Series comparison

-[Qemu-devel] [PULL 00/11] Block patches
+[PULL for-5.0 0/3] Block patches
-The following changes since commit c25e8bba1f546ea72744ccfab77f8a9e8a323be8:
+The following changes since commit 8bac3ba57eecc466b7e73dabf7d19328a59f684e:
-  Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20180601' into staging (2018-06-01 13:11:30 +0100)
+  Merge remote-tracking branch 'remotes/rth/tags/pull-rx-20200408' into staging (2020-04-09 13:23:30 +0100)
 are available in the Git repository at:
-  git://github.com/stefanha/qemu.git tags/block-pull-request
+  https://github.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 21891a5a3011608845b5d7f1f9cce60cdc2bcc62:
+for you to fetch changes up to 5710a3e09f9b85801e5ce70797a4a511e5fc9e2c:
-  main-loop: drop spin_counter (2018-06-01 16:01:29 +0100)
+  async: use explicit memory barriers (2020-04-09 16:17:14 +0100)
 ----------------------------------------------------------------
 Pull request
- * Copy offloading for qemu-img convert (iSCSI, raw, and qcow2)
+Fixes for QEMU on aarch64 ARM hosts and fdmon-io_uring.
    If the underlying storage supports copy offloading, qemu-img convert will
    use it instead of performing reads and writes.  This avoids data transfers
    and thus frees up storage bandwidth for other purposes.  SCSI EXTENDED COPY
    and Linux copy_file_range(2) are used to implement this optimization.
  * Drop spurious "WARNING: I\/O thread spun for 1000 iterations" warning
 ----------------------------------------------------------------
-Fam Zheng (10):
+Paolo Bonzini (2):
-  block: Introduce API for copy offloading
+  aio-wait: delegate polling of main AioContext if BQL not held
-  raw: Check byte range uniformly
+  async: use explicit memory barriers
   raw: Implement copy offloading
   qcow2: Implement copy offloading
   file-posix: Implement bdrv_co_copy_range
   iscsi: Query and save device designator when opening
   iscsi: Create and use iscsi_co_wait_for_task
   iscsi: Implement copy offloading
   block-backend: Add blk_co_copy_range
   qemu-img: Convert with copy offloading
 Stefan Hajnoczi (1):
-  main-loop: drop spin_counter
+  aio-posix: signal-proof fdmon-io_uring
- configure                        |  17 ++
+ include/block/aio-wait.h | 22 ++++++++++++++++++++++
- include/block/block.h            |  32 ++++
+ include/block/aio.h      | 29 ++++++++++-------------------
- include/block/block_int.h        |  38 ++++
+ util/aio-posix.c         | 16 ++++++++++++++--
- include/block/raw-aio.h          |  10 +-
+ util/aio-win32.c         | 17 ++++++++++++++---
- include/scsi/constants.h         |   4 +
+ util/async.c             | 16 ++++++++++++----
- include/sysemu/block-backend.h   |   4 +
+ util/fdmon-io_uring.c    | 10 ++++++++--
- block/block-backend.c            |  18 ++
+files changed, 80 insertions(+), 30 deletions(-)
  block/file-posix.c               |  98 +++++++++-
  block/io.c                       |  97 ++++++++++
  block/iscsi.c                    | 314 +++++++++++++++++++++++++++----
  block/qcow2.c                    | 229 +++++++++++++++++++---
  block/raw-format.c               |  96 +++++++---
  qemu-img.c                       |  50 ++++-
  util/main-loop.c                 |  25 ---
  tests/qemu-iotests/common.filter |   1 -
 files changed, 908 insertions(+), 125 deletions(-)
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 11/11] main-loop: drop spin_counter
+[PULL for-5.0 1/3] aio-posix: signal-proof fdmon-io_uring
-Commit d759c951f3287fad04210a52f2dc93f94cf58c7f ("replay: push
+The io_uring_enter(2) syscall returns with errno=EINTR when interrupted
-replay_mutex_lock up the call tree") removed the !timeout lock
+by a signal.  Retry the syscall in this case.
 optimization in the main loop.
-The idea of the optimization was to avoid ping-pongs between threads by
+It's essential to do this in the io_uring_submit_and_wait() case.  My
-keeping the Big QEMU Lock held across non-blocking (!timeout) main loop
+interpretation of the Linux v5.5 io_uring_enter(2) code is that it
-iterations.
+shouldn't affect the io_uring_submit() case, but there is no guarantee
 this will always be the case.  Let's check for -EINTR around both APIs.
-A warning is printed when the main loop spins without releasing BQL for
+Note that the liburing APIs have -errno return values.
 long periods of time.  These warnings were supposed to aid debugging but
 in practice they just alarm users.  They are considered noise because
 the cause of spinning is not shown and is hard to find.
 Now that the lock optimization has been removed, there is no danger of
 hogging the BQL.  Drop the spin counter and the infamous warning.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200408091139.273851-1-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- util/main-loop.c                 | 25 -------------------------
+ util/fdmon-io_uring.c | 10 ++++++++--
- tests/qemu-iotests/common.filter |  1 -
+file changed, 8 insertions(+), 2 deletions(-)
 files changed, 26 deletions(-)
-diff --git a/util/main-loop.c b/util/main-loop.c
+diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/main-loop.c
+--- a/util/fdmon-io_uring.c
-+++ b/util/main-loop.c
++++ b/util/fdmon-io_uring.c
-@@ -XXX,XX +XXX,XX @@ static int os_host_main_loop_wait(int64_t timeout)
+@@ -XXX,XX +XXX,XX @@ static struct io_uring_sqe *get_sqe(AioContext *ctx)
- {
+     }
-     GMainContext *context = g_main_context_default();
-     int ret;
+     /* No free sqes left, submit pending sqes first */
--    static int spin_counter;
+-    ret = io_uring_submit(ring);
++    do {
-     g_main_context_acquire(context);
++        ret = io_uring_submit(ring);
++    } while (ret == -EINTR);
-     glib_pollfds_fill(&timeout);
++
+     assert(ret > 1);
--    /* If the I/O thread is very busy or we are incorrectly busy waiting in
+     sqe = io_uring_get_sqe(ring);
--     * the I/O thread, this can lead to starvation of the BQL such that the
+     assert(sqe);
--     * VCPU threads never run.  To make sure we can detect the later case,
+@@ -XXX,XX +XXX,XX @@ static int fdmon_io_uring_wait(AioContext *ctx, AioHandlerList *ready_list,
--     * print a message to the screen.  If we run into this condition, create
--     * a fake timeout in order to give the VCPU threads a chance to run.
+     fill_sq_ring(ctx);
--     */
--    if (!timeout && (spin_counter > MAX_MAIN_LOOP_SPIN)) {
+-    ret = io_uring_submit_and_wait(&ctx->fdmon_io_uring, wait_nr);
--        static bool notified;
++    do {
--
++        ret = io_uring_submit_and_wait(&ctx->fdmon_io_uring, wait_nr);
--        if (!notified && !qtest_enabled() && !qtest_driver()) {
++    } while (ret == -EINTR);
--            warn_report("I/O thread spun for %d iterations",
++
--                        MAX_MAIN_LOOP_SPIN);
+     assert(ret >= 0);
--            notified = true;
--        }
+     return process_cq_ring(ctx, ready_list);
 -
 -        timeout = SCALE_MS;
 -    }
 -
 -
 -    if (timeout) {
 -        spin_counter = 0;
 -    } else {
 -        spin_counter++;
 -    }
      qemu_mutex_unlock_iothread();
      replay_mutex_unlock();
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -XXX,XX +XXX,XX @@ _filter_qemu()
  {
      sed -e "s#\\(^\\|(qemu) \\)$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
          -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
 -        -e '/main-loop: WARNING: I\/O thread spun for [0-9]\+ iterations/d' \
          -e $'s#\r##' # QEMU monitor uses \r\n line endings
  }
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 01/11] block: Introduce API for copy offloading
+[PULL for-5.0 2/3] aio-wait: delegate polling of main AioContext if BQL not held
-From: Fam Zheng <famz@redhat.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-Introduce the bdrv_co_copy_range() API for copy offloading.  Block
+Any thread that is not a iothread returns NULL for qemu_get_current_aio_context().
-drivers implementing this API support efficient copy operations that
+As a result, it would also return true for
-avoid reading each block from the source device and writing it to the
+in_aio_context_home_thread(qemu_get_aio_context()), causing
-destination devices.  Examples of copy offload primitives are SCSI
+AIO_WAIT_WHILE to invoke aio_poll() directly.  This is incorrect
-EXTENDED COPY and Linux copy_file_range(2).
+if the BQL is not held, because aio_poll() does not expect to
 run concurrently from multiple threads, and it can actually
 happen when savevm writes to the vmstate file from the
 migration thread.
-Signed-off-by: Fam Zheng <famz@redhat.com>
+Therefore, restrict in_aio_context_home_thread to return true
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+for the main AioContext only if the BQL is held.
-Message-id: 20180601092648.24614-2-famz@redhat.com
 The function is moved to aio-wait.h because it is mostly used
 there and to avoid a circular reference between main-loop.h
 and block/aio.h.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Message-Id: <20200407140746.8041-5-pbonzini@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/block/block.h     | 32 +++++++++++++
+ include/block/aio-wait.h | 22 ++++++++++++++++++++++
- include/block/block_int.h | 38 +++++++++++++++
+ include/block/aio.h      | 29 ++++++++++-------------------
- block/io.c                | 97 +++++++++++++++++++++++++++++++++++++++
+files changed, 32 insertions(+), 19 deletions(-)
 files changed, 167 insertions(+)
-diff --git a/include/block/block.h b/include/block/block.h
+diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/block/block.h
+--- a/include/block/aio-wait.h
-+++ b/include/block/block.h
++++ b/include/block/aio-wait.h
-@@ -XXX,XX +XXX,XX @@ bool bdrv_can_store_new_dirty_bitmap(BlockDriverState *bs, const char *name,
+@@ -XXX,XX +XXX,XX @@
  #define QEMU_AIO_WAIT_H
  #include "block/aio.h"
 +#include "qemu/main-loop.h"
  /**
   * AioWait:
@@ -XXX,XX +XXX,XX @@ void aio_wait_kick(void);
   */
- void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size);
+ void aio_wait_bh_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque);
- void bdrv_unregister_buf(BlockDriverState *bs, void *host);
 +
 +/**
++ * in_aio_context_home_thread:
++ * @ctx: the aio context
 + *
-+ * bdrv_co_copy_range:
++ * Return whether we are running in the thread that normally runs @ctx.  Note
-+ *
++ * that acquiring/releasing ctx does not affect the outcome, each AioContext
-+ * Do offloaded copy between two children. If the operation is not implemented
++ * still only has one home thread that is responsible for running it.
-+ * by the driver, or if the backend storage doesn't support it, a negative
++ */
-+ * error code will be returned.
++static inline bool in_aio_context_home_thread(AioContext *ctx)
 + *
 + * Note: block layer doesn't emulate or fallback to a bounce buffer approach
 + * because usually the caller shouldn't attempt offloaded copy any more (e.g.
 + * calling copy_file_range(2)) after the first error, thus it should fall back
 + * to a read+write path in the caller level.
 + *
 + * @src: Source child to copy data from
 + * @src_offset: offset in @src image to read data
 + * @dst: Destination child to copy data to
 + * @dst_offset: offset in @dst image to write data
 + * @bytes: number of bytes to copy
 + * @flags: request flags. Must be one of:
 + *         0 - actually read data from src;
 + *         BDRV_REQ_ZERO_WRITE - treat the @src range as zero data and do zero
 + *                               write on @dst as if bdrv_co_pwrite_zeroes is
 + *                               called. Used to simplify caller code, or
 + *                               during BlockDriver.bdrv_co_copy_range_from()
 + *                               recursion.
 + *
 + * Returns: 0 if succeeded; negative error code if failed.
 + **/
 +int coroutine_fn bdrv_co_copy_range(BdrvChild *src, uint64_t src_offset,
 +                                    BdrvChild *dst, uint64_t dst_offset,
 +                                    uint64_t bytes, BdrvRequestFlags flags);
  #endif
 diff --git a/include/block/block_int.h b/include/block/block_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/block_int.h
 +++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
      int coroutine_fn (*bdrv_co_pdiscard)(BlockDriverState *bs,
          int64_t offset, int bytes);
 +    /* Map [offset, offset + nbytes) range onto a child of @bs to copy from,
 +     * and invoke bdrv_co_copy_range_from(child, ...), or invoke
 +     * bdrv_co_copy_range_to() if @bs is the leaf child to copy data from.
 +     *
 +     * See the comment of bdrv_co_copy_range for the parameter and return value
 +     * semantics.
 +     */
 +    int coroutine_fn (*bdrv_co_copy_range_from)(BlockDriverState *bs,
 +                                                BdrvChild *src,
 +                                                uint64_t offset,
 +                                                BdrvChild *dst,
 +                                                uint64_t dst_offset,
 +                                                uint64_t bytes,
 +                                                BdrvRequestFlags flags);
 +
 +    /* Map [offset, offset + nbytes) range onto a child of bs to copy data to,
 +     * and invoke bdrv_co_copy_range_to(child, src, ...), or perform the copy
 +     * operation if @bs is the leaf and @src has the same BlockDriver.  Return
 +     * -ENOTSUP if @bs is the leaf but @src has a different BlockDriver.
 +     *
 +     * See the comment of bdrv_co_copy_range for the parameter and return value
 +     * semantics.
 +     */
 +    int coroutine_fn (*bdrv_co_copy_range_to)(BlockDriverState *bs,
 +                                              BdrvChild *src,
 +                                              uint64_t src_offset,
 +                                              BdrvChild *dst,
 +                                              uint64_t dst_offset,
 +                                              uint64_t bytes,
 +                                              BdrvRequestFlags flags);
 +
      /*
       * Building block for bdrv_block_status[_above] and
       * bdrv_is_allocated[_above].  The driver should answer only
@@ -XXX,XX +XXX,XX @@ void bdrv_dec_in_flight(BlockDriverState *bs);
  void blockdev_close_all_bdrv_states(void);
 +int coroutine_fn bdrv_co_copy_range_from(BdrvChild *src, uint64_t src_offset,
 +                                         BdrvChild *dst, uint64_t dst_offset,
 +                                         uint64_t bytes, BdrvRequestFlags flags);
 +int coroutine_fn bdrv_co_copy_range_to(BdrvChild *src, uint64_t src_offset,
 +                                       BdrvChild *dst, uint64_t dst_offset,
 +                                       uint64_t bytes, BdrvRequestFlags flags);
 +
  #endif /* BLOCK_INT_H */
 diff --git a/block/io.c b/block/io.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_unregister_buf(BlockDriverState *bs, void *host)
          bdrv_unregister_buf(child->bs, host);
      }
  }
 +
 +static int coroutine_fn bdrv_co_copy_range_internal(BdrvChild *src,
 +                                                    uint64_t src_offset,
 +                                                    BdrvChild *dst,
 +                                                    uint64_t dst_offset,
 +                                                    uint64_t bytes,
 +                                                    BdrvRequestFlags flags,
 +                                                    bool recurse_src)
 +{
-+    int ret;
++    if (ctx == qemu_get_current_aio_context()) {
-+
++        return true;
 +    if (!src || !dst || !src->bs || !dst->bs) {
 +        return -ENOMEDIUM;
 +    }
 +    ret = bdrv_check_byte_request(src->bs, src_offset, bytes);
 +    if (ret) {
 +        return ret;
 +    }
 +
-+    ret = bdrv_check_byte_request(dst->bs, dst_offset, bytes);
++    if (ctx == qemu_get_aio_context()) {
-+    if (ret) {
++        return qemu_mutex_iothread_locked();
 +        return ret;
 +    }
 +    if (flags & BDRV_REQ_ZERO_WRITE) {
 +        return bdrv_co_pwrite_zeroes(dst, dst_offset, bytes, flags);
 +    }
 +
 +    if (!src->bs->drv->bdrv_co_copy_range_from
 +        || !dst->bs->drv->bdrv_co_copy_range_to
 +        || src->bs->encrypted || dst->bs->encrypted) {
 +        return -ENOTSUP;
 +    }
 +    if (recurse_src) {
 +        return src->bs->drv->bdrv_co_copy_range_from(src->bs,
 +                                                     src, src_offset,
 +                                                     dst, dst_offset,
 +                                                     bytes, flags);
 +    } else {
-+        return dst->bs->drv->bdrv_co_copy_range_to(dst->bs,
++        return false;
 +                                                   src, src_offset,
 +                                                   dst, dst_offset,
 +                                                   bytes, flags);
 +    }
 +}
 +
-+/* Copy range from @src to @dst.
+ #endif /* QEMU_AIO_WAIT_H */
-+ *
+diff --git a/include/block/aio.h b/include/block/aio.h
-+ * See the comment of bdrv_co_copy_range for the parameter and return value
+index XXXXXXX..XXXXXXX 100644
-+ * semantics. */
+--- a/include/block/aio.h
-+int coroutine_fn bdrv_co_copy_range_from(BdrvChild *src, uint64_t src_offset,
++++ b/include/block/aio.h
-+                                         BdrvChild *dst, uint64_t dst_offset,
+@@ -XXX,XX +XXX,XX @@ struct AioContext {
-+                                         uint64_t bytes, BdrvRequestFlags flags)
+     AioHandlerList deleted_aio_handlers;
-+{
-+    return bdrv_co_copy_range_internal(src, src_offset, dst, dst_offset,
+     /* Used to avoid unnecessary event_notifier_set calls in aio_notify;
-+                                       bytes, flags, true);
+-     * accessed with atomic primitives.  If this field is 0, everything
-+}
+-     * (file descriptors, bottom halves, timers) will be re-evaluated
-+
+-     * before the next blocking poll(), thus the event_notifier_set call
-+/* Copy range from @src to @dst.
+-     * can be skipped.  If it is non-zero, you may need to wake up a
-+ *
+-     * concurrent aio_poll or the glib main event loop, making
-+ * See the comment of bdrv_co_copy_range for the parameter and return value
+-     * event_notifier_set necessary.
-+ * semantics. */
++     * only written from the AioContext home thread, or under the BQL in
-+int coroutine_fn bdrv_co_copy_range_to(BdrvChild *src, uint64_t src_offset,
++     * the case of the main AioContext.  However, it is read from any
-+                                       BdrvChild *dst, uint64_t dst_offset,
++     * thread so it is still accessed with atomic primitives.
-+                                       uint64_t bytes, BdrvRequestFlags flags)
++     *
-+{
++     * If this field is 0, everything (file descriptors, bottom halves,
-+    return bdrv_co_copy_range_internal(src, src_offset, dst, dst_offset,
++     * timers) will be re-evaluated before the next blocking poll() or
-+                                       bytes, flags, false);
++     * io_uring wait; therefore, the event_notifier_set call can be
-+}
++     * skipped.  If it is non-zero, you may need to wake up a concurrent
-+
++     * aio_poll or the glib main event loop, making event_notifier_set
-+int coroutine_fn bdrv_co_copy_range(BdrvChild *src, uint64_t src_offset,
++     * necessary.
-+                                    BdrvChild *dst, uint64_t dst_offset,
+      *
-+                                    uint64_t bytes, BdrvRequestFlags flags)
+      * Bit 0 is reserved for GSource usage of the AioContext, and is 1
-+{
+      * between a call to aio_ctx_prepare and the next call to aio_ctx_check.
-+    BdrvTrackedRequest src_req, dst_req;
+@@ -XXX,XX +XXX,XX @@ void aio_co_enter(AioContext *ctx, struct Coroutine *co);
-+    BlockDriverState *src_bs = src->bs;
+  */
-+    BlockDriverState *dst_bs = dst->bs;
+ AioContext *qemu_get_current_aio_context(void);
-+    int ret;
-+
+-/**
-+    bdrv_inc_in_flight(src_bs);
+- * in_aio_context_home_thread:
-+    bdrv_inc_in_flight(dst_bs);
+- * @ctx: the aio context
-+    tracked_request_begin(&src_req, src_bs, src_offset,
+- *
-+                          bytes, BDRV_TRACKED_READ);
+- * Return whether we are running in the thread that normally runs @ctx.  Note
-+    tracked_request_begin(&dst_req, dst_bs, dst_offset,
+- * that acquiring/releasing ctx does not affect the outcome, each AioContext
-+                          bytes, BDRV_TRACKED_WRITE);
+- * still only has one home thread that is responsible for running it.
-+
+- */
-+    wait_serialising_requests(&src_req);
+-static inline bool in_aio_context_home_thread(AioContext *ctx)
-+    wait_serialising_requests(&dst_req);
+-{
-+    ret = bdrv_co_copy_range_from(src, src_offset,
+-    return ctx == qemu_get_current_aio_context();
-+                                  dst, dst_offset,
+-}
-+                                  bytes, flags);
+-
-+
+ /**
-+    tracked_request_end(&src_req);
+  * aio_context_setup:
-+    tracked_request_end(&dst_req);
+  * @ctx: the aio context
 +    bdrv_dec_in_flight(src_bs);
 +    bdrv_dec_in_flight(dst_bs);
 +    return ret;
 +}
 --
-.17.1
+.25.1

-[Qemu-devel] [PULL 02/11] raw: Check byte range uniformly
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-We don't verify the request range against s->size in the I/O callbacks
-except for raw_co_pwritev. This is inconsistent (especially for
-raw_co_pwrite_zeroes and raw_co_pdiscard), so fix them, in the meanwhile
-make the helper reusable by the coming new callbacks.
-Note that in most cases the block layer already verifies the request
-byte range against our reported image length, before invoking the driver
-callbacks.  The exception is during image creating, after
-blk_set_allow_write_beyond_eof(blk, true) is called. But in that case,
-the requests are not directly from the user or guest. So there is no
-visible behavior change in adding the check code.
-The int64_t -> uint64_t inconsistency, as shown by the type casting, is
-pre-existing due to the interface.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Message-id: 20180601092648.24614-3-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/raw-format.c | 64 ++++++++++++++++++++++++++++------------------
-file changed, 39 insertions(+), 25 deletions(-)
-diff --git a/block/raw-format.c b/block/raw-format.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -XXX,XX +XXX,XX @@ static void raw_reopen_abort(BDRVReopenState *state)
-     state->opaque = NULL;
- }
-+/* Check and adjust the offset, against 'offset' and 'size' options. */
-+static inline int raw_adjust_offset(BlockDriverState *bs, uint64_t *offset,
-+                                    uint64_t bytes, bool is_write)
-+{
-+    BDRVRawState *s = bs->opaque;
-+
-+    if (s->has_size && (*offset > s->size || bytes > (s->size - *offset))) {
-+        /* There's not enough space for the write, or the read request is
-+         * out-of-range. Don't read/write anything to prevent leaking out of
-+         * the size specified in options. */
-+        return is_write ? -ENOSPC : -EINVAL;;
-+    }
-+
-+    if (*offset > INT64_MAX - s->offset) {
-+        return -EINVAL;
-+    }
-+    *offset += s->offset;
-+
-+    return 0;
-+}
-+
- static int coroutine_fn raw_co_preadv(BlockDriverState *bs, uint64_t offset,
-                                       uint64_t bytes, QEMUIOVector *qiov,
-                                       int flags)
- {
--    BDRVRawState *s = bs->opaque;
-+    int ret;
--    if (offset > UINT64_MAX - s->offset) {
--        return -EINVAL;
-+    ret = raw_adjust_offset(bs, &offset, bytes, false);
-+    if (ret) {
-+        return ret;
-     }
--    offset += s->offset;
-     BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-     return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
-                                        uint64_t bytes, QEMUIOVector *qiov,
-                                        int flags)
- {
--    BDRVRawState *s = bs->opaque;
-     void *buf = NULL;
-     BlockDriver *drv;
-     QEMUIOVector local_qiov;
-     int ret;
--    if (s->has_size && (offset > s->size || bytes > (s->size - offset))) {
--        /* There's not enough space for the data. Don't write anything and just
--         * fail to prevent leaking out of the size specified in options. */
--        return -ENOSPC;
--    }
--
--    if (offset > UINT64_MAX - s->offset) {
--        ret = -EINVAL;
--        goto fail;
--    }
--
-     if (bs->probed && offset < BLOCK_PROBE_BUF_SIZE && bytes) {
-         /* Handling partial writes would be a pain - so we just
-          * require that guests have 512-byte request alignment if
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
-         qiov = &local_qiov;
-     }
--    offset += s->offset;
-+    ret = raw_adjust_offset(bs, &offset, bytes, true);
-+    if (ret) {
-+        goto fail;
-+    }
-     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
-     ret = bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,
-                                              int64_t offset, int bytes,
-                                              BdrvRequestFlags flags)
- {
--    BDRVRawState *s = bs->opaque;
--    if (offset > UINT64_MAX - s->offset) {
--        return -EINVAL;
-+    int ret;
-+
-+    ret = raw_adjust_offset(bs, (uint64_t *)&offset, bytes, true);
-+    if (ret) {
-+        return ret;
-     }
--    offset += s->offset;
-     return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
- }
- static int coroutine_fn raw_co_pdiscard(BlockDriverState *bs,
-                                         int64_t offset, int bytes)
- {
--    BDRVRawState *s = bs->opaque;
--    if (offset > UINT64_MAX - s->offset) {
--        return -EINVAL;
-+    int ret;
-+
-+    ret = raw_adjust_offset(bs, (uint64_t *)&offset, bytes, true);
-+    if (ret) {
-+        return ret;
-     }
--    offset += s->offset;
-     return bdrv_co_pdiscard(bs->file->bs, offset, bytes);
- }
---
-.17.1

-[Qemu-devel] [PULL 03/11] raw: Implement copy offloading
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-Just pass down to ->file.
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20180601092648.24614-4-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/raw-format.c | 32 ++++++++++++++++++++++++++++++++
-file changed, 32 insertions(+)
-diff --git a/block/raw-format.c b/block/raw-format.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -XXX,XX +XXX,XX @@ static int raw_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
-     return bdrv_probe_geometry(bs->file->bs, geo);
- }
-+static int coroutine_fn raw_co_copy_range_from(BlockDriverState *bs,
-+                                               BdrvChild *src, uint64_t src_offset,
-+                                               BdrvChild *dst, uint64_t dst_offset,
-+                                               uint64_t bytes, BdrvRequestFlags flags)
-+{
-+    int ret;
-+
-+    ret = raw_adjust_offset(bs, &src_offset, bytes, false);
-+    if (ret) {
-+        return ret;
-+    }
-+    return bdrv_co_copy_range_from(bs->file, src_offset, dst, dst_offset,
-+                                   bytes, flags);
-+}
-+
-+static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
-+                                             BdrvChild *src, uint64_t src_offset,
-+                                             BdrvChild *dst, uint64_t dst_offset,
-+                                             uint64_t bytes, BdrvRequestFlags flags)
-+{
-+    int ret;
-+
-+    ret = raw_adjust_offset(bs, &dst_offset, bytes, true);
-+    if (ret) {
-+        return ret;
-+    }
-+    return bdrv_co_copy_range_to(src, src_offset, bs->file, dst_offset, bytes,
-+                                 flags);
-+}
-+
- BlockDriver bdrv_raw = {
-     .format_name          = "raw",
-     .instance_size        = sizeof(BDRVRawState),
-@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_raw = {
-     .bdrv_co_pwrite_zeroes = &raw_co_pwrite_zeroes,
-     .bdrv_co_pdiscard     = &raw_co_pdiscard,
-     .bdrv_co_block_status = &raw_co_block_status,
-+    .bdrv_co_copy_range_from = &raw_co_copy_range_from,
-+    .bdrv_co_copy_range_to  = &raw_co_copy_range_to,
-     .bdrv_truncate        = &raw_truncate,
-     .bdrv_getlength       = &raw_getlength,
-     .has_variable_length  = true,
---
-.17.1

-[Qemu-devel] [PULL 04/11] qcow2: Implement copy offloading
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-The two callbacks are implemented quite similarly to the read/write
-functions: bdrv_co_copy_range_from maps for read and calls into bs->file
-or bs->backing depending on the allocation status; bdrv_co_copy_range_to
-maps for write and calls into bs->file.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Message-id: 20180601092648.24614-5-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/qcow2.c | 229 +++++++++++++++++++++++++++++++++++++++++++-------
-file changed, 199 insertions(+), 30 deletions(-)
-diff --git a/block/qcow2.c b/block/qcow2.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
-     return status;
- }
-+static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
-+                                            QCowL2Meta **pl2meta,
-+                                            bool link_l2)
-+{
-+    int ret = 0;
-+    QCowL2Meta *l2meta = *pl2meta;
-+
-+    while (l2meta != NULL) {
-+        QCowL2Meta *next;
-+
-+        if (!ret && link_l2) {
-+            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
-+            if (ret) {
-+                goto out;
-+            }
-+        }
-+
-+        /* Take the request off the list of running requests */
-+        if (l2meta->nb_clusters != 0) {
-+            QLIST_REMOVE(l2meta, next_in_flight);
-+        }
-+
-+        qemu_co_queue_restart_all(&l2meta->dependent_requests);
-+
-+        next = l2meta->next;
-+        g_free(l2meta);
-+        l2meta = next;
-+    }
-+out:
-+    *pl2meta = l2meta;
-+    return ret;
-+}
-+
- static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
-                                         uint64_t bytes, QEMUIOVector *qiov,
-                                         int flags)
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
-             }
-         }
--        while (l2meta != NULL) {
--            QCowL2Meta *next;
--
--            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
--            if (ret < 0) {
--                goto fail;
--            }
--
--            /* Take the request off the list of running requests */
--            if (l2meta->nb_clusters != 0) {
--                QLIST_REMOVE(l2meta, next_in_flight);
--            }
--
--            qemu_co_queue_restart_all(&l2meta->dependent_requests);
--
--            next = l2meta->next;
--            g_free(l2meta);
--            l2meta = next;
-+        ret = qcow2_handle_l2meta(bs, &l2meta, true);
-+        if (ret) {
-+            goto fail;
-         }
-         bytes -= cur_bytes;
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
-     ret = 0;
- fail:
--    while (l2meta != NULL) {
--        QCowL2Meta *next;
--
--        if (l2meta->nb_clusters != 0) {
--            QLIST_REMOVE(l2meta, next_in_flight);
--        }
--        qemu_co_queue_restart_all(&l2meta->dependent_requests);
--
--        next = l2meta->next;
--        g_free(l2meta);
--        l2meta = next;
--    }
-+    qcow2_handle_l2meta(bs, &l2meta, false);
-     qemu_co_mutex_unlock(&s->lock);
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
-     return ret;
- }
-+static int coroutine_fn
-+qcow2_co_copy_range_from(BlockDriverState *bs,
-+                         BdrvChild *src, uint64_t src_offset,
-+                         BdrvChild *dst, uint64_t dst_offset,
-+                         uint64_t bytes, BdrvRequestFlags flags)
-+{
-+    BDRVQcow2State *s = bs->opaque;
-+    int ret;
-+    unsigned int cur_bytes; /* number of bytes in current iteration */
-+    BdrvChild *child = NULL;
-+    BdrvRequestFlags cur_flags;
-+
-+    assert(!bs->encrypted);
-+    qemu_co_mutex_lock(&s->lock);
-+
-+    while (bytes != 0) {
-+        uint64_t copy_offset = 0;
-+        /* prepare next request */
-+        cur_bytes = MIN(bytes, INT_MAX);
-+        cur_flags = flags;
-+
-+        ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
-+        if (ret < 0) {
-+            goto out;
-+        }
-+
-+        switch (ret) {
-+        case QCOW2_CLUSTER_UNALLOCATED:
-+            if (bs->backing && bs->backing->bs) {
-+                int64_t backing_length = bdrv_getlength(bs->backing->bs);
-+                if (src_offset >= backing_length) {
-+                    cur_flags |= BDRV_REQ_ZERO_WRITE;
-+                } else {
-+                    child = bs->backing;
-+                    cur_bytes = MIN(cur_bytes, backing_length - src_offset);
-+                    copy_offset = src_offset;
-+                }
-+            } else {
-+                cur_flags |= BDRV_REQ_ZERO_WRITE;
-+            }
-+            break;
-+
-+        case QCOW2_CLUSTER_ZERO_PLAIN:
-+        case QCOW2_CLUSTER_ZERO_ALLOC:
-+            cur_flags |= BDRV_REQ_ZERO_WRITE;
-+            break;
-+
-+        case QCOW2_CLUSTER_COMPRESSED:
-+            ret = -ENOTSUP;
-+            goto out;
-+            break;
-+
-+        case QCOW2_CLUSTER_NORMAL:
-+            child = bs->file;
-+            copy_offset += offset_into_cluster(s, src_offset);
-+            if ((copy_offset & 511) != 0) {
-+                ret = -EIO;
-+                goto out;
-+            }
-+            break;
-+
-+        default:
-+            abort();
-+        }
-+        qemu_co_mutex_unlock(&s->lock);
-+        ret = bdrv_co_copy_range_from(child,
-+                                      copy_offset,
-+                                      dst, dst_offset,
-+                                      cur_bytes, cur_flags);
-+        qemu_co_mutex_lock(&s->lock);
-+        if (ret < 0) {
-+            goto out;
-+        }
-+
-+        bytes -= cur_bytes;
-+        src_offset += cur_bytes;
-+        dst_offset += cur_bytes;
-+    }
-+    ret = 0;
-+
-+out:
-+    qemu_co_mutex_unlock(&s->lock);
-+    return ret;
-+}
-+
-+static int coroutine_fn
-+qcow2_co_copy_range_to(BlockDriverState *bs,
-+                       BdrvChild *src, uint64_t src_offset,
-+                       BdrvChild *dst, uint64_t dst_offset,
-+                       uint64_t bytes, BdrvRequestFlags flags)
-+{
-+    BDRVQcow2State *s = bs->opaque;
-+    int offset_in_cluster;
-+    int ret;
-+    unsigned int cur_bytes; /* number of sectors in current iteration */
-+    uint64_t cluster_offset;
-+    uint8_t *cluster_data = NULL;
-+    QCowL2Meta *l2meta = NULL;
-+
-+    assert(!bs->encrypted);
-+    s->cluster_cache_offset = -1; /* disable compressed cache */
-+
-+    qemu_co_mutex_lock(&s->lock);
-+
-+    while (bytes != 0) {
-+
-+        l2meta = NULL;
-+
-+        offset_in_cluster = offset_into_cluster(s, dst_offset);
-+        cur_bytes = MIN(bytes, INT_MAX);
-+
-+        /* TODO:
-+         * If src->bs == dst->bs, we could simply copy by incrementing
-+         * the refcnt, without copying user data.
-+         * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
-+        ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
-+                                         &cluster_offset, &l2meta);
-+        if (ret < 0) {
-+            goto fail;
-+        }
-+
-+        assert((cluster_offset & 511) == 0);
-+
-+        ret = qcow2_pre_write_overlap_check(bs, 0,
-+                cluster_offset + offset_in_cluster, cur_bytes);
-+        if (ret < 0) {
-+            goto fail;
-+        }
-+
-+        qemu_co_mutex_unlock(&s->lock);
-+        ret = bdrv_co_copy_range_to(src, src_offset,
-+                                    bs->file,
-+                                    cluster_offset + offset_in_cluster,
-+                                    cur_bytes, flags);
-+        qemu_co_mutex_lock(&s->lock);
-+        if (ret < 0) {
-+            goto fail;
-+        }
-+
-+        ret = qcow2_handle_l2meta(bs, &l2meta, true);
-+        if (ret) {
-+            goto fail;
-+        }
-+
-+        bytes -= cur_bytes;
-+        dst_offset += cur_bytes;
-+    }
-+    ret = 0;
-+
-+fail:
-+    qcow2_handle_l2meta(bs, &l2meta, false);
-+
-+    qemu_co_mutex_unlock(&s->lock);
-+
-+    qemu_vfree(cluster_data);
-+    trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
-+
-+    return ret;
-+}
-+
- static int qcow2_truncate(BlockDriverState *bs, int64_t offset,
-                           PreallocMode prealloc, Error **errp)
- {
-@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_qcow2 = {
-     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
-     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
-+    .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
-+    .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
-     .bdrv_truncate          = qcow2_truncate,
-     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
-     .bdrv_make_empty        = qcow2_make_empty,
---
-.17.1

-[Qemu-devel] [PULL 05/11] file-posix: Implement bdrv_co_copy_range
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-With copy_file_range(2), we can implement the bdrv_co_copy_range
-semantics.
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Message-id: 20180601092648.24614-6-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- configure               | 17 +++++++
- include/block/raw-aio.h | 10 ++++-
- block/file-posix.c      | 98 +++++++++++++++++++++++++++++++++++++++--
-files changed, 120 insertions(+), 5 deletions(-)
-diff --git a/configure b/configure
-index XXXXXXX..XXXXXXX 100755
---- a/configure
-+++ b/configure
-@@ -XXX,XX +XXX,XX @@ if test "$fortify_source" != "no"; then
-   fi
- fi
-+###############################################
-+# Check if copy_file_range is provided by glibc
-+have_copy_file_range=no
-+cat > $TMPC << EOF
-+#include <unistd.h>
-+int main(void) {
-+  copy_file_range(0, NULL, 0, NULL, 0, 0);
-+  return 0;
-+}
-+EOF
-+if compile_prog "" "" ; then
-+    have_copy_file_range=yes
-+fi
-+
- ##########################################
- # check if struct fsxattr is available via linux/fs.h
-@@ -XXX,XX +XXX,XX @@ fi
- if test "$have_fsxattr" = "yes" ; then
-     echo "HAVE_FSXATTR=y" >> $config_host_mak
- fi
-+if test "$have_copy_file_range" = "yes" ; then
-+    echo "HAVE_COPY_FILE_RANGE=y" >> $config_host_mak
-+fi
- if test "$vte" = "yes" ; then
-   echo "CONFIG_VTE=y" >> $config_host_mak
-   echo "VTE_CFLAGS=$vte_cflags" >> $config_host_mak
-diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/block/raw-aio.h
-+++ b/include/block/raw-aio.h
-@@ -XXX,XX +XXX,XX @@
- #define QEMU_AIO_FLUSH        0x0008
- #define QEMU_AIO_DISCARD      0x0010
- #define QEMU_AIO_WRITE_ZEROES 0x0020
-+#define QEMU_AIO_COPY_RANGE   0x0040
- #define QEMU_AIO_TYPE_MASK \
--        (QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH| \
--         QEMU_AIO_DISCARD|QEMU_AIO_WRITE_ZEROES)
-+        (QEMU_AIO_READ | \
-+         QEMU_AIO_WRITE | \
-+         QEMU_AIO_IOCTL | \
-+         QEMU_AIO_FLUSH | \
-+         QEMU_AIO_DISCARD | \
-+         QEMU_AIO_WRITE_ZEROES | \
-+         QEMU_AIO_COPY_RANGE)
- /* AIO flags */
- #define QEMU_AIO_MISALIGNED   0x1000
-diff --git a/block/file-posix.c b/block/file-posix.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/file-posix.c
-+++ b/block/file-posix.c
-@@ -XXX,XX +XXX,XX @@
- #ifdef __linux__
- #include <sys/ioctl.h>
- #include <sys/param.h>
-+#include <sys/syscall.h>
- #include <linux/cdrom.h>
- #include <linux/fd.h>
- #include <linux/fs.h>
-@@ -XXX,XX +XXX,XX @@ typedef struct RawPosixAIOData {
- #define aio_ioctl_cmd   aio_nbytes /* for QEMU_AIO_IOCTL */
-     off_t aio_offset;
-     int aio_type;
-+    int aio_fd2;
-+    off_t aio_offset2;
- } RawPosixAIOData;
- #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
-@@ -XXX,XX +XXX,XX @@ static ssize_t handle_aiocb_write_zeroes(RawPosixAIOData *aiocb)
-     return -ENOTSUP;
- }
-+#ifndef HAVE_COPY_FILE_RANGE
-+static off_t copy_file_range(int in_fd, off_t *in_off, int out_fd,
-+                             off_t *out_off, size_t len, unsigned int flags)
-+{
-+#ifdef __NR_copy_file_range
-+    return syscall(__NR_copy_file_range, in_fd, in_off, out_fd,
-+                   out_off, len, flags);
-+#else
-+    errno = ENOSYS;
-+    return -1;
-+#endif
-+}
-+#endif
-+
-+static ssize_t handle_aiocb_copy_range(RawPosixAIOData *aiocb)
-+{
-+    uint64_t bytes = aiocb->aio_nbytes;
-+    off_t in_off = aiocb->aio_offset;
-+    off_t out_off = aiocb->aio_offset2;
-+
-+    while (bytes) {
-+        ssize_t ret = copy_file_range(aiocb->aio_fildes, &in_off,
-+                                      aiocb->aio_fd2, &out_off,
-+                                      bytes, 0);
-+        if (ret == -EINTR) {
-+            continue;
-+        }
-+        if (ret < 0) {
-+            if (errno == ENOSYS) {
-+                return -ENOTSUP;
-+            } else {
-+                return -errno;
-+            }
-+        }
-+        if (!ret) {
-+            /* No progress (e.g. when beyond EOF), fall back to buffer I/O. */
-+            return -ENOTSUP;
-+        }
-+        bytes -= ret;
-+    }
-+    return 0;
-+}
-+
- static ssize_t handle_aiocb_discard(RawPosixAIOData *aiocb)
- {
-     int ret = -EOPNOTSUPP;
-@@ -XXX,XX +XXX,XX @@ static int aio_worker(void *arg)
-     case QEMU_AIO_WRITE_ZEROES:
-         ret = handle_aiocb_write_zeroes(aiocb);
-         break;
-+    case QEMU_AIO_COPY_RANGE:
-+        ret = handle_aiocb_copy_range(aiocb);
-+        break;
-     default:
-         fprintf(stderr, "invalid aio request (0x%x)\n", aiocb->aio_type);
-         ret = -EINVAL;
-@@ -XXX,XX +XXX,XX @@ static int aio_worker(void *arg)
-     return ret;
- }
--static int paio_submit_co(BlockDriverState *bs, int fd,
--                          int64_t offset, QEMUIOVector *qiov,
--                          int bytes, int type)
-+static int paio_submit_co_full(BlockDriverState *bs, int fd,
-+                               int64_t offset, int fd2, int64_t offset2,
-+                               QEMUIOVector *qiov,
-+                               int bytes, int type)
- {
-     RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
-     ThreadPool *pool;
-@@ -XXX,XX +XXX,XX @@ static int paio_submit_co(BlockDriverState *bs, int fd,
-     acb->bs = bs;
-     acb->aio_type = type;
-     acb->aio_fildes = fd;
-+    acb->aio_fd2 = fd2;
-+    acb->aio_offset2 = offset2;
-     acb->aio_nbytes = bytes;
-     acb->aio_offset = offset;
-@@ -XXX,XX +XXX,XX @@ static int paio_submit_co(BlockDriverState *bs, int fd,
-     return thread_pool_submit_co(pool, aio_worker, acb);
- }
-+static inline int paio_submit_co(BlockDriverState *bs, int fd,
-+                                 int64_t offset, QEMUIOVector *qiov,
-+                                 int bytes, int type)
-+{
-+    return paio_submit_co_full(bs, fd, offset, -1, 0, qiov, bytes, type);
-+}
-+
- static BlockAIOCB *paio_submit(BlockDriverState *bs, int fd,
-         int64_t offset, QEMUIOVector *qiov, int bytes,
-         BlockCompletionFunc *cb, void *opaque, int type)
-@@ -XXX,XX +XXX,XX @@ static void raw_abort_perm_update(BlockDriverState *bs)
-     raw_handle_perm_lock(bs, RAW_PL_ABORT, 0, 0, NULL);
- }
-+static int coroutine_fn raw_co_copy_range_from(BlockDriverState *bs,
-+                                               BdrvChild *src, uint64_t src_offset,
-+                                               BdrvChild *dst, uint64_t dst_offset,
-+                                               uint64_t bytes, BdrvRequestFlags flags)
-+{
-+    return bdrv_co_copy_range_to(src, src_offset, dst, dst_offset, bytes, flags);
-+}
-+
-+static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
-+                                             BdrvChild *src, uint64_t src_offset,
-+                                             BdrvChild *dst, uint64_t dst_offset,
-+                                             uint64_t bytes, BdrvRequestFlags flags)
-+{
-+    BDRVRawState *s = bs->opaque;
-+    BDRVRawState *src_s;
-+
-+    assert(dst->bs == bs);
-+    if (src->bs->drv->bdrv_co_copy_range_to != raw_co_copy_range_to) {
-+        return -ENOTSUP;
-+    }
-+
-+    src_s = src->bs->opaque;
-+    if (fd_open(bs) < 0 || fd_open(bs) < 0) {
-+        return -EIO;
-+    }
-+    return paio_submit_co_full(bs, src_s->fd, src_offset, s->fd, dst_offset,
-+                               NULL, bytes, QEMU_AIO_COPY_RANGE);
-+}
-+
- BlockDriver bdrv_file = {
-     .format_name = "file",
-     .protocol_name = "file",
-@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_file = {
-     .bdrv_co_pwritev        = raw_co_pwritev,
-     .bdrv_aio_flush = raw_aio_flush,
-     .bdrv_aio_pdiscard = raw_aio_pdiscard,
-+    .bdrv_co_copy_range_from = raw_co_copy_range_from,
-+    .bdrv_co_copy_range_to  = raw_co_copy_range_to,
-     .bdrv_refresh_limits = raw_refresh_limits,
-     .bdrv_io_plug = raw_aio_plug,
-     .bdrv_io_unplug = raw_aio_unplug,
-@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_host_device = {
-     .bdrv_co_pwritev        = raw_co_pwritev,
-     .bdrv_aio_flush    = raw_aio_flush,
-     .bdrv_aio_pdiscard   = hdev_aio_pdiscard,
-+    .bdrv_co_copy_range_from = raw_co_copy_range_from,
-+    .bdrv_co_copy_range_to  = raw_co_copy_range_to,
-     .bdrv_refresh_limits = raw_refresh_limits,
-     .bdrv_io_plug = raw_aio_plug,
-     .bdrv_io_unplug = raw_aio_unplug,
---
-.17.1

-[Qemu-devel] [PULL 06/11] iscsi: Query and save device designator when opening
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-The device designator data returned in INQUIRY command will be useful to
-fill in source/target fields during copy offloading. Do this when
-connecting to the target and save the data for later use.
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20180601092648.24614-7-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/iscsi.c | 41 +++++++++++++++++++++++++++++++++++++++++
-file changed, 41 insertions(+)
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ typedef struct IscsiLun {
-     QemuMutex mutex;
-     struct scsi_inquiry_logical_block_provisioning lbp;
-     struct scsi_inquiry_block_limits bl;
-+    struct scsi_inquiry_device_designator *dd;
-     unsigned char *zeroblock;
-     /* The allocmap tracks which clusters (pages) on the iSCSI target are
-      * allocated and which are not. In case a target returns zeros for
-@@ -XXX,XX +XXX,XX @@ static QemuOptsList runtime_opts = {
-     },
- };
-+static void iscsi_save_designator(IscsiLun *lun,
-+                                  struct scsi_inquiry_device_identification *inq_di)
-+{
-+    struct scsi_inquiry_device_designator *desig, *copy = NULL;
-+
-+    for (desig = inq_di->designators; desig; desig = desig->next) {
-+        if (desig->association ||
-+            desig->designator_type > SCSI_DESIGNATOR_TYPE_NAA) {
-+            continue;
-+        }
-+        /* NAA works better than T10 vendor ID based designator. */
-+        if (!copy || copy->designator_type < desig->designator_type) {
-+            copy = desig;
-+        }
-+    }
-+    if (copy) {
-+        lun->dd = g_new(struct scsi_inquiry_device_designator, 1);
-+        *lun->dd = *copy;
-+        lun->dd->next = NULL;
-+        lun->dd->designator = g_malloc(copy->designator_length);
-+        memcpy(lun->dd->designator, copy->designator, copy->designator_length);
-+    }
-+}
-+
- static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
-                       Error **errp)
- {
-@@ -XXX,XX +XXX,XX @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
-         struct scsi_task *inq_task;
-         struct scsi_inquiry_logical_block_provisioning *inq_lbp;
-         struct scsi_inquiry_block_limits *inq_bl;
-+        struct scsi_inquiry_device_identification *inq_di;
-         switch (inq_vpd->pages[i]) {
-         case SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING:
-             inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
-@@ -XXX,XX +XXX,XX @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
-                    sizeof(struct scsi_inquiry_block_limits));
-             scsi_free_scsi_task(inq_task);
-             break;
-+        case SCSI_INQUIRY_PAGECODE_DEVICE_IDENTIFICATION:
-+            inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
-+                                    SCSI_INQUIRY_PAGECODE_DEVICE_IDENTIFICATION,
-+                                    (void **) &inq_di, errp);
-+            if (inq_task == NULL) {
-+                ret = -EINVAL;
-+                goto out;
-+            }
-+            iscsi_save_designator(iscsilun, inq_di);
-+            scsi_free_scsi_task(inq_task);
-+            break;
-         default:
-             break;
-         }
-@@ -XXX,XX +XXX,XX @@ static void iscsi_close(BlockDriverState *bs)
-         iscsi_logout_sync(iscsi);
-     }
-     iscsi_destroy_context(iscsi);
-+    if (iscsilun->dd) {
-+        g_free(iscsilun->dd->designator);
-+        g_free(iscsilun->dd);
-+    }
-     g_free(iscsilun->zeroblock);
-     iscsi_allocmap_free(iscsilun);
-     qemu_mutex_destroy(&iscsilun->mutex);
---
-.17.1

-[Qemu-devel] [PULL 07/11] iscsi: Create and use iscsi_co_wait_for_task
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-This loop is repeated a growing number times. Make a helper.
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20180601092648.24614-8-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/iscsi.c | 54 ++++++++++++++++-----------------------------------
-file changed, 17 insertions(+), 37 deletions(-)
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ static inline bool iscsi_allocmap_is_valid(IscsiLun *iscsilun,
-                                offset / iscsilun->cluster_size) == size);
- }
-+static void coroutine_fn iscsi_co_wait_for_task(IscsiTask *iTask,
-+                                                IscsiLun *iscsilun)
-+{
-+    while (!iTask->complete) {
-+        iscsi_set_events(iscsilun);
-+        qemu_mutex_unlock(&iscsilun->mutex);
-+        qemu_coroutine_yield();
-+        qemu_mutex_lock(&iscsilun->mutex);
-+    }
-+}
-+
- static int coroutine_fn
- iscsi_co_writev(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
-                 QEMUIOVector *iov, int flags)
-@@ -XXX,XX +XXX,XX @@ retry:
-     scsi_task_set_iov_out(iTask.task, (struct scsi_iovec *) iov->iov,
-                           iov->niov);
- #endif
--    while (!iTask.complete) {
--        iscsi_set_events(iscsilun);
--        qemu_mutex_unlock(&iscsilun->mutex);
--        qemu_coroutine_yield();
--        qemu_mutex_lock(&iscsilun->mutex);
--    }
-+    iscsi_co_wait_for_task(&iTask, iscsilun);
-     if (iTask.task != NULL) {
-         scsi_free_scsi_task(iTask.task);
-@@ -XXX,XX +XXX,XX @@ retry:
-         ret = -ENOMEM;
-         goto out_unlock;
-     }
--
--    while (!iTask.complete) {
--        iscsi_set_events(iscsilun);
--        qemu_mutex_unlock(&iscsilun->mutex);
--        qemu_coroutine_yield();
--        qemu_mutex_lock(&iscsilun->mutex);
--    }
-+    iscsi_co_wait_for_task(&iTask, iscsilun);
-     if (iTask.do_retry) {
-         if (iTask.task != NULL) {
-@@ -XXX,XX +XXX,XX @@ retry:
- #if LIBISCSI_API_VERSION < (20160603)
-     scsi_task_set_iov_in(iTask.task, (struct scsi_iovec *) iov->iov, iov->niov);
- #endif
--    while (!iTask.complete) {
--        iscsi_set_events(iscsilun);
--        qemu_mutex_unlock(&iscsilun->mutex);
--        qemu_coroutine_yield();
--        qemu_mutex_lock(&iscsilun->mutex);
--    }
-+    iscsi_co_wait_for_task(&iTask, iscsilun);
-     if (iTask.task != NULL) {
-         scsi_free_scsi_task(iTask.task);
-         iTask.task = NULL;
-@@ -XXX,XX +XXX,XX @@ retry:
-         return -ENOMEM;
-     }
--    while (!iTask.complete) {
--        iscsi_set_events(iscsilun);
--        qemu_mutex_unlock(&iscsilun->mutex);
--        qemu_coroutine_yield();
--        qemu_mutex_lock(&iscsilun->mutex);
--    }
-+    iscsi_co_wait_for_task(&iTask, iscsilun);
-     if (iTask.task != NULL) {
-         scsi_free_scsi_task(iTask.task);
-@@ -XXX,XX +XXX,XX @@ retry:
-         goto out_unlock;
-     }
--    while (!iTask.complete) {
--        iscsi_set_events(iscsilun);
--        qemu_mutex_unlock(&iscsilun->mutex);
--        qemu_coroutine_yield();
--        qemu_mutex_lock(&iscsilun->mutex);
--    }
-+    iscsi_co_wait_for_task(&iTask, iscsilun);
-     if (iTask.task != NULL) {
-         scsi_free_scsi_task(iTask.task);
-@@ -XXX,XX +XXX,XX @@ retry:
-         return -ENOMEM;
-     }
--    while (!iTask.complete) {
--        iscsi_set_events(iscsilun);
--        qemu_mutex_unlock(&iscsilun->mutex);
--        qemu_coroutine_yield();
--        qemu_mutex_lock(&iscsilun->mutex);
--    }
-+    iscsi_co_wait_for_task(&iTask, iscsilun);
-     if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
-         iTask.task->sense.key == SCSI_SENSE_ILLEGAL_REQUEST &&
---
-.17.1

-[Qemu-devel] [PULL 08/11] iscsi: Implement copy offloading
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-Issue EXTENDED COPY (LID1) command to implement the copy_range API.
-The parameter data construction code is modified from libiscsi's
-iscsi-dd.c.
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20180601092648.24614-9-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/scsi/constants.h |   4 +
- block/iscsi.c            | 219 +++++++++++++++++++++++++++++++++++++++
-files changed, 223 insertions(+)
-diff --git a/include/scsi/constants.h b/include/scsi/constants.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/scsi/constants.h
-+++ b/include/scsi/constants.h
-@@ -XXX,XX +XXX,XX @@
- #define MMC_PROFILE_HDDVD_RW_DL         0x005A
- #define MMC_PROFILE_INVALID             0xFFFF
-+#define XCOPY_DESC_OFFSET 16
-+#define IDENT_DESCR_TGT_DESCR_SIZE 32
-+#define XCOPY_BLK2BLK_SEG_DESC_SIZE 28
-+
- #endif
-diff --git a/block/iscsi.c b/block/iscsi.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/iscsi.c
-+++ b/block/iscsi.c
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn iscsi_co_invalidate_cache(BlockDriverState *bs,
-     iscsi_allocmap_invalidate(iscsilun);
- }
-+static int coroutine_fn iscsi_co_copy_range_from(BlockDriverState *bs,
-+                                                 BdrvChild *src,
-+                                                 uint64_t src_offset,
-+                                                 BdrvChild *dst,
-+                                                 uint64_t dst_offset,
-+                                                 uint64_t bytes,
-+                                                 BdrvRequestFlags flags)
-+{
-+    return bdrv_co_copy_range_to(src, src_offset, dst, dst_offset, bytes, flags);
-+}
-+
-+static struct scsi_task *iscsi_xcopy_task(int param_len)
-+{
-+    struct scsi_task *task;
-+
-+    task = g_new0(struct scsi_task, 1);
-+
-+    task->cdb[0]     = EXTENDED_COPY;
-+    task->cdb[10]    = (param_len >> 24) & 0xFF;
-+    task->cdb[11]    = (param_len >> 16) & 0xFF;
-+    task->cdb[12]    = (param_len >> 8) & 0xFF;
-+    task->cdb[13]    = param_len & 0xFF;
-+    task->cdb_size   = 16;
-+    task->xfer_dir   = SCSI_XFER_WRITE;
-+    task->expxferlen = param_len;
-+
-+    return task;
-+}
-+
-+static void iscsi_populate_target_desc(unsigned char *desc, IscsiLun *lun)
-+{
-+    struct scsi_inquiry_device_designator *dd = lun->dd;
-+
-+    memset(desc, 0, 32);
-+    desc[0] = 0xE4; /* IDENT_DESCR_TGT_DESCR */
-+    desc[4] = dd->code_set;
-+    desc[5] = (dd->designator_type & 0xF)
-+        | ((dd->association & 3) << 4);
-+    desc[7] = dd->designator_length;
-+    memcpy(desc + 8, dd->designator, dd->designator_length);
-+
-+    desc[28] = 0;
-+    desc[29] = (lun->block_size >> 16) & 0xFF;
-+    desc[30] = (lun->block_size >> 8) & 0xFF;
-+    desc[31] = lun->block_size & 0xFF;
-+}
-+
-+static void iscsi_xcopy_desc_hdr(uint8_t *hdr, int dc, int cat, int src_index,
-+                                 int dst_index)
-+{
-+    hdr[0] = 0x02; /* BLK_TO_BLK_SEG_DESCR */
-+    hdr[1] = ((dc << 1) | cat) & 0xFF;
-+    hdr[2] = (XCOPY_BLK2BLK_SEG_DESC_SIZE >> 8) & 0xFF;
-+    /* don't account for the first 4 bytes in descriptor header*/
-+    hdr[3] = (XCOPY_BLK2BLK_SEG_DESC_SIZE - 4 /* SEG_DESC_SRC_INDEX_OFFSET */) & 0xFF;
-+    hdr[4] = (src_index >> 8) & 0xFF;
-+    hdr[5] = src_index & 0xFF;
-+    hdr[6] = (dst_index >> 8) & 0xFF;
-+    hdr[7] = dst_index & 0xFF;
-+}
-+
-+static void iscsi_xcopy_populate_desc(uint8_t *desc, int dc, int cat,
-+                                      int src_index, int dst_index, int num_blks,
-+                                      uint64_t src_lba, uint64_t dst_lba)
-+{
-+    iscsi_xcopy_desc_hdr(desc, dc, cat, src_index, dst_index);
-+
-+    /* The caller should verify the request size */
-+    assert(num_blks < 65536);
-+    desc[10] = (num_blks >> 8) & 0xFF;
-+    desc[11] = num_blks & 0xFF;
-+    desc[12] = (src_lba >> 56) & 0xFF;
-+    desc[13] = (src_lba >> 48) & 0xFF;
-+    desc[14] = (src_lba >> 40) & 0xFF;
-+    desc[15] = (src_lba >> 32) & 0xFF;
-+    desc[16] = (src_lba >> 24) & 0xFF;
-+    desc[17] = (src_lba >> 16) & 0xFF;
-+    desc[18] = (src_lba >> 8) & 0xFF;
-+    desc[19] = src_lba & 0xFF;
-+    desc[20] = (dst_lba >> 56) & 0xFF;
-+    desc[21] = (dst_lba >> 48) & 0xFF;
-+    desc[22] = (dst_lba >> 40) & 0xFF;
-+    desc[23] = (dst_lba >> 32) & 0xFF;
-+    desc[24] = (dst_lba >> 24) & 0xFF;
-+    desc[25] = (dst_lba >> 16) & 0xFF;
-+    desc[26] = (dst_lba >> 8) & 0xFF;
-+    desc[27] = dst_lba & 0xFF;
-+}
-+
-+static void iscsi_xcopy_populate_header(unsigned char *buf, int list_id, int str,
-+                                        int list_id_usage, int prio,
-+                                        int tgt_desc_len,
-+                                        int seg_desc_len, int inline_data_len)
-+{
-+    buf[0] = list_id;
-+    buf[1] = ((str & 1) << 5) | ((list_id_usage & 3) << 3) | (prio & 7);
-+    buf[2] = (tgt_desc_len >> 8) & 0xFF;
-+    buf[3] = tgt_desc_len & 0xFF;
-+    buf[8] = (seg_desc_len >> 24) & 0xFF;
-+    buf[9] = (seg_desc_len >> 16) & 0xFF;
-+    buf[10] = (seg_desc_len >> 8) & 0xFF;
-+    buf[11] = seg_desc_len & 0xFF;
-+    buf[12] = (inline_data_len >> 24) & 0xFF;
-+    buf[13] = (inline_data_len >> 16) & 0xFF;
-+    buf[14] = (inline_data_len >> 8) & 0xFF;
-+    buf[15] = inline_data_len & 0xFF;
-+}
-+
-+static void iscsi_xcopy_data(struct iscsi_data *data,
-+                             IscsiLun *src, int64_t src_lba,
-+                             IscsiLun *dst, int64_t dst_lba,
-+                             uint16_t num_blocks)
-+{
-+    uint8_t *buf;
-+    const int src_offset = XCOPY_DESC_OFFSET;
-+    const int dst_offset = XCOPY_DESC_OFFSET + IDENT_DESCR_TGT_DESCR_SIZE;
-+    const int seg_offset = dst_offset + IDENT_DESCR_TGT_DESCR_SIZE;
-+
-+    data->size = XCOPY_DESC_OFFSET +
-+                 IDENT_DESCR_TGT_DESCR_SIZE * 2 +
-+                 XCOPY_BLK2BLK_SEG_DESC_SIZE;
-+    data->data = g_malloc0(data->size);
-+    buf = data->data;
-+
-+    /* Initialise the parameter list header */
-+    iscsi_xcopy_populate_header(buf, 1, 0, 2 /* LIST_ID_USAGE_DISCARD */,
-+                                0, 2 * IDENT_DESCR_TGT_DESCR_SIZE,
-+                                XCOPY_BLK2BLK_SEG_DESC_SIZE,
-+                                0);
-+
-+    /* Initialise CSCD list with one src + one dst descriptor */
-+    iscsi_populate_target_desc(&buf[src_offset], src);
-+    iscsi_populate_target_desc(&buf[dst_offset], dst);
-+
-+    /* Initialise one segment descriptor */
-+    iscsi_xcopy_populate_desc(&buf[seg_offset], 0, 0, 0, 1, num_blocks,
-+                              src_lba, dst_lba);
-+}
-+
-+static int coroutine_fn iscsi_co_copy_range_to(BlockDriverState *bs,
-+                                               BdrvChild *src,
-+                                               uint64_t src_offset,
-+                                               BdrvChild *dst,
-+                                               uint64_t dst_offset,
-+                                               uint64_t bytes,
-+                                               BdrvRequestFlags flags)
-+{
-+    IscsiLun *dst_lun = dst->bs->opaque;
-+    IscsiLun *src_lun;
-+    struct IscsiTask iscsi_task;
-+    struct iscsi_data data;
-+    int r = 0;
-+    int block_size;
-+
-+    if (src->bs->drv->bdrv_co_copy_range_to != iscsi_co_copy_range_to) {
-+        return -ENOTSUP;
-+    }
-+    src_lun = src->bs->opaque;
-+
-+    if (!src_lun->dd || !dst_lun->dd) {
-+        return -ENOTSUP;
-+    }
-+    if (!is_byte_request_lun_aligned(dst_offset, bytes, dst_lun)) {
-+        return -ENOTSUP;
-+    }
-+    if (!is_byte_request_lun_aligned(src_offset, bytes, src_lun)) {
-+        return -ENOTSUP;
-+    }
-+    if (dst_lun->block_size != src_lun->block_size ||
-+        !dst_lun->block_size) {
-+        return -ENOTSUP;
-+    }
-+
-+    block_size = dst_lun->block_size;
-+    if (bytes / block_size > 65535) {
-+        return -ENOTSUP;
-+    }
-+
-+    iscsi_xcopy_data(&data,
-+                     src_lun, src_offset / block_size,
-+                     dst_lun, dst_offset / block_size,
-+                     bytes / block_size);
-+
-+    iscsi_co_init_iscsitask(dst_lun, &iscsi_task);
-+
-+    qemu_mutex_lock(&dst_lun->mutex);
-+    iscsi_task.task = iscsi_xcopy_task(data.size);
-+retry:
-+    if (iscsi_scsi_command_async(dst_lun->iscsi, dst_lun->lun,
-+                                 iscsi_task.task, iscsi_co_generic_cb,
-+                                 &data,
-+                                 &iscsi_task) != 0) {
-+        r = -EIO;
-+        goto out_unlock;
-+    }
-+
-+    iscsi_co_wait_for_task(&iscsi_task, dst_lun);
-+
-+    if (iscsi_task.do_retry) {
-+        iscsi_task.complete = 0;
-+        goto retry;
-+    }
-+
-+    if (iscsi_task.status != SCSI_STATUS_GOOD) {
-+        r = iscsi_task.err_code;
-+        goto out_unlock;
-+    }
-+
-+out_unlock:
-+    g_free(iscsi_task.task);
-+    qemu_mutex_unlock(&dst_lun->mutex);
-+    g_free(iscsi_task.err_str);
-+    return r;
-+}
-+
- static QemuOptsList iscsi_create_opts = {
-     .name = "iscsi-create-opts",
-     .head = QTAILQ_HEAD_INITIALIZER(iscsi_create_opts.head),
-@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_iscsi = {
-     .bdrv_co_block_status  = iscsi_co_block_status,
-     .bdrv_co_pdiscard      = iscsi_co_pdiscard,
-+    .bdrv_co_copy_range_from = iscsi_co_copy_range_from,
-+    .bdrv_co_copy_range_to  = iscsi_co_copy_range_to,
-     .bdrv_co_pwrite_zeroes = iscsi_co_pwrite_zeroes,
-     .bdrv_co_readv         = iscsi_co_readv,
-     .bdrv_co_writev        = iscsi_co_writev,
-@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_iser = {
-     .bdrv_co_block_status  = iscsi_co_block_status,
-     .bdrv_co_pdiscard      = iscsi_co_pdiscard,
-+    .bdrv_co_copy_range_from = iscsi_co_copy_range_from,
-+    .bdrv_co_copy_range_to  = iscsi_co_copy_range_to,
-     .bdrv_co_pwrite_zeroes = iscsi_co_pwrite_zeroes,
-     .bdrv_co_readv         = iscsi_co_readv,
-     .bdrv_co_writev        = iscsi_co_writev,
---
-.17.1

-[Qemu-devel] [PULL 09/11] block-backend: Add blk_co_copy_range
+Deleted patch
-From: Fam Zheng <famz@redhat.com>
-It's a BlockBackend wrapper of the BDS interface.
-Signed-off-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20180601092648.24614-10-famz@redhat.com
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/sysemu/block-backend.h |  4 ++++
- block/block-backend.c          | 18 ++++++++++++++++++
-files changed, 22 insertions(+)
-diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/block-backend.h
-+++ b/include/sysemu/block-backend.h
-@@ -XXX,XX +XXX,XX @@ void blk_set_force_allow_inactivate(BlockBackend *blk);
- void blk_register_buf(BlockBackend *blk, void *host, size_t size);
- void blk_unregister_buf(BlockBackend *blk, void *host);
-+int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
-+                                   BlockBackend *blk_out, int64_t off_out,
-+                                   int bytes, BdrvRequestFlags flags);
-+
- #endif
-diff --git a/block/block-backend.c b/block/block-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -XXX,XX +XXX,XX @@ void blk_unregister_buf(BlockBackend *blk, void *host)
- {
-     bdrv_unregister_buf(blk_bs(blk), host);
- }
-+
-+int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
-+                                   BlockBackend *blk_out, int64_t off_out,
-+                                   int bytes, BdrvRequestFlags flags)
-+{
-+    int r;
-+    r = blk_check_byte_request(blk_in, off_in, bytes);
-+    if (r) {
-+        return r;
-+    }
-+    r = blk_check_byte_request(blk_out, off_out, bytes);
-+    if (r) {
-+        return r;
-+    }
-+    return bdrv_co_copy_range(blk_in->root, off_in,
-+                              blk_out->root, off_out,
-+                              bytes, flags);
-+}
---
-.17.1

-[Qemu-devel] [PULL 10/11] qemu-img: Convert with copy offloading
+[PULL for-5.0 3/3] async: use explicit memory barriers
-From: Fam Zheng <famz@redhat.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-The new blk_co_copy_range interface offers a more efficient way in the
+When using C11 atomics, non-seqcst reads and writes do not participate
-case of network based storage. Make use of it to allow faster convert
+in the total order of seqcst operations.  In util/async.c and util/aio-posix.c,
-operation.
+in particular, the pattern that we use
-Since copy offloading cannot do zero detection ('-S') and compression
+          write ctx->notify_me                 write bh->scheduled
-(-c), only try it when these options are not used.
+          read bh->scheduled                   read ctx->notify_me
           if !bh->scheduled, sleep             if ctx->notify_me, notify
-Signed-off-by: Fam Zheng <famz@redhat.com>
+needs to use seqcst operations for both the write and the read.  In
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+general this is something that we do not want, because there can be
-Message-id: 20180601092648.24614-11-famz@redhat.com
+many sources that are polled in addition to bottom halves.  The
 alternative is to place a seqcst memory barrier between the write
 and the read.  This also comes with a disadvantage, in that the
 memory barrier is implicit on strongly-ordered architectures and
 it wastes a few dozen clock cycles.
 Fortunately, ctx->notify_me is never written concurrently by two
 threads, so we can assert that and relax the writes to ctx->notify_me.
 The resulting solution works and performs well on both aarch64 and x86.
 Note that the atomic_set/atomic_read combination is not an atomic
 read-modify-write, and therefore it is even weaker than C11 ATOMIC_RELAXED;
 on x86, ATOMIC_RELAXED compiles to a locked operation.
 Analyzed-by: Ying Fang <fangying1@huawei.com>
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Tested-by: Ying Fang <fangying1@huawei.com>
 Message-Id: <20200407140746.8041-6-pbonzini@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- qemu-img.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++--
+ util/aio-posix.c | 16 ++++++++++++++--
-file changed, 48 insertions(+), 2 deletions(-)
+ util/aio-win32.c | 17 ++++++++++++++---
  util/async.c     | 16 ++++++++++++----
 files changed, 40 insertions(+), 9 deletions(-)
-diff --git a/qemu-img.c b/qemu-img.c
+diff --git a/util/aio-posix.c b/util/aio-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-img.c
+--- a/util/aio-posix.c
-+++ b/qemu-img.c
++++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ typedef struct ImgConvertState {
+@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-     bool compressed;
+     int64_t timeout;
-     bool target_has_backing;
+     int64_t start = 0;
-     bool wr_in_order;
-+    bool copy_range;
++    /*
-     int min_sparse;
++     * There cannot be two concurrent aio_poll calls for the same AioContext (or
-     size_t cluster_sectors;
++     * an aio_poll concurrent with a GSource prepare/check/dispatch callback).
-     size_t buf_sectors;
++     * We rely on this below to avoid slow locked accesses to ctx->notify_me.
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_write(ImgConvertState *s, int64_t sector_num,
++     */
-     return 0;
+     assert(in_aio_context_home_thread(ctx));
- }
+     /* aio_notify can avoid the expensive event_notifier_set if
-+static int coroutine_fn convert_co_copy_range(ImgConvertState *s, int64_t sector_num,
+@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
-+                                              int nb_sectors)
+      * so disable the optimization now.
-+{
+      */
-+    int n, ret;
+     if (blocking) {
 -        atomic_add(&ctx->notify_me, 2);
 +        atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
 +        /*
 +         * Write ctx->notify_me before computing the timeout
 +         * (reading bottom half flags, etc.).  Pairs with
 +         * smp_mb in aio_notify().
 +         */
 +        smp_mb();
      }
      qemu_lockcnt_inc(&ctx->list_lock);
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      }
      if (blocking) {
 -        atomic_sub(&ctx->notify_me, 2);
 +        /* Finish the poll before clearing the flag.  */
 +        atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
          aio_notify_accept(ctx);
      }
 diff --git a/util/aio-win32.c b/util/aio-win32.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/aio-win32.c
 +++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      int count;
      int timeout;
 +    /*
 +     * There cannot be two concurrent aio_poll calls for the same AioContext (or
 +     * an aio_poll concurrent with a GSource prepare/check/dispatch callback).
 +     * We rely on this below to avoid slow locked accesses to ctx->notify_me.
 +     */
 +    assert(in_aio_context_home_thread(ctx));
      progress = false;
      /* aio_notify can avoid the expensive event_notifier_set if
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
       * so disable the optimization now.
       */
      if (blocking) {
 -        atomic_add(&ctx->notify_me, 2);
 +        atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
 +        /*
 +         * Write ctx->notify_me before computing the timeout
 +         * (reading bottom half flags, etc.).  Pairs with
 +         * smp_mb in aio_notify().
 +         */
 +        smp_mb();
      }
      qemu_lockcnt_inc(&ctx->list_lock);
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
          ret = WaitForMultipleObjects(count, events, FALSE, timeout);
          if (blocking) {
              assert(first);
 -            assert(in_aio_context_home_thread(ctx));
 -            atomic_sub(&ctx->notify_me, 2);
 +            atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
              aio_notify_accept(ctx);
          }
 diff --git a/util/async.c b/util/async.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/async.c
 +++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ aio_ctx_prepare(GSource *source, gint    *timeout)
  {
      AioContext *ctx = (AioContext *) source;
 -    atomic_or(&ctx->notify_me, 1);
 +    atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) | 1);
 +
-+    while (nb_sectors > 0) {
++    /*
-+        BlockBackend *blk;
++     * Write ctx->notify_me before computing the timeout
-+        int src_cur;
++     * (reading bottom half flags, etc.).  Pairs with
-+        int64_t bs_sectors, src_cur_offset;
++     * smp_mb in aio_notify().
-+        int64_t offset;
++     */
-+
++    smp_mb();
-+        convert_select_part(s, sector_num, &src_cur, &src_cur_offset);
-+        offset = (sector_num - src_cur_offset) << BDRV_SECTOR_BITS;
+     /* We assume there is no timeout already supplied */
-+        blk = s->src[src_cur];
+     *timeout = qemu_timeout_ns_to_ms(aio_compute_timeout(ctx));
-+        bs_sectors = s->src_sectors[src_cur];
+@@ -XXX,XX +XXX,XX @@ aio_ctx_check(GSource *source)
-+
+     QEMUBH *bh;
-+        n = MIN(nb_sectors, bs_sectors - (sector_num - src_cur_offset));
+     BHListSlice *s;
-+
-+        ret = blk_co_copy_range(blk, offset, s->target,
+-    atomic_and(&ctx->notify_me, ~1);
-+                                sector_num << BDRV_SECTOR_BITS,
++    /* Finish computing the timeout before clearing the flag.  */
-+                                n << BDRV_SECTOR_BITS, 0);
++    atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) & ~1);
-+        if (ret < 0) {
+     aio_notify_accept(ctx);
-+            return ret;
-+        }
+     QSLIST_FOREACH_RCU(bh, &ctx->bh_list, next) {
-+
+@@ -XXX,XX +XXX,XX @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
-+        sector_num += n;
+ void aio_notify(AioContext *ctx)
 +        nb_sectors -= n;
 +    }
 +    return 0;
 +}
 +
  static void coroutine_fn convert_co_do_copy(void *opaque)
  {
-     ImgConvertState *s = opaque;
+     /* Write e.g. bh->scheduled before reading ctx->notify_me.  Pairs
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn convert_co_do_copy(void *opaque)
+-     * with atomic_or in aio_ctx_prepare or atomic_add in aio_poll.
-         int n;
++     * with smp_mb in aio_ctx_prepare or aio_poll.
-         int64_t sector_num;
+      */
-         enum ImgConvertBlockStatus status;
+     smp_mb();
-+        bool copy_range;
+-    if (ctx->notify_me) {
++    if (atomic_read(&ctx->notify_me)) {
-         qemu_co_mutex_lock(&s->lock);
+         event_notifier_set(&ctx->notifier);
-         if (s->ret != -EINPROGRESS || s->sector_num >= s->total_sectors) {
+         atomic_mb_set(&ctx->notified, true);
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn convert_co_do_copy(void *opaque)
+     }
                                          s->allocated_sectors, 0);
          }
 -        if (status == BLK_DATA) {
 +retry:
 +        copy_range = s->copy_range && s->status == BLK_DATA;
 +        if (status == BLK_DATA && !copy_range) {
              ret = convert_co_read(s, sector_num, n, buf);
              if (ret < 0) {
                  error_report("error while reading sector %" PRId64
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn convert_co_do_copy(void *opaque)
          }
          if (s->ret == -EINPROGRESS) {
 -            ret = convert_co_write(s, sector_num, n, buf, status);
 +            if (copy_range) {
 +                ret = convert_co_copy_range(s, sector_num, n);
 +                if (ret) {
 +                    s->copy_range = false;
 +                    goto retry;
 +                }
 +            } else {
 +                ret = convert_co_write(s, sector_num, n, buf, status);
 +            }
              if (ret < 0) {
                  error_report("error while writing sector %" PRId64
                               ": %s", sector_num, strerror(-ret));
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
      ImgConvertState s = (ImgConvertState) {
          /* Need at least 4k of zeros for sparse detection */
          .min_sparse         = 8,
 +        .copy_range         = true,
          .buf_sectors        = IO_BUF_SIZE / BDRV_SECTOR_SIZE,
          .wr_in_order        = true,
          .num_coroutines     = 8,
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
              break;
          case 'c':
              s.compressed = true;
 +            s.copy_range = false;
              break;
          case 'o':
              if (!is_valid_option_list(optarg)) {
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
              }
              s.min_sparse = sval / BDRV_SECTOR_SIZE;
 +            s.copy_range = false;
              break;
          }
          case 'p':
 --
-.17.1
+.25.1

The following changes since commit c25e8bba1f546ea72744ccfab77f8a9e8a323be8:

Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20180601' into staging (2018-06-01 13:11:30 +0100)

are available in the Git repository at:

git://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 21891a5a3011608845b5d7f1f9cce60cdc2bcc62:

main-loop: drop spin_counter (2018-06-01 16:01:29 +0100)

----------------------------------------------------------------
Pull request

* Copy offloading for qemu-img convert (iSCSI, raw, and qcow2)

If the underlying storage supports copy offloading, qemu-img convert will
   use it instead of performing reads and writes.  This avoids data transfers
   and thus frees up storage bandwidth for other purposes.  SCSI EXTENDED COPY
   and Linux copy_file_range(2) are used to implement this optimization.

* Drop spurious "WARNING: I\/O thread spun for 1000 iterations" warning

----------------------------------------------------------------

Fam Zheng (10):
  block: Introduce API for copy offloading
  raw: Check byte range uniformly
  raw: Implement copy offloading
  qcow2: Implement copy offloading
  file-posix: Implement bdrv_co_copy_range
  iscsi: Query and save device designator when opening
  iscsi: Create and use iscsi_co_wait_for_task
  iscsi: Implement copy offloading
  block-backend: Add blk_co_copy_range
  qemu-img: Convert with copy offloading

Stefan Hajnoczi (1):
  main-loop: drop spin_counter

-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

Introduce the bdrv_co_copy_range() API for copy offloading.  Block
drivers implementing this API support efficient copy operations that
avoid reading each block from the source device and writing it to the
destination devices.  Examples of copy offload primitives are SCSI
EXTENDED COPY and Linux copy_file_range(2).

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180601092648.24614-2-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/block/block.h     | 32 +++++++++++++
 include/block/block_int.h | 38 +++++++++++++++
 block/io.c                | 97 +++++++++++++++++++++++++++++++++++++++
 3 files changed, 167 insertions(+)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ bool bdrv_can_store_new_dirty_bitmap(BlockDriverState *bs, const char *name,
  */
 void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size);
 void bdrv_unregister_buf(BlockDriverState *bs, void *host);
+
+/**
+ *
+ * bdrv_co_copy_range:
+ *
+ * Do offloaded copy between two children. If the operation is not implemented
+ * by the driver, or if the backend storage doesn't support it, a negative
+ * error code will be returned.
+ *
+ * Note: block layer doesn't emulate or fallback to a bounce buffer approach
+ * because usually the caller shouldn't attempt offloaded copy any more (e.g.
+ * calling copy_file_range(2)) after the first error, thus it should fall back
+ * to a read+write path in the caller level.
+ *
+ * @src: Source child to copy data from
+ * @src_offset: offset in @src image to read data
+ * @dst: Destination child to copy data to
+ * @dst_offset: offset in @dst image to write data
+ * @bytes: number of bytes to copy
+ * @flags: request flags. Must be one of:
+ *         0 - actually read data from src;
+ *         BDRV_REQ_ZERO_WRITE - treat the @src range as zero data and do zero
+ *                               write on @dst as if bdrv_co_pwrite_zeroes is
+ *                               called. Used to simplify caller code, or
+ *                               during BlockDriver.bdrv_co_copy_range_from()
+ *                               recursion.
+ *
+ * Returns: 0 if succeeded; negative error code if failed.
+ **/
+int coroutine_fn bdrv_co_copy_range(BdrvChild *src, uint64_t src_offset,
+                                    BdrvChild *dst, uint64_t dst_offset,
+                                    uint64_t bytes, BdrvRequestFlags flags);
 #endif
diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
     int coroutine_fn (*bdrv_co_pdiscard)(BlockDriverState *bs,
         int64_t offset, int bytes);
 
+    /* Map [offset, offset + nbytes) range onto a child of @bs to copy from,
+     * and invoke bdrv_co_copy_range_from(child, ...), or invoke
+     * bdrv_co_copy_range_to() if @bs is the leaf child to copy data from.
+     *
+     * See the comment of bdrv_co_copy_range for the parameter and return value
+     * semantics.
+     */
+    int coroutine_fn (*bdrv_co_copy_range_from)(BlockDriverState *bs,
+                                                BdrvChild *src,
+                                                uint64_t offset,
+                                                BdrvChild *dst,
+                                                uint64_t dst_offset,
+                                                uint64_t bytes,
+                                                BdrvRequestFlags flags);
+
+    /* Map [offset, offset + nbytes) range onto a child of bs to copy data to,
+     * and invoke bdrv_co_copy_range_to(child, src, ...), or perform the copy
+     * operation if @bs is the leaf and @src has the same BlockDriver.  Return
+     * -ENOTSUP if @bs is the leaf but @src has a different BlockDriver.
+     *
+     * See the comment of bdrv_co_copy_range for the parameter and return value
+     * semantics.
+     */
+    int coroutine_fn (*bdrv_co_copy_range_to)(BlockDriverState *bs,
+                                              BdrvChild *src,
+                                              uint64_t src_offset,
+                                              BdrvChild *dst,
+                                              uint64_t dst_offset,
+                                              uint64_t bytes,
+                                              BdrvRequestFlags flags);
+
     /*
      * Building block for bdrv_block_status[_above] and
      * bdrv_is_allocated[_above].  The driver should answer only
@@ -XXX,XX +XXX,XX @@ void bdrv_dec_in_flight(BlockDriverState *bs);
 
 void blockdev_close_all_bdrv_states(void);
 
+int coroutine_fn bdrv_co_copy_range_from(BdrvChild *src, uint64_t src_offset,
+                                         BdrvChild *dst, uint64_t dst_offset,
+                                         uint64_t bytes, BdrvRequestFlags flags);
+int coroutine_fn bdrv_co_copy_range_to(BdrvChild *src, uint64_t src_offset,
+                                       BdrvChild *dst, uint64_t dst_offset,
+                                       uint64_t bytes, BdrvRequestFlags flags);
+
 #endif /* BLOCK_INT_H */
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_unregister_buf(BlockDriverState *bs, void *host)
         bdrv_unregister_buf(child->bs, host);
     }
 }
+
+static int coroutine_fn bdrv_co_copy_range_internal(BdrvChild *src,
+                                                    uint64_t src_offset,
+                                                    BdrvChild *dst,
+                                                    uint64_t dst_offset,
+                                                    uint64_t bytes,
+                                                    BdrvRequestFlags flags,
+                                                    bool recurse_src)
+{
+    int ret;
+
+    if (!src || !dst || !src->bs || !dst->bs) {
+        return -ENOMEDIUM;
+    }
+    ret = bdrv_check_byte_request(src->bs, src_offset, bytes);
+    if (ret) {
+        return ret;
+    }
+
+    ret = bdrv_check_byte_request(dst->bs, dst_offset, bytes);
+    if (ret) {
+        return ret;
+    }
+    if (flags & BDRV_REQ_ZERO_WRITE) {
+        return bdrv_co_pwrite_zeroes(dst, dst_offset, bytes, flags);
+    }
+
+    if (!src->bs->drv->bdrv_co_copy_range_from
+        || !dst->bs->drv->bdrv_co_copy_range_to
+        || src->bs->encrypted || dst->bs->encrypted) {
+        return -ENOTSUP;
+    }
+    if (recurse_src) {
+        return src->bs->drv->bdrv_co_copy_range_from(src->bs,
+                                                     src, src_offset,
+                                                     dst, dst_offset,
+                                                     bytes, flags);
+    } else {
+        return dst->bs->drv->bdrv_co_copy_range_to(dst->bs,
+                                                   src, src_offset,
+                                                   dst, dst_offset,
+                                                   bytes, flags);
+    }
+}
+
+/* Copy range from @src to @dst.
+ *
+ * See the comment of bdrv_co_copy_range for the parameter and return value
+ * semantics. */
+int coroutine_fn bdrv_co_copy_range_from(BdrvChild *src, uint64_t src_offset,
+                                         BdrvChild *dst, uint64_t dst_offset,
+                                         uint64_t bytes, BdrvRequestFlags flags)
+{
+    return bdrv_co_copy_range_internal(src, src_offset, dst, dst_offset,
+                                       bytes, flags, true);
+}
+
+/* Copy range from @src to @dst.
+ *
+ * See the comment of bdrv_co_copy_range for the parameter and return value
+ * semantics. */
+int coroutine_fn bdrv_co_copy_range_to(BdrvChild *src, uint64_t src_offset,
+                                       BdrvChild *dst, uint64_t dst_offset,
+                                       uint64_t bytes, BdrvRequestFlags flags)
+{
+    return bdrv_co_copy_range_internal(src, src_offset, dst, dst_offset,
+                                       bytes, flags, false);
+}
+
+int coroutine_fn bdrv_co_copy_range(BdrvChild *src, uint64_t src_offset,
+                                    BdrvChild *dst, uint64_t dst_offset,
+                                    uint64_t bytes, BdrvRequestFlags flags)
+{
+    BdrvTrackedRequest src_req, dst_req;
+    BlockDriverState *src_bs = src->bs;
+    BlockDriverState *dst_bs = dst->bs;
+    int ret;
+
+    bdrv_inc_in_flight(src_bs);
+    bdrv_inc_in_flight(dst_bs);
+    tracked_request_begin(&src_req, src_bs, src_offset,
+                          bytes, BDRV_TRACKED_READ);
+    tracked_request_begin(&dst_req, dst_bs, dst_offset,
+                          bytes, BDRV_TRACKED_WRITE);
+
+    wait_serialising_requests(&src_req);
+    wait_serialising_requests(&dst_req);
+    ret = bdrv_co_copy_range_from(src, src_offset,
+                                  dst, dst_offset,
+                                  bytes, flags);
+
+    tracked_request_end(&src_req);
+    tracked_request_end(&dst_req);
+    bdrv_dec_in_flight(src_bs);
+    bdrv_dec_in_flight(dst_bs);
+    return ret;
+}
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

We don't verify the request range against s->size in the I/O callbacks
except for raw_co_pwritev. This is inconsistent (especially for
raw_co_pwrite_zeroes and raw_co_pdiscard), so fix them, in the meanwhile
make the helper reusable by the coming new callbacks.

Note that in most cases the block layer already verifies the request
byte range against our reported image length, before invoking the driver
callbacks.  The exception is during image creating, after
blk_set_allow_write_beyond_eof(blk, true) is called. But in that case,
the requests are not directly from the user or guest. So there is no
visible behavior change in adding the check code.

The int64_t -> uint64_t inconsistency, as shown by the type casting, is
pre-existing due to the interface.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 20180601092648.24614-3-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/raw-format.c | 64 ++++++++++++++++++++++++++++------------------
 1 file changed, 39 insertions(+), 25 deletions(-)

diff --git a/block/raw-format.c b/block/raw-format.c
index XXXXXXX..XXXXXXX 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static void raw_reopen_abort(BDRVReopenState *state)
     state->opaque = NULL;
 }
 
+/* Check and adjust the offset, against 'offset' and 'size' options. */
+static inline int raw_adjust_offset(BlockDriverState *bs, uint64_t *offset,
+                                    uint64_t bytes, bool is_write)
+{
+    BDRVRawState *s = bs->opaque;
+
+    if (s->has_size && (*offset > s->size || bytes > (s->size - *offset))) {
+        /* There's not enough space for the write, or the read request is
+         * out-of-range. Don't read/write anything to prevent leaking out of
+         * the size specified in options. */
+        return is_write ? -ENOSPC : -EINVAL;;
+    }
+
+    if (*offset > INT64_MAX - s->offset) {
+        return -EINVAL;
+    }
+    *offset += s->offset;
+
+    return 0;
+}
+
 static int coroutine_fn raw_co_preadv(BlockDriverState *bs, uint64_t offset,
                                       uint64_t bytes, QEMUIOVector *qiov,
                                       int flags)
 {
-    BDRVRawState *s = bs->opaque;
+    int ret;
 
-    if (offset > UINT64_MAX - s->offset) {
-        return -EINVAL;
+    ret = raw_adjust_offset(bs, &offset, bytes, false);
+    if (ret) {
+        return ret;
     }
-    offset += s->offset;
 
     BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
     return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
                                        uint64_t bytes, QEMUIOVector *qiov,
                                        int flags)
 {
-    BDRVRawState *s = bs->opaque;
     void *buf = NULL;
     BlockDriver *drv;
     QEMUIOVector local_qiov;
     int ret;
 
-    if (s->has_size && (offset > s->size || bytes > (s->size - offset))) {
-        /* There's not enough space for the data. Don't write anything and just
-         * fail to prevent leaking out of the size specified in options. */
-        return -ENOSPC;
-    }
-
-    if (offset > UINT64_MAX - s->offset) {
-        ret = -EINVAL;
-        goto fail;
-    }
-
     if (bs->probed && offset < BLOCK_PROBE_BUF_SIZE && bytes) {
         /* Handling partial writes would be a pain - so we just
          * require that guests have 512-byte request alignment if
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, uint64_t offset,
         qiov = &local_qiov;
     }
 
-    offset += s->offset;
+    ret = raw_adjust_offset(bs, &offset, bytes, true);
+    if (ret) {
+        goto fail;
+    }
 
     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
     ret = bdrv_co_pwritev(bs->file, offset, bytes, qiov, flags);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwrite_zeroes(BlockDriverState *bs,
                                              int64_t offset, int bytes,
                                              BdrvRequestFlags flags)
 {
-    BDRVRawState *s = bs->opaque;
-    if (offset > UINT64_MAX - s->offset) {
-        return -EINVAL;
+    int ret;
+
+    ret = raw_adjust_offset(bs, (uint64_t *)&offset, bytes, true);
+    if (ret) {
+        return ret;
     }
-    offset += s->offset;
     return bdrv_co_pwrite_zeroes(bs->file, offset, bytes, flags);
 }
 
 static int coroutine_fn raw_co_pdiscard(BlockDriverState *bs,
                                         int64_t offset, int bytes)
 {
-    BDRVRawState *s = bs->opaque;
-    if (offset > UINT64_MAX - s->offset) {
-        return -EINVAL;
+    int ret;
+
+    ret = raw_adjust_offset(bs, (uint64_t *)&offset, bytes, true);
+    if (ret) {
+        return ret;
     }
-    offset += s->offset;
     return bdrv_co_pdiscard(bs->file->bs, offset, bytes);
 }
 
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

Just pass down to ->file.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180601092648.24614-4-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/raw-format.c | 32 ++++++++++++++++++++++++++++++++
 1 file changed, 32 insertions(+)

diff --git a/block/raw-format.c b/block/raw-format.c
index XXXXXXX..XXXXXXX 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static int raw_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
     return bdrv_probe_geometry(bs->file->bs, geo);
 }
 
+static int coroutine_fn raw_co_copy_range_from(BlockDriverState *bs,
+                                               BdrvChild *src, uint64_t src_offset,
+                                               BdrvChild *dst, uint64_t dst_offset,
+                                               uint64_t bytes, BdrvRequestFlags flags)
+{
+    int ret;
+
+    ret = raw_adjust_offset(bs, &src_offset, bytes, false);
+    if (ret) {
+        return ret;
+    }
+    return bdrv_co_copy_range_from(bs->file, src_offset, dst, dst_offset,
+                                   bytes, flags);
+}
+
+static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
+                                             BdrvChild *src, uint64_t src_offset,
+                                             BdrvChild *dst, uint64_t dst_offset,
+                                             uint64_t bytes, BdrvRequestFlags flags)
+{
+    int ret;
+
+    ret = raw_adjust_offset(bs, &dst_offset, bytes, true);
+    if (ret) {
+        return ret;
+    }
+    return bdrv_co_copy_range_to(src, src_offset, bs->file, dst_offset, bytes,
+                                 flags);
+}
+
 BlockDriver bdrv_raw = {
     .format_name          = "raw",
     .instance_size        = sizeof(BDRVRawState),
@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_raw = {
     .bdrv_co_pwrite_zeroes = &raw_co_pwrite_zeroes,
     .bdrv_co_pdiscard     = &raw_co_pdiscard,
     .bdrv_co_block_status = &raw_co_block_status,
+    .bdrv_co_copy_range_from = &raw_co_copy_range_from,
+    .bdrv_co_copy_range_to  = &raw_co_copy_range_to,
     .bdrv_truncate        = &raw_truncate,
     .bdrv_getlength       = &raw_getlength,
     .has_variable_length  = true,
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

The two callbacks are implemented quite similarly to the read/write
functions: bdrv_co_copy_range_from maps for read and calls into bs->file
or bs->backing depending on the allocation status; bdrv_co_copy_range_to
maps for write and calls into bs->file.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 20180601092648.24614-5-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qcow2.c | 229 +++++++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 199 insertions(+), 30 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
     return status;
 }
 
+static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
+                                            QCowL2Meta **pl2meta,
+                                            bool link_l2)
+{
+    int ret = 0;
+    QCowL2Meta *l2meta = *pl2meta;
+
+    while (l2meta != NULL) {
+        QCowL2Meta *next;
+
+        if (!ret && link_l2) {
+            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
+            if (ret) {
+                goto out;
+            }
+        }
+
+        /* Take the request off the list of running requests */
+        if (l2meta->nb_clusters != 0) {
+            QLIST_REMOVE(l2meta, next_in_flight);
+        }
+
+        qemu_co_queue_restart_all(&l2meta->dependent_requests);
+
+        next = l2meta->next;
+        g_free(l2meta);
+        l2meta = next;
+    }
+out:
+    *pl2meta = l2meta;
+    return ret;
+}
+
 static coroutine_fn int qcow2_co_preadv(BlockDriverState *bs, uint64_t offset,
                                         uint64_t bytes, QEMUIOVector *qiov,
                                         int flags)
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
             }
         }
 
-        while (l2meta != NULL) {
-            QCowL2Meta *next;
-
-            ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
-            if (ret < 0) {
-                goto fail;
-            }
-
-            /* Take the request off the list of running requests */
-            if (l2meta->nb_clusters != 0) {
-                QLIST_REMOVE(l2meta, next_in_flight);
-            }
-
-            qemu_co_queue_restart_all(&l2meta->dependent_requests);
-
-            next = l2meta->next;
-            g_free(l2meta);
-            l2meta = next;
+        ret = qcow2_handle_l2meta(bs, &l2meta, true);
+        if (ret) {
+            goto fail;
         }
 
         bytes -= cur_bytes;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow2_co_pwritev(BlockDriverState *bs, uint64_t offset,
     ret = 0;
 
 fail:
-    while (l2meta != NULL) {
-        QCowL2Meta *next;
-
-        if (l2meta->nb_clusters != 0) {
-            QLIST_REMOVE(l2meta, next_in_flight);
-        }
-        qemu_co_queue_restart_all(&l2meta->dependent_requests);
-
-        next = l2meta->next;
-        g_free(l2meta);
-        l2meta = next;
-    }
+    qcow2_handle_l2meta(bs, &l2meta, false);
 
     qemu_co_mutex_unlock(&s->lock);
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
     return ret;
 }
 
+static int coroutine_fn
+qcow2_co_copy_range_from(BlockDriverState *bs,
+                         BdrvChild *src, uint64_t src_offset,
+                         BdrvChild *dst, uint64_t dst_offset,
+                         uint64_t bytes, BdrvRequestFlags flags)
+{
+    BDRVQcow2State *s = bs->opaque;
+    int ret;
+    unsigned int cur_bytes; /* number of bytes in current iteration */
+    BdrvChild *child = NULL;
+    BdrvRequestFlags cur_flags;
+
+    assert(!bs->encrypted);
+    qemu_co_mutex_lock(&s->lock);
+
+    while (bytes != 0) {
+        uint64_t copy_offset = 0;
+        /* prepare next request */
+        cur_bytes = MIN(bytes, INT_MAX);
+        cur_flags = flags;
+
+        ret = qcow2_get_cluster_offset(bs, src_offset, &cur_bytes, &copy_offset);
+        if (ret < 0) {
+            goto out;
+        }
+
+        switch (ret) {
+        case QCOW2_CLUSTER_UNALLOCATED:
+            if (bs->backing && bs->backing->bs) {
+                int64_t backing_length = bdrv_getlength(bs->backing->bs);
+                if (src_offset >= backing_length) {
+                    cur_flags |= BDRV_REQ_ZERO_WRITE;
+                } else {
+                    child = bs->backing;
+                    cur_bytes = MIN(cur_bytes, backing_length - src_offset);
+                    copy_offset = src_offset;
+                }
+            } else {
+                cur_flags |= BDRV_REQ_ZERO_WRITE;
+            }
+            break;
+
+        case QCOW2_CLUSTER_ZERO_PLAIN:
+        case QCOW2_CLUSTER_ZERO_ALLOC:
+            cur_flags |= BDRV_REQ_ZERO_WRITE;
+            break;
+
+        case QCOW2_CLUSTER_COMPRESSED:
+            ret = -ENOTSUP;
+            goto out;
+            break;
+
+        case QCOW2_CLUSTER_NORMAL:
+            child = bs->file;
+            copy_offset += offset_into_cluster(s, src_offset);
+            if ((copy_offset & 511) != 0) {
+                ret = -EIO;
+                goto out;
+            }
+            break;
+
+        default:
+            abort();
+        }
+        qemu_co_mutex_unlock(&s->lock);
+        ret = bdrv_co_copy_range_from(child,
+                                      copy_offset,
+                                      dst, dst_offset,
+                                      cur_bytes, cur_flags);
+        qemu_co_mutex_lock(&s->lock);
+        if (ret < 0) {
+            goto out;
+        }
+
+        bytes -= cur_bytes;
+        src_offset += cur_bytes;
+        dst_offset += cur_bytes;
+    }
+    ret = 0;
+
+out:
+    qemu_co_mutex_unlock(&s->lock);
+    return ret;
+}
+
+static int coroutine_fn
+qcow2_co_copy_range_to(BlockDriverState *bs,
+                       BdrvChild *src, uint64_t src_offset,
+                       BdrvChild *dst, uint64_t dst_offset,
+                       uint64_t bytes, BdrvRequestFlags flags)
+{
+    BDRVQcow2State *s = bs->opaque;
+    int offset_in_cluster;
+    int ret;
+    unsigned int cur_bytes; /* number of sectors in current iteration */
+    uint64_t cluster_offset;
+    uint8_t *cluster_data = NULL;
+    QCowL2Meta *l2meta = NULL;
+
+    assert(!bs->encrypted);
+    s->cluster_cache_offset = -1; /* disable compressed cache */
+
+    qemu_co_mutex_lock(&s->lock);
+
+    while (bytes != 0) {
+
+        l2meta = NULL;
+
+        offset_in_cluster = offset_into_cluster(s, dst_offset);
+        cur_bytes = MIN(bytes, INT_MAX);
+
+        /* TODO:
+         * If src->bs == dst->bs, we could simply copy by incrementing
+         * the refcnt, without copying user data.
+         * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
+        ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
+                                         &cluster_offset, &l2meta);
+        if (ret < 0) {
+            goto fail;
+        }
+
+        assert((cluster_offset & 511) == 0);
+
+        ret = qcow2_pre_write_overlap_check(bs, 0,
+                cluster_offset + offset_in_cluster, cur_bytes);
+        if (ret < 0) {
+            goto fail;
+        }
+
+        qemu_co_mutex_unlock(&s->lock);
+        ret = bdrv_co_copy_range_to(src, src_offset,
+                                    bs->file,
+                                    cluster_offset + offset_in_cluster,
+                                    cur_bytes, flags);
+        qemu_co_mutex_lock(&s->lock);
+        if (ret < 0) {
+            goto fail;
+        }
+
+        ret = qcow2_handle_l2meta(bs, &l2meta, true);
+        if (ret) {
+            goto fail;
+        }
+
+        bytes -= cur_bytes;
+        dst_offset += cur_bytes;
+    }
+    ret = 0;
+
+fail:
+    qcow2_handle_l2meta(bs, &l2meta, false);
+
+    qemu_co_mutex_unlock(&s->lock);
+
+    qemu_vfree(cluster_data);
+    trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
+
+    return ret;
+}
+
 static int qcow2_truncate(BlockDriverState *bs, int64_t offset,
                           PreallocMode prealloc, Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_qcow2 = {
 
     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
+    .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
+    .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
     .bdrv_truncate          = qcow2_truncate,
     .bdrv_co_pwritev_compressed = qcow2_co_pwritev_compressed,
     .bdrv_make_empty        = qcow2_make_empty,
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

With copy_file_range(2), we can implement the bdrv_co_copy_range
semantics.

Signed-off-by: Fam Zheng <famz@redhat.com>
Message-id: 20180601092648.24614-6-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 configure               | 17 +++++++
 include/block/raw-aio.h | 10 ++++-
 block/file-posix.c      | 98 +++++++++++++++++++++++++++++++++++++++--
 3 files changed, 120 insertions(+), 5 deletions(-)

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ if test "$fortify_source" != "no"; then
   fi
 fi
 
+###############################################
+# Check if copy_file_range is provided by glibc
+have_copy_file_range=no
+cat > $TMPC << EOF
+#include <unistd.h>
+int main(void) {
+  copy_file_range(0, NULL, 0, NULL, 0, 0);
+  return 0;
+}
+EOF
+if compile_prog "" "" ; then
+    have_copy_file_range=yes
+fi
+
 ##########################################
 # check if struct fsxattr is available via linux/fs.h
 
@@ -XXX,XX +XXX,XX @@ fi
 if test "$have_fsxattr" = "yes" ; then
     echo "HAVE_FSXATTR=y" >> $config_host_mak
 fi
+if test "$have_copy_file_range" = "yes" ; then
+    echo "HAVE_COPY_FILE_RANGE=y" >> $config_host_mak
+fi
 if test "$vte" = "yes" ; then
   echo "CONFIG_VTE=y" >> $config_host_mak
   echo "VTE_CFLAGS=$vte_cflags" >> $config_host_mak
diff --git a/include/block/raw-aio.h b/include/block/raw-aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/raw-aio.h
+++ b/include/block/raw-aio.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_AIO_FLUSH        0x0008
 #define QEMU_AIO_DISCARD      0x0010
 #define QEMU_AIO_WRITE_ZEROES 0x0020
+#define QEMU_AIO_COPY_RANGE   0x0040
 #define QEMU_AIO_TYPE_MASK \
-        (QEMU_AIO_READ|QEMU_AIO_WRITE|QEMU_AIO_IOCTL|QEMU_AIO_FLUSH| \
-         QEMU_AIO_DISCARD|QEMU_AIO_WRITE_ZEROES)
+        (QEMU_AIO_READ | \
+         QEMU_AIO_WRITE | \
+         QEMU_AIO_IOCTL | \
+         QEMU_AIO_FLUSH | \
+         QEMU_AIO_DISCARD | \
+         QEMU_AIO_WRITE_ZEROES | \
+         QEMU_AIO_COPY_RANGE)
 
 /* AIO flags */
 #define QEMU_AIO_MISALIGNED   0x1000
diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@
 #ifdef __linux__
 #include <sys/ioctl.h>
 #include <sys/param.h>
+#include <sys/syscall.h>
 #include <linux/cdrom.h>
 #include <linux/fd.h>
 #include <linux/fs.h>
@@ -XXX,XX +XXX,XX @@ typedef struct RawPosixAIOData {
 #define aio_ioctl_cmd   aio_nbytes /* for QEMU_AIO_IOCTL */
     off_t aio_offset;
     int aio_type;
+    int aio_fd2;
+    off_t aio_offset2;
 } RawPosixAIOData;
 
 #if defined(__FreeBSD__) || defined(__FreeBSD_kernel__)
@@ -XXX,XX +XXX,XX @@ static ssize_t handle_aiocb_write_zeroes(RawPosixAIOData *aiocb)
     return -ENOTSUP;
 }
 
+#ifndef HAVE_COPY_FILE_RANGE
+static off_t copy_file_range(int in_fd, off_t *in_off, int out_fd,
+                             off_t *out_off, size_t len, unsigned int flags)
+{
+#ifdef __NR_copy_file_range
+    return syscall(__NR_copy_file_range, in_fd, in_off, out_fd,
+                   out_off, len, flags);
+#else
+    errno = ENOSYS;
+    return -1;
+#endif
+}
+#endif
+
+static ssize_t handle_aiocb_copy_range(RawPosixAIOData *aiocb)
+{
+    uint64_t bytes = aiocb->aio_nbytes;
+    off_t in_off = aiocb->aio_offset;
+    off_t out_off = aiocb->aio_offset2;
+
+    while (bytes) {
+        ssize_t ret = copy_file_range(aiocb->aio_fildes, &in_off,
+                                      aiocb->aio_fd2, &out_off,
+                                      bytes, 0);
+        if (ret == -EINTR) {
+            continue;
+        }
+        if (ret < 0) {
+            if (errno == ENOSYS) {
+                return -ENOTSUP;
+            } else {
+                return -errno;
+            }
+        }
+        if (!ret) {
+            /* No progress (e.g. when beyond EOF), fall back to buffer I/O. */
+            return -ENOTSUP;
+        }
+        bytes -= ret;
+    }
+    return 0;
+}
+
 static ssize_t handle_aiocb_discard(RawPosixAIOData *aiocb)
 {
     int ret = -EOPNOTSUPP;
@@ -XXX,XX +XXX,XX @@ static int aio_worker(void *arg)
     case QEMU_AIO_WRITE_ZEROES:
         ret = handle_aiocb_write_zeroes(aiocb);
         break;
+    case QEMU_AIO_COPY_RANGE:
+        ret = handle_aiocb_copy_range(aiocb);
+        break;
     default:
         fprintf(stderr, "invalid aio request (0x%x)\n", aiocb->aio_type);
         ret = -EINVAL;
@@ -XXX,XX +XXX,XX @@ static int aio_worker(void *arg)
     return ret;
 }
 
-static int paio_submit_co(BlockDriverState *bs, int fd,
-                          int64_t offset, QEMUIOVector *qiov,
-                          int bytes, int type)
+static int paio_submit_co_full(BlockDriverState *bs, int fd,
+                               int64_t offset, int fd2, int64_t offset2,
+                               QEMUIOVector *qiov,
+                               int bytes, int type)
 {
     RawPosixAIOData *acb = g_new(RawPosixAIOData, 1);
     ThreadPool *pool;
@@ -XXX,XX +XXX,XX @@ static int paio_submit_co(BlockDriverState *bs, int fd,
     acb->bs = bs;
     acb->aio_type = type;
     acb->aio_fildes = fd;
+    acb->aio_fd2 = fd2;
+    acb->aio_offset2 = offset2;
 
     acb->aio_nbytes = bytes;
     acb->aio_offset = offset;
@@ -XXX,XX +XXX,XX @@ static int paio_submit_co(BlockDriverState *bs, int fd,
     return thread_pool_submit_co(pool, aio_worker, acb);
 }
 
+static inline int paio_submit_co(BlockDriverState *bs, int fd,
+                                 int64_t offset, QEMUIOVector *qiov,
+                                 int bytes, int type)
+{
+    return paio_submit_co_full(bs, fd, offset, -1, 0, qiov, bytes, type);
+}
+
 static BlockAIOCB *paio_submit(BlockDriverState *bs, int fd,
         int64_t offset, QEMUIOVector *qiov, int bytes,
         BlockCompletionFunc *cb, void *opaque, int type)
@@ -XXX,XX +XXX,XX @@ static void raw_abort_perm_update(BlockDriverState *bs)
     raw_handle_perm_lock(bs, RAW_PL_ABORT, 0, 0, NULL);
 }
 
+static int coroutine_fn raw_co_copy_range_from(BlockDriverState *bs,
+                                               BdrvChild *src, uint64_t src_offset,
+                                               BdrvChild *dst, uint64_t dst_offset,
+                                               uint64_t bytes, BdrvRequestFlags flags)
+{
+    return bdrv_co_copy_range_to(src, src_offset, dst, dst_offset, bytes, flags);
+}
+
+static int coroutine_fn raw_co_copy_range_to(BlockDriverState *bs,
+                                             BdrvChild *src, uint64_t src_offset,
+                                             BdrvChild *dst, uint64_t dst_offset,
+                                             uint64_t bytes, BdrvRequestFlags flags)
+{
+    BDRVRawState *s = bs->opaque;
+    BDRVRawState *src_s;
+
+    assert(dst->bs == bs);
+    if (src->bs->drv->bdrv_co_copy_range_to != raw_co_copy_range_to) {
+        return -ENOTSUP;
+    }
+
+    src_s = src->bs->opaque;
+    if (fd_open(bs) < 0 || fd_open(bs) < 0) {
+        return -EIO;
+    }
+    return paio_submit_co_full(bs, src_s->fd, src_offset, s->fd, dst_offset,
+                               NULL, bytes, QEMU_AIO_COPY_RANGE);
+}
+
 BlockDriver bdrv_file = {
     .format_name = "file",
     .protocol_name = "file",
@@ -XXX,XX +XXX,XX @@ BlockDriver bdrv_file = {
     .bdrv_co_pwritev        = raw_co_pwritev,
     .bdrv_aio_flush = raw_aio_flush,
     .bdrv_aio_pdiscard = raw_aio_pdiscard,
+    .bdrv_co_copy_range_from = raw_co_copy_range_from,
+    .bdrv_co_copy_range_to  = raw_co_copy_range_to,
     .bdrv_refresh_limits = raw_refresh_limits,
     .bdrv_io_plug = raw_aio_plug,
     .bdrv_io_unplug = raw_aio_unplug,
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_host_device = {
     .bdrv_co_pwritev        = raw_co_pwritev,
     .bdrv_aio_flush	= raw_aio_flush,
     .bdrv_aio_pdiscard   = hdev_aio_pdiscard,
+    .bdrv_co_copy_range_from = raw_co_copy_range_from,
+    .bdrv_co_copy_range_to  = raw_co_copy_range_to,
     .bdrv_refresh_limits = raw_refresh_limits,
     .bdrv_io_plug = raw_aio_plug,
     .bdrv_io_unplug = raw_aio_unplug,
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

The device designator data returned in INQUIRY command will be useful to
fill in source/target fields during copy offloading. Do this when
connecting to the target and save the data for later use.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180601092648.24614-7-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/iscsi.c | 41 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 41 insertions(+)

diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ typedef struct IscsiLun {
     QemuMutex mutex;
     struct scsi_inquiry_logical_block_provisioning lbp;
     struct scsi_inquiry_block_limits bl;
+    struct scsi_inquiry_device_designator *dd;
     unsigned char *zeroblock;
     /* The allocmap tracks which clusters (pages) on the iSCSI target are
      * allocated and which are not. In case a target returns zeros for
@@ -XXX,XX +XXX,XX @@ static QemuOptsList runtime_opts = {
     },
 };
 
+static void iscsi_save_designator(IscsiLun *lun,
+                                  struct scsi_inquiry_device_identification *inq_di)
+{
+    struct scsi_inquiry_device_designator *desig, *copy = NULL;
+
+    for (desig = inq_di->designators; desig; desig = desig->next) {
+        if (desig->association ||
+            desig->designator_type > SCSI_DESIGNATOR_TYPE_NAA) {
+            continue;
+        }
+        /* NAA works better than T10 vendor ID based designator. */
+        if (!copy || copy->designator_type < desig->designator_type) {
+            copy = desig;
+        }
+    }
+    if (copy) {
+        lun->dd = g_new(struct scsi_inquiry_device_designator, 1);
+        *lun->dd = *copy;
+        lun->dd->next = NULL;
+        lun->dd->designator = g_malloc(copy->designator_length);
+        memcpy(lun->dd->designator, copy->designator, copy->designator_length);
+    }
+}
+
 static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
                       Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
         struct scsi_task *inq_task;
         struct scsi_inquiry_logical_block_provisioning *inq_lbp;
         struct scsi_inquiry_block_limits *inq_bl;
+        struct scsi_inquiry_device_identification *inq_di;
         switch (inq_vpd->pages[i]) {
         case SCSI_INQUIRY_PAGECODE_LOGICAL_BLOCK_PROVISIONING:
             inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
@@ -XXX,XX +XXX,XX @@ static int iscsi_open(BlockDriverState *bs, QDict *options, int flags,
                    sizeof(struct scsi_inquiry_block_limits));
             scsi_free_scsi_task(inq_task);
             break;
+        case SCSI_INQUIRY_PAGECODE_DEVICE_IDENTIFICATION:
+            inq_task = iscsi_do_inquiry(iscsilun->iscsi, iscsilun->lun, 1,
+                                    SCSI_INQUIRY_PAGECODE_DEVICE_IDENTIFICATION,
+                                    (void **) &inq_di, errp);
+            if (inq_task == NULL) {
+                ret = -EINVAL;
+                goto out;
+            }
+            iscsi_save_designator(iscsilun, inq_di);
+            scsi_free_scsi_task(inq_task);
+            break;
         default:
             break;
         }
@@ -XXX,XX +XXX,XX @@ static void iscsi_close(BlockDriverState *bs)
         iscsi_logout_sync(iscsi);
     }
     iscsi_destroy_context(iscsi);
+    if (iscsilun->dd) {
+        g_free(iscsilun->dd->designator);
+        g_free(iscsilun->dd);
+    }
     g_free(iscsilun->zeroblock);
     iscsi_allocmap_free(iscsilun);
     qemu_mutex_destroy(&iscsilun->mutex);
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

This loop is repeated a growing number times. Make a helper.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20180601092648.24614-8-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/iscsi.c | 54 ++++++++++++++++-----------------------------------
 1 file changed, 17 insertions(+), 37 deletions(-)

diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static inline bool iscsi_allocmap_is_valid(IscsiLun *iscsilun,
                                offset / iscsilun->cluster_size) == size);
 }
 
+static void coroutine_fn iscsi_co_wait_for_task(IscsiTask *iTask,
+                                                IscsiLun *iscsilun)
+{
+    while (!iTask->complete) {
+        iscsi_set_events(iscsilun);
+        qemu_mutex_unlock(&iscsilun->mutex);
+        qemu_coroutine_yield();
+        qemu_mutex_lock(&iscsilun->mutex);
+    }
+}
+
 static int coroutine_fn
 iscsi_co_writev(BlockDriverState *bs, int64_t sector_num, int nb_sectors,
                 QEMUIOVector *iov, int flags)
@@ -XXX,XX +XXX,XX @@ retry:
     scsi_task_set_iov_out(iTask.task, (struct scsi_iovec *) iov->iov,
                           iov->niov);
 #endif
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
+    iscsi_co_wait_for_task(&iTask, iscsilun);
 
     if (iTask.task != NULL) {
         scsi_free_scsi_task(iTask.task);
@@ -XXX,XX +XXX,XX @@ retry:
         ret = -ENOMEM;
         goto out_unlock;
     }
-
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
+    iscsi_co_wait_for_task(&iTask, iscsilun);
 
     if (iTask.do_retry) {
         if (iTask.task != NULL) {
@@ -XXX,XX +XXX,XX @@ retry:
 #if LIBISCSI_API_VERSION < (20160603)
     scsi_task_set_iov_in(iTask.task, (struct scsi_iovec *) iov->iov, iov->niov);
 #endif
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
 
+    iscsi_co_wait_for_task(&iTask, iscsilun);
     if (iTask.task != NULL) {
         scsi_free_scsi_task(iTask.task);
         iTask.task = NULL;
@@ -XXX,XX +XXX,XX @@ retry:
         return -ENOMEM;
     }
 
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
+    iscsi_co_wait_for_task(&iTask, iscsilun);
 
     if (iTask.task != NULL) {
         scsi_free_scsi_task(iTask.task);
@@ -XXX,XX +XXX,XX @@ retry:
         goto out_unlock;
     }
 
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
+    iscsi_co_wait_for_task(&iTask, iscsilun);
 
     if (iTask.task != NULL) {
         scsi_free_scsi_task(iTask.task);
@@ -XXX,XX +XXX,XX @@ retry:
         return -ENOMEM;
     }
 
-    while (!iTask.complete) {
-        iscsi_set_events(iscsilun);
-        qemu_mutex_unlock(&iscsilun->mutex);
-        qemu_coroutine_yield();
-        qemu_mutex_lock(&iscsilun->mutex);
-    }
+    iscsi_co_wait_for_task(&iTask, iscsilun);
 
     if (iTask.status == SCSI_STATUS_CHECK_CONDITION &&
         iTask.task->sense.key == SCSI_SENSE_ILLEGAL_REQUEST &&
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

Issue EXTENDED COPY (LID1) command to implement the copy_range API.

The parameter data construction code is modified from libiscsi's
iscsi-dd.c.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180601092648.24614-9-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/scsi/constants.h |   4 +
 block/iscsi.c            | 219 +++++++++++++++++++++++++++++++++++++++
 2 files changed, 223 insertions(+)

diff --git a/include/scsi/constants.h b/include/scsi/constants.h
index XXXXXXX..XXXXXXX 100644
--- a/include/scsi/constants.h
+++ b/include/scsi/constants.h
@@ -XXX,XX +XXX,XX @@
 #define MMC_PROFILE_HDDVD_RW_DL         0x005A
 #define MMC_PROFILE_INVALID             0xFFFF
 
+#define XCOPY_DESC_OFFSET 16
+#define IDENT_DESCR_TGT_DESCR_SIZE 32
+#define XCOPY_BLK2BLK_SEG_DESC_SIZE 28
+
 #endif
diff --git a/block/iscsi.c b/block/iscsi.c
index XXXXXXX..XXXXXXX 100644
--- a/block/iscsi.c
+++ b/block/iscsi.c
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn iscsi_co_invalidate_cache(BlockDriverState *bs,
     iscsi_allocmap_invalidate(iscsilun);
 }
 
+static int coroutine_fn iscsi_co_copy_range_from(BlockDriverState *bs,
+                                                 BdrvChild *src,
+                                                 uint64_t src_offset,
+                                                 BdrvChild *dst,
+                                                 uint64_t dst_offset,
+                                                 uint64_t bytes,
+                                                 BdrvRequestFlags flags)
+{
+    return bdrv_co_copy_range_to(src, src_offset, dst, dst_offset, bytes, flags);
+}
+
+static struct scsi_task *iscsi_xcopy_task(int param_len)
+{
+    struct scsi_task *task;
+
+    task = g_new0(struct scsi_task, 1);
+
+    task->cdb[0]     = EXTENDED_COPY;
+    task->cdb[10]    = (param_len >> 24) & 0xFF;
+    task->cdb[11]    = (param_len >> 16) & 0xFF;
+    task->cdb[12]    = (param_len >> 8) & 0xFF;
+    task->cdb[13]    = param_len & 0xFF;
+    task->cdb_size   = 16;
+    task->xfer_dir   = SCSI_XFER_WRITE;
+    task->expxferlen = param_len;
+
+    return task;
+}
+
+static void iscsi_populate_target_desc(unsigned char *desc, IscsiLun *lun)
+{
+    struct scsi_inquiry_device_designator *dd = lun->dd;
+
+    memset(desc, 0, 32);
+    desc[0] = 0xE4; /* IDENT_DESCR_TGT_DESCR */
+    desc[4] = dd->code_set;
+    desc[5] = (dd->designator_type & 0xF)
+        | ((dd->association & 3) << 4);
+    desc[7] = dd->designator_length;
+    memcpy(desc + 8, dd->designator, dd->designator_length);
+
+    desc[28] = 0;
+    desc[29] = (lun->block_size >> 16) & 0xFF;
+    desc[30] = (lun->block_size >> 8) & 0xFF;
+    desc[31] = lun->block_size & 0xFF;
+}
+
+static void iscsi_xcopy_desc_hdr(uint8_t *hdr, int dc, int cat, int src_index,
+                                 int dst_index)
+{
+    hdr[0] = 0x02; /* BLK_TO_BLK_SEG_DESCR */
+    hdr[1] = ((dc << 1) | cat) & 0xFF;
+    hdr[2] = (XCOPY_BLK2BLK_SEG_DESC_SIZE >> 8) & 0xFF;
+    /* don't account for the first 4 bytes in descriptor header*/
+    hdr[3] = (XCOPY_BLK2BLK_SEG_DESC_SIZE - 4 /* SEG_DESC_SRC_INDEX_OFFSET */) & 0xFF;
+    hdr[4] = (src_index >> 8) & 0xFF;
+    hdr[5] = src_index & 0xFF;
+    hdr[6] = (dst_index >> 8) & 0xFF;
+    hdr[7] = dst_index & 0xFF;
+}
+
+static void iscsi_xcopy_populate_desc(uint8_t *desc, int dc, int cat,
+                                      int src_index, int dst_index, int num_blks,
+                                      uint64_t src_lba, uint64_t dst_lba)
+{
+    iscsi_xcopy_desc_hdr(desc, dc, cat, src_index, dst_index);
+
+    /* The caller should verify the request size */
+    assert(num_blks < 65536);
+    desc[10] = (num_blks >> 8) & 0xFF;
+    desc[11] = num_blks & 0xFF;
+    desc[12] = (src_lba >> 56) & 0xFF;
+    desc[13] = (src_lba >> 48) & 0xFF;
+    desc[14] = (src_lba >> 40) & 0xFF;
+    desc[15] = (src_lba >> 32) & 0xFF;
+    desc[16] = (src_lba >> 24) & 0xFF;
+    desc[17] = (src_lba >> 16) & 0xFF;
+    desc[18] = (src_lba >> 8) & 0xFF;
+    desc[19] = src_lba & 0xFF;
+    desc[20] = (dst_lba >> 56) & 0xFF;
+    desc[21] = (dst_lba >> 48) & 0xFF;
+    desc[22] = (dst_lba >> 40) & 0xFF;
+    desc[23] = (dst_lba >> 32) & 0xFF;
+    desc[24] = (dst_lba >> 24) & 0xFF;
+    desc[25] = (dst_lba >> 16) & 0xFF;
+    desc[26] = (dst_lba >> 8) & 0xFF;
+    desc[27] = dst_lba & 0xFF;
+}
+
+static void iscsi_xcopy_populate_header(unsigned char *buf, int list_id, int str,
+                                        int list_id_usage, int prio,
+                                        int tgt_desc_len,
+                                        int seg_desc_len, int inline_data_len)
+{
+    buf[0] = list_id;
+    buf[1] = ((str & 1) << 5) | ((list_id_usage & 3) << 3) | (prio & 7);
+    buf[2] = (tgt_desc_len >> 8) & 0xFF;
+    buf[3] = tgt_desc_len & 0xFF;
+    buf[8] = (seg_desc_len >> 24) & 0xFF;
+    buf[9] = (seg_desc_len >> 16) & 0xFF;
+    buf[10] = (seg_desc_len >> 8) & 0xFF;
+    buf[11] = seg_desc_len & 0xFF;
+    buf[12] = (inline_data_len >> 24) & 0xFF;
+    buf[13] = (inline_data_len >> 16) & 0xFF;
+    buf[14] = (inline_data_len >> 8) & 0xFF;
+    buf[15] = inline_data_len & 0xFF;
+}
+
+static void iscsi_xcopy_data(struct iscsi_data *data,
+                             IscsiLun *src, int64_t src_lba,
+                             IscsiLun *dst, int64_t dst_lba,
+                             uint16_t num_blocks)
+{
+    uint8_t *buf;
+    const int src_offset = XCOPY_DESC_OFFSET;
+    const int dst_offset = XCOPY_DESC_OFFSET + IDENT_DESCR_TGT_DESCR_SIZE;
+    const int seg_offset = dst_offset + IDENT_DESCR_TGT_DESCR_SIZE;
+
+    data->size = XCOPY_DESC_OFFSET +
+                 IDENT_DESCR_TGT_DESCR_SIZE * 2 +
+                 XCOPY_BLK2BLK_SEG_DESC_SIZE;
+    data->data = g_malloc0(data->size);
+    buf = data->data;
+
+    /* Initialise the parameter list header */
+    iscsi_xcopy_populate_header(buf, 1, 0, 2 /* LIST_ID_USAGE_DISCARD */,
+                                0, 2 * IDENT_DESCR_TGT_DESCR_SIZE,
+                                XCOPY_BLK2BLK_SEG_DESC_SIZE,
+                                0);
+
+    /* Initialise CSCD list with one src + one dst descriptor */
+    iscsi_populate_target_desc(&buf[src_offset], src);
+    iscsi_populate_target_desc(&buf[dst_offset], dst);
+
+    /* Initialise one segment descriptor */
+    iscsi_xcopy_populate_desc(&buf[seg_offset], 0, 0, 0, 1, num_blocks,
+                              src_lba, dst_lba);
+}
+
+static int coroutine_fn iscsi_co_copy_range_to(BlockDriverState *bs,
+                                               BdrvChild *src,
+                                               uint64_t src_offset,
+                                               BdrvChild *dst,
+                                               uint64_t dst_offset,
+                                               uint64_t bytes,
+                                               BdrvRequestFlags flags)
+{
+    IscsiLun *dst_lun = dst->bs->opaque;
+    IscsiLun *src_lun;
+    struct IscsiTask iscsi_task;
+    struct iscsi_data data;
+    int r = 0;
+    int block_size;
+
+    if (src->bs->drv->bdrv_co_copy_range_to != iscsi_co_copy_range_to) {
+        return -ENOTSUP;
+    }
+    src_lun = src->bs->opaque;
+
+    if (!src_lun->dd || !dst_lun->dd) {
+        return -ENOTSUP;
+    }
+    if (!is_byte_request_lun_aligned(dst_offset, bytes, dst_lun)) {
+        return -ENOTSUP;
+    }
+    if (!is_byte_request_lun_aligned(src_offset, bytes, src_lun)) {
+        return -ENOTSUP;
+    }
+    if (dst_lun->block_size != src_lun->block_size ||
+        !dst_lun->block_size) {
+        return -ENOTSUP;
+    }
+
+    block_size = dst_lun->block_size;
+    if (bytes / block_size > 65535) {
+        return -ENOTSUP;
+    }
+
+    iscsi_xcopy_data(&data,
+                     src_lun, src_offset / block_size,
+                     dst_lun, dst_offset / block_size,
+                     bytes / block_size);
+
+    iscsi_co_init_iscsitask(dst_lun, &iscsi_task);
+
+    qemu_mutex_lock(&dst_lun->mutex);
+    iscsi_task.task = iscsi_xcopy_task(data.size);
+retry:
+    if (iscsi_scsi_command_async(dst_lun->iscsi, dst_lun->lun,
+                                 iscsi_task.task, iscsi_co_generic_cb,
+                                 &data,
+                                 &iscsi_task) != 0) {
+        r = -EIO;
+        goto out_unlock;
+    }
+
+    iscsi_co_wait_for_task(&iscsi_task, dst_lun);
+
+    if (iscsi_task.do_retry) {
+        iscsi_task.complete = 0;
+        goto retry;
+    }
+
+    if (iscsi_task.status != SCSI_STATUS_GOOD) {
+        r = iscsi_task.err_code;
+        goto out_unlock;
+    }
+
+out_unlock:
+    g_free(iscsi_task.task);
+    qemu_mutex_unlock(&dst_lun->mutex);
+    g_free(iscsi_task.err_str);
+    return r;
+}
+
 static QemuOptsList iscsi_create_opts = {
     .name = "iscsi-create-opts",
     .head = QTAILQ_HEAD_INITIALIZER(iscsi_create_opts.head),
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_iscsi = {
 
     .bdrv_co_block_status  = iscsi_co_block_status,
     .bdrv_co_pdiscard      = iscsi_co_pdiscard,
+    .bdrv_co_copy_range_from = iscsi_co_copy_range_from,
+    .bdrv_co_copy_range_to  = iscsi_co_copy_range_to,
     .bdrv_co_pwrite_zeroes = iscsi_co_pwrite_zeroes,
     .bdrv_co_readv         = iscsi_co_readv,
     .bdrv_co_writev        = iscsi_co_writev,
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_iser = {
 
     .bdrv_co_block_status  = iscsi_co_block_status,
     .bdrv_co_pdiscard      = iscsi_co_pdiscard,
+    .bdrv_co_copy_range_from = iscsi_co_copy_range_from,
+    .bdrv_co_copy_range_to  = iscsi_co_copy_range_to,
     .bdrv_co_pwrite_zeroes = iscsi_co_pwrite_zeroes,
     .bdrv_co_readv         = iscsi_co_readv,
     .bdrv_co_writev        = iscsi_co_writev,
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

It's a BlockBackend wrapper of the BDS interface.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180601092648.24614-10-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/sysemu/block-backend.h |  4 ++++
 block/block-backend.c          | 18 ++++++++++++++++++
 2 files changed, 22 insertions(+)

diff --git a/include/sysemu/block-backend.h b/include/sysemu/block-backend.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/block-backend.h
+++ b/include/sysemu/block-backend.h
@@ -XXX,XX +XXX,XX @@ void blk_set_force_allow_inactivate(BlockBackend *blk);
 void blk_register_buf(BlockBackend *blk, void *host, size_t size);
 void blk_unregister_buf(BlockBackend *blk, void *host);
 
+int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
+                                   BlockBackend *blk_out, int64_t off_out,
+                                   int bytes, BdrvRequestFlags flags);
+
 #endif
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ void blk_unregister_buf(BlockBackend *blk, void *host)
 {
     bdrv_unregister_buf(blk_bs(blk), host);
 }
+
+int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
+                                   BlockBackend *blk_out, int64_t off_out,
+                                   int bytes, BdrvRequestFlags flags)
+{
+    int r;
+    r = blk_check_byte_request(blk_in, off_in, bytes);
+    if (r) {
+        return r;
+    }
+    r = blk_check_byte_request(blk_out, off_out, bytes);
+    if (r) {
+        return r;
+    }
+    return bdrv_co_copy_range(blk_in->root, off_in,
+                              blk_out->root, off_out,
+                              bytes, flags);
+}
-- 
2.17.1

From: Fam Zheng <famz@redhat.com>

The new blk_co_copy_range interface offers a more efficient way in the
case of network based storage. Make use of it to allow faster convert
operation.

Since copy offloading cannot do zero detection ('-S') and compression
(-c), only try it when these options are not used.

Signed-off-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20180601092648.24614-11-famz@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qemu-img.c | 50 ++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 48 insertions(+), 2 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ typedef struct ImgConvertState {
     bool compressed;
     bool target_has_backing;
     bool wr_in_order;
+    bool copy_range;
     int min_sparse;
     size_t cluster_sectors;
     size_t buf_sectors;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_write(ImgConvertState *s, int64_t sector_num,
     return 0;
 }
 
+static int coroutine_fn convert_co_copy_range(ImgConvertState *s, int64_t sector_num,
+                                              int nb_sectors)
+{
+    int n, ret;
+
+    while (nb_sectors > 0) {
+        BlockBackend *blk;
+        int src_cur;
+        int64_t bs_sectors, src_cur_offset;
+        int64_t offset;
+
+        convert_select_part(s, sector_num, &src_cur, &src_cur_offset);
+        offset = (sector_num - src_cur_offset) << BDRV_SECTOR_BITS;
+        blk = s->src[src_cur];
+        bs_sectors = s->src_sectors[src_cur];
+
+        n = MIN(nb_sectors, bs_sectors - (sector_num - src_cur_offset));
+
+        ret = blk_co_copy_range(blk, offset, s->target,
+                                sector_num << BDRV_SECTOR_BITS,
+                                n << BDRV_SECTOR_BITS, 0);
+        if (ret < 0) {
+            return ret;
+        }
+
+        sector_num += n;
+        nb_sectors -= n;
+    }
+    return 0;
+}
+
 static void coroutine_fn convert_co_do_copy(void *opaque)
 {
     ImgConvertState *s = opaque;
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn convert_co_do_copy(void *opaque)
         int n;
         int64_t sector_num;
         enum ImgConvertBlockStatus status;
+        bool copy_range;
 
         qemu_co_mutex_lock(&s->lock);
         if (s->ret != -EINPROGRESS || s->sector_num >= s->total_sectors) {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn convert_co_do_copy(void *opaque)
                                         s->allocated_sectors, 0);
         }
 
-        if (status == BLK_DATA) {
+retry:
+        copy_range = s->copy_range && s->status == BLK_DATA;
+        if (status == BLK_DATA && !copy_range) {
             ret = convert_co_read(s, sector_num, n, buf);
             if (ret < 0) {
                 error_report("error while reading sector %" PRId64
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn convert_co_do_copy(void *opaque)
         }
 
         if (s->ret == -EINPROGRESS) {
-            ret = convert_co_write(s, sector_num, n, buf, status);
+            if (copy_range) {
+                ret = convert_co_copy_range(s, sector_num, n);
+                if (ret) {
+                    s->copy_range = false;
+                    goto retry;
+                }
+            } else {
+                ret = convert_co_write(s, sector_num, n, buf, status);
+            }
             if (ret < 0) {
                 error_report("error while writing sector %" PRId64
                              ": %s", sector_num, strerror(-ret));
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
     ImgConvertState s = (ImgConvertState) {
         /* Need at least 4k of zeros for sparse detection */
         .min_sparse         = 8,
+        .copy_range         = true,
         .buf_sectors        = IO_BUF_SIZE / BDRV_SECTOR_SIZE,
         .wr_in_order        = true,
         .num_coroutines     = 8,
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
             break;
         case 'c':
             s.compressed = true;
+            s.copy_range = false;
             break;
         case 'o':
             if (!is_valid_option_list(optarg)) {
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
             }
 
             s.min_sparse = sval / BDRV_SECTOR_SIZE;
+            s.copy_range = false;
             break;
         }
         case 'p':
-- 
2.17.1

Commit d759c951f3287fad04210a52f2dc93f94cf58c7f ("replay: push
replay_mutex_lock up the call tree") removed the !timeout lock
optimization in the main loop.

The idea of the optimization was to avoid ping-pongs between threads by
keeping the Big QEMU Lock held across non-blocking (!timeout) main loop
iterations.

A warning is printed when the main loop spins without releasing BQL for
long periods of time.  These warnings were supposed to aid debugging but
in practice they just alarm users.  They are considered noise because
the cause of spinning is not shown and is hard to find.

Now that the lock optimization has been removed, there is no danger of
hogging the BQL.  Drop the spin counter and the infamous warning.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
---
 util/main-loop.c                 | 25 -------------------------
 tests/qemu-iotests/common.filter |  1 -
 2 files changed, 26 deletions(-)

diff --git a/util/main-loop.c b/util/main-loop.c
index XXXXXXX..XXXXXXX 100644
--- a/util/main-loop.c
+++ b/util/main-loop.c
@@ -XXX,XX +XXX,XX @@ static int os_host_main_loop_wait(int64_t timeout)
 {
     GMainContext *context = g_main_context_default();
     int ret;
-    static int spin_counter;
 
     g_main_context_acquire(context);
 
     glib_pollfds_fill(&timeout);
 
-    /* If the I/O thread is very busy or we are incorrectly busy waiting in
-     * the I/O thread, this can lead to starvation of the BQL such that the
-     * VCPU threads never run.  To make sure we can detect the later case,
-     * print a message to the screen.  If we run into this condition, create
-     * a fake timeout in order to give the VCPU threads a chance to run.
-     */
-    if (!timeout && (spin_counter > MAX_MAIN_LOOP_SPIN)) {
-        static bool notified;
-
-        if (!notified && !qtest_enabled() && !qtest_driver()) {
-            warn_report("I/O thread spun for %d iterations",
-                        MAX_MAIN_LOOP_SPIN);
-            notified = true;
-        }
-
-        timeout = SCALE_MS;
-    }
-
-
-    if (timeout) {
-        spin_counter = 0;
-    } else {
-        spin_counter++;
-    }
     qemu_mutex_unlock_iothread();
     replay_mutex_unlock();
 
diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -XXX,XX +XXX,XX @@ _filter_qemu()
 {
     sed -e "s#\$^\\|(qemu) \$$(basename $QEMU_PROG):#\1QEMU_PROG:#" \
         -e 's#^QEMU [0-9]\+\.[0-9]\+\.[0-9]\+ monitor#QEMU X.Y.Z monitor#' \
-        -e '/main-loop: WARNING: I\/O thread spun for [0-9]\+ iterations/d' \
         -e $'s#\r##' # QEMU monitor uses \r\n line endings
 }
 
-- 
2.17.1

The following changes since commit 8bac3ba57eecc466b7e73dabf7d19328a59f684e:

Merge remote-tracking branch 'remotes/rth/tags/pull-rx-20200408' into staging (2020-04-09 13:23:30 +0100)

are available in the Git repository at:

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 5710a3e09f9b85801e5ce70797a4a511e5fc9e2c:

async: use explicit memory barriers (2020-04-09 16:17:14 +0100)

----------------------------------------------------------------
Pull request

Fixes for QEMU on aarch64 ARM hosts and fdmon-io_uring.

----------------------------------------------------------------

Paolo Bonzini (2):
  aio-wait: delegate polling of main AioContext if BQL not held
  async: use explicit memory barriers

Stefan Hajnoczi (1):
  aio-posix: signal-proof fdmon-io_uring

include/block/aio-wait.h | 22 ++++++++++++++++++++++
 include/block/aio.h      | 29 ++++++++++-------------------
 util/aio-posix.c         | 16 ++++++++++++++--
 util/aio-win32.c         | 17 ++++++++++++++---
 util/async.c             | 16 ++++++++++++----
 util/fdmon-io_uring.c    | 10 ++++++++--
 6 files changed, 80 insertions(+), 30 deletions(-)

-- 
2.25.1

The io_uring_enter(2) syscall returns with errno=EINTR when interrupted
by a signal.  Retry the syscall in this case.

It's essential to do this in the io_uring_submit_and_wait() case.  My
interpretation of the Linux v5.5 io_uring_enter(2) code is that it
shouldn't affect the io_uring_submit() case, but there is no guarantee
this will always be the case.  Let's check for -EINTR around both APIs.

Note that the liburing APIs have -errno return values.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200408091139.273851-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/fdmon-io_uring.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c
index XXXXXXX..XXXXXXX 100644
--- a/util/fdmon-io_uring.c
+++ b/util/fdmon-io_uring.c
@@ -XXX,XX +XXX,XX @@ static struct io_uring_sqe *get_sqe(AioContext *ctx)
     }
 
     /* No free sqes left, submit pending sqes first */
-    ret = io_uring_submit(ring);
+    do {
+        ret = io_uring_submit(ring);
+    } while (ret == -EINTR);
+
     assert(ret > 1);
     sqe = io_uring_get_sqe(ring);
     assert(sqe);
@@ -XXX,XX +XXX,XX @@ static int fdmon_io_uring_wait(AioContext *ctx, AioHandlerList *ready_list,
 
     fill_sq_ring(ctx);
 
-    ret = io_uring_submit_and_wait(&ctx->fdmon_io_uring, wait_nr);
+    do {
+        ret = io_uring_submit_and_wait(&ctx->fdmon_io_uring, wait_nr);
+    } while (ret == -EINTR);
+
     assert(ret >= 0);
 
     return process_cq_ring(ctx, ready_list);
-- 
2.25.1

From: Paolo Bonzini <pbonzini@redhat.com>

Any thread that is not a iothread returns NULL for qemu_get_current_aio_context().
As a result, it would also return true for
in_aio_context_home_thread(qemu_get_aio_context()), causing
AIO_WAIT_WHILE to invoke aio_poll() directly.  This is incorrect
if the BQL is not held, because aio_poll() does not expect to
run concurrently from multiple threads, and it can actually
happen when savevm writes to the vmstate file from the
migration thread.

Therefore, restrict in_aio_context_home_thread to return true
for the main AioContext only if the BQL is held.

The function is moved to aio-wait.h because it is mostly used
there and to avoid a circular reference between main-loop.h
and block/aio.h.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20200407140746.8041-5-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/block/aio-wait.h | 22 ++++++++++++++++++++++
 include/block/aio.h      | 29 ++++++++++-------------------
 2 files changed, 32 insertions(+), 19 deletions(-)

diff --git a/include/block/aio-wait.h b/include/block/aio-wait.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio-wait.h
+++ b/include/block/aio-wait.h
@@ -XXX,XX +XXX,XX @@
 #define QEMU_AIO_WAIT_H
 
 #include "block/aio.h"
+#include "qemu/main-loop.h"
 
 /**
  * AioWait:
@@ -XXX,XX +XXX,XX @@ void aio_wait_kick(void);
  */
 void aio_wait_bh_oneshot(AioContext *ctx, QEMUBHFunc *cb, void *opaque);
 
+/**
+ * in_aio_context_home_thread:
+ * @ctx: the aio context
+ *
+ * Return whether we are running in the thread that normally runs @ctx.  Note
+ * that acquiring/releasing ctx does not affect the outcome, each AioContext
+ * still only has one home thread that is responsible for running it.
+ */
+static inline bool in_aio_context_home_thread(AioContext *ctx)
+{
+    if (ctx == qemu_get_current_aio_context()) {
+        return true;
+    }
+
+    if (ctx == qemu_get_aio_context()) {
+        return qemu_mutex_iothread_locked();
+    } else {
+        return false;
+    }
+}
+
 #endif /* QEMU_AIO_WAIT_H */
diff --git a/include/block/aio.h b/include/block/aio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/aio.h
+++ b/include/block/aio.h
@@ -XXX,XX +XXX,XX @@ struct AioContext {
     AioHandlerList deleted_aio_handlers;
 
     /* Used to avoid unnecessary event_notifier_set calls in aio_notify;
-     * accessed with atomic primitives.  If this field is 0, everything
-     * (file descriptors, bottom halves, timers) will be re-evaluated
-     * before the next blocking poll(), thus the event_notifier_set call
-     * can be skipped.  If it is non-zero, you may need to wake up a
-     * concurrent aio_poll or the glib main event loop, making
-     * event_notifier_set necessary.
+     * only written from the AioContext home thread, or under the BQL in
+     * the case of the main AioContext.  However, it is read from any
+     * thread so it is still accessed with atomic primitives.
+     *
+     * If this field is 0, everything (file descriptors, bottom halves,
+     * timers) will be re-evaluated before the next blocking poll() or
+     * io_uring wait; therefore, the event_notifier_set call can be
+     * skipped.  If it is non-zero, you may need to wake up a concurrent
+     * aio_poll or the glib main event loop, making event_notifier_set
+     * necessary.
      *
      * Bit 0 is reserved for GSource usage of the AioContext, and is 1
      * between a call to aio_ctx_prepare and the next call to aio_ctx_check.
@@ -XXX,XX +XXX,XX @@ void aio_co_enter(AioContext *ctx, struct Coroutine *co);
  */
 AioContext *qemu_get_current_aio_context(void);
 
-/**
- * in_aio_context_home_thread:
- * @ctx: the aio context
- *
- * Return whether we are running in the thread that normally runs @ctx.  Note
- * that acquiring/releasing ctx does not affect the outcome, each AioContext
- * still only has one home thread that is responsible for running it.
- */
-static inline bool in_aio_context_home_thread(AioContext *ctx)
-{
-    return ctx == qemu_get_current_aio_context();
-}
-
 /**
  * aio_context_setup:
  * @ctx: the aio context
-- 
2.25.1

From: Paolo Bonzini <pbonzini@redhat.com>

When using C11 atomics, non-seqcst reads and writes do not participate
in the total order of seqcst operations.  In util/async.c and util/aio-posix.c,
in particular, the pattern that we use

write ctx->notify_me                 write bh->scheduled
          read bh->scheduled                   read ctx->notify_me
          if !bh->scheduled, sleep             if ctx->notify_me, notify

needs to use seqcst operations for both the write and the read.  In
general this is something that we do not want, because there can be
many sources that are polled in addition to bottom halves.  The
alternative is to place a seqcst memory barrier between the write
and the read.  This also comes with a disadvantage, in that the
memory barrier is implicit on strongly-ordered architectures and
it wastes a few dozen clock cycles.

Fortunately, ctx->notify_me is never written concurrently by two
threads, so we can assert that and relax the writes to ctx->notify_me.
The resulting solution works and performs well on both aarch64 and x86.

Note that the atomic_set/atomic_read combination is not an atomic
read-modify-write, and therefore it is even weaker than C11 ATOMIC_RELAXED;
on x86, ATOMIC_RELAXED compiles to a locked operation.

Analyzed-by: Ying Fang <fangying1@huawei.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Tested-by: Ying Fang <fangying1@huawei.com>
Message-Id: <20200407140746.8041-6-pbonzini@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/aio-posix.c | 16 ++++++++++++++--
 util/aio-win32.c | 17 ++++++++++++++---
 util/async.c     | 16 ++++++++++++----
 3 files changed, 40 insertions(+), 9 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     int64_t timeout;
     int64_t start = 0;
 
+    /*
+     * There cannot be two concurrent aio_poll calls for the same AioContext (or
+     * an aio_poll concurrent with a GSource prepare/check/dispatch callback).
+     * We rely on this below to avoid slow locked accesses to ctx->notify_me.
+     */
     assert(in_aio_context_home_thread(ctx));
 
     /* aio_notify can avoid the expensive event_notifier_set if
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      * so disable the optimization now.
      */
     if (blocking) {
-        atomic_add(&ctx->notify_me, 2);
+        atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
+        /*
+         * Write ctx->notify_me before computing the timeout
+         * (reading bottom half flags, etc.).  Pairs with
+         * smp_mb in aio_notify().
+         */
+        smp_mb();
     }
 
     qemu_lockcnt_inc(&ctx->list_lock);
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     }
 
     if (blocking) {
-        atomic_sub(&ctx->notify_me, 2);
+        /* Finish the poll before clearing the flag.  */
+        atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
         aio_notify_accept(ctx);
     }
 
diff --git a/util/aio-win32.c b/util/aio-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-win32.c
+++ b/util/aio-win32.c
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     int count;
     int timeout;
 
+    /*
+     * There cannot be two concurrent aio_poll calls for the same AioContext (or
+     * an aio_poll concurrent with a GSource prepare/check/dispatch callback).
+     * We rely on this below to avoid slow locked accesses to ctx->notify_me.
+     */
+    assert(in_aio_context_home_thread(ctx));
     progress = false;
 
     /* aio_notify can avoid the expensive event_notifier_set if
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      * so disable the optimization now.
      */
     if (blocking) {
-        atomic_add(&ctx->notify_me, 2);
+        atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
+        /*
+         * Write ctx->notify_me before computing the timeout
+         * (reading bottom half flags, etc.).  Pairs with
+         * smp_mb in aio_notify().
+         */
+        smp_mb();
     }
 
     qemu_lockcnt_inc(&ctx->list_lock);
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         ret = WaitForMultipleObjects(count, events, FALSE, timeout);
         if (blocking) {
             assert(first);
-            assert(in_aio_context_home_thread(ctx));
-            atomic_sub(&ctx->notify_me, 2);
+            atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
             aio_notify_accept(ctx);
         }
 
diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ aio_ctx_prepare(GSource *source, gint    *timeout)
 {
     AioContext *ctx = (AioContext *) source;
 
-    atomic_or(&ctx->notify_me, 1);
+    atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) | 1);
+
+    /*
+     * Write ctx->notify_me before computing the timeout
+     * (reading bottom half flags, etc.).  Pairs with
+     * smp_mb in aio_notify().
+     */
+    smp_mb();
 
     /* We assume there is no timeout already supplied */
     *timeout = qemu_timeout_ns_to_ms(aio_compute_timeout(ctx));
@@ -XXX,XX +XXX,XX @@ aio_ctx_check(GSource *source)
     QEMUBH *bh;
     BHListSlice *s;
 
-    atomic_and(&ctx->notify_me, ~1);
+    /* Finish computing the timeout before clearing the flag.  */
+    atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) & ~1);
     aio_notify_accept(ctx);
 
     QSLIST_FOREACH_RCU(bh, &ctx->bh_list, next) {
@@ -XXX,XX +XXX,XX @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
 void aio_notify(AioContext *ctx)
 {
     /* Write e.g. bh->scheduled before reading ctx->notify_me.  Pairs
-     * with atomic_or in aio_ctx_prepare or atomic_add in aio_poll.
+     * with smp_mb in aio_ctx_prepare or aio_poll.
      */
     smp_mb();
-    if (ctx->notify_me) {
+    if (atomic_read(&ctx->notify_me)) {
         event_notifier_set(&ctx->notifier);
         atomic_mb_set(&ctx->notified, true);
     }
-- 
2.25.1