channel_set_name(QIO_CHANNEL(sioc), "vhost-user client");
     server->ioc = QIO_CHANNEL(sioc);
     object_ref(OBJECT(server->ioc));
-    qio_channel_attach_aio_context(server->ioc, server->ctx);
+
+    /* TODO vu_message_write() spins if non-blocking! */
     qio_channel_set_blocking(server->ioc, false, NULL);
-    vu_client_start(server);
+
+    server->co_trip = qemu_coroutine_create(vu_client_trip, server);
+
+    aio_context_acquire(server->ctx);
+    vhost_user_server_attach_aio_context(server, server->ctx);
+    aio_context_release(server->ctx);
 }
 
-
 void vhost_user_server_stop(VuServer *server)
 {
+    aio_context_acquire(server->ctx);
+
+    qemu_bh_delete(server->restart_listener_bh);
+    server->restart_listener_bh = NULL;
+
     if (server->sioc) {
-        close_client(server);
+        VuFdWatch *vu_fd_watch;
+
+        QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) {
+            aio_set_fd_handler(server->ctx, vu_fd_watch->fd, true,
+                               NULL, NULL, NULL, vu_fd_watch);
+        }
+
+        qio_channel_shutdown(server->ioc, QIO_CHANNEL_SHUTDOWN_BOTH, NULL);
+
+        AIO_WAIT_WHILE(server->ctx, server->co_trip);
     }
 
+    aio_context_release(server->ctx);
+
     if (server->listener) {
         qio_net_listener_disconnect(server->listener);
         object_unref(OBJECT(server->listener));
     }
+}
+
+/*
+ * Allow the next client to connect to the server. Called from a BH in the main
+ * loop.
+ */
+static void restart_listener_bh(void *opaque)
+{
+    VuServer *server = opaque;
 
+    qio_net_listener_set_client_func(server->listener, vu_accept, server,
+                                     NULL);
 }
 
-void vhost_user_server_set_aio_context(VuServer *server, AioContext *ctx)
+/* Called with ctx acquired */
+void vhost_user_server_attach_aio_context(VuServer *server, AioContext *ctx)
 {
-    VuFdWatch *vu_fd_watch, *next;
-    void *opaque = NULL;
-    IOHandler *io_read = NULL;
-    bool attach;
+    VuFdWatch *vu_fd_watch;
 
-    server->ctx = ctx ? ctx : qemu_get_aio_context();
+    server->ctx = ctx;
 
     if (!server->sioc) {
-        /* not yet serving any client*/
         return;
     }
 
-    if (ctx) {
-        qio_channel_attach_aio_context(server->ioc, ctx);
-        server->aio_context_changed = true;
-        io_read = kick_handler;
-        attach = true;
-    } else {
+    qio_channel_attach_aio_context(server->ioc, ctx);
+
+    QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) {
+        aio_set_fd_handler(ctx, vu_fd_watch->fd, true, kick_handler, NULL,
+                           NULL, vu_fd_watch);
+    }
+
+    aio_co_schedule(ctx, server->co_trip);
+}
+
+/* Called with server->ctx acquired */
+void vhost_user_server_detach_aio_context(VuServer *server)
+{
+    if (server->sioc) {
+        VuFdWatch *vu_fd_watch;
+
+        QTAILQ_FOREACH(vu_fd_watch, &server->vu_fd_watches, next) {
+            aio_set_fd_handler(server->ctx, vu_fd_watch->fd, true,
+                               NULL, NULL, NULL, vu_fd_watch);
+        }
+
         qio_channel_detach_aio_context(server->ioc);
-        /* server->ioc->ctx keeps the old AioConext */
-        ctx = server->ioc->ctx;
-        attach = false;
     }
 
-    QTAILQ_FOREACH_SAFE(vu_fd_watch, &server->vu_fd_watches, next, next) {
-        if (vu_fd_watch->cb) {
-            opaque = attach ? vu_fd_watch : NULL;
-            aio_set_fd_handler(ctx, vu_fd_watch->fd, true,
-                               io_read, NULL, NULL,
-                               opaque);
-        }
-    }
+    server->ctx = NULL;
 }
 
-
 bool vhost_user_server_start(VuServer *server,
                              SocketAddress *socket_addr,
                              AioContext *ctx,
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
                              const VuDevIface *vu_iface,
                              Error **errp)
 {
+    QEMUBH *bh;
     QIONetListener *listener = qio_net_listener_new();
     if (qio_net_listener_open_sync(listener, socket_addr, 1,
                                    errp) < 0) {
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
         return false;
     }
 
+    bh = qemu_bh_new(restart_listener_bh, server);
+
     /* zero out unspecified fields */
     *server = (VuServer) {
         .listener              = listener,
+        .restart_listener_bh   = bh,
         .vu_iface              = vu_iface,
         .max_queues            = max_queues,
         .ctx                   = ctx,
-- 
2.26.2

Propagate the flush return value since errors are possible.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-11-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/export/vhost-user-blk-server.c | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

Use the new QAPI block exports API instead of defining our own QOM
objects.

This is a large change because the lifecycle of VuBlockDev needs to
follow BlockExportDriver. QOM properties are replaced by QAPI options
objects.

VuBlockDev is renamed VuBlkExport and contains a BlockExport field.
Several fields can be dropped since BlockExport already has equivalents.

The file names and meson build integration will be adjusted in a future
patch. libvhost-user should probably be built as a static library that
is linked into QEMU instead of as a .c file that results in duplicate
compilation.

The new command-line syntax is:

$ qemu-storage-daemon \
      --blockdev file,node-name=drive0,filename=test.img \
      --export vhost-user-blk,node-name=drive0,id=export0,unix-socket=/tmp/vhost-user-blk.sock

Note that unix-socket is optional because we may wish to accept chardevs
too in the future.

Markus noted that supported address families are not explicit in the
QAPI schema. It is unlikely that support for more address families will
be added since file descriptor passing is required and few address
families support it. If a new address family needs to be added, then the
QAPI 'features' syntax can be used to advertize them.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20200924151549.913737-12-stefanha@redhat.com
[Skip test on big-endian host architectures because this device doesn't
support them yet (as already mentioned in a code comment).
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-export.json               |  21 +-
 block/export/vhost-user-blk-server.h |  23 +-
 block/export/export.c                |   6 +
 block/export/vhost-user-blk-server.c | 452 +++++++--------------------
 util/vhost-user-server.c             |  10 +-
 block/export/meson.build             |   1 +
 block/meson.build                    |   1 -
 7 files changed, 156 insertions(+), 358 deletions(-)

diff --git a/qapi/block-export.json b/qapi/block-export.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -XXX,XX +XXX,XX @@
   'data': { '*name': 'str', '*description': 'str',
             '*bitmap': 'str' } }
 
+##
+# @BlockExportOptionsVhostUserBlk:
+#
+# A vhost-user-blk block export.
+#
+# @addr: The vhost-user socket on which to listen. Both 'unix' and 'fd'
+#        SocketAddress types are supported. Passed fds must be UNIX domain
+#        sockets.
+# @logical-block-size: Logical block size in bytes. Defaults to 512 bytes.
+#
+# Since: 5.2
+##
+{ 'struct': 'BlockExportOptionsVhostUserBlk',
+  'data': { 'addr': 'SocketAddress', '*logical-block-size': 'size' } }
+
 ##
 # @NbdServerAddOptions:
 #
@@ -XXX,XX +XXX,XX @@
 # An enumeration of block export types
 #
 # @nbd: NBD export
+# @vhost-user-blk: vhost-user-blk export (since 5.2)
 #
 # Since: 4.2
 ##
 { 'enum': 'BlockExportType',
-  'data': [ 'nbd' ] }
+  'data': [ 'nbd', 'vhost-user-blk' ] }
 
 ##
 # @BlockExportOptions:
@@ -XXX,XX +XXX,XX @@
             '*writethrough': 'bool' },
   'discriminator': 'type',
   'data': {
-      'nbd': 'BlockExportOptionsNbd'
+      'nbd': 'BlockExportOptionsNbd',
+      'vhost-user-blk': 'BlockExportOptionsVhostUserBlk'
    } }
 
 ##
diff --git a/block/export/vhost-user-blk-server.h b/block/export/vhost-user-blk-server.h
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.h
+++ b/block/export/vhost-user-blk-server.h
@@ -XXX,XX +XXX,XX @@
 
 #ifndef VHOST_USER_BLK_SERVER_H
 #define VHOST_USER_BLK_SERVER_H
-#include "util/vhost-user-server.h"
 
-typedef struct VuBlockDev VuBlockDev;
-#define TYPE_VHOST_USER_BLK_SERVER "vhost-user-blk-server"
-#define VHOST_USER_BLK_SERVER(obj) \
-   OBJECT_CHECK(VuBlockDev, obj, TYPE_VHOST_USER_BLK_SERVER)
+#include "block/export.h"
 
-/* vhost user block device */
-struct VuBlockDev {
-    Object parent_obj;
-    char *node_name;
-    SocketAddress *addr;
-    AioContext *ctx;
-    VuServer vu_server;
-    bool running;
-    uint32_t blk_size;
-    BlockBackend *backend;
-    QIOChannelSocket *sioc;
-    QTAILQ_ENTRY(VuBlockDev) next;
-    struct virtio_blk_config blkcfg;
-    bool writable;
-};
+/* For block/export/export.c */
+extern const BlockExportDriver blk_exp_vhost_user_blk;
 
 #endif /* VHOST_USER_BLK_SERVER_H */
diff --git a/block/export/export.c b/block/export/export.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/export.c
+++ b/block/export/export.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/block-backend.h"
 #include "block/export.h"
 #include "block/nbd.h"
+#if CONFIG_LINUX
+#include "block/export/vhost-user-blk-server.h"
+#endif
 #include "qapi/error.h"
 #include "qapi/qapi-commands-block-export.h"
 #include "qapi/qapi-events-block-export.h"
@@ -XXX,XX +XXX,XX @@
 
 static const BlockExportDriver *blk_exp_drivers[] = {
     &blk_exp_nbd,
+#if CONFIG_LINUX
+    &blk_exp_vhost_user_blk,
+#endif
 };
 
 /* Only accessed from the main thread */
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "block/block.h"
+#include "contrib/libvhost-user/libvhost-user.h"
+#include "standard-headers/linux/virtio_blk.h"
+#include "util/vhost-user-server.h"
 #include "vhost-user-blk-server.h"
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
@@ -XXX,XX +XXX,XX @@ struct virtio_blk_inhdr {
     unsigned char status;
 };
 
-typedef struct VuBlockReq {
+typedef struct VuBlkReq {
     VuVirtqElement elem;
     int64_t sector_num;
     size_t size;
@@ -XXX,XX +XXX,XX @@ typedef struct VuBlockReq {
     struct virtio_blk_outhdr out;
     VuServer *server;
     struct VuVirtq *vq;
-} VuBlockReq;
+} VuBlkReq;
 
-static void vu_block_req_complete(VuBlockReq *req)
+/* vhost user block device */
+typedef struct {
+    BlockExport export;
+    VuServer vu_server;
+    uint32_t blk_size;
+    QIOChannelSocket *sioc;
+    struct virtio_blk_config blkcfg;
+    bool writable;
+} VuBlkExport;
+
+static void vu_blk_req_complete(VuBlkReq *req)
 {
     VuDev *vu_dev = &req->server->vu_dev;
 
@@ -XXX,XX +XXX,XX @@ static void vu_block_req_complete(VuBlockReq *req)
     free(req);
 }
 
-static VuBlockDev *get_vu_block_device_by_server(VuServer *server)
-{
-    return container_of(server, VuBlockDev, vu_server);
-}
-
 static int coroutine_fn
-vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
-                              uint32_t iovcnt, uint32_t type)
+vu_blk_discard_write_zeroes(BlockBackend *blk, struct iovec *iov,
+                            uint32_t iovcnt, uint32_t type)
 {
     struct virtio_blk_discard_write_zeroes desc;
     ssize_t size = iov_to_buf(iov, iovcnt, 0, &desc, sizeof(desc));
@@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
         return -EINVAL;
     }
 
-    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
     uint64_t range[2] = { le64_to_cpu(desc.sector) << 9,
                           le32_to_cpu(desc.num_sectors) << 9 };
     if (type == VIRTIO_BLK_T_DISCARD) {
-        if (blk_co_pdiscard(vdev_blk->backend, range[0], range[1]) == 0) {
+        if (blk_co_pdiscard(blk, range[0], range[1]) == 0) {
             return 0;
         }
     } else if (type == VIRTIO_BLK_T_WRITE_ZEROES) {
-        if (blk_co_pwrite_zeroes(vdev_blk->backend,
-                                 range[0], range[1], 0) == 0) {
+        if (blk_co_pwrite_zeroes(blk, range[0], range[1], 0) == 0) {
             return 0;
         }
     }
@@ -XXX,XX +XXX,XX @@ vu_block_discard_write_zeroes(VuBlockReq *req, struct iovec *iov,
     return -EINVAL;
 }
 
-static int coroutine_fn vu_block_flush(VuBlockReq *req)
+static void coroutine_fn vu_blk_virtio_process_req(void *opaque)
 {
-    VuBlockDev *vdev_blk = get_vu_block_device_by_server(req->server);
-    BlockBackend *backend = vdev_blk->backend;
-    return blk_co_flush(backend);
-}
-
-static void coroutine_fn vu_block_virtio_process_req(void *opaque)
-{
-    VuBlockReq *req = opaque;
+    VuBlkReq *req = opaque;
     VuServer *server = req->server;
     VuVirtqElement *elem = &req->elem;
     uint32_t type;
 
-    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
-    BlockBackend *backend = vdev_blk->backend;
+    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
+    BlockBackend *blk = vexp->export.blk;
 
     struct iovec *in_iov = elem->in_sg;
     struct iovec *out_iov = elem->out_sg;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
         bool is_write = type & VIRTIO_BLK_T_OUT;
         req->sector_num = le64_to_cpu(req->out.sector);
 
-        int64_t offset = req->sector_num * vdev_blk->blk_size;
+        if (is_write && !vexp->writable) {
+            req->in->status = VIRTIO_BLK_S_IOERR;
+            break;
+        }
+
+        int64_t offset = req->sector_num * vexp->blk_size;
         QEMUIOVector qiov;
         if (is_write) {
             qemu_iovec_init_external(&qiov, out_iov, out_num);
-            ret = blk_co_pwritev(backend, offset, qiov.size,
-                                 &qiov, 0);
+            ret = blk_co_pwritev(blk, offset, qiov.size, &qiov, 0);
         } else {
             qemu_iovec_init_external(&qiov, in_iov, in_num);
-            ret = blk_co_preadv(backend, offset, qiov.size,
-                                &qiov, 0);
+            ret = blk_co_preadv(blk, offset, qiov.size, &qiov, 0);
         }
         if (ret >= 0) {
             req->in->status = VIRTIO_BLK_S_OK;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
         break;
     }
     case VIRTIO_BLK_T_FLUSH:
-        if (vu_block_flush(req) == 0) {
+        if (blk_co_flush(blk) == 0) {
             req->in->status = VIRTIO_BLK_S_OK;
         } else {
             req->in->status = VIRTIO_BLK_S_IOERR;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
     case VIRTIO_BLK_T_DISCARD:
     case VIRTIO_BLK_T_WRITE_ZEROES: {
         int rc;
-        rc = vu_block_discard_write_zeroes(req, &elem->out_sg[1],
-                                           out_num, type);
+
+        if (!vexp->writable) {
+            req->in->status = VIRTIO_BLK_S_IOERR;
+            break;
+        }
+
+        rc = vu_blk_discard_write_zeroes(blk, &elem->out_sg[1], out_num, type);
         if (rc == 0) {
             req->in->status = VIRTIO_BLK_S_OK;
         } else {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn vu_block_virtio_process_req(void *opaque)
         break;
     }
 
-    vu_block_req_complete(req);
+    vu_blk_req_complete(req);
     return;
 
 err:
-    free(elem);
+    free(req);
 }
 
-static void vu_block_process_vq(VuDev *vu_dev, int idx)
+static void vu_blk_process_vq(VuDev *vu_dev, int idx)
 {
     VuServer *server = container_of(vu_dev, VuServer, vu_dev);
     VuVirtq *vq = vu_get_queue(vu_dev, idx);
 
     while (1) {
-        VuBlockReq *req;
+        VuBlkReq *req;
 
-        req = vu_queue_pop(vu_dev, vq, sizeof(VuBlockReq));
+        req = vu_queue_pop(vu_dev, vq, sizeof(VuBlkReq));
         if (!req) {
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void vu_block_process_vq(VuDev *vu_dev, int idx)
         req->vq = vq;
 
         Coroutine *co =
-            qemu_coroutine_create(vu_block_virtio_process_req, req);
+            qemu_coroutine_create(vu_blk_virtio_process_req, req);
         qemu_coroutine_enter(co);
     }
 }
 
-static void vu_block_queue_set_started(VuDev *vu_dev, int idx, bool started)
+static void vu_blk_queue_set_started(VuDev *vu_dev, int idx, bool started)
 {
     VuVirtq *vq;
 
     assert(vu_dev);
 
     vq = vu_get_queue(vu_dev, idx);
-    vu_set_queue_handler(vu_dev, vq, started ? vu_block_process_vq : NULL);
+    vu_set_queue_handler(vu_dev, vq, started ? vu_blk_process_vq : NULL);
 }
 
-static uint64_t vu_block_get_features(VuDev *dev)
+static uint64_t vu_blk_get_features(VuDev *dev)
 {
     uint64_t features;
     VuServer *server = container_of(dev, VuServer, vu_dev);
-    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
     features = 1ull << VIRTIO_BLK_F_SIZE_MAX |
                1ull << VIRTIO_BLK_F_SEG_MAX |
                1ull << VIRTIO_BLK_F_TOPOLOGY |
@@ -XXX,XX +XXX,XX @@ static uint64_t vu_block_get_features(VuDev *dev)
                1ull << VIRTIO_RING_F_EVENT_IDX |
                1ull << VHOST_USER_F_PROTOCOL_FEATURES;
 
-    if (!vdev_blk->writable) {
+    if (!vexp->writable) {
         features |= 1ull << VIRTIO_BLK_F_RO;
     }
 
     return features;
 }
 
-static uint64_t vu_block_get_protocol_features(VuDev *dev)
+static uint64_t vu_blk_get_protocol_features(VuDev *dev)
 {
     return 1ull << VHOST_USER_PROTOCOL_F_CONFIG |
            1ull << VHOST_USER_PROTOCOL_F_INFLIGHT_SHMFD;
 }
 
 static int
-vu_block_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
+vu_blk_get_config(VuDev *vu_dev, uint8_t *config, uint32_t len)
 {
+    /* TODO blkcfg must be little-endian for VIRTIO 1.0 */
     VuServer *server = container_of(vu_dev, VuServer, vu_dev);
-    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
-    memcpy(config, &vdev_blk->blkcfg, len);
-
+    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
+    memcpy(config, &vexp->blkcfg, len);
     return 0;
 }
 
 static int
-vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
+vu_blk_set_config(VuDev *vu_dev, const uint8_t *data,
                     uint32_t offset, uint32_t size, uint32_t flags)
 {
     VuServer *server = container_of(vu_dev, VuServer, vu_dev);
-    VuBlockDev *vdev_blk = get_vu_block_device_by_server(server);
+    VuBlkExport *vexp = container_of(server, VuBlkExport, vu_server);
     uint8_t wce;
 
     /* don't support live migration */
@@ -XXX,XX +XXX,XX @@ vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
     }
 
     wce = *data;
-    vdev_blk->blkcfg.wce = wce;
-    blk_set_enable_write_cache(vdev_blk->backend, wce);
+    vexp->blkcfg.wce = wce;
+    blk_set_enable_write_cache(vexp->export.blk, wce);
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ vu_block_set_config(VuDev *vu_dev, const uint8_t *data,
  * of vu_process_message.
  *
  */
-static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
+static int vu_blk_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
 {
     if (vmsg->request == VHOST_USER_NONE) {
         dev->panic(dev, "disconnect");
@@ -XXX,XX +XXX,XX @@ static int vu_block_process_msg(VuDev *dev, VhostUserMsg *vmsg, int *do_reply)
     return false;
 }
 
-static const VuDevIface vu_block_iface = {
-    .get_features          = vu_block_get_features,
-    .queue_set_started     = vu_block_queue_set_started,
-    .get_protocol_features = vu_block_get_protocol_features,
-    .get_config            = vu_block_get_config,
-    .set_config            = vu_block_set_config,
-    .process_msg           = vu_block_process_msg,
+static const VuDevIface vu_blk_iface = {
+    .get_features          = vu_blk_get_features,
+    .queue_set_started     = vu_blk_queue_set_started,
+    .get_protocol_features = vu_blk_get_protocol_features,
+    .get_config            = vu_blk_get_config,
+    .set_config            = vu_blk_set_config,
+    .process_msg           = vu_blk_process_msg,
 };
 
 static void blk_aio_attached(AioContext *ctx, void *opaque)
 {
-    VuBlockDev *vub_dev = opaque;
-    vhost_user_server_attach_aio_context(&vub_dev->vu_server, ctx);
+    VuBlkExport *vexp = opaque;
+    vhost_user_server_attach_aio_context(&vexp->vu_server, ctx);
 }
 
 static void blk_aio_detach(void *opaque)
 {
-    VuBlockDev *vub_dev = opaque;
-    vhost_user_server_detach_aio_context(&vub_dev->vu_server);
+    VuBlkExport *vexp = opaque;
+    vhost_user_server_detach_aio_context(&vexp->vu_server);
 }
 
 static void
-vu_block_initialize_config(BlockDriverState *bs,
+vu_blk_initialize_config(BlockDriverState *bs,
                            struct virtio_blk_config *config, uint32_t blk_size)
 {
     config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
@@ -XXX,XX +XXX,XX @@ vu_block_initialize_config(BlockDriverState *bs,
     config->max_write_zeroes_seg = 1;
 }
 
-static VuBlockDev *vu_block_init(VuBlockDev *vu_block_device, Error **errp)
+static void vu_blk_exp_request_shutdown(BlockExport *exp)
 {
+    VuBlkExport *vexp = container_of(exp, VuBlkExport, export);
 
-    BlockBackend *blk;
-    Error *local_error = NULL;
-    const char *node_name = vu_block_device->node_name;
-    bool writable = vu_block_device->writable;
-    uint64_t perm = BLK_PERM_CONSISTENT_READ;
-    int ret;
-
-    AioContext *ctx;
-
-    BlockDriverState *bs = bdrv_lookup_bs(node_name, node_name, &local_error);
-
-    if (!bs) {
-        error_propagate(errp, local_error);
-        return NULL;
-    }
-
-    if (bdrv_is_read_only(bs)) {
-        writable = false;
-    }
-
-    if (writable) {
-        perm |= BLK_PERM_WRITE;
-    }
-
-    ctx = bdrv_get_aio_context(bs);
-    aio_context_acquire(ctx);
-    bdrv_invalidate_cache(bs, NULL);
-    aio_context_release(ctx);
-
-    /*
-     * Don't allow resize while the vhost user server is running,
-     * otherwise we don't care what happens with the node.
-     */
-    blk = blk_new(bdrv_get_aio_context(bs), perm,
-                  BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED |
-                  BLK_PERM_WRITE | BLK_PERM_GRAPH_MOD);
-    ret = blk_insert_bs(blk, bs, errp);
-
-    if (ret < 0) {
-        goto fail;
-    }
-
-    blk_set_enable_write_cache(blk, false);
-
-    blk_set_allow_aio_context_change(blk, true);
-
-    vu_block_device->blkcfg.wce = 0;
-    vu_block_device->backend = blk;
-    if (!vu_block_device->blk_size) {
-        vu_block_device->blk_size = BDRV_SECTOR_SIZE;
-    }
-    vu_block_device->blkcfg.blk_size = vu_block_device->blk_size;
-    blk_set_guest_block_size(blk, vu_block_device->blk_size);
-    vu_block_initialize_config(bs, &vu_block_device->blkcfg,
-                                   vu_block_device->blk_size);
-    return vu_block_device;
-
-fail:
-    blk_unref(blk);
-    return NULL;
-}
-
-static void vu_block_deinit(VuBlockDev *vu_block_device)
-{
-    if (vu_block_device->backend) {
-        blk_remove_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
-                                        blk_aio_detach, vu_block_device);
-    }
-
-    blk_unref(vu_block_device->backend);
-}
-
-static void vhost_user_blk_server_stop(VuBlockDev *vu_block_device)
-{
-    vhost_user_server_stop(&vu_block_device->vu_server);
-    vu_block_deinit(vu_block_device);
-}
-
-static void vhost_user_blk_server_start(VuBlockDev *vu_block_device,
-                                        Error **errp)
-{
-    AioContext *ctx;
-    SocketAddress *addr = vu_block_device->addr;
-
-    if (!vu_block_init(vu_block_device, errp)) {
-        return;
-    }
-
-    ctx = bdrv_get_aio_context(blk_bs(vu_block_device->backend));
-
-    if (!vhost_user_server_start(&vu_block_device->vu_server, addr, ctx,
-                                 VHOST_USER_BLK_MAX_QUEUES, &vu_block_iface,
-                                 errp)) {
-        goto error;
-    }
-
-    blk_add_aio_context_notifier(vu_block_device->backend, blk_aio_attached,
-                                 blk_aio_detach, vu_block_device);
-    vu_block_device->running = true;
-    return;
-
- error:
-    vu_block_deinit(vu_block_device);
-}
-
-static bool vu_prop_modifiable(VuBlockDev *vus, Error **errp)
-{
-    if (vus->running) {
-            error_setg(errp, "The property can't be modified "
-                       "while the server is running");
-            return false;
-    }
-    return true;
-}
-
-static void vu_set_node_name(Object *obj, const char *value, Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-
-    if (!vu_prop_modifiable(vus, errp)) {
-        return;
-    }
-
-    if (vus->node_name) {
-        g_free(vus->node_name);
-    }
-
-    vus->node_name = g_strdup(value);
-}
-
-static char *vu_get_node_name(Object *obj, Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-    return g_strdup(vus->node_name);
-}
-
-static void free_socket_addr(SocketAddress *addr)
-{
-        g_free(addr->u.q_unix.path);
-        g_free(addr);
-}
-
-static void vu_set_unix_socket(Object *obj, const char *value,
-                               Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-
-    if (!vu_prop_modifiable(vus, errp)) {
-        return;
-    }
-
-    if (vus->addr) {
-        free_socket_addr(vus->addr);
-    }
-
-    SocketAddress *addr = g_new0(SocketAddress, 1);
-    addr->type = SOCKET_ADDRESS_TYPE_UNIX;
-    addr->u.q_unix.path = g_strdup(value);
-    vus->addr = addr;
+    vhost_user_server_stop(&vexp->vu_server);
 }
 
-static char *vu_get_unix_socket(Object *obj, Error **errp)
+static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
+                             Error **errp)
 {
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-    return g_strdup(vus->addr->u.q_unix.path);
-}
-
-static bool vu_get_block_writable(Object *obj, Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-    return vus->writable;
-}
-
-static void vu_set_block_writable(Object *obj, bool value, Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-
-    if (!vu_prop_modifiable(vus, errp)) {
-            return;
-    }
-
-    vus->writable = value;
-}
-
-static void vu_get_blk_size(Object *obj, Visitor *v, const char *name,
-                            void *opaque, Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-    uint32_t value = vus->blk_size;
-
-    visit_type_uint32(v, name, &value, errp);
-}
-
-static void vu_set_blk_size(Object *obj, Visitor *v, const char *name,
-                            void *opaque, Error **errp)
-{
-    VuBlockDev *vus = VHOST_USER_BLK_SERVER(obj);
-
+    VuBlkExport *vexp = container_of(exp, VuBlkExport, export);
+    BlockExportOptionsVhostUserBlk *vu_opts = &opts->u.vhost_user_blk;
     Error *local_err = NULL;
-    uint32_t value;
+    uint64_t logical_block_size;
 
-    if (!vu_prop_modifiable(vus, errp)) {
-            return;
-    }
+    vexp->writable = opts->writable;
+    vexp->blkcfg.wce = 0;
 
-    visit_type_uint32(v, name, &value, &local_err);
-    if (local_err) {
-        goto out;
+    if (vu_opts->has_logical_block_size) {
+        logical_block_size = vu_opts->logical_block_size;
+    } else {
+        logical_block_size = BDRV_SECTOR_SIZE;
     }
-
-    check_block_size(object_get_typename(obj), name, value, &local_err);
+    check_block_size(exp->id, "logical-block-size", logical_block_size,
+                     &local_err);
     if (local_err) {
-        goto out;
+        error_propagate(errp, local_err);
+        return -EINVAL;
+    }
+    vexp->blk_size = logical_block_size;
+    blk_set_guest_block_size(exp->blk, logical_block_size);
+    vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg,
+                               logical_block_size);
+
+    blk_set_allow_aio_context_change(exp->blk, true);
+    blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
+                                 vexp);
+
+    if (!vhost_user_server_start(&vexp->vu_server, vu_opts->addr, exp->ctx,
+                                 VHOST_USER_BLK_MAX_QUEUES, &vu_blk_iface,
+                                 errp)) {
+        blk_remove_aio_context_notifier(exp->blk, blk_aio_attached,
+                                        blk_aio_detach, vexp);
+        return -EADDRNOTAVAIL;
     }
 
-    vus->blk_size = value;
-
-out:
-    error_propagate(errp, local_err);
-}
-
-static void vhost_user_blk_server_instance_finalize(Object *obj)
-{
-    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
-
-    vhost_user_blk_server_stop(vub);
-
-    /*
-     * Unlike object_property_add_str, object_class_property_add_str
-     * doesn't have a release method. Thus manual memory freeing is
-     * needed.
-     */
-    free_socket_addr(vub->addr);
-    g_free(vub->node_name);
-}
-
-static void vhost_user_blk_server_complete(UserCreatable *obj, Error **errp)
-{
-    VuBlockDev *vub = VHOST_USER_BLK_SERVER(obj);
-
-    vhost_user_blk_server_start(vub, errp);
+    return 0;
 }
 
-static void vhost_user_blk_server_class_init(ObjectClass *klass,
-                                             void *class_data)
+static void vu_blk_exp_delete(BlockExport *exp)
 {
-    UserCreatableClass *ucc = USER_CREATABLE_CLASS(klass);
-    ucc->complete = vhost_user_blk_server_complete;
-
-    object_class_property_add_bool(klass, "writable",
-                                   vu_get_block_writable,
-                                   vu_set_block_writable);
-
-    object_class_property_add_str(klass, "node-name",
-                                  vu_get_node_name,
-                                  vu_set_node_name);
-
-    object_class_property_add_str(klass, "unix-socket",
-                                  vu_get_unix_socket,
-                                  vu_set_unix_socket);
+    VuBlkExport *vexp = container_of(exp, VuBlkExport, export);
 
-    object_class_property_add(klass, "logical-block-size", "uint32",
-                              vu_get_blk_size, vu_set_blk_size,
-                              NULL, NULL);
+    blk_remove_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
+                                    vexp);
 }
 
-static const TypeInfo vhost_user_blk_server_info = {
-    .name = TYPE_VHOST_USER_BLK_SERVER,
-    .parent = TYPE_OBJECT,
-    .instance_size = sizeof(VuBlockDev),
-    .instance_finalize = vhost_user_blk_server_instance_finalize,
-    .class_init = vhost_user_blk_server_class_init,
-    .interfaces = (InterfaceInfo[]) {
-        {TYPE_USER_CREATABLE},
-        {}
-    },
+const BlockExportDriver blk_exp_vhost_user_blk = {
+    .type               = BLOCK_EXPORT_TYPE_VHOST_USER_BLK,
+    .instance_size      = sizeof(VuBlkExport),
+    .create             = vu_blk_exp_create,
+    .delete             = vu_blk_exp_delete,
+    .request_shutdown   = vu_blk_exp_request_shutdown,
 };
-
-static void vhost_user_blk_server_register_types(void)
-{
-    type_register_static(&vhost_user_blk_server_info);
-}
-
-type_init(vhost_user_blk_server_register_types)
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@ bool vhost_user_server_start(VuServer *server,
                              Error **errp)
 {
     QEMUBH *bh;
-    QIONetListener *listener = qio_net_listener_new();
+    QIONetListener *listener;
+
+    if (socket_addr->type != SOCKET_ADDRESS_TYPE_UNIX &&
+        socket_addr->type != SOCKET_ADDRESS_TYPE_FD) {
+        error_setg(errp, "Only socket address types 'unix' and 'fd' are supported");
+        return false;
+    }
+
+    listener = qio_net_listener_new();
     if (qio_net_listener_open_sync(listener, socket_addr, 1,
                                    errp) < 0) {
         object_unref(OBJECT(listener));
diff --git a/block/export/meson.build b/block/export/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/export/meson.build
+++ b/block/export/meson.build
@@ -1 +1,2 @@
 block_ss.add(files('export.c'))
+block_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-blk-server.c', '../../contrib/libvhost-user/libvhost-user.c'))
diff --git a/block/meson.build b/block/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(when: 'CONFIG_WIN32', if_true: files('file-win32.c', 'win32-aio.c')
 block_ss.add(when: 'CONFIG_POSIX', if_true: [files('file-posix.c'), coref, iokit])
 block_ss.add(when: 'CONFIG_LIBISCSI', if_true: files('iscsi-opts.c'))
 block_ss.add(when: 'CONFIG_LINUX', if_true: files('nvme.c'))
-block_ss.add(when: 'CONFIG_LINUX', if_true: files('export/vhost-user-blk-server.c', '../contrib/libvhost-user/libvhost-user.c'))
 block_ss.add(when: 'CONFIG_REPLICATION', if_true: files('replication.c'))
 block_ss.add(when: 'CONFIG_SHEEPDOG', if_true: files('sheepdog.c'))
 block_ss.add(when: ['CONFIG_LINUX_AIO', libaio], if_true: files('linux-aio.c'))
-- 
2.26.2

Headers used by other subsystems are located in include/. Also add the
vhost-user-server and vhost-user-blk-server headers to MAINTAINERS.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-13-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 MAINTAINERS                                | 4 +++-
 {util => include/qemu}/vhost-user-server.h | 0
 block/export/vhost-user-blk-server.c       | 2 +-
 util/vhost-user-server.c                   | 2 +-
 4 files changed, 5 insertions(+), 3 deletions(-)
 rename {util => include/qemu}/vhost-user-server.h (100%)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ Vhost-user block device backend server
 M: Coiby Xu <Coiby.Xu@gmail.com>
 S: Maintained
 F: block/export/vhost-user-blk-server.c
-F: util/vhost-user-server.c
+F: block/export/vhost-user-blk-server.h
+F: include/qemu/vhost-user-server.h
 F: tests/qtest/libqos/vhost-user-blk.c
+F: util/vhost-user-server.c
 
 Replication
 M: Wen Congyang <wencongyang2@huawei.com>
diff --git a/util/vhost-user-server.h b/include/qemu/vhost-user-server.h
similarity index 100%
rename from util/vhost-user-server.h
rename to include/qemu/vhost-user-server.h
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@
 #include "block/block.h"
 #include "contrib/libvhost-user/libvhost-user.h"
 #include "standard-headers/linux/virtio_blk.h"
-#include "util/vhost-user-server.h"
+#include "qemu/vhost-user-server.h"
 #include "vhost-user-blk-server.h"
 #include "qapi/error.h"
 #include "qom/object_interfaces.h"
diff --git a/util/vhost-user-server.c b/util/vhost-user-server.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vhost-user-server.c
+++ b/util/vhost-user-server.c
@@ -XXX,XX +XXX,XX @@
  */
 #include "qemu/osdep.h"
 #include "qemu/main-loop.h"
+#include "qemu/vhost-user-server.h"
 #include "block/aio-wait.h"
-#include "vhost-user-server.h"
 
 /*
  * Theory of operation:
-- 
2.26.2

Don't compile contrib/libvhost-user/libvhost-user.c again. Instead build
the static library once and then reuse it throughout QEMU.

Also switch from CONFIG_LINUX to CONFIG_VHOST_USER, which is what the
vhost-user tools (vhost-user-gpu, etc) do.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200924151549.913737-14-stefanha@redhat.com
[Added CONFIG_LINUX again because libvhost-user doesn't build on macOS.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/export/export.c             | 8 ++++----
 block/export/meson.build          | 2 +-
 contrib/libvhost-user/meson.build | 1 +
 meson.build                       | 6 +++++-
 util/meson.build                  | 4 +++-
 5 files changed, 14 insertions(+), 7 deletions(-)

diff --git a/block/export/export.c b/block/export/export.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/export.c
+++ b/block/export/export.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/block-backend.h"
 #include "block/export.h"
 #include "block/nbd.h"
-#if CONFIG_LINUX
-#include "block/export/vhost-user-blk-server.h"
-#endif
 #include "qapi/error.h"
 #include "qapi/qapi-commands-block-export.h"
 #include "qapi/qapi-events-block-export.h"
 #include "qemu/id.h"
+#ifdef CONFIG_VHOST_USER
+#include "vhost-user-blk-server.h"
+#endif
 
 static const BlockExportDriver *blk_exp_drivers[] = {
     &blk_exp_nbd,
-#if CONFIG_LINUX
+#ifdef CONFIG_VHOST_USER
     &blk_exp_vhost_user_blk,
 #endif
 };
diff --git a/block/export/meson.build b/block/export/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/export/meson.build
+++ b/block/export/meson.build
@@ -XXX,XX +XXX,XX @@
 block_ss.add(files('export.c'))
-block_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-blk-server.c', '../../contrib/libvhost-user/libvhost-user.c'))
+block_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c'))
diff --git a/contrib/libvhost-user/meson.build b/contrib/libvhost-user/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/contrib/libvhost-user/meson.build
+++ b/contrib/libvhost-user/meson.build
@@ -XXX,XX +XXX,XX @@
 libvhost_user = static_library('vhost-user',
                                files('libvhost-user.c', 'libvhost-user-glib.c'),
                                build_by_default: false)
+vhost_user = declare_dependency(link_with: libvhost_user)
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ trace_events_subdirs += [
   'util',
 ]
 
+vhost_user = not_found
+if 'CONFIG_VHOST_USER' in config_host
+  subdir('contrib/libvhost-user')
+endif
+
 subdir('qapi')
 subdir('qobject')
 subdir('stubs')
@@ -XXX,XX +XXX,XX @@ if have_tools
              install: true)
 
   if 'CONFIG_VHOST_USER' in config_host
-    subdir('contrib/libvhost-user')
     subdir('contrib/vhost-user-blk')
     subdir('contrib/vhost-user-gpu')
     subdir('contrib/vhost-user-input')
diff --git a/util/meson.build b/util/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ if have_block
   util_ss.add(files('main-loop.c'))
   util_ss.add(files('nvdimm-utils.c'))
   util_ss.add(files('qemu-coroutine.c', 'qemu-coroutine-lock.c', 'qemu-coroutine-io.c'))
-  util_ss.add(when: 'CONFIG_LINUX', if_true: files('vhost-user-server.c'))
+  util_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: [
+    files('vhost-user-server.c'), vhost_user
+  ])
   util_ss.add(files('block-helpers.c'))
   util_ss.add(files('qemu-coroutine-sleep.c'))
   util_ss.add(files('qemu-co-shared-resource.c'))
-- 
2.26.2

Introduce libblkdev.fa to avoid recompiling blockdev_ss twice.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200929125516.186715-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 meson.build                | 12 ++++++++++--
 storage-daemon/meson.build |  3 +--
 2 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ blockdev_ss.add(files(
 # os-win32.c does not
 blockdev_ss.add(when: 'CONFIG_POSIX', if_true: files('os-posix.c'))
 softmmu_ss.add(when: 'CONFIG_WIN32', if_true: [files('os-win32.c')])
-softmmu_ss.add_all(blockdev_ss)
 
 common_ss.add(files('cpus-common.c'))
 
@@ -XXX,XX +XXX,XX @@ block = declare_dependency(link_whole: [libblock],
                            link_args: '@block.syms',
                            dependencies: [crypto, io])
 
+blockdev_ss = blockdev_ss.apply(config_host, strict: false)
+libblockdev = static_library('blockdev', blockdev_ss.sources() + genh,
+                             dependencies: blockdev_ss.dependencies(),
+                             name_suffix: 'fa',
+                             build_by_default: false)
+
+blockdev = declare_dependency(link_whole: [libblockdev],
+                              dependencies: [block])
+
 qmp_ss = qmp_ss.apply(config_host, strict: false)
 libqmp = static_library('qmp', qmp_ss.sources() + genh,
                         dependencies: qmp_ss.dependencies(),
@@ -XXX,XX +XXX,XX @@ foreach m : block_mods + softmmu_mods
                 install_dir: config_host['qemu_moddir'])
 endforeach
 
-softmmu_ss.add(authz, block, chardev, crypto, io, qmp)
+softmmu_ss.add(authz, blockdev, chardev, crypto, io, qmp)
 common_ss.add(qom, qemuutil)
 
 common_ss.add_all(when: 'CONFIG_SOFTMMU', if_true: [softmmu_ss])
diff --git a/storage-daemon/meson.build b/storage-daemon/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/storage-daemon/meson.build
+++ b/storage-daemon/meson.build
@@ -XXX,XX +XXX,XX @@
 qsd_ss = ss.source_set()
 qsd_ss.add(files('qemu-storage-daemon.c'))
-qsd_ss.add(block, chardev, qmp, qom, qemuutil)
-qsd_ss.add_all(blockdev_ss)
+qsd_ss.add(blockdev, chardev, qmp, qom, qemuutil)
 
 subdir('qapi')
 
-- 
2.26.2

Block exports are used by softmmu, qemu-storage-daemon, and qemu-nbd.
They are not used by other programs and are not otherwise needed in
libblock.

Undo the recent move of blockdev-nbd.c from blockdev_ss into block_ss.
Since bdrv_close_all() (libblock) calls blk_exp_close_all()
(libblockdev) a stub function is required..

Make qemu-nbd.c use signal handling utility functions instead of
duplicating the code. This helps because os-posix.c is in libblockdev
and it depends on a qemu_system_killed() symbol that qemu-nbd.c lacks.
Once we use the signal handling utility functions we also end up
providing the necessary symbol.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20200929125516.186715-4-stefanha@redhat.com
[Fixed s/ndb/nbd/ typo in commit description as suggested by Eric Blake
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qemu-nbd.c                | 21 ++++++++-------------
 stubs/blk-exp-close-all.c |  7 +++++++
 block/export/meson.build  |  4 ++--
 meson.build               |  4 ++--
 nbd/meson.build           |  2 ++
 stubs/meson.build         |  1 +
 6 files changed, 22 insertions(+), 17 deletions(-)
 create mode 100644 stubs/blk-exp-close-all.c

diff --git a/qemu-nbd.c b/qemu-nbd.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-nbd.c
+++ b/qemu-nbd.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 #include "qemu/cutils.h"
 #include "sysemu/block-backend.h"
+#include "sysemu/runstate.h" /* for qemu_system_killed() prototype */
 #include "block/block_int.h"
 #include "block/nbd.h"
 #include "qemu/main-loop.h"
@@ -XXX,XX +XXX,XX @@ QEMU_COPYRIGHT "\n"
 }
 
 #ifdef CONFIG_POSIX
-static void termsig_handler(int signum)
+/*
+ * The client thread uses SIGTERM to interrupt the server.  A signal
+ * handler ensures that "qemu-nbd -v -c" exits with a nice status code.
+ */
+void qemu_system_killed(int signum, pid_t pid)
 {
     qatomic_cmpxchg(&state, RUNNING, TERMINATE);
     qemu_notify_event();
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
     BlockExportOptions *export_opts;
 
 #ifdef CONFIG_POSIX
-    /*
-     * Exit gracefully on various signals, which includes SIGTERM used
-     * by 'qemu-nbd -v -c'.
-     */
-    struct sigaction sa_sigterm;
-    memset(&sa_sigterm, 0, sizeof(sa_sigterm));
-    sa_sigterm.sa_handler = termsig_handler;
-    sigaction(SIGTERM, &sa_sigterm, NULL);
-    sigaction(SIGINT, &sa_sigterm, NULL);
-    sigaction(SIGHUP, &sa_sigterm, NULL);
-
-    signal(SIGPIPE, SIG_IGN);
+    os_setup_early_signal_handling();
+    os_setup_signal_handling();
 #endif
 
     socket_init();
diff --git a/stubs/blk-exp-close-all.c b/stubs/blk-exp-close-all.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/stubs/blk-exp-close-all.c
@@ -XXX,XX +XXX,XX @@
+#include "qemu/osdep.h"
+#include "block/export.h"
+
+/* Only used in programs that support block exports (libblockdev.fa) */
+void blk_exp_close_all(void)
+{
+}
diff --git a/block/export/meson.build b/block/export/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/export/meson.build
+++ b/block/export/meson.build
@@ -XXX,XX +XXX,XX @@
-block_ss.add(files('export.c'))
-block_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c'))
+blockdev_ss.add(files('export.c'))
+blockdev_ss.add(when: ['CONFIG_LINUX', 'CONFIG_VHOST_USER'], if_true: files('vhost-user-blk-server.c'))
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ subdir('dump')
 
 block_ss.add(files(
   'block.c',
-  'blockdev-nbd.c',
   'blockjob.c',
   'job.c',
   'qemu-io-cmds.c',
@@ -XXX,XX +XXX,XX @@ subdir('block')
 
 blockdev_ss.add(files(
   'blockdev.c',
+  'blockdev-nbd.c',
   'iothread.c',
   'job-qmp.c',
 ))
@@ -XXX,XX +XXX,XX @@ if have_tools
   qemu_io = executable('qemu-io', files('qemu-io.c'),
              dependencies: [block, qemuutil], install: true)
   qemu_nbd = executable('qemu-nbd', files('qemu-nbd.c'),
-               dependencies: [block, qemuutil], install: true)
+               dependencies: [blockdev, qemuutil], install: true)
 
   subdir('storage-daemon')
   subdir('contrib/rdmacm-mux')
diff --git a/nbd/meson.build b/nbd/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/nbd/meson.build
+++ b/nbd/meson.build
@@ -XXX,XX +XXX,XX @@
 block_ss.add(files(
   'client.c',
   'common.c',
+))
+blockdev_ss.add(files(
   'server.c',
 ))
diff --git a/stubs/meson.build b/stubs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -XXX,XX +XXX,XX @@
 stub_ss.add(files('arch_type.c'))
 stub_ss.add(files('bdrv-next-monitor-owned.c'))
 stub_ss.add(files('blk-commit-all.c'))
+stub_ss.add(files('blk-exp-close-all.c'))
 stub_ss.add(files('blockdev-close-all-bdrv-states.c'))
 stub_ss.add(files('change-state-handler.c'))
 stub_ss.add(files('cmos.c'))
-- 
2.26.2

Make it possible to specify the iothread where the export will run. By
default the block node can be moved to other AioContexts later and the
export will follow. The fixed-iothread option forces strict behavior
that prevents changing AioContext while the export is active. See the
QAPI docs for details.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20200929125516.186715-5-stefanha@redhat.com
[Fix stray '#' character in block-export.json and add missing "(since:
5.2)" as suggested by Eric Blake.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-export.json               | 11 ++++++++++
 block/export/export.c                | 31 +++++++++++++++++++++++++++-
 block/export/vhost-user-blk-server.c |  5 ++++-
 nbd/server.c                         |  2 --
 4 files changed, 45 insertions(+), 4 deletions(-)

diff --git a/qapi/block-export.json b/qapi/block-export.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -XXX,XX +XXX,XX @@
 #                export before completion is signalled. (since: 5.2;
 #                default: false)
 #
+# @iothread: The name of the iothread object where the export will run. The
+#            default is to use the thread currently associated with the
+#            block node. (since: 5.2)
+#
+# @fixed-iothread: True prevents the block node from being moved to another
+#                  thread while the export is active. If true and @iothread is
+#                  given, export creation fails if the block node cannot be
+#                  moved to the iothread. The default is false. (since: 5.2)
+#
 # Since: 4.2
 ##
 { 'union': 'BlockExportOptions',
   'base': { 'type': 'BlockExportType',
             'id': 'str',
+	    '*fixed-iothread': 'bool',
+	    '*iothread': 'str',
             'node-name': 'str',
             '*writable': 'bool',
             '*writethrough': 'bool' },
diff --git a/block/export/export.c b/block/export/export.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/export.c
+++ b/block/export/export.c
@@ -XXX,XX +XXX,XX @@
 
 #include "block/block.h"
 #include "sysemu/block-backend.h"
+#include "sysemu/iothread.h"
 #include "block/export.h"
 #include "block/nbd.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@ static const BlockExportDriver *blk_exp_find_driver(BlockExportType type)
 
 BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
 {
+    bool fixed_iothread = export->has_fixed_iothread && export->fixed_iothread;
     const BlockExportDriver *drv;
     BlockExport *exp = NULL;
     BlockDriverState *bs;
-    BlockBackend *blk;
+    BlockBackend *blk = NULL;
     AioContext *ctx;
     uint64_t perm;
     int ret;
@@ -XXX,XX +XXX,XX @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
     ctx = bdrv_get_aio_context(bs);
     aio_context_acquire(ctx);
 
+    if (export->has_iothread) {
+        IOThread *iothread;
+        AioContext *new_ctx;
+
+        iothread = iothread_by_id(export->iothread);
+        if (!iothread) {
+            error_setg(errp, "iothread \"%s\" not found", export->iothread);
+            goto fail;
+        }
+
+        new_ctx = iothread_get_aio_context(iothread);
+
+        ret = bdrv_try_set_aio_context(bs, new_ctx, errp);
+        if (ret == 0) {
+            aio_context_release(ctx);
+            aio_context_acquire(new_ctx);
+            ctx = new_ctx;
+        } else if (fixed_iothread) {
+            goto fail;
+        }
+    }
+
     /*
      * Block exports are used for non-shared storage migration. Make sure
      * that BDRV_O_INACTIVE is cleared and the image is ready for write
@@ -XXX,XX +XXX,XX @@ BlockExport *blk_exp_add(BlockExportOptions *export, Error **errp)
     }
 
     blk = blk_new(ctx, perm, BLK_PERM_ALL);
+
+    if (!fixed_iothread) {
+        blk_set_allow_aio_context_change(blk, true);
+    }
+
     ret = blk_insert_bs(blk, bs, errp);
     if (ret < 0) {
         goto fail;
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@ static const VuDevIface vu_blk_iface = {
 static void blk_aio_attached(AioContext *ctx, void *opaque)
 {
     VuBlkExport *vexp = opaque;
+
+    vexp->export.ctx = ctx;
     vhost_user_server_attach_aio_context(&vexp->vu_server, ctx);
 }
 
 static void blk_aio_detach(void *opaque)
 {
     VuBlkExport *vexp = opaque;
+
     vhost_user_server_detach_aio_context(&vexp->vu_server);
+    vexp->export.ctx = NULL;
 }
 
 static void
@@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
     vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg,
                                logical_block_size);
 
-    blk_set_allow_aio_context_change(exp->blk, true);
     blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
                                  vexp);
 
diff --git a/nbd/server.c b/nbd/server.c
index XXXXXXX..XXXXXXX 100644
--- a/nbd/server.c
+++ b/nbd/server.c
@@ -XXX,XX +XXX,XX @@ static int nbd_export_create(BlockExport *blk_exp, BlockExportOptions *exp_args,
         return ret;
     }
 
-    blk_set_allow_aio_context_change(blk, true);
-
     QTAILQ_INIT(&exp->clients);
     exp->name = g_strdup(arg->name);
     exp->description = g_strdup(arg->description);
-- 
2.26.2

Allow the number of queues to be configured using --export
vhost-user-blk,num-queues=N. This setting should match the QEMU --device
vhost-user-blk-pci,num-queues=N setting but QEMU vhost-user-blk.c lowers
its own value if the vhost-user-blk backend offers fewer queues than
QEMU.

The vhost-user-blk-server.c code is already capable of multi-queue. All
virtqueue processing runs in the same AioContext. No new locking is
needed.

Add the num-queues=N option and set the VIRTIO_BLK_F_MQ feature bit.
Note that the feature bit only announces the presence of the num_queues
configuration space field. It does not promise that there is more than 1
virtqueue, so we can set it unconditionally.

I tested multi-queue by running a random read fio test with numjobs=4 on
an -smp 4 guest. After the benchmark finished the guest /proc/interrupts
file showed activity on all 4 virtio-blk MSI-X. The /sys/block/vda/mq/
directory shows that Linux blk-mq has 4 queues configured.

An automated test is included in the next commit.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Message-id: 20201001144604.559733-2-stefanha@redhat.com
[Fixed accidental tab characters as suggested by Markus Armbruster
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-export.json               | 10 +++++++---
 block/export/vhost-user-blk-server.c | 24 ++++++++++++++++++------
 2 files changed, 25 insertions(+), 9 deletions(-)

diff --git a/qapi/block-export.json b/qapi/block-export.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -XXX,XX +XXX,XX @@
 #        SocketAddress types are supported. Passed fds must be UNIX domain
 #        sockets.
 # @logical-block-size: Logical block size in bytes. Defaults to 512 bytes.
+# @num-queues: Number of request virtqueues. Must be greater than 0. Defaults
+#              to 1.
 #
 # Since: 5.2
 ##
 { 'struct': 'BlockExportOptionsVhostUserBlk',
-  'data': { 'addr': 'SocketAddress', '*logical-block-size': 'size' } }
+  'data': { 'addr': 'SocketAddress',
+	    '*logical-block-size': 'size',
+            '*num-queues': 'uint16'} }
 
 ##
 # @NbdServerAddOptions:
@@ -XXX,XX +XXX,XX @@
 { 'union': 'BlockExportOptions',
   'base': { 'type': 'BlockExportType',
             'id': 'str',
-	    '*fixed-iothread': 'bool',
-	    '*iothread': 'str',
+            '*fixed-iothread': 'bool',
+            '*iothread': 'str',
             'node-name': 'str',
             '*writable': 'bool',
             '*writethrough': 'bool' },
diff --git a/block/export/vhost-user-blk-server.c b/block/export/vhost-user-blk-server.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/vhost-user-blk-server.c
+++ b/block/export/vhost-user-blk-server.c
@@ -XXX,XX +XXX,XX @@
 #include "util/block-helpers.h"
 
 enum {
-    VHOST_USER_BLK_MAX_QUEUES = 1,
+    VHOST_USER_BLK_NUM_QUEUES_DEFAULT = 1,
 };
 struct virtio_blk_inhdr {
     unsigned char status;
@@ -XXX,XX +XXX,XX @@ static uint64_t vu_blk_get_features(VuDev *dev)
                1ull << VIRTIO_BLK_F_DISCARD |
                1ull << VIRTIO_BLK_F_WRITE_ZEROES |
                1ull << VIRTIO_BLK_F_CONFIG_WCE |
+               1ull << VIRTIO_BLK_F_MQ |
                1ull << VIRTIO_F_VERSION_1 |
                1ull << VIRTIO_RING_F_INDIRECT_DESC |
                1ull << VIRTIO_RING_F_EVENT_IDX |
@@ -XXX,XX +XXX,XX @@ static void blk_aio_detach(void *opaque)
 
 static void
 vu_blk_initialize_config(BlockDriverState *bs,
-                           struct virtio_blk_config *config, uint32_t blk_size)
+                         struct virtio_blk_config *config,
+                         uint32_t blk_size,
+                         uint16_t num_queues)
 {
     config->capacity = bdrv_getlength(bs) >> BDRV_SECTOR_BITS;
     config->blk_size = blk_size;
@@ -XXX,XX +XXX,XX @@ vu_blk_initialize_config(BlockDriverState *bs,
     config->seg_max = 128 - 2;
     config->min_io_size = 1;
     config->opt_io_size = 1;
-    config->num_queues = VHOST_USER_BLK_MAX_QUEUES;
+    config->num_queues = num_queues;
     config->max_discard_sectors = 32768;
     config->max_discard_seg = 1;
     config->discard_sector_alignment = config->blk_size >> 9;
@@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
     BlockExportOptionsVhostUserBlk *vu_opts = &opts->u.vhost_user_blk;
     Error *local_err = NULL;
     uint64_t logical_block_size;
+    uint16_t num_queues = VHOST_USER_BLK_NUM_QUEUES_DEFAULT;
 
     vexp->writable = opts->writable;
     vexp->blkcfg.wce = 0;
@@ -XXX,XX +XXX,XX @@ static int vu_blk_exp_create(BlockExport *exp, BlockExportOptions *opts,
     }
     vexp->blk_size = logical_block_size;
     blk_set_guest_block_size(exp->blk, logical_block_size);
+
+    if (vu_opts->has_num_queues) {
+        num_queues = vu_opts->num_queues;
+    }
+    if (num_queues == 0) {
+        error_setg(errp, "num-queues must be greater than 0");
+        return -EINVAL;
+    }
+
     vu_blk_initialize_config(blk_bs(exp->blk), &vexp->blkcfg,
-                               logical_block_size);
+                             logical_block_size, num_queues);
 
     blk_add_aio_context_notifier(exp->blk, blk_aio_attached, blk_aio_detach,
                                  vexp);
 
     if (!vhost_user_server_start(&vexp->vu_server, vu_opts->addr, exp->ctx,
-                                 VHOST_USER_BLK_MAX_QUEUES, &vu_blk_iface,
-                                 errp)) {
+                                 num_queues, &vu_blk_iface, errp)) {
         blk_remove_aio_context_notifier(exp->blk, blk_aio_attached,
                                         blk_aio_detach, vexp);
         return -EADDRNOTAVAIL;
-- 
2.26.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

bdrv_co_block_status_above has several design problems with handling
short backing files:

1. With want_zeros=true, it may return ret with BDRV_BLOCK_ZERO but
without BDRV_BLOCK_ALLOCATED flag, when actually short backing file
which produces these after-EOF zeros is inside requested backing
sequence.

2. With want_zero=false, it may return pnum=0 prior to actual EOF,
because of EOF of short backing file.

Fix these things, making logic about short backing files clearer.

With fixed bdrv_block_status_above we also have to improve is_zero in
qcow2 code, otherwise iotest 154 will fail, because with this patch we
stop to merge zeros of different types (produced by fully unallocated
in the whole backing chain regions vs produced by short backing files).

Note also, that this patch leaves for another day the general problem
around block-status: misuse of BDRV_BLOCK_ALLOCATED as is-fs-allocated
vs go-to-backing.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20200924194003.22080-2-vsementsov@virtuozzo.com
[Fix s/comes/come/ as suggested by Eric Blake
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c    | 68 ++++++++++++++++++++++++++++++++++++++++-----------
 block/qcow2.c | 16 ++++++++++--
 2 files changed, 68 insertions(+), 16 deletions(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
                                   int64_t *map,
                                   BlockDriverState **file)
 {
+    int ret;
     BlockDriverState *p;
-    int ret = 0;
-    bool first = true;
+    int64_t eof = 0;
 
     assert(bs != base);
-    for (p = bs; p != base; p = bdrv_filter_or_cow_bs(p)) {
+
+    ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
+    if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED) {
+        return ret;
+    }
+
+    if (ret & BDRV_BLOCK_EOF) {
+        eof = offset + *pnum;
+    }
+
+    assert(*pnum <= bytes);
+    bytes = *pnum;
+
+    for (p = bdrv_filter_or_cow_bs(bs); p != base;
+         p = bdrv_filter_or_cow_bs(p))
+    {
         ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map,
                                    file);
         if (ret < 0) {
-            break;
+            return ret;
         }
-        if (ret & BDRV_BLOCK_ZERO && ret & BDRV_BLOCK_EOF && !first) {
+        if (*pnum == 0) {
             /*
-             * Reading beyond the end of the file continues to read
-             * zeroes, but we can only widen the result to the
-             * unallocated length we learned from an earlier
-             * iteration.
+             * The top layer deferred to this layer, and because this layer is
+             * short, any zeroes that we synthesize beyond EOF behave as if they
+             * were allocated at this layer.
+             *
+             * We don't include BDRV_BLOCK_EOF into ret, as upper layer may be
+             * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see
+             * below.
              */
+            assert(ret & BDRV_BLOCK_EOF);
             *pnum = bytes;
+            if (file) {
+                *file = p;
+            }
+            ret = BDRV_BLOCK_ZERO | BDRV_BLOCK_ALLOCATED;
+            break;
         }
-        if (ret & (BDRV_BLOCK_ZERO | BDRV_BLOCK_DATA)) {
+        if (ret & BDRV_BLOCK_ALLOCATED) {
+            /*
+             * We've found the node and the status, we must break.
+             *
+             * Drop BDRV_BLOCK_EOF, as it's not for upper layer, which may be
+             * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see
+             * below.
+             */
+            ret &= ~BDRV_BLOCK_EOF;
             break;
         }
-        /* [offset, pnum] unallocated on this layer, which could be only
-         * the first part of [offset, bytes].  */
-        bytes = MIN(bytes, *pnum);
-        first = false;
+
+        /*
+         * OK, [offset, offset + *pnum) region is unallocated on this layer,
+         * let's continue the diving.
+         */
+        assert(*pnum <= bytes);
+        bytes = *pnum;
+    }
+
+    if (offset + *pnum == eof) {
+        ret |= BDRV_BLOCK_EOF;
     }
+
     return ret;
 }
 
diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
     if (!bytes) {
         return true;
     }
-    res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
-    return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
+
+    /*
+     * bdrv_block_status_above doesn't merge different types of zeros, for
+     * example, zeros which come from the region which is unallocated in
+     * the whole backing chain, and zeros which come because of a short
+     * backing file. So, we need a loop.
+     */
+    do {
+        res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
+        offset += nr;
+        bytes -= nr;
+    } while (res >= 0 && (res & BDRV_BLOCK_ZERO) && nr && bytes);
+
+    return res >= 0 && (res & BDRV_BLOCK_ZERO) && bytes == 0;
 }
 
 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
-- 
2.26.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

In order to reuse bdrv_common_block_status_above in
bdrv_is_allocated_above, let's support include_base parameter.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20200924194003.22080-3-vsementsov@virtuozzo.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/coroutines.h |  2 ++
 block/io.c         | 21 ++++++++++++++-------
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/block/coroutines.h b/block/coroutines.h
index XXXXXXX..XXXXXXX 100644
--- a/block/coroutines.h
+++ b/block/coroutines.h
@@ -XXX,XX +XXX,XX @@ bdrv_pwritev(BdrvChild *child, int64_t offset, unsigned int bytes,
 int coroutine_fn
 bdrv_co_common_block_status_above(BlockDriverState *bs,
                                   BlockDriverState *base,
+                                  bool include_base,
                                   bool want_zero,
                                   int64_t offset,
                                   int64_t bytes,
@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
 int generated_co_wrapper
 bdrv_common_block_status_above(BlockDriverState *bs,
                                BlockDriverState *base,
+                               bool include_base,
                                bool want_zero,
                                int64_t offset,
                                int64_t bytes,
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ early_out:
 int coroutine_fn
 bdrv_co_common_block_status_above(BlockDriverState *bs,
                                   BlockDriverState *base,
+                                  bool include_base,
                                   bool want_zero,
                                   int64_t offset,
                                   int64_t bytes,
@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
     BlockDriverState *p;
     int64_t eof = 0;
 
-    assert(bs != base);
+    assert(include_base || bs != base);
+    assert(!include_base || base); /* Can't include NULL base */
 
     ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
-    if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED) {
+    if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
         return ret;
     }
 
@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
     assert(*pnum <= bytes);
     bytes = *pnum;
 
-    for (p = bdrv_filter_or_cow_bs(bs); p != base;
+    for (p = bdrv_filter_or_cow_bs(bs); include_base || p != base;
          p = bdrv_filter_or_cow_bs(p))
     {
         ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map,
@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
             break;
         }
 
+        if (p == base) {
+            assert(include_base);
+            break;
+        }
+
         /*
          * OK, [offset, offset + *pnum) region is unallocated on this layer,
          * let's continue the diving.
@@ -XXX,XX +XXX,XX @@ int bdrv_block_status_above(BlockDriverState *bs, BlockDriverState *base,
                             int64_t offset, int64_t bytes, int64_t *pnum,
                             int64_t *map, BlockDriverState **file)
 {
-    return bdrv_common_block_status_above(bs, base, true, offset, bytes,
+    return bdrv_common_block_status_above(bs, base, false, true, offset, bytes,
                                           pnum, map, file);
 }
 
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset,
     int ret;
     int64_t dummy;
 
-    ret = bdrv_common_block_status_above(bs, bdrv_filter_or_cow_bs(bs), false,
-                                         offset, bytes, pnum ? pnum : &dummy,
-                                         NULL, NULL);
+    ret = bdrv_common_block_status_above(bs, bs, true, false, offset,
+                                         bytes, pnum ? pnum : &dummy, NULL,
+                                         NULL);
     if (ret < 0) {
         return ret;
     }
-- 
2.26.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We are going to reuse bdrv_common_block_status_above in
bdrv_is_allocated_above. bdrv_is_allocated_above may be called with
include_base == false and still bs == base (for ex. from img_rebase()).

So, support this corner case.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20200924194003.22080-4-vsementsov@virtuozzo.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ bdrv_co_common_block_status_above(BlockDriverState *bs,
     BlockDriverState *p;
     int64_t eof = 0;
 
-    assert(include_base || bs != base);
     assert(!include_base || base); /* Can't include NULL base */
 
+    if (!include_base && bs == base) {
+        *pnum = bytes;
+        return 0;
+    }
+
     ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
     if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
         return ret;
-- 
2.26.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

bdrv_is_allocated_above wrongly handles short backing files: it reports
after-EOF space as UNALLOCATED which is wrong, as on read the data is
generated on the level of short backing file (if all overlays have
unallocated areas at that place).

Reusing bdrv_common_block_status_above fixes the issue and unifies code
path.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20200924194003.22080-5-vsementsov@virtuozzo.com
[Fix s/has/have/ as suggested by Eric Blake. Fix s/area/areas/.
--Stefan]
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 43 +++++--------------------------------------
 1 file changed, 5 insertions(+), 38 deletions(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t offset,
  * at 'offset + *pnum' may return the same allocation status (in other
  * words, the result is not necessarily the maximum possible range);
  * but 'pnum' will only be 0 when end of file is reached.
- *
  */
 int bdrv_is_allocated_above(BlockDriverState *top,
                             BlockDriverState *base,
                             bool include_base, int64_t offset,
                             int64_t bytes, int64_t *pnum)
 {
-    BlockDriverState *intermediate;
-    int ret;
-    int64_t n = bytes;
-
-    assert(base || !include_base);
-
-    intermediate = top;
-    while (include_base || intermediate != base) {
-        int64_t pnum_inter;
-        int64_t size_inter;
-
-        assert(intermediate);
-        ret = bdrv_is_allocated(intermediate, offset, bytes, &pnum_inter);
-        if (ret < 0) {
-            return ret;
-        }
-        if (ret) {
-            *pnum = pnum_inter;
-            return 1;
-        }
-
-        size_inter = bdrv_getlength(intermediate);
-        if (size_inter < 0) {
-            return size_inter;
-        }
-        if (n > pnum_inter &&
-            (intermediate == top || offset + pnum_inter < size_inter)) {
-            n = pnum_inter;
-        }
-
-        if (intermediate == base) {
-            break;
-        }
-
-        intermediate = bdrv_filter_or_cow_bs(intermediate);
+    int ret = bdrv_common_block_status_above(top, base, include_base, false,
+                                             offset, bytes, pnum, NULL, NULL);
+    if (ret < 0) {
+        return ret;
     }
 
-    *pnum = n;
-    return 0;
+    return !!(ret & BDRV_BLOCK_ALLOCATED);
 }
 
 int coroutine_fn
-- 
2.26.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

These cases are fixed by previous patches around block_status and
is_allocated.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Message-id: 20200924194003.22080-6-vsementsov@virtuozzo.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qemu-iotests/274     | 20 +++++++++++
 tests/qemu-iotests/274.out | 68 ++++++++++++++++++++++++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/tests/qemu-iotests/274 b/tests/qemu-iotests/274
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/274
+++ b/tests/qemu-iotests/274
@@ -XXX,XX +XXX,XX @@ with iotests.FilePath('base') as base, \
     iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, mid)
     iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), mid)
 
+    iotests.log('=== Testing qemu-img commit (top -> base) ===')
+
+    create_chain()
+    iotests.qemu_img_log('commit', '-b', base, top)
+    iotests.img_info_log(base)
+    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, base)
+    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), base)
+
+    iotests.log('=== Testing QMP active commit (top -> base) ===')
+
+    create_chain()
+    with create_vm() as vm:
+        vm.launch()
+        vm.qmp_log('block-commit', device='top', base_node='base',
+                   job_id='job0', auto_dismiss=False)
+        vm.run_job('job0', wait=5)
+
+    iotests.img_info_log(mid)
+    iotests.qemu_io_log('-c', 'read -P 1 0 %d' % size_short, base)
+    iotests.qemu_io_log('-c', 'read -P 0 %d %d' % (size_short, size_diff), base)
 
     iotests.log('== Resize tests ==')
 
diff --git a/tests/qemu-iotests/274.out b/tests/qemu-iotests/274.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/274.out
+++ b/tests/qemu-iotests/274.out
@@ -XXX,XX +XXX,XX @@ read 1048576/1048576 bytes at offset 0
 read 1048576/1048576 bytes at offset 1048576
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 
+=== Testing qemu-img commit (top -> base) ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-mid', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=1048576 backing_file=TEST_DIR/PID-base backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 backing_file=TEST_DIR/PID-mid backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
+
+wrote 2097152/2097152 bytes at offset 0
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+Image committed.
+
+image: TEST_IMG
+file format: IMGFMT
+virtual size: 2 MiB (2097152 bytes)
+cluster_size: 65536
+Format specific information:
+    compat: 1.1
+    compression type: zlib
+    lazy refcounts: false
+    refcount bits: 16
+    corrupt: false
+    extended l2: false
+
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+=== Testing QMP active commit (top -> base) ===
+Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-mid', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=1048576 backing_file=TEST_DIR/PID-base backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
+
+Formatting 'TEST_DIR/PID-top', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=2097152 backing_file=TEST_DIR/PID-mid backing_fmt=qcow2 lazy_refcounts=off refcount_bits=16
+
+wrote 2097152/2097152 bytes at offset 0
+2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+{"execute": "block-commit", "arguments": {"auto-dismiss": false, "base-node": "base", "device": "top", "job-id": "job0"}}
+{"return": {}}
+{"execute": "job-complete", "arguments": {"id": "job0"}}
+{"return": {}}
+{"data": {"device": "job0", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_READY", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"data": {"device": "job0", "len": 1048576, "offset": 1048576, "speed": 0, "type": "commit"}, "event": "BLOCK_JOB_COMPLETED", "timestamp": {"microseconds": "USECS", "seconds": "SECS"}}
+{"execute": "job-dismiss", "arguments": {"id": "job0"}}
+{"return": {}}
+image: TEST_IMG
+file format: IMGFMT
+virtual size: 1 MiB (1048576 bytes)
+cluster_size: 65536
+backing file: TEST_DIR/PID-base
+backing file format: IMGFMT
+Format specific information:
+    compat: 1.1
+    compression type: zlib
+    lazy refcounts: false
+    refcount bits: 16
+    corrupt: false
+    extended l2: false
+
+read 1048576/1048576 bytes at offset 0
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
+read 1048576/1048576 bytes at offset 1048576
+1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+
 == Resize tests ==
 === preallocation=off ===
 Formatting 'TEST_DIR/PID-base', fmt=qcow2 cluster_size=65536 extended_l2=off compression_type=zlib size=6442450944 lazy_refcounts=off refcount_bits=16
-- 
2.26.2