Series comparison

-[Qemu-devel] [PULL 0/2] Block patches
+[PULL 0/1] Block patches
-The following changes since commit 41feb5b955f0d7c9d071b2c5adbc404ae2895c7a:
+The following changes since commit a3607def89f9cd68c1b994e1030527df33aa91d0:
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-3.0-pull-request' into staging (2018-06-05 10:38:33 +0100)
+  Update version for v6.2.0-rc4 release (2021-12-07 17:51:38 -0800)
-are available in the git repository at:
+are available in the Git repository at:
-  git://github.com/codyprime/qemu-kvm-jtc.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 68acc99f143b60ec4faa2903065b187d4d3c4bf3:
+for you to fetch changes up to cf4fbc3030c974fff726756a7ceef8386cdf500b:
-  sheepdog: remove huge BSS object (2018-06-05 10:15:12 -0400)
+  block/nvme: fix infinite loop in nvme_free_req_queue_cb() (2021-12-09 09:19:49 +0000)
 ----------------------------------------------------------------
-Sheepdog patches
+Pull request
 An infinite loop fix for the userspace NVMe driver.
 ----------------------------------------------------------------
-Paolo Bonzini (2):
+Stefan Hajnoczi (1):
-  sheepdog: cleanup repeated expression
+  block/nvme: fix infinite loop in nvme_free_req_queue_cb()
   sheepdog: remove huge BSS object
- block/sheepdog.c | 28 +++++++++++++++-------------
+ block/nvme.c | 5 +++--
-file changed, 15 insertions(+), 13 deletions(-)
+file changed, 3 insertions(+), 2 deletions(-)
 --
-.13.6
+.33.1

-[Qemu-devel] [PULL 1/2] sheepdog: cleanup repeated expression
+Deleted patch
-From: Paolo Bonzini <pbonzini@redhat.com>
-The expression "SD_INODE_SIZE - sizeof(inode.data_vdi_id)" already has a macro
-defined for the same value (though with a nicer definition using offsetof).
-Replace it.
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Fam Zheng <famz@redhat.com>
-Reviewed-by: Jeff Cody <jcody@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-Id: <20180523160721.14018-2-pbonzini@redhat.com>
-Signed-off-by: Jeff Cody <jcody@redhat.com>
----
- block/sheepdog.c | 6 +++---
-file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/block/sheepdog.c b/block/sheepdog.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
-+++ b/block/sheepdog.c
-@@ -XXX,XX +XXX,XX @@ static int sd_truncate(BlockDriverState *bs, int64_t offset,
-     }
-     /* we don't need to update entire object */
--    datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
-+    datalen = SD_INODE_HEADER_SIZE;
-     s->inode.vdi_size = offset;
-     ret = write_object(fd, s->bs, (char *)&s->inode,
-                        vid_to_vdi_oid(s->inode.vdi_id), s->inode.nr_copies,
-@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
-      */
-     strncpy(s->inode.tag, sn_info->name, sizeof(s->inode.tag));
-     /* we don't need to update entire object */
--    datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
-+    datalen = SD_INODE_HEADER_SIZE;
-     inode = g_malloc(datalen);
-     /* refresh inode. */
-@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
-         /* we don't need to read entire object */
-         ret = read_object(fd, s->bs, (char *)&inode,
-                           vid_to_vdi_oid(vid),
--                          0, SD_INODE_SIZE - sizeof(inode.data_vdi_id), 0,
-+                          0, SD_INODE_HEADER_SIZE, 0,
-                           s->cache_flags);
-         if (ret) {
---
-.13.6

-[Qemu-devel] [PULL 2/2] sheepdog: remove huge BSS object
+[PULL 1/1] block/nvme: fix infinite loop in nvme_free_req_queue_cb()
-From: Paolo Bonzini <pbonzini@redhat.com>
+When the request free list is exhausted the coroutine waits on
 q->free_req_queue for the next free request. Whenever a request is
 completed a BH is scheduled to invoke nvme_free_req_queue_cb() and wake
 up waiting coroutines.
-block/sheepdog.o has a 4M static variable that is 90% of QEMU's whole .bss
+. nvme_get_free_req() waits for a free request:
 section.  Replace it with a heap-allocated block, and make it smaller too
 since only the inode header is actually being used.
-bss size goes down from 4464280 to 269976.
+    while (q->free_req_head == -1) {
         ...
             trace_nvme_free_req_queue_wait(q->s, q->index);
             qemu_co_queue_wait(&q->free_req_queue, &q->lock);
         ...
     }
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+. nvme_free_req_queue_cb() wakes up the coroutine:
-Reviewed-by: Jeff Cody <jcody@redhat.com>
-Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
+    while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
-Message-Id: <20180523160721.14018-3-pbonzini@redhat.com>
+       ^--- infinite loop when free_req_head == -1
-Signed-off-by: Jeff Cody <jcody@redhat.com>
+    }
 nvme_free_req_queue_cb() and the coroutine form an infinite loop when
 q->free_req_head == -1. Fix this by checking q->free_req_head in
 nvme_free_req_queue_cb(). If the free request list is exhausted, don't
 wake waiting coroutines. Eventually an in-flight request will complete
 and the BH will be scheduled again, guaranteeing forward progress.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20211208152246.244585-1-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/sheepdog.c | 22 ++++++++++++----------
+ block/nvme.c | 5 +++--
-file changed, 12 insertions(+), 10 deletions(-)
+file changed, 3 insertions(+), 2 deletions(-)
-diff --git a/block/sheepdog.c b/block/sheepdog.c
+diff --git a/block/nvme.c b/block/nvme.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/sheepdog.c
+--- a/block/nvme.c
-+++ b/block/sheepdog.c
++++ b/block/nvme.c
-@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
+@@ -XXX,XX +XXX,XX @@ static void nvme_free_req_queue_cb(void *opaque)
-     QEMUSnapshotInfo *sn_tab = NULL;
+     NVMeQueuePair *q = opaque;
-     unsigned wlen, rlen;
-     int found = 0;
+     qemu_mutex_lock(&q->lock);
--    static SheepdogInode inode;
+-    while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
-+    SheepdogInode *inode;
+-        /* Retry all pending requests */
-     unsigned long *vdi_inuse;
++    while (q->free_req_head != -1 &&
-     unsigned int start_nr;
++           qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
-     uint64_t hval;
++        /* Retry waiting requests */
      uint32_t vid;
      vdi_inuse = g_malloc(max);
 +    inode = g_malloc(SD_INODE_HEADER_SIZE);
      fd = connect_to_sdog(s, &local_err);
      if (fd < 0) {
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
          }
          /* we don't need to read entire object */
 -        ret = read_object(fd, s->bs, (char *)&inode,
 +        ret = read_object(fd, s->bs, (char *)inode,
                            vid_to_vdi_oid(vid),
 , SD_INODE_HEADER_SIZE, 0,
                            s->cache_flags);
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
              continue;
          }
 -        if (!strcmp(inode.name, s->name) && is_snapshot(&inode)) {
 -            sn_tab[found].date_sec = inode.snap_ctime >> 32;
 -            sn_tab[found].date_nsec = inode.snap_ctime & 0xffffffff;
 -            sn_tab[found].vm_state_size = inode.vm_state_size;
 -            sn_tab[found].vm_clock_nsec = inode.vm_clock_nsec;
 +        if (!strcmp(inode->name, s->name) && is_snapshot(inode)) {
 +            sn_tab[found].date_sec = inode->snap_ctime >> 32;
 +            sn_tab[found].date_nsec = inode->snap_ctime & 0xffffffff;
 +            sn_tab[found].vm_state_size = inode->vm_state_size;
 +            sn_tab[found].vm_clock_nsec = inode->vm_clock_nsec;
              snprintf(sn_tab[found].id_str, sizeof(sn_tab[found].id_str),
 -                     "%" PRIu32, inode.snap_id);
 +                     "%" PRIu32, inode->snap_id);
              pstrcpy(sn_tab[found].name,
 -                    MIN(sizeof(sn_tab[found].name), sizeof(inode.tag)),
 -                    inode.tag);
 +                    MIN(sizeof(sn_tab[found].name), sizeof(inode->tag)),
 +                    inode->tag);
              found++;
          }
      }
-@@ -XXX,XX +XXX,XX @@ out:
+     qemu_mutex_unlock(&q->lock);
-     *psn_tab = sn_tab;
+ }
      g_free(vdi_inuse);
 +    g_free(inode);
      if (ret < 0) {
          return ret;
 --
-.13.6
+.33.1

From: Paolo Bonzini <pbonzini@redhat.com>

The expression "SD_INODE_SIZE - sizeof(inode.data_vdi_id)" already has a macro
defined for the same value (though with a nicer definition using offsetof).
Replace it.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Fam Zheng <famz@redhat.com>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20180523160721.14018-2-pbonzini@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static int sd_truncate(BlockDriverState *bs, int64_t offset,
     }
 
     /* we don't need to update entire object */
-    datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
+    datalen = SD_INODE_HEADER_SIZE;
     s->inode.vdi_size = offset;
     ret = write_object(fd, s->bs, (char *)&s->inode,
                        vid_to_vdi_oid(s->inode.vdi_id), s->inode.nr_copies,
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_create(BlockDriverState *bs, QEMUSnapshotInfo *sn_info)
      */
     strncpy(s->inode.tag, sn_info->name, sizeof(s->inode.tag));
     /* we don't need to update entire object */
-    datalen = SD_INODE_SIZE - sizeof(s->inode.data_vdi_id);
+    datalen = SD_INODE_HEADER_SIZE;
     inode = g_malloc(datalen);
 
     /* refresh inode. */
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
         /* we don't need to read entire object */
         ret = read_object(fd, s->bs, (char *)&inode,
                           vid_to_vdi_oid(vid),
-                          0, SD_INODE_SIZE - sizeof(inode.data_vdi_id), 0,
+                          0, SD_INODE_HEADER_SIZE, 0,
                           s->cache_flags);
 
         if (ret) {
-- 
2.13.6

From: Paolo Bonzini <pbonzini@redhat.com>

block/sheepdog.o has a 4M static variable that is 90% of QEMU's whole .bss
section.  Replace it with a heap-allocated block, and make it smaller too
since only the inode header is actually being used.

bss size goes down from 4464280 to 269976.

Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Jeff Cody <jcody@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Message-Id: <20180523160721.14018-3-pbonzini@redhat.com>
Signed-off-by: Jeff Cody <jcody@redhat.com>
---
 block/sheepdog.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
     QEMUSnapshotInfo *sn_tab = NULL;
     unsigned wlen, rlen;
     int found = 0;
-    static SheepdogInode inode;
+    SheepdogInode *inode;
     unsigned long *vdi_inuse;
     unsigned int start_nr;
     uint64_t hval;
     uint32_t vid;
 
     vdi_inuse = g_malloc(max);
+    inode = g_malloc(SD_INODE_HEADER_SIZE);
 
     fd = connect_to_sdog(s, &local_err);
     if (fd < 0) {
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
         }
 
         /* we don't need to read entire object */
-        ret = read_object(fd, s->bs, (char *)&inode,
+        ret = read_object(fd, s->bs, (char *)inode,
                           vid_to_vdi_oid(vid),
                           0, SD_INODE_HEADER_SIZE, 0,
                           s->cache_flags);
@@ -XXX,XX +XXX,XX @@ static int sd_snapshot_list(BlockDriverState *bs, QEMUSnapshotInfo **psn_tab)
             continue;
         }
 
-        if (!strcmp(inode.name, s->name) && is_snapshot(&inode)) {
-            sn_tab[found].date_sec = inode.snap_ctime >> 32;
-            sn_tab[found].date_nsec = inode.snap_ctime & 0xffffffff;
-            sn_tab[found].vm_state_size = inode.vm_state_size;
-            sn_tab[found].vm_clock_nsec = inode.vm_clock_nsec;
+        if (!strcmp(inode->name, s->name) && is_snapshot(inode)) {
+            sn_tab[found].date_sec = inode->snap_ctime >> 32;
+            sn_tab[found].date_nsec = inode->snap_ctime & 0xffffffff;
+            sn_tab[found].vm_state_size = inode->vm_state_size;
+            sn_tab[found].vm_clock_nsec = inode->vm_clock_nsec;
 
             snprintf(sn_tab[found].id_str, sizeof(sn_tab[found].id_str),
-                     "%" PRIu32, inode.snap_id);
+                     "%" PRIu32, inode->snap_id);
             pstrcpy(sn_tab[found].name,
-                    MIN(sizeof(sn_tab[found].name), sizeof(inode.tag)),
-                    inode.tag);
+                    MIN(sizeof(sn_tab[found].name), sizeof(inode->tag)),
+                    inode->tag);
             found++;
         }
     }
@@ -XXX,XX +XXX,XX @@ out:
     *psn_tab = sn_tab;
 
     g_free(vdi_inuse);
+    g_free(inode);
 
     if (ret < 0) {
         return ret;
-- 
2.13.6

When the request free list is exhausted the coroutine waits on
q->free_req_queue for the next free request. Whenever a request is
completed a BH is scheduled to invoke nvme_free_req_queue_cb() and wake
up waiting coroutines.

1. nvme_get_free_req() waits for a free request:

while (q->free_req_head == -1) {
        ...
            trace_nvme_free_req_queue_wait(q->s, q->index);
            qemu_co_queue_wait(&q->free_req_queue, &q->lock);
        ...
    }

2. nvme_free_req_queue_cb() wakes up the coroutine:

while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
       ^--- infinite loop when free_req_head == -1
    }

nvme_free_req_queue_cb() and the coroutine form an infinite loop when
q->free_req_head == -1. Fix this by checking q->free_req_head in
nvme_free_req_queue_cb(). If the free request list is exhausted, don't
wake waiting coroutines. Eventually an in-flight request will complete
and the BH will be scheduled again, guaranteeing forward progress.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20211208152246.244585-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/nvme.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/nvme.c b/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static void nvme_free_req_queue_cb(void *opaque)
     NVMeQueuePair *q = opaque;
 
     qemu_mutex_lock(&q->lock);
-    while (qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
-        /* Retry all pending requests */
+    while (q->free_req_head != -1 &&
+           qemu_co_enter_next(&q->free_req_queue, &q->lock)) {
+        /* Retry waiting requests */
     }
     qemu_mutex_unlock(&q->lock);
 }
-- 
2.33.1