Series comparison

-[Qemu-devel] [PULL 00/27] Block patches
+[PULL 0/1] Block patches
-The following changes since commit fc3dbb90f2eb069801bfb4cfe9cbc83cf9c5f4a9:
+The following changes since commit 661c2e1ab29cd9c4d268ae3f44712e8d421c0e56:
-  Merge remote-tracking branch 'remotes/jnsnow/tags/bitmaps-pull-request' into staging (2019-02-21 13:09:33 +0000)
+  scripts/checkpatch: Fix a typo (2025-03-04 09:30:26 +0800)
 are available in the Git repository at:
-  git://github.com/stefanha/qemu.git tags/block-pull-request
+  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 9a9f4b74fa547b68edb38fa414999836770a4735:
+for you to fetch changes up to 2ad638a3d160923ef3dbf87c73944e6e44bdc724:
-  tests/virtio-blk: add test for DISCARD command (2019-02-22 09:42:17 +0000)
+  block/qed: fix use-after-free by nullifying timer pointer after free (2025-03-06 10:19:54 +0800)
 ----------------------------------------------------------------
 Pull request
+QED need_check_timer use-after-free fix
 ----------------------------------------------------------------
-Stefano Garzarella (10):
+Denis Rastyogin (1):
-  virtio-blk: add acct_failed param to virtio_blk_handle_rw_error()
+  block/qed: fix use-after-free by nullifying timer pointer after free
   virtio-blk: add host_features field in VirtIOBlock
   virtio-blk: add "discard" and "write-zeroes" properties
   virtio-net: make VirtIOFeature usable for other virtio devices
   virtio-blk: set config size depending on the features enabled
   virtio-blk: add DISCARD and WRITE_ZEROES features
   tests/virtio-blk: change assert on data_size in virtio_blk_request()
   tests/virtio-blk: add virtio_blk_fix_dwz_hdr() function
   tests/virtio-blk: add test for WRITE_ZEROES command
   tests/virtio-blk: add test for DISCARD command
-Vladimir Sementsov-Ogievskiy (17):
+ block/qed.c | 1 +
-  block: enhance QEMUIOVector structure
+file changed, 1 insertion(+)
   block/io: use qemu_iovec_init_buf
   block/block-backend: use QEMU_IOVEC_INIT_BUF
   block/backup: use qemu_iovec_init_buf
   block/commit: use QEMU_IOVEC_INIT_BUF
   block/stream: use QEMU_IOVEC_INIT_BUF
   block/parallels: use QEMU_IOVEC_INIT_BUF
   block/qcow: use qemu_iovec_init_buf
   block/qcow2: use qemu_iovec_init_buf
   block/qed: use qemu_iovec_init_buf
   block/vmdk: use qemu_iovec_init_buf
   qemu-img: use qemu_iovec_init_buf
   migration/block: use qemu_iovec_init_buf
   tests/test-bdrv-drain: use QEMU_IOVEC_INIT_BUF
   hw/ide: drop iov field from IDEState
   hw/ide: drop iov field from IDEBufferedRequest
   hw/ide: drop iov field from IDEDMA
  include/hw/ide/internal.h      |   3 -
  include/hw/virtio/virtio-blk.h |   6 +-
  include/hw/virtio/virtio.h     |  15 ++
  include/qemu/iov.h             |  64 ++++++++-
  block/backup.c                 |   5 +-
  block/block-backend.c          |  13 +-
  block/commit.c                 |   7 +-
  block/io.c                     |  89 +++---------
  block/parallels.c              |  13 +-
  block/qcow.c                   |  21 +--
  block/qcow2.c                  |  12 +-
  block/qed-table.c              |  16 +--
  block/qed.c                    |  31 ++---
  block/stream.c                 |   7 +-
  block/vmdk.c                   |   7 +-
  hw/block/virtio-blk.c          | 245 ++++++++++++++++++++++++++++++---
  hw/core/machine.c              |   2 +
  hw/ide/atapi.c                 |  14 +-
  hw/ide/core.c                  |  19 ++-
  hw/net/virtio-net.c            |  31 +----
  hw/virtio/virtio.c             |  15 ++
  migration/block.c              |  10 +-
  qemu-img.c                     |  10 +-
  tests/test-bdrv-drain.c        |  29 +---
  tests/virtio-blk-test.c        | 127 ++++++++++++++++-
 files changed, 525 insertions(+), 286 deletions(-)
 --
-.20.1
+.48.1

-[Qemu-devel] [PULL 01/27] block: enhance QEMUIOVector structure
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Add a possibility of embedded iovec, for cases when we need only one
-local iov.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20190218140926.333779-2-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-2-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/qemu/iov.h | 64 ++++++++++++++++++++++++++++++++++++++++++++--
-file changed, 62 insertions(+), 2 deletions(-)
-diff --git a/include/qemu/iov.h b/include/qemu/iov.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/qemu/iov.h
-+++ b/include/qemu/iov.h
-@@ -XXX,XX +XXX,XX @@ size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,
- typedef struct QEMUIOVector {
-     struct iovec *iov;
-     int niov;
--    int nalloc;
--    size_t size;
-+
-+    /*
-+     * For external @iov (qemu_iovec_init_external()) or allocated @iov
-+     * (qemu_iovec_init()), @size is the cumulative size of iovecs and
-+     * @local_iov is invalid and unused.
-+     *
-+     * For embedded @iov (QEMU_IOVEC_INIT_BUF() or qemu_iovec_init_buf()),
-+     * @iov is equal to &@local_iov, and @size is valid, as it has same
-+     * offset and type as @local_iov.iov_len, which is guaranteed by
-+     * static assertion below.
-+     *
-+     * @nalloc is always valid and is -1 both for embedded and external
-+     * cases. It is included in the union only to ensure the padding prior
-+     * to the @size field will not result in a 0-length array.
-+     */
-+    union {
-+        struct {
-+            int nalloc;
-+            struct iovec local_iov;
-+        };
-+        struct {
-+            char __pad[sizeof(int) + offsetof(struct iovec, iov_len)];
-+            size_t size;
-+        };
-+    };
- } QEMUIOVector;
-+QEMU_BUILD_BUG_ON(offsetof(QEMUIOVector, size) !=
-+                  offsetof(QEMUIOVector, local_iov.iov_len));
-+
-+#define QEMU_IOVEC_INIT_BUF(self, buf, len)              \
-+{                                                        \
-+    .iov = &(self).local_iov,                            \
-+    .niov = 1,                                           \
-+    .nalloc = -1,                                        \
-+    .local_iov = {                                       \
-+        .iov_base = (void *)(buf), /* cast away const */ \
-+        .iov_len = (len),                                \
-+    },                                                   \
-+}
-+
-+/*
-+ * qemu_iovec_init_buf
-+ *
-+ * Initialize embedded QEMUIOVector.
-+ *
-+ * Note: "const" is used over @buf pointer to make it simple to pass
-+ * const pointers, appearing in read functions. Then this "const" is
-+ * cast away by QEMU_IOVEC_INIT_BUF().
-+ */
-+static inline void qemu_iovec_init_buf(QEMUIOVector *qiov,
-+                                       const void *buf, size_t len)
-+{
-+    *qiov = (QEMUIOVector) QEMU_IOVEC_INIT_BUF(*qiov, buf, len);
-+}
-+
-+static inline void *qemu_iovec_buf(QEMUIOVector *qiov)
-+{
-+    /* Only supports embedded iov */
-+    assert(qiov->nalloc == -1 && qiov->iov == &qiov->local_iov);
-+
-+    return qiov->local_iov.iov_base;
-+}
-+
- void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint);
- void qemu_iovec_init_external(QEMUIOVector *qiov, struct iovec *iov, int niov);
- void qemu_iovec_add(QEMUIOVector *qiov, void *base, size_t len);
---
-.20.1

-[Qemu-devel] [PULL 02/27] block/io: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-While being here, use qemu_try_blockalign0 as well.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-3-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-3-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/io.c | 89 ++++++++++++------------------------------------------
-file changed, 20 insertions(+), 69 deletions(-)
-diff --git a/block/io.c b/block/io.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
- static int bdrv_rw_co(BdrvChild *child, int64_t sector_num, uint8_t *buf,
-                       int nb_sectors, bool is_write, BdrvRequestFlags flags)
- {
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = (void *)buf,
--        .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf,
-+                                            nb_sectors * BDRV_SECTOR_SIZE);
-     if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
-         return -EINVAL;
-     }
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     return bdrv_prwv_co(child, sector_num << BDRV_SECTOR_BITS,
-                         &qiov, is_write, flags);
- }
-@@ -XXX,XX +XXX,XX @@ int bdrv_write(BdrvChild *child, int64_t sector_num,
- int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
-                        int bytes, BdrvRequestFlags flags)
- {
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = NULL,
--        .iov_len = bytes,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     return bdrv_prwv_co(child, offset, &qiov, true,
-                         BDRV_REQ_ZERO_WRITE | flags);
- }
-@@ -XXX,XX +XXX,XX @@ int bdrv_preadv(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
- int bdrv_pread(BdrvChild *child, int64_t offset, void *buf, int bytes)
- {
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = (void *)buf,
--        .iov_len = bytes,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-     if (bytes < 0) {
-         return -EINVAL;
-     }
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     return bdrv_preadv(child, offset, &qiov);
- }
-@@ -XXX,XX +XXX,XX @@ int bdrv_pwritev(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
- int bdrv_pwrite(BdrvChild *child, int64_t offset, const void *buf, int bytes)
- {
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base   = (void *) buf,
--        .iov_len    = bytes,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-     if (bytes < 0) {
-         return -EINVAL;
-     }
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     return bdrv_pwritev(child, offset, &qiov);
- }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
-     void *bounce_buffer;
-     BlockDriver *drv = bs->drv;
--    struct iovec iov;
-     QEMUIOVector local_qiov;
-     int64_t cluster_offset;
-     int64_t cluster_bytes;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
-         if (ret <= 0) {
-             /* Must copy-on-read; use the bounce buffer */
--            iov.iov_base = bounce_buffer;
--            iov.iov_len = pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
--            qemu_iovec_init_external(&local_qiov, &iov, 1);
-+            pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
-+            qemu_iovec_init_buf(&local_qiov, bounce_buffer, pnum);
-             ret = bdrv_driver_preadv(bs, cluster_offset, pnum,
-                                      &local_qiov, 0);
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
- {
-     BlockDriver *drv = bs->drv;
-     QEMUIOVector qiov;
--    struct iovec iov = {0};
-+    void *buf = NULL;
-     int ret = 0;
-     bool need_flush = false;
-     int head = 0;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-                 need_flush = true;
-             }
-             num = MIN(num, max_transfer);
--            iov.iov_len = num;
--            if (iov.iov_base == NULL) {
--                iov.iov_base = qemu_try_blockalign(bs, num);
--                if (iov.iov_base == NULL) {
-+            if (buf == NULL) {
-+                buf = qemu_try_blockalign0(bs, num);
-+                if (buf == NULL) {
-                     ret = -ENOMEM;
-                     goto fail;
-                 }
--                memset(iov.iov_base, 0, num);
-             }
--            qemu_iovec_init_external(&qiov, &iov, 1);
-+            qemu_iovec_init_buf(&qiov, buf, num);
-             ret = bdrv_driver_pwritev(bs, offset, num, &qiov, write_flags);
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-              * all future requests.
-              */
-             if (num < max_transfer) {
--                qemu_vfree(iov.iov_base);
--                iov.iov_base = NULL;
-+                qemu_vfree(buf);
-+                buf = NULL;
-             }
-         }
-@@ -XXX,XX +XXX,XX @@ fail:
-     if (ret == 0 && need_flush) {
-         ret = bdrv_co_flush(bs);
-     }
--    qemu_vfree(iov.iov_base);
-+    qemu_vfree(buf);
-     return ret;
- }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
-     BlockDriverState *bs = child->bs;
-     uint8_t *buf = NULL;
-     QEMUIOVector local_qiov;
--    struct iovec iov;
-     uint64_t align = bs->bl.request_alignment;
-     unsigned int head_padding_bytes, tail_padding_bytes;
-     int ret = 0;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
-     assert(flags & BDRV_REQ_ZERO_WRITE);
-     if (head_padding_bytes || tail_padding_bytes) {
-         buf = qemu_blockalign(bs, align);
--        iov = (struct iovec) {
--            .iov_base   = buf,
--            .iov_len    = align,
--        };
--        qemu_iovec_init_external(&local_qiov, &iov, 1);
-+        qemu_iovec_init_buf(&local_qiov, buf, align);
-     }
-     if (head_padding_bytes) {
-         uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
-@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
-     if (offset & (align - 1)) {
-         QEMUIOVector head_qiov;
--        struct iovec head_iov;
-         mark_request_serialising(&req, align);
-         wait_serialising_requests(&req);
-         head_buf = qemu_blockalign(bs, align);
--        head_iov = (struct iovec) {
--            .iov_base   = head_buf,
--            .iov_len    = align,
--        };
--        qemu_iovec_init_external(&head_qiov, &head_iov, 1);
-+        qemu_iovec_init_buf(&head_qiov, head_buf, align);
-         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
-         ret = bdrv_aligned_preadv(child, &req, offset & ~(align - 1), align,
-@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
-     if ((offset + bytes) & (align - 1)) {
-         QEMUIOVector tail_qiov;
--        struct iovec tail_iov;
-         size_t tail_bytes;
-         bool waited;
-@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
-         assert(!waited || !use_local_qiov);
-         tail_buf = qemu_blockalign(bs, align);
--        tail_iov = (struct iovec) {
--            .iov_base   = tail_buf,
--            .iov_len    = align,
--        };
--        qemu_iovec_init_external(&tail_qiov, &tail_iov, 1);
-+        qemu_iovec_init_buf(&tail_qiov, tail_buf, align);
-         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
-         ret = bdrv_aligned_preadv(child, &req, (offset + bytes) & ~(align - 1),
-@@ -XXX,XX +XXX,XX @@ bdrv_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
- int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
-                       int64_t pos, int size)
- {
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base   = (void *) buf,
--        .iov_len    = size,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
-     int ret;
--    qemu_iovec_init_external(&qiov, &iov, 1);
--
-     ret = bdrv_writev_vmstate(bs, &qiov, pos);
-     if (ret < 0) {
-         return ret;
-@@ -XXX,XX +XXX,XX @@ int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
- int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
-                       int64_t pos, int size)
- {
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base   = buf,
--        .iov_len    = size,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
-     int ret;
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     ret = bdrv_readv_vmstate(bs, &qiov, pos);
-     if (ret < 0) {
-         return ret;
---
-.20.1

-[Qemu-devel] [PULL 03/27] block/block-backend: use QEMU_IOVEC_INIT_BUF
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new QEMU_IOVEC_INIT_BUF() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-4-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-4-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/block-backend.c | 13 ++-----------
-file changed, 2 insertions(+), 11 deletions(-)
-diff --git a/block/block-backend.c b/block/block-backend.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/block-backend.c
-+++ b/block/block-backend.c
-@@ -XXX,XX +XXX,XX @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
-                    int64_t bytes, CoroutineEntry co_entry,
-                    BdrvRequestFlags flags)
- {
--    QEMUIOVector qiov;
--    struct iovec iov;
--    BlkRwCo rwco;
--
--    iov = (struct iovec) {
--        .iov_base = buf,
--        .iov_len = bytes,
--    };
--    qemu_iovec_init_external(&qiov, &iov, 1);
--
--    rwco = (BlkRwCo) {
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-+    BlkRwCo rwco = {
-         .blk    = blk,
-         .offset = offset,
-         .iobuf  = &qiov,
---
-.20.1

-[Qemu-devel] [PULL 04/27] block/backup: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-5-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-5-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/backup.c | 5 +----
-file changed, 1 insertion(+), 4 deletions(-)
-diff --git a/block/backup.c b/block/backup.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/backup.c
-+++ b/block/backup.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
-                                                       void **bounce_buffer)
- {
-     int ret;
--    struct iovec iov;
-     QEMUIOVector qiov;
-     BlockBackend *blk = job->common.blk;
-     int nbytes;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
-     if (!*bounce_buffer) {
-         *bounce_buffer = blk_blockalign(blk, job->cluster_size);
-     }
--    iov.iov_base = *bounce_buffer;
--    iov.iov_len = nbytes;
--    qemu_iovec_init_external(&qiov, &iov, 1);
-+    qemu_iovec_init_buf(&qiov, *bounce_buffer, nbytes);
-     ret = blk_co_preadv(blk, start, qiov.size, &qiov, read_flags);
-     if (ret < 0) {
---
-.20.1

-[Qemu-devel] [PULL 05/27] block/commit: use QEMU_IOVEC_INIT_BUF
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new QEMU_IOVEC_INIT_BUF() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-6-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-6-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/commit.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/block/commit.c b/block/commit.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/commit.c
-+++ b/block/commit.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn commit_populate(BlockBackend *bs, BlockBackend *base,
-                                         void *buf)
- {
-     int ret = 0;
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = buf,
--        .iov_len = bytes,
--    };
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-     assert(bytes < SIZE_MAX);
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     ret = blk_co_preadv(bs, offset, qiov.size, &qiov, 0);
-     if (ret < 0) {
---
-.20.1

-[Qemu-devel] [PULL 06/27] block/stream: use QEMU_IOVEC_INIT_BUF
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new QEMU_IOVEC_INIT_BUF() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-7-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-7-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/stream.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/block/stream.c b/block/stream.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/stream.c
-+++ b/block/stream.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn stream_populate(BlockBackend *blk,
-                                         int64_t offset, uint64_t bytes,
-                                         void *buf)
- {
--    struct iovec iov = {
--        .iov_base = buf,
--        .iov_len  = bytes,
--    };
--    QEMUIOVector qiov;
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
-     assert(bytes < SIZE_MAX);
--    qemu_iovec_init_external(&qiov, &iov, 1);
-     /* Copy-on-read the unallocated clusters */
-     return blk_co_preadv(blk, offset, qiov.size, &qiov, BDRV_REQ_COPY_ON_READ);
---
-.20.1

-[Qemu-devel] [PULL 07/27] block/parallels: use QEMU_IOVEC_INIT_BUF
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new QEMU_IOVEC_INIT_BUF() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-8-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-8-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/parallels.c | 13 +++++--------
-file changed, 5 insertions(+), 8 deletions(-)
-diff --git a/block/parallels.c b/block/parallels.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/parallels.c
-+++ b/block/parallels.c
-@@ -XXX,XX +XXX,XX @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
-     if (bs->backing) {
-         int64_t nb_cow_sectors = to_allocate * s->tracks;
-         int64_t nb_cow_bytes = nb_cow_sectors << BDRV_SECTOR_BITS;
--        QEMUIOVector qiov;
--        struct iovec iov = {
--            .iov_len = nb_cow_bytes,
--            .iov_base = qemu_blockalign(bs, nb_cow_bytes)
--        };
--        qemu_iovec_init_external(&qiov, &iov, 1);
-+        QEMUIOVector qiov =
-+            QEMU_IOVEC_INIT_BUF(qiov, qemu_blockalign(bs, nb_cow_bytes),
-+                                nb_cow_bytes);
-         ret = bdrv_co_preadv(bs->backing, idx * s->tracks * BDRV_SECTOR_SIZE,
-                              nb_cow_bytes, &qiov, 0);
-         if (ret < 0) {
--            qemu_vfree(iov.iov_base);
-+            qemu_vfree(qemu_iovec_buf(&qiov));
-             return ret;
-         }
-         ret = bdrv_co_pwritev(bs->file, s->data_end * BDRV_SECTOR_SIZE,
-                               nb_cow_bytes, &qiov, 0);
--        qemu_vfree(iov.iov_base);
-+        qemu_vfree(qemu_iovec_buf(&qiov));
-         if (ret < 0) {
-             return ret;
-         }
---
-.20.1

-[Qemu-devel] [PULL 08/27] block/qcow: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-9-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-9-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/qcow.c | 21 ++++-----------------
-file changed, 4 insertions(+), 17 deletions(-)
-diff --git a/block/qcow.c b/block/qcow.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qcow.c
-+++ b/block/qcow.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
-     int offset_in_cluster;
-     int ret = 0, n;
-     uint64_t cluster_offset;
--    struct iovec hd_iov;
-     QEMUIOVector hd_qiov;
-     uint8_t *buf;
-     void *orig_buf;
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
-         if (!cluster_offset) {
-             if (bs->backing) {
-                 /* read from the base image */
--                hd_iov.iov_base = (void *)buf;
--                hd_iov.iov_len = n;
--                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-+                qemu_iovec_init_buf(&hd_qiov, buf, n);
-                 qemu_co_mutex_unlock(&s->lock);
-                 /* qcow2 emits this on bs->file instead of bs->backing */
-                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
-                 ret = -EIO;
-                 break;
-             }
--            hd_iov.iov_base = (void *)buf;
--            hd_iov.iov_len = n;
--            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-+            qemu_iovec_init_buf(&hd_qiov, buf, n);
-             qemu_co_mutex_unlock(&s->lock);
-             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-             ret = bdrv_co_preadv(bs->file, cluster_offset + offset_in_cluster,
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
-     int offset_in_cluster;
-     uint64_t cluster_offset;
-     int ret = 0, n;
--    struct iovec hd_iov;
-     QEMUIOVector hd_qiov;
-     uint8_t *buf;
-     void *orig_buf;
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
-             }
-         }
--        hd_iov.iov_base = (void *)buf;
--        hd_iov.iov_len = n;
--        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
-+        qemu_iovec_init_buf(&hd_qiov, buf, n);
-         qemu_co_mutex_unlock(&s->lock);
-         BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
-         ret = bdrv_co_pwritev(bs->file, cluster_offset + offset_in_cluster,
-@@ -XXX,XX +XXX,XX @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
- {
-     BDRVQcowState *s = bs->opaque;
-     QEMUIOVector hd_qiov;
--    struct iovec iov;
-     z_stream strm;
-     int ret, out_len;
-     uint8_t *buf, *out_buf;
-@@ -XXX,XX +XXX,XX @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-     }
-     cluster_offset &= s->cluster_offset_mask;
--    iov = (struct iovec) {
--        .iov_base   = out_buf,
--        .iov_len    = out_len,
--    };
--    qemu_iovec_init_external(&hd_qiov, &iov, 1);
-+    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
-     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
-     ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
-     if (ret < 0) {
---
-.20.1

-[Qemu-devel] [PULL 09/27] block/qcow2: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-10-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-10-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/qcow2.c | 12 ++----------
-file changed, 2 insertions(+), 10 deletions(-)
-diff --git a/block/qcow2.c b/block/qcow2.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qcow2.c
-+++ b/block/qcow2.c
-@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
- {
-     BDRVQcow2State *s = bs->opaque;
-     QEMUIOVector hd_qiov;
--    struct iovec iov;
-     int ret;
-     size_t out_len;
-     uint8_t *buf, *out_buf;
-@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
-         goto fail;
-     }
--    iov = (struct iovec) {
--        .iov_base   = out_buf,
--        .iov_len    = out_len,
--    };
--    qemu_iovec_init_external(&hd_qiov, &iov, 1);
-+    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
-     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
-     ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
-@@ -XXX,XX +XXX,XX @@ qcow2_co_preadv_compressed(BlockDriverState *bs,
-     int ret = 0, csize, nb_csectors;
-     uint64_t coffset;
-     uint8_t *buf, *out_buf;
--    struct iovec iov;
-     QEMUIOVector local_qiov;
-     int offset_in_cluster = offset_into_cluster(s, offset);
-@@ -XXX,XX +XXX,XX @@ qcow2_co_preadv_compressed(BlockDriverState *bs,
-     if (!buf) {
-         return -ENOMEM;
-     }
--    iov.iov_base = buf;
--    iov.iov_len = csize;
--    qemu_iovec_init_external(&local_qiov, &iov, 1);
-+    qemu_iovec_init_buf(&local_qiov, buf, csize);
-     out_buf = qemu_blockalign(bs, s->cluster_size);
---
-.20.1

-[Qemu-devel] [PULL 10/27] block/qed: use qemu_iovec_init_buf
+[PULL 1/1] block/qed: fix use-after-free by nullifying timer pointer after free
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+From: Denis Rastyogin <gerben@altlinux.org>
-Use new qemu_iovec_init_buf() instead of
+This error was discovered by fuzzing qemu-img.
 qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+In the QED block driver, the need_check_timer timer is freed in
-Reviewed-by: Eric Blake <eblake@redhat.com>
+bdrv_qed_detach_aio_context, but the pointer to the timer is not
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+set to NULL. This can lead to a use-after-free scenario
-Message-id: 20190218140926.333779-11-vsementsov@virtuozzo.com
+in bdrv_qed_drain_begin().
-Message-Id: <20190218140926.333779-11-vsementsov@virtuozzo.com>
 The need_check_timer pointer is set to NULL after freeing the timer.
 Which helps catch this condition when checking in bdrv_qed_drain_begin().
 Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
 Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
 Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/qed-table.c | 16 +++-------------
+ block/qed.c | 1 +
- block/qed.c       | 31 +++++++++----------------------
+file changed, 1 insertion(+)
 files changed, 12 insertions(+), 35 deletions(-)
-diff --git a/block/qed-table.c b/block/qed-table.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed-table.c
-+++ b/block/qed-table.c
-@@ -XXX,XX +XXX,XX @@
- /* Called with table_lock held.  */
- static int qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table)
- {
--    QEMUIOVector qiov;
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(
-+        qiov, table->offsets, s->header.cluster_size * s->header.table_size);
-     int noffsets;
-     int i, ret;
--    struct iovec iov = {
--        .iov_base = table->offsets,
--        .iov_len = s->header.cluster_size * s->header.table_size,
--    };
--    qemu_iovec_init_external(&qiov, &iov, 1);
--
-     trace_qed_read_table(s, offset, table);
-     qemu_co_mutex_unlock(&s->table_lock);
-@@ -XXX,XX +XXX,XX @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
-     unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
-     unsigned int start, end, i;
-     QEDTable *new_table;
--    struct iovec iov;
-     QEMUIOVector qiov;
-     size_t len_bytes;
-     int ret;
-@@ -XXX,XX +XXX,XX @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
-     len_bytes = (end - start) * sizeof(uint64_t);
-     new_table = qemu_blockalign(s->bs, len_bytes);
--    iov = (struct iovec) {
--        .iov_base = new_table->offsets,
--        .iov_len = len_bytes,
--    };
--    qemu_iovec_init_external(&qiov, &iov, 1);
-+    qemu_iovec_init_buf(&qiov, new_table->offsets, len_bytes);
-     /* Byteswap table */
-     for (i = start; i < end; i++) {
 diff --git a/block/qed.c b/block/qed.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qed.c
 +++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_write_header(BDRVQEDState *s)
+@@ -XXX,XX +XXX,XX @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
-     int nsectors = DIV_ROUND_UP(sizeof(QEDHeader), BDRV_SECTOR_SIZE);
-     size_t len = nsectors * BDRV_SECTOR_SIZE;
+     qed_cancel_need_check_timer(s);
-     uint8_t *buf;
+     timer_free(s->need_check_timer);
--    struct iovec iov;
++    s->need_check_timer = NULL;
      QEMUIOVector qiov;
      int ret;
      assert(s->allocating_acb || s->allocating_write_reqs_plugged);
      buf = qemu_blockalign(s->bs, len);
 -    iov = (struct iovec) {
 -        .iov_base = buf,
 -        .iov_len = len,
 -    };
 -    qemu_iovec_init_external(&qiov, &iov, 1);
 +    qemu_iovec_init_buf(&qiov, buf, len);
      ret = bdrv_co_preadv(s->bs->file, 0, qiov.size, &qiov, 0);
      if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
  {
      QEMUIOVector qiov;
      QEMUIOVector *backing_qiov = NULL;
 -    struct iovec iov;
      int ret;
      /* Skip copy entirely if there is no work to do */
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
          return 0;
      }
 -    iov = (struct iovec) {
 -        .iov_base = qemu_blockalign(s->bs, len),
 -        .iov_len = len,
 -    };
 -    qemu_iovec_init_external(&qiov, &iov, 1);
 +    qemu_iovec_init_buf(&qiov, qemu_blockalign(s->bs, len), len);
      ret = qed_read_backing_file(s, pos, &qiov, &backing_qiov);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
      }
      ret = 0;
  out:
 -    qemu_vfree(iov.iov_base);
 +    qemu_vfree(qemu_iovec_buf(&qiov));
      return ret;
  }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_pwrite_zeroes(BlockDriverState *bs,
+ static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
                                                    BdrvRequestFlags flags)
  {
      BDRVQEDState *s = bs->opaque;
 -    QEMUIOVector qiov;
 -    struct iovec iov;
 +
 +    /*
 +     * Zero writes start without an I/O buffer.  If a buffer becomes necessary
 +     * then it will be allocated during request processing.
 +     */
 +    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
      /* Fall back if the request is not aligned */
      if (qed_offset_into_cluster(s, offset) ||
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_pwrite_zeroes(BlockDriverState *bs,
          return -ENOTSUP;
      }
 -    /* Zero writes start without an I/O buffer.  If a buffer becomes necessary
 -     * then it will be allocated during request processing.
 -     */
 -    iov.iov_base = NULL;
 -    iov.iov_len = bytes;
 -
 -    qemu_iovec_init_external(&qiov, &iov, 1);
      return qed_co_request(bs, offset >> BDRV_SECTOR_BITS, &qiov,
                            bytes >> BDRV_SECTOR_BITS,
                            QED_AIOCB_WRITE | QED_AIOCB_ZERO);
 --
-.20.1
+.48.1

-[Qemu-devel] [PULL 11/27] block/vmdk: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-12-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-12-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- block/vmdk.c | 7 +------
-file changed, 1 insertion(+), 6 deletions(-)
-diff --git a/block/vmdk.c b/block/vmdk.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/vmdk.c
-+++ b/block/vmdk.c
-@@ -XXX,XX +XXX,XX @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
-     VmdkGrainMarker *data = NULL;
-     uLongf buf_len;
-     QEMUIOVector local_qiov;
--    struct iovec iov;
-     int64_t write_offset;
-     int64_t write_end_sector;
-@@ -XXX,XX +XXX,XX @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
-         data->size = cpu_to_le32(buf_len);
-         n_bytes = buf_len + sizeof(VmdkGrainMarker);
--        iov = (struct iovec) {
--            .iov_base   = data,
--            .iov_len    = n_bytes,
--        };
--        qemu_iovec_init_external(&local_qiov, &iov, 1);
-+        qemu_iovec_init_buf(&local_qiov, data, n_bytes);
-         BLKDBG_EVENT(extent->file, BLKDBG_WRITE_COMPRESSED);
-     } else {
---
-.20.1

-[Qemu-devel] [PULL 12/27] qemu-img: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-13-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-13-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- qemu-img.c | 10 ++--------
-file changed, 2 insertions(+), 8 deletions(-)
-diff --git a/qemu-img.c b/qemu-img.c
-index XXXXXXX..XXXXXXX 100644
---- a/qemu-img.c
-+++ b/qemu-img.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_read(ImgConvertState *s, int64_t sector_num,
- {
-     int n, ret;
-     QEMUIOVector qiov;
--    struct iovec iov;
-     assert(nb_sectors <= s->buf_sectors);
-     while (nb_sectors > 0) {
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_read(ImgConvertState *s, int64_t sector_num,
-         bs_sectors = s->src_sectors[src_cur];
-         n = MIN(nb_sectors, bs_sectors - (sector_num - src_cur_offset));
--        iov.iov_base = buf;
--        iov.iov_len = n << BDRV_SECTOR_BITS;
--        qemu_iovec_init_external(&qiov, &iov, 1);
-+        qemu_iovec_init_buf(&qiov, buf, n << BDRV_SECTOR_BITS);
-         ret = blk_co_preadv(
-                 blk, (sector_num - src_cur_offset) << BDRV_SECTOR_BITS,
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_write(ImgConvertState *s, int64_t sector_num,
- {
-     int ret;
-     QEMUIOVector qiov;
--    struct iovec iov;
-     while (nb_sectors > 0) {
-         int n = nb_sectors;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_write(ImgConvertState *s, int64_t sector_num,
-                 (s->compressed &&
-                  !buffer_is_zero(buf, n * BDRV_SECTOR_SIZE)))
-             {
--                iov.iov_base = buf;
--                iov.iov_len = n << BDRV_SECTOR_BITS;
--                qemu_iovec_init_external(&qiov, &iov, 1);
-+                qemu_iovec_init_buf(&qiov, buf, n << BDRV_SECTOR_BITS);
-                 ret = blk_co_pwritev(s->target, sector_num << BDRV_SECTOR_BITS,
-                                      n << BDRV_SECTOR_BITS, &qiov, flags);
---
-.20.1

-[Qemu-devel] [PULL 13/27] migration/block: use qemu_iovec_init_buf
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new qemu_iovec_init_buf() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-14-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-14-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- migration/block.c | 10 +++-------
-file changed, 3 insertions(+), 7 deletions(-)
-diff --git a/migration/block.c b/migration/block.c
-index XXXXXXX..XXXXXXX 100644
---- a/migration/block.c
-+++ b/migration/block.c
-@@ -XXX,XX +XXX,XX @@ typedef struct BlkMigBlock {
-     BlkMigDevState *bmds;
-     int64_t sector;
-     int nr_sectors;
--    struct iovec iov;
-     QEMUIOVector qiov;
-     BlockAIOCB *aiocb;
-@@ -XXX,XX +XXX,XX @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
-     blk->sector = cur_sector;
-     blk->nr_sectors = nr_sectors;
--    blk->iov.iov_base = blk->buf;
--    blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
--    qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);
-+    qemu_iovec_init_buf(&blk->qiov, blk->buf, nr_sectors * BDRV_SECTOR_SIZE);
-     blk_mig_lock();
-     block_mig_state.submitted++;
-@@ -XXX,XX +XXX,XX @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
-             blk->nr_sectors = nr_sectors;
-             if (is_async) {
--                blk->iov.iov_base = blk->buf;
--                blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
--                qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);
-+                qemu_iovec_init_buf(&blk->qiov, blk->buf,
-+                                    nr_sectors * BDRV_SECTOR_SIZE);
-                 blk->aiocb = blk_aio_preadv(bmds->blk,
-                                             sector * BDRV_SECTOR_SIZE,
---
-.20.1

-[Qemu-devel] [PULL 14/27] tests/test-bdrv-drain: use QEMU_IOVEC_INIT_BUF
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Use new QEMU_IOVEC_INIT_BUF() instead of
-qemu_iovec_init_external( ... , 1), which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-15-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-15-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/test-bdrv-drain.c | 29 ++++-------------------------
-file changed, 4 insertions(+), 25 deletions(-)
-diff --git a/tests/test-bdrv-drain.c b/tests/test-bdrv-drain.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/test-bdrv-drain.c
-+++ b/tests/test-bdrv-drain.c
-@@ -XXX,XX +XXX,XX @@ static void test_drv_cb_common(enum drain_type drain_type, bool recursive)
-     BlockAIOCB *acb;
-     int aio_ret;
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = NULL,
--        .iov_len = 0,
--    };
--    qemu_iovec_init_external(&qiov, &iov, 1);
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
-     blk = blk_new(BLK_PERM_ALL, BLK_PERM_ALL);
-     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
-@@ -XXX,XX +XXX,XX @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
-     AioContext *ctx_a = iothread_get_aio_context(a);
-     AioContext *ctx_b = iothread_get_aio_context(b);
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = NULL,
--        .iov_len = 0,
--    };
--    qemu_iovec_init_external(&qiov, &iov, 1);
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
-     /* bdrv_drain_all() may only be called from the main loop thread */
-     if (drain_type == BDRV_DRAIN_ALL && drain_thread != 0) {
-@@ -XXX,XX +XXX,XX @@ static void coroutine_fn test_co_delete_by_drain(void *opaque)
-     BlockDriverState *bs = blk_bs(blk);
-     BDRVTestTopState *tts = bs->opaque;
-     void *buffer = g_malloc(65536);
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = buffer,
--        .iov_len  = 65536,
--    };
--
--    qemu_iovec_init_external(&qiov, &iov, 1);
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buffer, 65536);
-     /* Pretend some internal write operation from parent to child.
-      * Important: We have to read from the child, not from the parent!
-@@ -XXX,XX +XXX,XX @@ static void test_detach_indirect(bool by_parent_cb)
-     BdrvChild *child_a, *child_b;
-     BlockAIOCB *acb;
--    QEMUIOVector qiov;
--    struct iovec iov = {
--        .iov_base = NULL,
--        .iov_len = 0,
--    };
--    qemu_iovec_init_external(&qiov, &iov, 1);
-+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
-     if (!by_parent_cb) {
-         detach_by_driver_cb_role = child_file;
---
-.20.1

-[Qemu-devel] [PULL 15/27] hw/ide: drop iov field from IDEState
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-@iov is used only to initialize @qiov. Let's use new
-qemu_iovec_init_buf() instead, which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-16-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-16-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/ide/internal.h | 1 -
- hw/ide/atapi.c            | 9 ++++-----
- hw/ide/core.c             | 8 ++------
-files changed, 6 insertions(+), 12 deletions(-)
-diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ide/internal.h
-+++ b/include/hw/ide/internal.h
-@@ -XXX,XX +XXX,XX @@ struct IDEState {
-     int atapi_dma; /* true if dma is requested for the packet cmd */
-     BlockAcctCookie acct;
-     BlockAIOCB *pio_aiocb;
--    struct iovec iov;
-     QEMUIOVector qiov;
-     QLIST_HEAD(, IDEBufferedRequest) buffered_requests;
-     /* ATA DMA state */
-diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ide/atapi.c
-+++ b/hw/ide/atapi.c
-@@ -XXX,XX +XXX,XX @@ static void cd_read_sector_cb(void *opaque, int ret)
- static int cd_read_sector(IDEState *s)
- {
-+    void *buf;
-+
-     if (s->cd_sector_size != 2048 && s->cd_sector_size != 2352) {
-         block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_READ);
-         return -EINVAL;
-     }
--    s->iov.iov_base = (s->cd_sector_size == 2352) ?
--                      s->io_buffer + 16 : s->io_buffer;
--
--    s->iov.iov_len = ATAPI_SECTOR_SIZE;
--    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
-+    buf = (s->cd_sector_size == 2352) ? s->io_buffer + 16 : s->io_buffer;
-+    qemu_iovec_init_buf(&s->qiov, buf, ATAPI_SECTOR_SIZE);
-     trace_cd_read_sector(s->lba);
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -XXX,XX +XXX,XX @@ static void ide_sector_read(IDEState *s)
-         return;
-     }
--    s->iov.iov_base = s->io_buffer;
--    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;
--    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
-+    qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
-     block_acct_start(blk_get_stats(s->blk), &s->acct,
-                      n * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
-@@ -XXX,XX +XXX,XX @@ static void ide_sector_write(IDEState *s)
-         return;
-     }
--    s->iov.iov_base = s->io_buffer;
--    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;
--    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
-+    qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
-     block_acct_start(blk_get_stats(s->blk), &s->acct,
-                      n * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
---
-.20.1

-[Qemu-devel] [PULL 16/27] hw/ide: drop iov field from IDEBufferedRequest
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-@iov is used only to initialize @qiov. Let's use new
-qemu_iovec_init_buf() instead, which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-17-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-17-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/ide/internal.h |  1 -
- hw/ide/core.c             | 11 ++++++-----
-files changed, 6 insertions(+), 6 deletions(-)
-diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ide/internal.h
-+++ b/include/hw/ide/internal.h
-@@ -XXX,XX +XXX,XX @@ extern const char *IDE_DMA_CMD_lookup[IDE_DMA__COUNT];
- typedef struct IDEBufferedRequest {
-     QLIST_ENTRY(IDEBufferedRequest) list;
--    struct iovec iov;
-     QEMUIOVector qiov;
-     QEMUIOVector *original_qiov;
-     BlockCompletionFunc *original_cb;
-diff --git a/hw/ide/core.c b/hw/ide/core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ide/core.c
-+++ b/hw/ide/core.c
-@@ -XXX,XX +XXX,XX @@ static void ide_buffered_readv_cb(void *opaque, int ret)
-     IDEBufferedRequest *req = opaque;
-     if (!req->orphaned) {
-         if (!ret) {
--            qemu_iovec_from_buf(req->original_qiov, 0, req->iov.iov_base,
-+            assert(req->qiov.size == req->original_qiov->size);
-+            qemu_iovec_from_buf(req->original_qiov, 0,
-+                                req->qiov.local_iov.iov_base,
-                                 req->original_qiov->size);
-         }
-         req->original_cb(req->original_opaque, ret);
-     }
-     QLIST_REMOVE(req, list);
--    qemu_vfree(req->iov.iov_base);
-+    qemu_vfree(qemu_iovec_buf(&req->qiov));
-     g_free(req);
- }
-@@ -XXX,XX +XXX,XX @@ BlockAIOCB *ide_buffered_readv(IDEState *s, int64_t sector_num,
-     req->original_qiov = iov;
-     req->original_cb = cb;
-     req->original_opaque = opaque;
--    req->iov.iov_base = qemu_blockalign(blk_bs(s->blk), iov->size);
--    req->iov.iov_len = iov->size;
--    qemu_iovec_init_external(&req->qiov, &req->iov, 1);
-+    qemu_iovec_init_buf(&req->qiov, blk_blockalign(s->blk, iov->size),
-+                        iov->size);
-     aioreq = blk_aio_preadv(s->blk, sector_num << BDRV_SECTOR_BITS,
-                             &req->qiov, 0, ide_buffered_readv_cb, req);
---
-.20.1

-[Qemu-devel] [PULL 17/27] hw/ide: drop iov field from IDEDMA
+Deleted patch
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-@iov is used only to initialize @qiov. Let's use new
-qemu_iovec_init_buf() instead, which simplifies the code.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Reviewed-by: Eric Blake <eblake@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20190218140926.333779-18-vsementsov@virtuozzo.com
-Message-Id: <20190218140926.333779-18-vsementsov@virtuozzo.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/ide/internal.h | 1 -
- hw/ide/atapi.c            | 5 ++---
-files changed, 2 insertions(+), 4 deletions(-)
-diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/ide/internal.h
-+++ b/include/hw/ide/internal.h
-@@ -XXX,XX +XXX,XX @@ struct IDEDMAOps {
- struct IDEDMA {
-     const struct IDEDMAOps *ops;
--    struct iovec iov;
-     QEMUIOVector qiov;
-     BlockAIOCB *aiocb;
- };
-diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/ide/atapi.c
-+++ b/hw/ide/atapi.c
-@@ -XXX,XX +XXX,XX @@ static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
-         data_offset = 0;
-     }
-     trace_ide_atapi_cmd_read_dma_cb_aio(s, s->lba, n);
--    s->bus->dma->iov.iov_base = (void *)(s->io_buffer + data_offset);
--    s->bus->dma->iov.iov_len = n * ATAPI_SECTOR_SIZE;
--    qemu_iovec_init_external(&s->bus->dma->qiov, &s->bus->dma->iov, 1);
-+    qemu_iovec_init_buf(&s->bus->dma->qiov, s->io_buffer + data_offset,
-+                        n * ATAPI_SECTOR_SIZE);
-     s->bus->dma->aiocb = ide_buffered_readv(s, (int64_t)s->lba << 2,
-                                             &s->bus->dma->qiov, n * 4,
---
-.20.1

-[Qemu-devel] [PULL 18/27] virtio-blk: add acct_failed param to virtio_blk_handle_rw_error()
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-We add acct_failed param in order to use virtio_blk_handle_rw_error()
-also when is not required to call block_acct_failed(). (eg. a discard
-operation is failed)
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-2-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-2-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 10 ++++++----
-file changed, 6 insertions(+), 4 deletions(-)
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)
- }
- static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
--    bool is_read)
-+    bool is_read, bool acct_failed)
- {
-     VirtIOBlock *s = req->dev;
-     BlockErrorAction action = blk_get_error_action(s->blk, is_read, error);
-@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
-         s->rq = req;
-     } else if (action == BLOCK_ERROR_ACTION_REPORT) {
-         virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
--        block_acct_failed(blk_get_stats(s->blk), &req->acct);
-+        if (acct_failed) {
-+            block_acct_failed(blk_get_stats(s->blk), &req->acct);
-+        }
-         virtio_blk_free_request(req);
-     }
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_rw_complete(void *opaque, int ret)
-              * the memory until the request is completed (which will
-              * happen on the other side of the migration).
-              */
--            if (virtio_blk_handle_rw_error(req, -ret, is_read)) {
-+            if (virtio_blk_handle_rw_error(req, -ret, is_read, true)) {
-                 continue;
-             }
-         }
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_flush_complete(void *opaque, int ret)
-     aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-     if (ret) {
--        if (virtio_blk_handle_rw_error(req, -ret, 0)) {
-+        if (virtio_blk_handle_rw_error(req, -ret, 0, true)) {
-             goto out;
-         }
-     }
---
-.20.1

-[Qemu-devel] [PULL 19/27] virtio-blk: add host_features field in VirtIOBlock
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-Since configurable features for virtio-blk are growing, this patch
-adds host_features field in the struct VirtIOBlock. (as in virtio-net)
-In this way, we can avoid to add new fields for new properties and
-we can directly set VIRTIO_BLK_F* flags in the host_features.
-We update "config-wce" and "scsi" property definition to use the new
-host_features field without change the behaviour.
-Suggested-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-3-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-3-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/virtio/virtio-blk.h |  3 +--
- hw/block/virtio-blk.c          | 16 +++++++++-------
-files changed, 10 insertions(+), 9 deletions(-)
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -XXX,XX +XXX,XX @@ struct VirtIOBlkConf
-     BlockConf conf;
-     IOThread *iothread;
-     char *serial;
--    uint32_t scsi;
--    uint32_t config_wce;
-     uint32_t request_merging;
-     uint16_t num_queues;
-     uint16_t queue_size;
-@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOBlock {
-     bool dataplane_disabled;
-     bool dataplane_started;
-     struct VirtIOBlockDataPlane *dataplane;
-+    uint64_t host_features;
- } VirtIOBlock;
- typedef struct VirtIOBlockReq {
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_scsi_req(VirtIOBlockReq *req)
-      */
-     scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base;
--    if (!blk->conf.scsi) {
-+    if (!virtio_has_feature(blk->host_features, VIRTIO_BLK_F_SCSI)) {
-         status = VIRTIO_BLK_S_UNSUPP;
-         goto fail;
-     }
-@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,
- {
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
-+    /* Firstly sync all virtio-blk possible supported features */
-+    features |= s->host_features;
-+
-     virtio_add_feature(&features, VIRTIO_BLK_F_SEG_MAX);
-     virtio_add_feature(&features, VIRTIO_BLK_F_GEOMETRY);
-     virtio_add_feature(&features, VIRTIO_BLK_F_TOPOLOGY);
-     virtio_add_feature(&features, VIRTIO_BLK_F_BLK_SIZE);
-     if (virtio_has_feature(features, VIRTIO_F_VERSION_1)) {
--        if (s->conf.scsi) {
-+        if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_SCSI)) {
-             error_setg(errp, "Please set scsi=off for virtio-blk devices in order to use virtio 1.0");
-             return 0;
-         }
-@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,
-         virtio_add_feature(&features, VIRTIO_BLK_F_SCSI);
-     }
--    if (s->conf.config_wce) {
--        virtio_add_feature(&features, VIRTIO_BLK_F_CONFIG_WCE);
--    }
-     if (blk_enable_write_cache(s->blk)) {
-         virtio_add_feature(&features, VIRTIO_BLK_F_WCE);
-     }
-@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
-     DEFINE_BLOCK_ERROR_PROPERTIES(VirtIOBlock, conf.conf),
-     DEFINE_BLOCK_CHS_PROPERTIES(VirtIOBlock, conf.conf),
-     DEFINE_PROP_STRING("serial", VirtIOBlock, conf.serial),
--    DEFINE_PROP_BIT("config-wce", VirtIOBlock, conf.config_wce, 0, true),
-+    DEFINE_PROP_BIT64("config-wce", VirtIOBlock, host_features,
-+                      VIRTIO_BLK_F_CONFIG_WCE, true),
- #ifdef __linux__
--    DEFINE_PROP_BIT("scsi", VirtIOBlock, conf.scsi, 0, false),
-+    DEFINE_PROP_BIT64("scsi", VirtIOBlock, host_features,
-+                      VIRTIO_BLK_F_SCSI, false),
- #endif
-     DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0,
-                     true),
---
-.20.1

-[Qemu-devel] [PULL 20/27] virtio-blk: add "discard" and "write-zeroes" properties
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-In order to avoid migration issues, we enable DISCARD and
-WRITE_ZEROES features only for machine type >= 4.0
-As discussed with Michael S. Tsirkin and Stefan Hajnoczi on the
-list [1], DISCARD operation should not have security implications
-(eg. page cache attacks), so we can enable it by default.
-[1] https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg00504.html
-Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-4-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-4-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- hw/block/virtio-blk.c | 4 ++++
- hw/core/machine.c     | 2 ++
-files changed, 6 insertions(+)
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
-     DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 128),
-     DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD,
-                      IOThread *),
-+    DEFINE_PROP_BIT64("discard", VirtIOBlock, host_features,
-+                      VIRTIO_BLK_F_DISCARD, true),
-+    DEFINE_PROP_BIT64("write-zeroes", VirtIOBlock, host_features,
-+                      VIRTIO_BLK_F_WRITE_ZEROES, true),
-     DEFINE_PROP_END_OF_LIST(),
- };
-diff --git a/hw/core/machine.c b/hw/core/machine.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/core/machine.c
-+++ b/hw/core/machine.c
-@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_3_1[] = {
-     { "usb-kbd", "serial", "42" },
-     { "usb-mouse", "serial", "42" },
-     { "usb-kbd", "serial", "42" },
-+    { "virtio-blk-device", "discard", "false" },
-+    { "virtio-blk-device", "write-zeroes", "false" },
- };
- const size_t hw_compat_3_1_len = G_N_ELEMENTS(hw_compat_3_1);
---
-.20.1

-[Qemu-devel] [PULL 21/27] virtio-net: make VirtIOFeature usable for other virtio devices
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-In order to use VirtIOFeature also in other virtio devices, we move
-its declaration and the endof() macro (renamed in virtio_endof())
-in virtio.h.
-We add virtio_feature_get_config_size() function to iterate the array
-of VirtIOFeature and to return the config size depending on the
-features enabled. (as virtio_net_set_config_size() did)
-Suggested-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-5-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-5-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/virtio/virtio.h | 15 +++++++++++++++
- hw/net/virtio-net.c        | 31 +++++++------------------------
- hw/virtio/virtio.c         | 15 +++++++++++++++
-files changed, 37 insertions(+), 24 deletions(-)
-diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/virtio/virtio.h
-+++ b/include/hw/virtio/virtio.h
-@@ -XXX,XX +XXX,XX @@ static inline hwaddr vring_align(hwaddr addr,
-     return QEMU_ALIGN_UP(addr, align);
- }
-+/*
-+ * Calculate the number of bytes up to and including the given 'field' of
-+ * 'container'.
-+ */
-+#define virtio_endof(container, field) \
-+    (offsetof(container, field) + sizeof_field(container, field))
-+
-+typedef struct VirtIOFeature {
-+    uint64_t flags;
-+    size_t end;
-+} VirtIOFeature;
-+
-+size_t virtio_feature_get_config_size(VirtIOFeature *features,
-+                                      uint64_t host_features);
-+
- typedef struct VirtQueue VirtQueue;
- #define VIRTQUEUE_MAX_SIZE 1024
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static inline __virtio16 *virtio_net_rsc_ext_num_dupacks(
- #endif
--/*
-- * Calculate the number of bytes up to and including the given 'field' of
-- * 'container'.
-- */
--#define endof(container, field) \
--    (offsetof(container, field) + sizeof_field(container, field))
--
--typedef struct VirtIOFeature {
--    uint64_t flags;
--    size_t end;
--} VirtIOFeature;
--
- static VirtIOFeature feature_sizes[] = {
-     {.flags = 1ULL << VIRTIO_NET_F_MAC,
--     .end = endof(struct virtio_net_config, mac)},
-+     .end = virtio_endof(struct virtio_net_config, mac)},
-     {.flags = 1ULL << VIRTIO_NET_F_STATUS,
--     .end = endof(struct virtio_net_config, status)},
-+     .end = virtio_endof(struct virtio_net_config, status)},
-     {.flags = 1ULL << VIRTIO_NET_F_MQ,
--     .end = endof(struct virtio_net_config, max_virtqueue_pairs)},
-+     .end = virtio_endof(struct virtio_net_config, max_virtqueue_pairs)},
-     {.flags = 1ULL << VIRTIO_NET_F_MTU,
--     .end = endof(struct virtio_net_config, mtu)},
-+     .end = virtio_endof(struct virtio_net_config, mtu)},
-     {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
--     .end = endof(struct virtio_net_config, duplex)},
-+     .end = virtio_endof(struct virtio_net_config, duplex)},
-     {}
- };
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_guest_notifier_mask(VirtIODevice *vdev, int idx,
- static void virtio_net_set_config_size(VirtIONet *n, uint64_t host_features)
- {
--    int i, config_size = 0;
-     virtio_add_feature(&host_features, VIRTIO_NET_F_MAC);
--    for (i = 0; feature_sizes[i].flags != 0; i++) {
--        if (host_features & feature_sizes[i].flags) {
--            config_size = MAX(feature_sizes[i].end, config_size);
--        }
--    }
--    n->config_size = config_size;
-+    n->config_size = virtio_feature_get_config_size(feature_sizes,
-+                                                    host_features);
- }
- void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
-diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/virtio/virtio.c
-+++ b/hw/virtio/virtio.c
-@@ -XXX,XX +XXX,XX @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
-     return ret;
- }
-+size_t virtio_feature_get_config_size(VirtIOFeature *feature_sizes,
-+                                      uint64_t host_features)
-+{
-+    size_t config_size = 0;
-+    int i;
-+
-+    for (i = 0; feature_sizes[i].flags != 0; i++) {
-+        if (host_features & feature_sizes[i].flags) {
-+            config_size = MAX(feature_sizes[i].end, config_size);
-+        }
-+    }
-+
-+    return config_size;
-+}
-+
- int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
- {
-     int i, ret;
---
-.20.1

-[Qemu-devel] [PULL 22/27] virtio-blk: set config size depending on the features enabled
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-Starting from DISABLE and WRITE_ZEROES features, we use an array of
-VirtIOFeature (as virtio-net) to properly set the config size
-depending on the features enabled.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-6-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-6-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/virtio/virtio-blk.h |  1 +
- hw/block/virtio-blk.c          | 31 +++++++++++++++++++++++++------
-files changed, 26 insertions(+), 6 deletions(-)
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOBlock {
-     bool dataplane_started;
-     struct VirtIOBlockDataPlane *dataplane;
-     uint64_t host_features;
-+    size_t config_size;
- } VirtIOBlock;
- typedef struct VirtIOBlockReq {
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@
- #include "hw/virtio/virtio-bus.h"
- #include "hw/virtio/virtio-access.h"
--/* We don't support discard yet, hide associated config fields. */
-+/* Config size before the discard support (hide associated config fields) */
- #define VIRTIO_BLK_CFG_SIZE offsetof(struct virtio_blk_config, \
-                                      max_discard_sectors)
-+/*
-+ * Starting from the discard feature, we can use this array to properly
-+ * set the config size depending on the features enabled.
-+ */
-+static VirtIOFeature feature_sizes[] = {
-+    {.flags = 1ULL << VIRTIO_BLK_F_DISCARD,
-+     .end = virtio_endof(struct virtio_blk_config, discard_sector_alignment)},
-+    {.flags = 1ULL << VIRTIO_BLK_F_WRITE_ZEROES,
-+     .end = virtio_endof(struct virtio_blk_config, write_zeroes_may_unmap)},
-+    {}
-+};
-+
-+static void virtio_blk_set_config_size(VirtIOBlock *s, uint64_t host_features)
-+{
-+    s->config_size = MAX(VIRTIO_BLK_CFG_SIZE,
-+        virtio_feature_get_config_size(feature_sizes, host_features));
-+
-+    assert(s->config_size <= sizeof(struct virtio_blk_config));
-+}
- static void virtio_blk_init_request(VirtIOBlock *s, VirtQueue *vq,
-                                     VirtIOBlockReq *req)
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
-     blkcfg.alignment_offset = 0;
-     blkcfg.wce = blk_enable_write_cache(s->blk);
-     virtio_stw_p(vdev, &blkcfg.num_queues, s->conf.num_queues);
--    memcpy(config, &blkcfg, VIRTIO_BLK_CFG_SIZE);
--    QEMU_BUILD_BUG_ON(VIRTIO_BLK_CFG_SIZE > sizeof(blkcfg));
-+    memcpy(config, &blkcfg, s->config_size);
- }
- static void virtio_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
-     VirtIOBlock *s = VIRTIO_BLK(vdev);
-     struct virtio_blk_config blkcfg;
--    memcpy(&blkcfg, config, VIRTIO_BLK_CFG_SIZE);
--    QEMU_BUILD_BUG_ON(VIRTIO_BLK_CFG_SIZE > sizeof(blkcfg));
-+    memcpy(&blkcfg, config, s->config_size);
-     aio_context_acquire(blk_get_aio_context(s->blk));
-     blk_set_enable_write_cache(s->blk, blkcfg.wce != 0);
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-         return;
-     }
--    virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK, VIRTIO_BLK_CFG_SIZE);
-+    virtio_blk_set_config_size(s, s->host_features);
-+
-+    virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK, s->config_size);
-     s->blk = conf->conf.blk;
-     s->rq = NULL;
---
-.20.1

-[Qemu-devel] [PULL 23/27] virtio-blk: add DISCARD and WRITE_ZEROES features
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-This patch adds the support of DISCARD and WRITE_ZEROES commands,
-that have been introduced in the virtio-blk protocol to have
-better performance when using SSD backend.
-We support only one segment per request since multiple segments
-are not widely used and there are no userspace APIs that allow
-applications to submit multiple segments in a single call.
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-7-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-7-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- include/hw/virtio/virtio-blk.h |   2 +
- hw/block/virtio-blk.c          | 184 +++++++++++++++++++++++++++++++++
-files changed, 186 insertions(+)
-diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/virtio/virtio-blk.h
-+++ b/include/hw/virtio/virtio-blk.h
-@@ -XXX,XX +XXX,XX @@ struct VirtIOBlkConf
-     uint32_t request_merging;
-     uint16_t num_queues;
-     uint16_t queue_size;
-+    uint32_t max_discard_sectors;
-+    uint32_t max_write_zeroes_sectors;
- };
- struct VirtIOBlockDataPlane;
-diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/block/virtio-blk.c
-+++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ out:
-     aio_context_release(blk_get_aio_context(s->conf.conf.blk));
- }
-+static void virtio_blk_discard_write_zeroes_complete(void *opaque, int ret)
-+{
-+    VirtIOBlockReq *req = opaque;
-+    VirtIOBlock *s = req->dev;
-+    bool is_write_zeroes = (virtio_ldl_p(VIRTIO_DEVICE(s), &req->out.type) &
-+                            ~VIRTIO_BLK_T_BARRIER) == VIRTIO_BLK_T_WRITE_ZEROES;
-+
-+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
-+    if (ret) {
-+        if (virtio_blk_handle_rw_error(req, -ret, false, is_write_zeroes)) {
-+            goto out;
-+        }
-+    }
-+
-+    virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
-+    if (is_write_zeroes) {
-+        block_acct_done(blk_get_stats(s->blk), &req->acct);
-+    }
-+    virtio_blk_free_request(req);
-+
-+out:
-+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
-+}
-+
- #ifdef __linux__
- typedef struct {
-@@ -XXX,XX +XXX,XX @@ static bool virtio_blk_sect_range_ok(VirtIOBlock *dev,
-     return true;
- }
-+static uint8_t virtio_blk_handle_discard_write_zeroes(VirtIOBlockReq *req,
-+    struct virtio_blk_discard_write_zeroes *dwz_hdr, bool is_write_zeroes)
-+{
-+    VirtIOBlock *s = req->dev;
-+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
-+    uint64_t sector;
-+    uint32_t num_sectors, flags, max_sectors;
-+    uint8_t err_status;
-+    int bytes;
-+
-+    sector = virtio_ldq_p(vdev, &dwz_hdr->sector);
-+    num_sectors = virtio_ldl_p(vdev, &dwz_hdr->num_sectors);
-+    flags = virtio_ldl_p(vdev, &dwz_hdr->flags);
-+    max_sectors = is_write_zeroes ? s->conf.max_write_zeroes_sectors :
-+                  s->conf.max_discard_sectors;
-+
-+    /*
-+     * max_sectors is at most BDRV_REQUEST_MAX_SECTORS, this check
-+     * make us sure that "num_sectors << BDRV_SECTOR_BITS" can fit in
-+     * the integer variable.
-+     */
-+    if (unlikely(num_sectors > max_sectors)) {
-+        err_status = VIRTIO_BLK_S_IOERR;
-+        goto err;
-+    }
-+
-+    bytes = num_sectors << BDRV_SECTOR_BITS;
-+
-+    if (unlikely(!virtio_blk_sect_range_ok(s, sector, bytes))) {
-+        err_status = VIRTIO_BLK_S_IOERR;
-+        goto err;
-+    }
-+
-+    /*
-+     * The device MUST set the status byte to VIRTIO_BLK_S_UNSUPP for discard
-+     * and write zeroes commands if any unknown flag is set.
-+     */
-+    if (unlikely(flags & ~VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP)) {
-+        err_status = VIRTIO_BLK_S_UNSUPP;
-+        goto err;
-+    }
-+
-+    if (is_write_zeroes) { /* VIRTIO_BLK_T_WRITE_ZEROES */
-+        int blk_aio_flags = 0;
-+
-+        if (flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP) {
-+            blk_aio_flags |= BDRV_REQ_MAY_UNMAP;
-+        }
-+
-+        block_acct_start(blk_get_stats(s->blk), &req->acct, bytes,
-+                         BLOCK_ACCT_WRITE);
-+
-+        blk_aio_pwrite_zeroes(s->blk, sector << BDRV_SECTOR_BITS,
-+                              bytes, blk_aio_flags,
-+                              virtio_blk_discard_write_zeroes_complete, req);
-+    } else { /* VIRTIO_BLK_T_DISCARD */
-+        /*
-+         * The device MUST set the status byte to VIRTIO_BLK_S_UNSUPP for
-+         * discard commands if the unmap flag is set.
-+         */
-+        if (unlikely(flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP)) {
-+            err_status = VIRTIO_BLK_S_UNSUPP;
-+            goto err;
-+        }
-+
-+        blk_aio_pdiscard(s->blk, sector << BDRV_SECTOR_BITS, bytes,
-+                         virtio_blk_discard_write_zeroes_complete, req);
-+    }
-+
-+    return VIRTIO_BLK_S_OK;
-+
-+err:
-+    if (is_write_zeroes) {
-+        block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_WRITE);
-+    }
-+    return err_status;
-+}
-+
- static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)
- {
-     uint32_t type;
-@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)
-         virtio_blk_free_request(req);
-         break;
-     }
-+    /*
-+     * VIRTIO_BLK_T_DISCARD and VIRTIO_BLK_T_WRITE_ZEROES are defined with
-+     * VIRTIO_BLK_T_OUT flag set. We masked this flag in the switch statement,
-+     * so we must mask it for these requests, then we will check if it is set.
-+     */
-+    case VIRTIO_BLK_T_DISCARD & ~VIRTIO_BLK_T_OUT:
-+    case VIRTIO_BLK_T_WRITE_ZEROES & ~VIRTIO_BLK_T_OUT:
-+    {
-+        struct virtio_blk_discard_write_zeroes dwz_hdr;
-+        size_t out_len = iov_size(out_iov, out_num);
-+        bool is_write_zeroes = (type & ~VIRTIO_BLK_T_BARRIER) ==
-+                               VIRTIO_BLK_T_WRITE_ZEROES;
-+        uint8_t err_status;
-+
-+        /*
-+         * Unsupported if VIRTIO_BLK_T_OUT is not set or the request contains
-+         * more than one segment.
-+         */
-+        if (unlikely(!(type & VIRTIO_BLK_T_OUT) ||
-+                     out_len > sizeof(dwz_hdr))) {
-+            virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP);
-+            virtio_blk_free_request(req);
-+            return 0;
-+        }
-+
-+        if (unlikely(iov_to_buf(out_iov, out_num, 0, &dwz_hdr,
-+                                sizeof(dwz_hdr)) != sizeof(dwz_hdr))) {
-+            virtio_error(vdev, "virtio-blk discard/write_zeroes header"
-+                         " too short");
-+            return -1;
-+        }
-+
-+        err_status = virtio_blk_handle_discard_write_zeroes(req, &dwz_hdr,
-+                                                            is_write_zeroes);
-+        if (err_status != VIRTIO_BLK_S_OK) {
-+            virtio_blk_req_complete(req, err_status);
-+            virtio_blk_free_request(req);
-+        }
-+
-+        break;
-+    }
-     default:
-         virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP);
-         virtio_blk_free_request(req);
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
-     blkcfg.alignment_offset = 0;
-     blkcfg.wce = blk_enable_write_cache(s->blk);
-     virtio_stw_p(vdev, &blkcfg.num_queues, s->conf.num_queues);
-+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_DISCARD)) {
-+        virtio_stl_p(vdev, &blkcfg.max_discard_sectors,
-+                     s->conf.max_discard_sectors);
-+        virtio_stl_p(vdev, &blkcfg.discard_sector_alignment,
-+                     blk_size >> BDRV_SECTOR_BITS);
-+        /*
-+         * We support only one segment per request since multiple segments
-+         * are not widely used and there are no userspace APIs that allow
-+         * applications to submit multiple segments in a single call.
-+         */
-+        virtio_stl_p(vdev, &blkcfg.max_discard_seg, 1);
-+    }
-+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_WRITE_ZEROES)) {
-+        virtio_stl_p(vdev, &blkcfg.max_write_zeroes_sectors,
-+                     s->conf.max_write_zeroes_sectors);
-+        blkcfg.write_zeroes_may_unmap = 1;
-+        virtio_stl_p(vdev, &blkcfg.max_write_zeroes_seg, 1);
-+    }
-     memcpy(config, &blkcfg, s->config_size);
- }
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-         return;
-     }
-+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_DISCARD) &&
-+        (!conf->max_discard_sectors ||
-+         conf->max_discard_sectors > BDRV_REQUEST_MAX_SECTORS)) {
-+        error_setg(errp, "invalid max-discard-sectors property (%" PRIu32 ")"
-+                   ", must be between 1 and %d",
-+                   conf->max_discard_sectors, (int)BDRV_REQUEST_MAX_SECTORS);
-+        return;
-+    }
-+
-+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_WRITE_ZEROES) &&
-+        (!conf->max_write_zeroes_sectors ||
-+         conf->max_write_zeroes_sectors > BDRV_REQUEST_MAX_SECTORS)) {
-+        error_setg(errp, "invalid max-write-zeroes-sectors property (%" PRIu32
-+                   "), must be between 1 and %d",
-+                   conf->max_write_zeroes_sectors,
-+                   (int)BDRV_REQUEST_MAX_SECTORS);
-+        return;
-+    }
-+
-     virtio_blk_set_config_size(s, s->host_features);
-     virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK, s->config_size);
-@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
-                       VIRTIO_BLK_F_DISCARD, true),
-     DEFINE_PROP_BIT64("write-zeroes", VirtIOBlock, host_features,
-                       VIRTIO_BLK_F_WRITE_ZEROES, true),
-+    DEFINE_PROP_UINT32("max-discard-sectors", VirtIOBlock,
-+                       conf.max_discard_sectors, BDRV_REQUEST_MAX_SECTORS),
-+    DEFINE_PROP_UINT32("max-write-zeroes-sectors", VirtIOBlock,
-+                       conf.max_write_zeroes_sectors, BDRV_REQUEST_MAX_SECTORS),
-     DEFINE_PROP_END_OF_LIST(),
- };
---
-.20.1

-[Qemu-devel] [PULL 24/27] tests/virtio-blk: change assert on data_size in virtio_blk_request()
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-The size of data in the virtio_blk_request must be a multiple
-of 512 bytes for IN and OUT requests, or a multiple of the size
-of struct virtio_blk_discard_write_zeroes for DISCARD and
-WRITE_ZEROES requests.
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-8-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-8-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/virtio-blk-test.c | 15 ++++++++++++++-
-file changed, 14 insertions(+), 1 deletion(-)
-diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/virtio-blk-test.c
-+++ b/tests/virtio-blk-test.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_blk_request(QGuestAllocator *alloc, QVirtioDevice *d,
-     uint64_t addr;
-     uint8_t status = 0xFF;
--    g_assert_cmpuint(data_size % 512, ==, 0);
-+    switch (req->type) {
-+    case VIRTIO_BLK_T_IN:
-+    case VIRTIO_BLK_T_OUT:
-+        g_assert_cmpuint(data_size % 512, ==, 0);
-+        break;
-+    case VIRTIO_BLK_T_DISCARD:
-+    case VIRTIO_BLK_T_WRITE_ZEROES:
-+        g_assert_cmpuint(data_size %
-+                         sizeof(struct virtio_blk_discard_write_zeroes), ==, 0);
-+        break;
-+    default:
-+        g_assert_cmpuint(data_size, ==, 0);
-+    }
-+
-     addr = guest_alloc(alloc, sizeof(*req) + data_size);
-     virtio_blk_fix_request(d, req);
---
-.20.1

-[Qemu-devel] [PULL 25/27] tests/virtio-blk: add virtio_blk_fix_dwz_hdr() function
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-This function is useful to fix the endianness of struct
-virtio_blk_discard_write_zeroes headers.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-9-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-9-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/virtio-blk-test.c | 23 +++++++++++++++++------
-file changed, 17 insertions(+), 6 deletions(-)
-diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/virtio-blk-test.c
-+++ b/tests/virtio-blk-test.c
-@@ -XXX,XX +XXX,XX @@ typedef struct QVirtioBlkReq {
-     uint8_t status;
- } QVirtioBlkReq;
-+#ifdef HOST_WORDS_BIGENDIAN
-+const bool host_is_big_endian = true;
-+#else
-+const bool host_is_big_endian; /* false */
-+#endif
-+
- static char *drive_create(void)
- {
-     int fd, ret;
-@@ -XXX,XX +XXX,XX @@ static QVirtioPCIDevice *virtio_blk_pci_init(QPCIBus *bus, int slot)
- static inline void virtio_blk_fix_request(QVirtioDevice *d, QVirtioBlkReq *req)
- {
--#ifdef HOST_WORDS_BIGENDIAN
--    const bool host_is_big_endian = true;
--#else
--    const bool host_is_big_endian = false;
--#endif
--
-     if (qvirtio_is_big_endian(d) != host_is_big_endian) {
-         req->type = bswap32(req->type);
-         req->ioprio = bswap32(req->ioprio);
-@@ -XXX,XX +XXX,XX @@ static inline void virtio_blk_fix_request(QVirtioDevice *d, QVirtioBlkReq *req)
-     }
- }
-+
-+static inline void virtio_blk_fix_dwz_hdr(QVirtioDevice *d,
-+    struct virtio_blk_discard_write_zeroes *dwz_hdr)
-+{
-+    if (qvirtio_is_big_endian(d) != host_is_big_endian) {
-+        dwz_hdr->sector = bswap64(dwz_hdr->sector);
-+        dwz_hdr->num_sectors = bswap32(dwz_hdr->num_sectors);
-+        dwz_hdr->flags = bswap32(dwz_hdr->flags);
-+    }
-+}
-+
- static uint64_t virtio_blk_request(QGuestAllocator *alloc, QVirtioDevice *d,
-                                    QVirtioBlkReq *req, uint64_t data_size)
- {
---
-.20.1

-[Qemu-devel] [PULL 26/27] tests/virtio-blk: add test for WRITE_ZEROES command
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-If the WRITE_ZEROES feature is enabled, we check this command
-in the test_basic().
-Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Acked-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-10-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-10-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/virtio-blk-test.c | 62 +++++++++++++++++++++++++++++++++++++++++
-file changed, 62 insertions(+)
-diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/virtio-blk-test.c
-+++ b/tests/virtio-blk-test.c
-@@ -XXX,XX +XXX,XX @@ static void test_basic(QVirtioDevice *dev, QGuestAllocator *alloc,
-     guest_free(alloc, req_addr);
-+    if (features & (1u << VIRTIO_BLK_F_WRITE_ZEROES)) {
-+        struct virtio_blk_discard_write_zeroes dwz_hdr;
-+        void *expected;
-+
-+        /*
-+         * WRITE_ZEROES request on the same sector of previous test where
-+         * we wrote "TEST".
-+         */
-+        req.type = VIRTIO_BLK_T_WRITE_ZEROES;
-+        req.data = (char *) &dwz_hdr;
-+        dwz_hdr.sector = 0;
-+        dwz_hdr.num_sectors = 1;
-+        dwz_hdr.flags = 0;
-+
-+        virtio_blk_fix_dwz_hdr(dev, &dwz_hdr);
-+
-+        req_addr = virtio_blk_request(alloc, dev, &req, sizeof(dwz_hdr));
-+
-+        free_head = qvirtqueue_add(vq, req_addr, 16, false, true);
-+        qvirtqueue_add(vq, req_addr + 16, sizeof(dwz_hdr), false, true);
-+        qvirtqueue_add(vq, req_addr + 16 + sizeof(dwz_hdr), 1, true, false);
-+
-+        qvirtqueue_kick(dev, vq, free_head);
-+
-+        qvirtio_wait_used_elem(dev, vq, free_head, NULL,
-+                               QVIRTIO_BLK_TIMEOUT_US);
-+        status = readb(req_addr + 16 + sizeof(dwz_hdr));
-+        g_assert_cmpint(status, ==, 0);
-+
-+        guest_free(alloc, req_addr);
-+
-+        /* Read request to check if the sector contains all zeroes */
-+        req.type = VIRTIO_BLK_T_IN;
-+        req.ioprio = 1;
-+        req.sector = 0;
-+        req.data = g_malloc0(512);
-+
-+        req_addr = virtio_blk_request(alloc, dev, &req, 512);
-+
-+        g_free(req.data);
-+
-+        free_head = qvirtqueue_add(vq, req_addr, 16, false, true);
-+        qvirtqueue_add(vq, req_addr + 16, 512, true, true);
-+        qvirtqueue_add(vq, req_addr + 528, 1, true, false);
-+
-+        qvirtqueue_kick(dev, vq, free_head);
-+
-+        qvirtio_wait_used_elem(dev, vq, free_head, NULL,
-+                               QVIRTIO_BLK_TIMEOUT_US);
-+        status = readb(req_addr + 528);
-+        g_assert_cmpint(status, ==, 0);
-+
-+        data = g_malloc(512);
-+        expected = g_malloc0(512);
-+        memread(req_addr + 16, data, 512);
-+        g_assert_cmpmem(data, 512, expected, 512);
-+        g_free(expected);
-+        g_free(data);
-+
-+        guest_free(alloc, req_addr);
-+    }
-+
-     if (features & (1u << VIRTIO_F_ANY_LAYOUT)) {
-         /* Write and read with 2 descriptor layout */
-         /* Write request */
---
-.20.1

-[Qemu-devel] [PULL 27/27] tests/virtio-blk: add test for DISCARD command
+Deleted patch
-From: Stefano Garzarella <sgarzare@redhat.com>
-If the DISCARD feature is enabled, we try this command in the
-test_basic(), checking only the status returned by the request.
-Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
-Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
-Message-id: 20190221103314.58500-11-sgarzare@redhat.com
-Message-Id: <20190221103314.58500-11-sgarzare@redhat.com>
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
----
- tests/virtio-blk-test.c | 27 +++++++++++++++++++++++++++
-file changed, 27 insertions(+)
-diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
-index XXXXXXX..XXXXXXX 100644
---- a/tests/virtio-blk-test.c
-+++ b/tests/virtio-blk-test.c
-@@ -XXX,XX +XXX,XX @@ static void test_basic(QVirtioDevice *dev, QGuestAllocator *alloc,
-         guest_free(alloc, req_addr);
-     }
-+    if (features & (1u << VIRTIO_BLK_F_DISCARD)) {
-+        struct virtio_blk_discard_write_zeroes dwz_hdr;
-+
-+        req.type = VIRTIO_BLK_T_DISCARD;
-+        req.data = (char *) &dwz_hdr;
-+        dwz_hdr.sector = 0;
-+        dwz_hdr.num_sectors = 1;
-+        dwz_hdr.flags = 0;
-+
-+        virtio_blk_fix_dwz_hdr(dev, &dwz_hdr);
-+
-+        req_addr = virtio_blk_request(alloc, dev, &req, sizeof(dwz_hdr));
-+
-+        free_head = qvirtqueue_add(vq, req_addr, 16, false, true);
-+        qvirtqueue_add(vq, req_addr + 16, sizeof(dwz_hdr), false, true);
-+        qvirtqueue_add(vq, req_addr + 16 + sizeof(dwz_hdr), 1, true, false);
-+
-+        qvirtqueue_kick(dev, vq, free_head);
-+
-+        qvirtio_wait_used_elem(dev, vq, free_head, NULL,
-+                               QVIRTIO_BLK_TIMEOUT_US);
-+        status = readb(req_addr + 16 + sizeof(dwz_hdr));
-+        g_assert_cmpint(status, ==, 0);
-+
-+        guest_free(alloc, req_addr);
-+    }
-+
-     if (features & (1u << VIRTIO_F_ANY_LAYOUT)) {
-         /* Write and read with 2 descriptor layout */
-         /* Write request */
---
-.20.1

The following changes since commit fc3dbb90f2eb069801bfb4cfe9cbc83cf9c5f4a9:

Merge remote-tracking branch 'remotes/jnsnow/tags/bitmaps-pull-request' into staging (2019-02-21 13:09:33 +0000)

are available in the Git repository at:

git://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 9a9f4b74fa547b68edb38fa414999836770a4735:

tests/virtio-blk: add test for DISCARD command (2019-02-22 09:42:17 +0000)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Stefano Garzarella (10):
  virtio-blk: add acct_failed param to virtio_blk_handle_rw_error()
  virtio-blk: add host_features field in VirtIOBlock
  virtio-blk: add "discard" and "write-zeroes" properties
  virtio-net: make VirtIOFeature usable for other virtio devices
  virtio-blk: set config size depending on the features enabled
  virtio-blk: add DISCARD and WRITE_ZEROES features
  tests/virtio-blk: change assert on data_size in virtio_blk_request()
  tests/virtio-blk: add virtio_blk_fix_dwz_hdr() function
  tests/virtio-blk: add test for WRITE_ZEROES command
  tests/virtio-blk: add test for DISCARD command

Vladimir Sementsov-Ogievskiy (17):
  block: enhance QEMUIOVector structure
  block/io: use qemu_iovec_init_buf
  block/block-backend: use QEMU_IOVEC_INIT_BUF
  block/backup: use qemu_iovec_init_buf
  block/commit: use QEMU_IOVEC_INIT_BUF
  block/stream: use QEMU_IOVEC_INIT_BUF
  block/parallels: use QEMU_IOVEC_INIT_BUF
  block/qcow: use qemu_iovec_init_buf
  block/qcow2: use qemu_iovec_init_buf
  block/qed: use qemu_iovec_init_buf
  block/vmdk: use qemu_iovec_init_buf
  qemu-img: use qemu_iovec_init_buf
  migration/block: use qemu_iovec_init_buf
  tests/test-bdrv-drain: use QEMU_IOVEC_INIT_BUF
  hw/ide: drop iov field from IDEState
  hw/ide: drop iov field from IDEBufferedRequest
  hw/ide: drop iov field from IDEDMA

-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add a possibility of embedded iovec, for cases when we need only one
local iov.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20190218140926.333779-2-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-2-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/iov.h | 64 ++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 62 insertions(+), 2 deletions(-)

diff --git a/include/qemu/iov.h b/include/qemu/iov.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/iov.h
+++ b/include/qemu/iov.h
@@ -XXX,XX +XXX,XX @@ size_t iov_discard_back(struct iovec *iov, unsigned int *iov_cnt,
 typedef struct QEMUIOVector {
     struct iovec *iov;
     int niov;
-    int nalloc;
-    size_t size;
+
+    /*
+     * For external @iov (qemu_iovec_init_external()) or allocated @iov
+     * (qemu_iovec_init()), @size is the cumulative size of iovecs and
+     * @local_iov is invalid and unused.
+     *
+     * For embedded @iov (QEMU_IOVEC_INIT_BUF() or qemu_iovec_init_buf()),
+     * @iov is equal to &@local_iov, and @size is valid, as it has same
+     * offset and type as @local_iov.iov_len, which is guaranteed by
+     * static assertion below.
+     *
+     * @nalloc is always valid and is -1 both for embedded and external
+     * cases. It is included in the union only to ensure the padding prior
+     * to the @size field will not result in a 0-length array.
+     */
+    union {
+        struct {
+            int nalloc;
+            struct iovec local_iov;
+        };
+        struct {
+            char __pad[sizeof(int) + offsetof(struct iovec, iov_len)];
+            size_t size;
+        };
+    };
 } QEMUIOVector;
 
+QEMU_BUILD_BUG_ON(offsetof(QEMUIOVector, size) !=
+                  offsetof(QEMUIOVector, local_iov.iov_len));
+
+#define QEMU_IOVEC_INIT_BUF(self, buf, len)              \
+{                                                        \
+    .iov = &(self).local_iov,                            \
+    .niov = 1,                                           \
+    .nalloc = -1,                                        \
+    .local_iov = {                                       \
+        .iov_base = (void *)(buf), /* cast away const */ \
+        .iov_len = (len),                                \
+    },                                                   \
+}
+
+/*
+ * qemu_iovec_init_buf
+ *
+ * Initialize embedded QEMUIOVector.
+ *
+ * Note: "const" is used over @buf pointer to make it simple to pass
+ * const pointers, appearing in read functions. Then this "const" is
+ * cast away by QEMU_IOVEC_INIT_BUF().
+ */
+static inline void qemu_iovec_init_buf(QEMUIOVector *qiov,
+                                       const void *buf, size_t len)
+{
+    *qiov = (QEMUIOVector) QEMU_IOVEC_INIT_BUF(*qiov, buf, len);
+}
+
+static inline void *qemu_iovec_buf(QEMUIOVector *qiov)
+{
+    /* Only supports embedded iov */
+    assert(qiov->nalloc == -1 && qiov->iov == &qiov->local_iov);
+
+    return qiov->local_iov.iov_base;
+}
+
 void qemu_iovec_init(QEMUIOVector *qiov, int alloc_hint);
 void qemu_iovec_init_external(QEMUIOVector *qiov, struct iovec *iov, int niov);
 void qemu_iovec_add(QEMUIOVector *qiov, void *base, size_t len);
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

While being here, use qemu_try_blockalign0 as well.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-3-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-3-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/io.c | 89 ++++++++++++------------------------------------------
 1 file changed, 20 insertions(+), 69 deletions(-)

diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
 static int bdrv_rw_co(BdrvChild *child, int64_t sector_num, uint8_t *buf,
                       int nb_sectors, bool is_write, BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = (void *)buf,
-        .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf,
+                                            nb_sectors * BDRV_SECTOR_SIZE);
 
     if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
         return -EINVAL;
     }
 
-    qemu_iovec_init_external(&qiov, &iov, 1);
     return bdrv_prwv_co(child, sector_num << BDRV_SECTOR_BITS,
                         &qiov, is_write, flags);
 }
@@ -XXX,XX +XXX,XX @@ int bdrv_write(BdrvChild *child, int64_t sector_num,
 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
                        int bytes, BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = NULL,
-        .iov_len = bytes,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
 
-    qemu_iovec_init_external(&qiov, &iov, 1);
     return bdrv_prwv_co(child, offset, &qiov, true,
                         BDRV_REQ_ZERO_WRITE | flags);
 }
@@ -XXX,XX +XXX,XX @@ int bdrv_preadv(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
 
 int bdrv_pread(BdrvChild *child, int64_t offset, void *buf, int bytes)
 {
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = (void *)buf,
-        .iov_len = bytes,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
 
     if (bytes < 0) {
         return -EINVAL;
     }
 
-    qemu_iovec_init_external(&qiov, &iov, 1);
     return bdrv_preadv(child, offset, &qiov);
 }
 
@@ -XXX,XX +XXX,XX @@ int bdrv_pwritev(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
 
 int bdrv_pwrite(BdrvChild *child, int64_t offset, const void *buf, int bytes)
 {
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base   = (void *) buf,
-        .iov_len    = bytes,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
 
     if (bytes < 0) {
         return -EINVAL;
     }
 
-    qemu_iovec_init_external(&qiov, &iov, 1);
     return bdrv_pwritev(child, offset, &qiov);
 }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
     void *bounce_buffer;
 
     BlockDriver *drv = bs->drv;
-    struct iovec iov;
     QEMUIOVector local_qiov;
     int64_t cluster_offset;
     int64_t cluster_bytes;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
 
         if (ret <= 0) {
             /* Must copy-on-read; use the bounce buffer */
-            iov.iov_base = bounce_buffer;
-            iov.iov_len = pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
-            qemu_iovec_init_external(&local_qiov, &iov, 1);
+            pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
+            qemu_iovec_init_buf(&local_qiov, bounce_buffer, pnum);
 
             ret = bdrv_driver_preadv(bs, cluster_offset, pnum,
                                      &local_qiov, 0);
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
 {
     BlockDriver *drv = bs->drv;
     QEMUIOVector qiov;
-    struct iovec iov = {0};
+    void *buf = NULL;
     int ret = 0;
     bool need_flush = false;
     int head = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
                 need_flush = true;
             }
             num = MIN(num, max_transfer);
-            iov.iov_len = num;
-            if (iov.iov_base == NULL) {
-                iov.iov_base = qemu_try_blockalign(bs, num);
-                if (iov.iov_base == NULL) {
+            if (buf == NULL) {
+                buf = qemu_try_blockalign0(bs, num);
+                if (buf == NULL) {
                     ret = -ENOMEM;
                     goto fail;
                 }
-                memset(iov.iov_base, 0, num);
             }
-            qemu_iovec_init_external(&qiov, &iov, 1);
+            qemu_iovec_init_buf(&qiov, buf, num);
 
             ret = bdrv_driver_pwritev(bs, offset, num, &qiov, write_flags);
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
              * all future requests.
              */
             if (num < max_transfer) {
-                qemu_vfree(iov.iov_base);
-                iov.iov_base = NULL;
+                qemu_vfree(buf);
+                buf = NULL;
             }
         }
 
@@ -XXX,XX +XXX,XX @@ fail:
     if (ret == 0 && need_flush) {
         ret = bdrv_co_flush(bs);
     }
-    qemu_vfree(iov.iov_base);
+    qemu_vfree(buf);
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     BlockDriverState *bs = child->bs;
     uint8_t *buf = NULL;
     QEMUIOVector local_qiov;
-    struct iovec iov;
     uint64_t align = bs->bl.request_alignment;
     unsigned int head_padding_bytes, tail_padding_bytes;
     int ret = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     assert(flags & BDRV_REQ_ZERO_WRITE);
     if (head_padding_bytes || tail_padding_bytes) {
         buf = qemu_blockalign(bs, align);
-        iov = (struct iovec) {
-            .iov_base   = buf,
-            .iov_len    = align,
-        };
-        qemu_iovec_init_external(&local_qiov, &iov, 1);
+        qemu_iovec_init_buf(&local_qiov, buf, align);
     }
     if (head_padding_bytes) {
         uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
 
     if (offset & (align - 1)) {
         QEMUIOVector head_qiov;
-        struct iovec head_iov;
 
         mark_request_serialising(&req, align);
         wait_serialising_requests(&req);
 
         head_buf = qemu_blockalign(bs, align);
-        head_iov = (struct iovec) {
-            .iov_base   = head_buf,
-            .iov_len    = align,
-        };
-        qemu_iovec_init_external(&head_qiov, &head_iov, 1);
+        qemu_iovec_init_buf(&head_qiov, head_buf, align);
 
         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
         ret = bdrv_aligned_preadv(child, &req, offset & ~(align - 1), align,
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
 
     if ((offset + bytes) & (align - 1)) {
         QEMUIOVector tail_qiov;
-        struct iovec tail_iov;
         size_t tail_bytes;
         bool waited;
 
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
         assert(!waited || !use_local_qiov);
 
         tail_buf = qemu_blockalign(bs, align);
-        tail_iov = (struct iovec) {
-            .iov_base   = tail_buf,
-            .iov_len    = align,
-        };
-        qemu_iovec_init_external(&tail_qiov, &tail_iov, 1);
+        qemu_iovec_init_buf(&tail_qiov, tail_buf, align);
 
         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
         ret = bdrv_aligned_preadv(child, &req, (offset + bytes) & ~(align - 1),
@@ -XXX,XX +XXX,XX @@ bdrv_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
                       int64_t pos, int size)
 {
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base   = (void *) buf,
-        .iov_len    = size,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
     int ret;
 
-    qemu_iovec_init_external(&qiov, &iov, 1);
-
     ret = bdrv_writev_vmstate(bs, &qiov, pos);
     if (ret < 0) {
         return ret;
@@ -XXX,XX +XXX,XX @@ int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
                       int64_t pos, int size)
 {
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base   = buf,
-        .iov_len    = size,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
     int ret;
 
-    qemu_iovec_init_external(&qiov, &iov, 1);
     ret = bdrv_readv_vmstate(bs, &qiov, pos);
     if (ret < 0) {
         return ret;
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new QEMU_IOVEC_INIT_BUF() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-4-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-4-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/block-backend.c | 13 ++-----------
 1 file changed, 2 insertions(+), 11 deletions(-)

diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ static int blk_prw(BlockBackend *blk, int64_t offset, uint8_t *buf,
                    int64_t bytes, CoroutineEntry co_entry,
                    BdrvRequestFlags flags)
 {
-    QEMUIOVector qiov;
-    struct iovec iov;
-    BlkRwCo rwco;
-
-    iov = (struct iovec) {
-        .iov_base = buf,
-        .iov_len = bytes,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
-
-    rwco = (BlkRwCo) {
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
+    BlkRwCo rwco = {
         .blk    = blk,
         .offset = offset,
         .iobuf  = &qiov,
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-5-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-5-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/backup.c | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/block/backup.c b/block/backup.c
index XXXXXXX..XXXXXXX 100644
--- a/block/backup.c
+++ b/block/backup.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
                                                       void **bounce_buffer)
 {
     int ret;
-    struct iovec iov;
     QEMUIOVector qiov;
     BlockBackend *blk = job->common.blk;
     int nbytes;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn backup_cow_with_bounce_buffer(BackupBlockJob *job,
     if (!*bounce_buffer) {
         *bounce_buffer = blk_blockalign(blk, job->cluster_size);
     }
-    iov.iov_base = *bounce_buffer;
-    iov.iov_len = nbytes;
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    qemu_iovec_init_buf(&qiov, *bounce_buffer, nbytes);
 
     ret = blk_co_preadv(blk, start, qiov.size, &qiov, read_flags);
     if (ret < 0) {
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new QEMU_IOVEC_INIT_BUF() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-6-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-6-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/commit.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/block/commit.c b/block/commit.c
index XXXXXXX..XXXXXXX 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn commit_populate(BlockBackend *bs, BlockBackend *base,
                                         void *buf)
 {
     int ret = 0;
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = buf,
-        .iov_len = bytes,
-    };
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
 
     assert(bytes < SIZE_MAX);
-    qemu_iovec_init_external(&qiov, &iov, 1);
 
     ret = blk_co_preadv(bs, offset, qiov.size, &qiov, 0);
     if (ret < 0) {
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new QEMU_IOVEC_INIT_BUF() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-7-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-7-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/stream.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/block/stream.c b/block/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn stream_populate(BlockBackend *blk,
                                         int64_t offset, uint64_t bytes,
                                         void *buf)
 {
-    struct iovec iov = {
-        .iov_base = buf,
-        .iov_len  = bytes,
-    };
-    QEMUIOVector qiov;
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, bytes);
 
     assert(bytes < SIZE_MAX);
-    qemu_iovec_init_external(&qiov, &iov, 1);
 
     /* Copy-on-read the unallocated clusters */
     return blk_co_preadv(blk, offset, qiov.size, &qiov, BDRV_REQ_COPY_ON_READ);
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new QEMU_IOVEC_INIT_BUF() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-8-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-8-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/parallels.c | 13 +++++--------
 1 file changed, 5 insertions(+), 8 deletions(-)

diff --git a/block/parallels.c b/block/parallels.c
index XXXXXXX..XXXXXXX 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -XXX,XX +XXX,XX @@ static int64_t allocate_clusters(BlockDriverState *bs, int64_t sector_num,
     if (bs->backing) {
         int64_t nb_cow_sectors = to_allocate * s->tracks;
         int64_t nb_cow_bytes = nb_cow_sectors << BDRV_SECTOR_BITS;
-        QEMUIOVector qiov;
-        struct iovec iov = {
-            .iov_len = nb_cow_bytes,
-            .iov_base = qemu_blockalign(bs, nb_cow_bytes)
-        };
-        qemu_iovec_init_external(&qiov, &iov, 1);
+        QEMUIOVector qiov =
+            QEMU_IOVEC_INIT_BUF(qiov, qemu_blockalign(bs, nb_cow_bytes),
+                                nb_cow_bytes);
 
         ret = bdrv_co_preadv(bs->backing, idx * s->tracks * BDRV_SECTOR_SIZE,
                              nb_cow_bytes, &qiov, 0);
         if (ret < 0) {
-            qemu_vfree(iov.iov_base);
+            qemu_vfree(qemu_iovec_buf(&qiov));
             return ret;
         }
 
         ret = bdrv_co_pwritev(bs->file, s->data_end * BDRV_SECTOR_SIZE,
                               nb_cow_bytes, &qiov, 0);
-        qemu_vfree(iov.iov_base);
+        qemu_vfree(qemu_iovec_buf(&qiov));
         if (ret < 0) {
             return ret;
         }
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-9-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-9-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qcow.c | 21 ++++-----------------
 1 file changed, 4 insertions(+), 17 deletions(-)

diff --git a/block/qcow.c b/block/qcow.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
     int offset_in_cluster;
     int ret = 0, n;
     uint64_t cluster_offset;
-    struct iovec hd_iov;
     QEMUIOVector hd_qiov;
     uint8_t *buf;
     void *orig_buf;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
         if (!cluster_offset) {
             if (bs->backing) {
                 /* read from the base image */
-                hd_iov.iov_base = (void *)buf;
-                hd_iov.iov_len = n;
-                qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
+                qemu_iovec_init_buf(&hd_qiov, buf, n);
                 qemu_co_mutex_unlock(&s->lock);
                 /* qcow2 emits this on bs->file instead of bs->backing */
                 BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, uint64_t offset,
                 ret = -EIO;
                 break;
             }
-            hd_iov.iov_base = (void *)buf;
-            hd_iov.iov_len = n;
-            qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
+            qemu_iovec_init_buf(&hd_qiov, buf, n);
             qemu_co_mutex_unlock(&s->lock);
             BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
             ret = bdrv_co_preadv(bs->file, cluster_offset + offset_in_cluster,
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
     int offset_in_cluster;
     uint64_t cluster_offset;
     int ret = 0, n;
-    struct iovec hd_iov;
     QEMUIOVector hd_qiov;
     uint8_t *buf;
     void *orig_buf;
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, uint64_t offset,
             }
         }
 
-        hd_iov.iov_base = (void *)buf;
-        hd_iov.iov_len = n;
-        qemu_iovec_init_external(&hd_qiov, &hd_iov, 1);
+        qemu_iovec_init_buf(&hd_qiov, buf, n);
         qemu_co_mutex_unlock(&s->lock);
         BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
         ret = bdrv_co_pwritev(bs->file, cluster_offset + offset_in_cluster,
@@ -XXX,XX +XXX,XX @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 {
     BDRVQcowState *s = bs->opaque;
     QEMUIOVector hd_qiov;
-    struct iovec iov;
     z_stream strm;
     int ret, out_len;
     uint8_t *buf, *out_buf;
@@ -XXX,XX +XXX,XX @@ qcow_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
     }
     cluster_offset &= s->cluster_offset_mask;
 
-    iov = (struct iovec) {
-        .iov_base   = out_buf,
-        .iov_len    = out_len,
-    };
-    qemu_iovec_init_external(&hd_qiov, &iov, 1);
+    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
     ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
     if (ret < 0) {
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-10-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-10-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qcow2.c | 12 ++----------
 1 file changed, 2 insertions(+), 10 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 {
     BDRVQcow2State *s = bs->opaque;
     QEMUIOVector hd_qiov;
-    struct iovec iov;
     int ret;
     size_t out_len;
     uint8_t *buf, *out_buf;
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
         goto fail;
     }
 
-    iov = (struct iovec) {
-        .iov_base   = out_buf,
-        .iov_len    = out_len,
-    };
-    qemu_iovec_init_external(&hd_qiov, &iov, 1);
+    qemu_iovec_init_buf(&hd_qiov, out_buf, out_len);
 
     BLKDBG_EVENT(bs->file, BLKDBG_WRITE_COMPRESSED);
     ret = bdrv_co_pwritev(bs->file, cluster_offset, out_len, &hd_qiov, 0);
@@ -XXX,XX +XXX,XX @@ qcow2_co_preadv_compressed(BlockDriverState *bs,
     int ret = 0, csize, nb_csectors;
     uint64_t coffset;
     uint8_t *buf, *out_buf;
-    struct iovec iov;
     QEMUIOVector local_qiov;
     int offset_in_cluster = offset_into_cluster(s, offset);
 
@@ -XXX,XX +XXX,XX @@ qcow2_co_preadv_compressed(BlockDriverState *bs,
     if (!buf) {
         return -ENOMEM;
     }
-    iov.iov_base = buf;
-    iov.iov_len = csize;
-    qemu_iovec_init_external(&local_qiov, &iov, 1);
+    qemu_iovec_init_buf(&local_qiov, buf, csize);
 
     out_buf = qemu_blockalign(bs, s->cluster_size);
 
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-11-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-11-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qed-table.c | 16 +++-------------
 block/qed.c       | 31 +++++++++----------------------
 2 files changed, 12 insertions(+), 35 deletions(-)

diff --git a/block/qed-table.c b/block/qed-table.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -XXX,XX +XXX,XX @@
 /* Called with table_lock held.  */
 static int qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table)
 {
-    QEMUIOVector qiov;
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(
+        qiov, table->offsets, s->header.cluster_size * s->header.table_size);
     int noffsets;
     int i, ret;
 
-    struct iovec iov = {
-        .iov_base = table->offsets,
-        .iov_len = s->header.cluster_size * s->header.table_size,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
-
     trace_qed_read_table(s, offset, table);
 
     qemu_co_mutex_unlock(&s->table_lock);
@@ -XXX,XX +XXX,XX @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
     unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
     unsigned int start, end, i;
     QEDTable *new_table;
-    struct iovec iov;
     QEMUIOVector qiov;
     size_t len_bytes;
     int ret;
@@ -XXX,XX +XXX,XX @@ static int qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
     len_bytes = (end - start) * sizeof(uint64_t);
 
     new_table = qemu_blockalign(s->bs, len_bytes);
-    iov = (struct iovec) {
-        .iov_base = new_table->offsets,
-        .iov_len = len_bytes,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    qemu_iovec_init_buf(&qiov, new_table->offsets, len_bytes);
 
     /* Byteswap table */
     for (i = start; i < end; i++) {
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_write_header(BDRVQEDState *s)
     int nsectors = DIV_ROUND_UP(sizeof(QEDHeader), BDRV_SECTOR_SIZE);
     size_t len = nsectors * BDRV_SECTOR_SIZE;
     uint8_t *buf;
-    struct iovec iov;
     QEMUIOVector qiov;
     int ret;
 
     assert(s->allocating_acb || s->allocating_write_reqs_plugged);
 
     buf = qemu_blockalign(s->bs, len);
-    iov = (struct iovec) {
-        .iov_base = buf,
-        .iov_len = len,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    qemu_iovec_init_buf(&qiov, buf, len);
 
     ret = bdrv_co_preadv(s->bs->file, 0, qiov.size, &qiov, 0);
     if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
 {
     QEMUIOVector qiov;
     QEMUIOVector *backing_qiov = NULL;
-    struct iovec iov;
     int ret;
 
     /* Skip copy entirely if there is no work to do */
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
         return 0;
     }
 
-    iov = (struct iovec) {
-        .iov_base = qemu_blockalign(s->bs, len),
-        .iov_len = len,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    qemu_iovec_init_buf(&qiov, qemu_blockalign(s->bs, len), len);
 
     ret = qed_read_backing_file(s, pos, &qiov, &backing_qiov);
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qed_copy_from_backing_file(BDRVQEDState *s,
     }
     ret = 0;
 out:
-    qemu_vfree(iov.iov_base);
+    qemu_vfree(qemu_iovec_buf(&qiov));
     return ret;
 }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_pwrite_zeroes(BlockDriverState *bs,
                                                   BdrvRequestFlags flags)
 {
     BDRVQEDState *s = bs->opaque;
-    QEMUIOVector qiov;
-    struct iovec iov;
+
+    /*
+     * Zero writes start without an I/O buffer.  If a buffer becomes necessary
+     * then it will be allocated during request processing.
+     */
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, bytes);
 
     /* Fall back if the request is not aligned */
     if (qed_offset_into_cluster(s, offset) ||
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_pwrite_zeroes(BlockDriverState *bs,
         return -ENOTSUP;
     }
 
-    /* Zero writes start without an I/O buffer.  If a buffer becomes necessary
-     * then it will be allocated during request processing.
-     */
-    iov.iov_base = NULL;
-    iov.iov_len = bytes;
-
-    qemu_iovec_init_external(&qiov, &iov, 1);
     return qed_co_request(bs, offset >> BDRV_SECTOR_BITS, &qiov,
                           bytes >> BDRV_SECTOR_BITS,
                           QED_AIOCB_WRITE | QED_AIOCB_ZERO);
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-12-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-12-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/vmdk.c | 7 +------
 1 file changed, 1 insertion(+), 6 deletions(-)

diff --git a/block/vmdk.c b/block/vmdk.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -XXX,XX +XXX,XX @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
     VmdkGrainMarker *data = NULL;
     uLongf buf_len;
     QEMUIOVector local_qiov;
-    struct iovec iov;
     int64_t write_offset;
     int64_t write_end_sector;
 
@@ -XXX,XX +XXX,XX @@ static int vmdk_write_extent(VmdkExtent *extent, int64_t cluster_offset,
         data->size = cpu_to_le32(buf_len);
 
         n_bytes = buf_len + sizeof(VmdkGrainMarker);
-        iov = (struct iovec) {
-            .iov_base   = data,
-            .iov_len    = n_bytes,
-        };
-        qemu_iovec_init_external(&local_qiov, &iov, 1);
+        qemu_iovec_init_buf(&local_qiov, data, n_bytes);
 
         BLKDBG_EVENT(extent->file, BLKDBG_WRITE_COMPRESSED);
     } else {
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-13-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-13-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qemu-img.c | 10 ++--------
 1 file changed, 2 insertions(+), 8 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_read(ImgConvertState *s, int64_t sector_num,
 {
     int n, ret;
     QEMUIOVector qiov;
-    struct iovec iov;
 
     assert(nb_sectors <= s->buf_sectors);
     while (nb_sectors > 0) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_read(ImgConvertState *s, int64_t sector_num,
         bs_sectors = s->src_sectors[src_cur];
 
         n = MIN(nb_sectors, bs_sectors - (sector_num - src_cur_offset));
-        iov.iov_base = buf;
-        iov.iov_len = n << BDRV_SECTOR_BITS;
-        qemu_iovec_init_external(&qiov, &iov, 1);
+        qemu_iovec_init_buf(&qiov, buf, n << BDRV_SECTOR_BITS);
 
         ret = blk_co_preadv(
                 blk, (sector_num - src_cur_offset) << BDRV_SECTOR_BITS,
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_write(ImgConvertState *s, int64_t sector_num,
 {
     int ret;
     QEMUIOVector qiov;
-    struct iovec iov;
 
     while (nb_sectors > 0) {
         int n = nb_sectors;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn convert_co_write(ImgConvertState *s, int64_t sector_num,
                 (s->compressed &&
                  !buffer_is_zero(buf, n * BDRV_SECTOR_SIZE)))
             {
-                iov.iov_base = buf;
-                iov.iov_len = n << BDRV_SECTOR_BITS;
-                qemu_iovec_init_external(&qiov, &iov, 1);
+                qemu_iovec_init_buf(&qiov, buf, n << BDRV_SECTOR_BITS);
 
                 ret = blk_co_pwritev(s->target, sector_num << BDRV_SECTOR_BITS,
                                      n << BDRV_SECTOR_BITS, &qiov, flags);
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new qemu_iovec_init_buf() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-14-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-14-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 migration/block.c | 10 +++-------
 1 file changed, 3 insertions(+), 7 deletions(-)

diff --git a/migration/block.c b/migration/block.c
index XXXXXXX..XXXXXXX 100644
--- a/migration/block.c
+++ b/migration/block.c
@@ -XXX,XX +XXX,XX @@ typedef struct BlkMigBlock {
     BlkMigDevState *bmds;
     int64_t sector;
     int nr_sectors;
-    struct iovec iov;
     QEMUIOVector qiov;
     BlockAIOCB *aiocb;
 
@@ -XXX,XX +XXX,XX @@ static int mig_save_device_bulk(QEMUFile *f, BlkMigDevState *bmds)
     blk->sector = cur_sector;
     blk->nr_sectors = nr_sectors;
 
-    blk->iov.iov_base = blk->buf;
-    blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
-    qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);
+    qemu_iovec_init_buf(&blk->qiov, blk->buf, nr_sectors * BDRV_SECTOR_SIZE);
 
     blk_mig_lock();
     block_mig_state.submitted++;
@@ -XXX,XX +XXX,XX @@ static int mig_save_device_dirty(QEMUFile *f, BlkMigDevState *bmds,
             blk->nr_sectors = nr_sectors;
 
             if (is_async) {
-                blk->iov.iov_base = blk->buf;
-                blk->iov.iov_len = nr_sectors * BDRV_SECTOR_SIZE;
-                qemu_iovec_init_external(&blk->qiov, &blk->iov, 1);
+                qemu_iovec_init_buf(&blk->qiov, blk->buf,
+                                    nr_sectors * BDRV_SECTOR_SIZE);
 
                 blk->aiocb = blk_aio_preadv(bmds->blk,
                                             sector * BDRV_SECTOR_SIZE,
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Use new QEMU_IOVEC_INIT_BUF() instead of
qemu_iovec_init_external( ... , 1), which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-15-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-15-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/test-bdrv-drain.c | 29 ++++-------------------------
 1 file changed, 4 insertions(+), 25 deletions(-)

diff --git a/tests/test-bdrv-drain.c b/tests/test-bdrv-drain.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/test-bdrv-drain.c
+++ b/tests/test-bdrv-drain.c
@@ -XXX,XX +XXX,XX @@ static void test_drv_cb_common(enum drain_type drain_type, bool recursive)
     BlockAIOCB *acb;
     int aio_ret;
 
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = NULL,
-        .iov_len = 0,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
 
     blk = blk_new(BLK_PERM_ALL, BLK_PERM_ALL);
     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
@@ -XXX,XX +XXX,XX @@ static void test_iothread_common(enum drain_type drain_type, int drain_thread)
     AioContext *ctx_a = iothread_get_aio_context(a);
     AioContext *ctx_b = iothread_get_aio_context(b);
 
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = NULL,
-        .iov_len = 0,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
 
     /* bdrv_drain_all() may only be called from the main loop thread */
     if (drain_type == BDRV_DRAIN_ALL && drain_thread != 0) {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn test_co_delete_by_drain(void *opaque)
     BlockDriverState *bs = blk_bs(blk);
     BDRVTestTopState *tts = bs->opaque;
     void *buffer = g_malloc(65536);
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = buffer,
-        .iov_len  = 65536,
-    };
-
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buffer, 65536);
 
     /* Pretend some internal write operation from parent to child.
      * Important: We have to read from the child, not from the parent!
@@ -XXX,XX +XXX,XX @@ static void test_detach_indirect(bool by_parent_cb)
     BdrvChild *child_a, *child_b;
     BlockAIOCB *acb;
 
-    QEMUIOVector qiov;
-    struct iovec iov = {
-        .iov_base = NULL,
-        .iov_len = 0,
-    };
-    qemu_iovec_init_external(&qiov, &iov, 1);
+    QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
 
     if (!by_parent_cb) {
         detach_by_driver_cb_role = child_file;
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

@iov is used only to initialize @qiov. Let's use new
qemu_iovec_init_buf() instead, which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-16-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-16-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/ide/internal.h | 1 -
 hw/ide/atapi.c            | 9 ++++-----
 hw/ide/core.c             | 8 ++------
 3 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ide/internal.h
+++ b/include/hw/ide/internal.h
@@ -XXX,XX +XXX,XX @@ struct IDEState {
     int atapi_dma; /* true if dma is requested for the packet cmd */
     BlockAcctCookie acct;
     BlockAIOCB *pio_aiocb;
-    struct iovec iov;
     QEMUIOVector qiov;
     QLIST_HEAD(, IDEBufferedRequest) buffered_requests;
     /* ATA DMA state */
diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/atapi.c
+++ b/hw/ide/atapi.c
@@ -XXX,XX +XXX,XX @@ static void cd_read_sector_cb(void *opaque, int ret)
 
 static int cd_read_sector(IDEState *s)
 {
+    void *buf;
+
     if (s->cd_sector_size != 2048 && s->cd_sector_size != 2352) {
         block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_READ);
         return -EINVAL;
     }
 
-    s->iov.iov_base = (s->cd_sector_size == 2352) ?
-                      s->io_buffer + 16 : s->io_buffer;
-
-    s->iov.iov_len = ATAPI_SECTOR_SIZE;
-    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
+    buf = (s->cd_sector_size == 2352) ? s->io_buffer + 16 : s->io_buffer;
+    qemu_iovec_init_buf(&s->qiov, buf, ATAPI_SECTOR_SIZE);
 
     trace_cd_read_sector(s->lba);
 
diff --git a/hw/ide/core.c b/hw/ide/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -XXX,XX +XXX,XX @@ static void ide_sector_read(IDEState *s)
         return;
     }
 
-    s->iov.iov_base = s->io_buffer;
-    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;
-    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
+    qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
 
     block_acct_start(blk_get_stats(s->blk), &s->acct,
                      n * BDRV_SECTOR_SIZE, BLOCK_ACCT_READ);
@@ -XXX,XX +XXX,XX @@ static void ide_sector_write(IDEState *s)
         return;
     }
 
-    s->iov.iov_base = s->io_buffer;
-    s->iov.iov_len  = n * BDRV_SECTOR_SIZE;
-    qemu_iovec_init_external(&s->qiov, &s->iov, 1);
+    qemu_iovec_init_buf(&s->qiov, s->io_buffer, n * BDRV_SECTOR_SIZE);
 
     block_acct_start(blk_get_stats(s->blk), &s->acct,
                      n * BDRV_SECTOR_SIZE, BLOCK_ACCT_WRITE);
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

@iov is used only to initialize @qiov. Let's use new
qemu_iovec_init_buf() instead, which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-17-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-17-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/ide/internal.h |  1 -
 hw/ide/core.c             | 11 ++++++-----
 2 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ide/internal.h
+++ b/include/hw/ide/internal.h
@@ -XXX,XX +XXX,XX @@ extern const char *IDE_DMA_CMD_lookup[IDE_DMA__COUNT];
 
 typedef struct IDEBufferedRequest {
     QLIST_ENTRY(IDEBufferedRequest) list;
-    struct iovec iov;
     QEMUIOVector qiov;
     QEMUIOVector *original_qiov;
     BlockCompletionFunc *original_cb;
diff --git a/hw/ide/core.c b/hw/ide/core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -XXX,XX +XXX,XX @@ static void ide_buffered_readv_cb(void *opaque, int ret)
     IDEBufferedRequest *req = opaque;
     if (!req->orphaned) {
         if (!ret) {
-            qemu_iovec_from_buf(req->original_qiov, 0, req->iov.iov_base,
+            assert(req->qiov.size == req->original_qiov->size);
+            qemu_iovec_from_buf(req->original_qiov, 0,
+                                req->qiov.local_iov.iov_base,
                                 req->original_qiov->size);
         }
         req->original_cb(req->original_opaque, ret);
     }
     QLIST_REMOVE(req, list);
-    qemu_vfree(req->iov.iov_base);
+    qemu_vfree(qemu_iovec_buf(&req->qiov));
     g_free(req);
 }
 
@@ -XXX,XX +XXX,XX @@ BlockAIOCB *ide_buffered_readv(IDEState *s, int64_t sector_num,
     req->original_qiov = iov;
     req->original_cb = cb;
     req->original_opaque = opaque;
-    req->iov.iov_base = qemu_blockalign(blk_bs(s->blk), iov->size);
-    req->iov.iov_len = iov->size;
-    qemu_iovec_init_external(&req->qiov, &req->iov, 1);
+    qemu_iovec_init_buf(&req->qiov, blk_blockalign(s->blk, iov->size),
+                        iov->size);
 
     aioreq = blk_aio_preadv(s->blk, sector_num << BDRV_SECTOR_BITS,
                             &req->qiov, 0, ide_buffered_readv_cb, req);
-- 
2.20.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

@iov is used only to initialize @qiov. Let's use new
qemu_iovec_init_buf() instead, which simplifies the code.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20190218140926.333779-18-vsementsov@virtuozzo.com
Message-Id: <20190218140926.333779-18-vsementsov@virtuozzo.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/ide/internal.h | 1 -
 hw/ide/atapi.c            | 5 ++---
 2 files changed, 2 insertions(+), 4 deletions(-)

diff --git a/include/hw/ide/internal.h b/include/hw/ide/internal.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/ide/internal.h
+++ b/include/hw/ide/internal.h
@@ -XXX,XX +XXX,XX @@ struct IDEDMAOps {
 
 struct IDEDMA {
     const struct IDEDMAOps *ops;
-    struct iovec iov;
     QEMUIOVector qiov;
     BlockAIOCB *aiocb;
 };
diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/atapi.c
+++ b/hw/ide/atapi.c
@@ -XXX,XX +XXX,XX @@ static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
         data_offset = 0;
     }
     trace_ide_atapi_cmd_read_dma_cb_aio(s, s->lba, n);
-    s->bus->dma->iov.iov_base = (void *)(s->io_buffer + data_offset);
-    s->bus->dma->iov.iov_len = n * ATAPI_SECTOR_SIZE;
-    qemu_iovec_init_external(&s->bus->dma->qiov, &s->bus->dma->iov, 1);
+    qemu_iovec_init_buf(&s->bus->dma->qiov, s->io_buffer + data_offset,
+                        n * ATAPI_SECTOR_SIZE);
 
     s->bus->dma->aiocb = ide_buffered_readv(s, (int64_t)s->lba << 2,
                                             &s->bus->dma->qiov, n * 4,
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

We add acct_failed param in order to use virtio_blk_handle_rw_error()
also when is not required to call block_acct_failed(). (eg. a discard
operation is failed)

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-2-sgarzare@redhat.com
Message-Id: <20190221103314.58500-2-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_req_complete(VirtIOBlockReq *req, unsigned char status)
 }
 
 static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
-    bool is_read)
+    bool is_read, bool acct_failed)
 {
     VirtIOBlock *s = req->dev;
     BlockErrorAction action = blk_get_error_action(s->blk, is_read, error);
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_rw_error(VirtIOBlockReq *req, int error,
         s->rq = req;
     } else if (action == BLOCK_ERROR_ACTION_REPORT) {
         virtio_blk_req_complete(req, VIRTIO_BLK_S_IOERR);
-        block_acct_failed(blk_get_stats(s->blk), &req->acct);
+        if (acct_failed) {
+            block_acct_failed(blk_get_stats(s->blk), &req->acct);
+        }
         virtio_blk_free_request(req);
     }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_rw_complete(void *opaque, int ret)
              * the memory until the request is completed (which will
              * happen on the other side of the migration).
              */
-            if (virtio_blk_handle_rw_error(req, -ret, is_read)) {
+            if (virtio_blk_handle_rw_error(req, -ret, is_read, true)) {
                 continue;
             }
         }
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_flush_complete(void *opaque, int ret)
 
     aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
     if (ret) {
-        if (virtio_blk_handle_rw_error(req, -ret, 0)) {
+        if (virtio_blk_handle_rw_error(req, -ret, 0, true)) {
             goto out;
         }
     }
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

Since configurable features for virtio-blk are growing, this patch
adds host_features field in the struct VirtIOBlock. (as in virtio-net)
In this way, we can avoid to add new fields for new properties and
we can directly set VIRTIO_BLK_F* flags in the host_features.

We update "config-wce" and "scsi" property definition to use the new
host_features field without change the behaviour.

Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-3-sgarzare@redhat.com
Message-Id: <20190221103314.58500-3-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/virtio/virtio-blk.h |  3 +--
 hw/block/virtio-blk.c          | 16 +++++++++-------
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -XXX,XX +XXX,XX @@ struct VirtIOBlkConf
     BlockConf conf;
     IOThread *iothread;
     char *serial;
-    uint32_t scsi;
-    uint32_t config_wce;
     uint32_t request_merging;
     uint16_t num_queues;
     uint16_t queue_size;
@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOBlock {
     bool dataplane_disabled;
     bool dataplane_started;
     struct VirtIOBlockDataPlane *dataplane;
+    uint64_t host_features;
 } VirtIOBlock;
 
 typedef struct VirtIOBlockReq {
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_scsi_req(VirtIOBlockReq *req)
      */
     scsi = (void *)elem->in_sg[elem->in_num - 2].iov_base;
 
-    if (!blk->conf.scsi) {
+    if (!virtio_has_feature(blk->host_features, VIRTIO_BLK_F_SCSI)) {
         status = VIRTIO_BLK_S_UNSUPP;
         goto fail;
     }
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,
 {
     VirtIOBlock *s = VIRTIO_BLK(vdev);
 
+    /* Firstly sync all virtio-blk possible supported features */
+    features |= s->host_features;
+
     virtio_add_feature(&features, VIRTIO_BLK_F_SEG_MAX);
     virtio_add_feature(&features, VIRTIO_BLK_F_GEOMETRY);
     virtio_add_feature(&features, VIRTIO_BLK_F_TOPOLOGY);
     virtio_add_feature(&features, VIRTIO_BLK_F_BLK_SIZE);
     if (virtio_has_feature(features, VIRTIO_F_VERSION_1)) {
-        if (s->conf.scsi) {
+        if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_SCSI)) {
             error_setg(errp, "Please set scsi=off for virtio-blk devices in order to use virtio 1.0");
             return 0;
         }
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_blk_get_features(VirtIODevice *vdev, uint64_t features,
         virtio_add_feature(&features, VIRTIO_BLK_F_SCSI);
     }
 
-    if (s->conf.config_wce) {
-        virtio_add_feature(&features, VIRTIO_BLK_F_CONFIG_WCE);
-    }
     if (blk_enable_write_cache(s->blk)) {
         virtio_add_feature(&features, VIRTIO_BLK_F_WCE);
     }
@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
     DEFINE_BLOCK_ERROR_PROPERTIES(VirtIOBlock, conf.conf),
     DEFINE_BLOCK_CHS_PROPERTIES(VirtIOBlock, conf.conf),
     DEFINE_PROP_STRING("serial", VirtIOBlock, conf.serial),
-    DEFINE_PROP_BIT("config-wce", VirtIOBlock, conf.config_wce, 0, true),
+    DEFINE_PROP_BIT64("config-wce", VirtIOBlock, host_features,
+                      VIRTIO_BLK_F_CONFIG_WCE, true),
 #ifdef __linux__
-    DEFINE_PROP_BIT("scsi", VirtIOBlock, conf.scsi, 0, false),
+    DEFINE_PROP_BIT64("scsi", VirtIOBlock, host_features,
+                      VIRTIO_BLK_F_SCSI, false),
 #endif
     DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0,
                     true),
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

In order to avoid migration issues, we enable DISCARD and
WRITE_ZEROES features only for machine type >= 4.0

As discussed with Michael S. Tsirkin and Stefan Hajnoczi on the
list [1], DISCARD operation should not have security implications
(eg. page cache attacks), so we can enable it by default.

[1] https://lists.gnu.org/archive/html/qemu-devel/2019-02/msg00504.html

Suggested-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-4-sgarzare@redhat.com
Message-Id: <20190221103314.58500-4-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 4 ++++
 hw/core/machine.c     | 2 ++
 2 files changed, 6 insertions(+)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
     DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 128),
     DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD,
                      IOThread *),
+    DEFINE_PROP_BIT64("discard", VirtIOBlock, host_features,
+                      VIRTIO_BLK_F_DISCARD, true),
+    DEFINE_PROP_BIT64("write-zeroes", VirtIOBlock, host_features,
+                      VIRTIO_BLK_F_WRITE_ZEROES, true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/hw/core/machine.c b/hw/core/machine.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -XXX,XX +XXX,XX @@ GlobalProperty hw_compat_3_1[] = {
     { "usb-kbd", "serial", "42" },
     { "usb-mouse", "serial", "42" },
     { "usb-kbd", "serial", "42" },
+    { "virtio-blk-device", "discard", "false" },
+    { "virtio-blk-device", "write-zeroes", "false" },
 };
 const size_t hw_compat_3_1_len = G_N_ELEMENTS(hw_compat_3_1);
 
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

In order to use VirtIOFeature also in other virtio devices, we move
its declaration and the endof() macro (renamed in virtio_endof())
in virtio.h.
We add virtio_feature_get_config_size() function to iterate the array
of VirtIOFeature and to return the config size depending on the
features enabled. (as virtio_net_set_config_size() did)

Suggested-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-5-sgarzare@redhat.com
Message-Id: <20190221103314.58500-5-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/virtio/virtio.h | 15 +++++++++++++++
 hw/net/virtio-net.c        | 31 +++++++------------------------
 hw/virtio/virtio.c         | 15 +++++++++++++++
 3 files changed, 37 insertions(+), 24 deletions(-)

diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -XXX,XX +XXX,XX @@ static inline hwaddr vring_align(hwaddr addr,
     return QEMU_ALIGN_UP(addr, align);
 }
 
+/*
+ * Calculate the number of bytes up to and including the given 'field' of
+ * 'container'.
+ */
+#define virtio_endof(container, field) \
+    (offsetof(container, field) + sizeof_field(container, field))
+
+typedef struct VirtIOFeature {
+    uint64_t flags;
+    size_t end;
+} VirtIOFeature;
+
+size_t virtio_feature_get_config_size(VirtIOFeature *features,
+                                      uint64_t host_features);
+
 typedef struct VirtQueue VirtQueue;
 
 #define VIRTQUEUE_MAX_SIZE 1024
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static inline __virtio16 *virtio_net_rsc_ext_num_dupacks(
 
 #endif
 
-/*
- * Calculate the number of bytes up to and including the given 'field' of
- * 'container'.
- */
-#define endof(container, field) \
-    (offsetof(container, field) + sizeof_field(container, field))
-
-typedef struct VirtIOFeature {
-    uint64_t flags;
-    size_t end;
-} VirtIOFeature;
-
 static VirtIOFeature feature_sizes[] = {
     {.flags = 1ULL << VIRTIO_NET_F_MAC,
-     .end = endof(struct virtio_net_config, mac)},
+     .end = virtio_endof(struct virtio_net_config, mac)},
     {.flags = 1ULL << VIRTIO_NET_F_STATUS,
-     .end = endof(struct virtio_net_config, status)},
+     .end = virtio_endof(struct virtio_net_config, status)},
     {.flags = 1ULL << VIRTIO_NET_F_MQ,
-     .end = endof(struct virtio_net_config, max_virtqueue_pairs)},
+     .end = virtio_endof(struct virtio_net_config, max_virtqueue_pairs)},
     {.flags = 1ULL << VIRTIO_NET_F_MTU,
-     .end = endof(struct virtio_net_config, mtu)},
+     .end = virtio_endof(struct virtio_net_config, mtu)},
     {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
-     .end = endof(struct virtio_net_config, duplex)},
+     .end = virtio_endof(struct virtio_net_config, duplex)},
     {}
 };
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_guest_notifier_mask(VirtIODevice *vdev, int idx,
 
 static void virtio_net_set_config_size(VirtIONet *n, uint64_t host_features)
 {
-    int i, config_size = 0;
     virtio_add_feature(&host_features, VIRTIO_NET_F_MAC);
 
-    for (i = 0; feature_sizes[i].flags != 0; i++) {
-        if (host_features & feature_sizes[i].flags) {
-            config_size = MAX(feature_sizes[i].end, config_size);
-        }
-    }
-    n->config_size = config_size;
+    n->config_size = virtio_feature_get_config_size(feature_sizes,
+                                                    host_features);
 }
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -XXX,XX +XXX,XX @@ int virtio_set_features(VirtIODevice *vdev, uint64_t val)
     return ret;
 }
 
+size_t virtio_feature_get_config_size(VirtIOFeature *feature_sizes,
+                                      uint64_t host_features)
+{
+    size_t config_size = 0;
+    int i;
+
+    for (i = 0; feature_sizes[i].flags != 0; i++) {
+        if (host_features & feature_sizes[i].flags) {
+            config_size = MAX(feature_sizes[i].end, config_size);
+        }
+    }
+
+    return config_size;
+}
+
 int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
 {
     int i, ret;
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

Starting from DISABLE and WRITE_ZEROES features, we use an array of
VirtIOFeature (as virtio-net) to properly set the config size
depending on the features enabled.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-6-sgarzare@redhat.com
Message-Id: <20190221103314.58500-6-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/virtio/virtio-blk.h |  1 +
 hw/block/virtio-blk.c          | 31 +++++++++++++++++++++++++------
 2 files changed, 26 insertions(+), 6 deletions(-)

diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtIOBlock {
     bool dataplane_started;
     struct VirtIOBlockDataPlane *dataplane;
     uint64_t host_features;
+    size_t config_size;
 } VirtIOBlock;
 
 typedef struct VirtIOBlockReq {
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/virtio/virtio-bus.h"
 #include "hw/virtio/virtio-access.h"
 
-/* We don't support discard yet, hide associated config fields. */
+/* Config size before the discard support (hide associated config fields) */
 #define VIRTIO_BLK_CFG_SIZE offsetof(struct virtio_blk_config, \
                                      max_discard_sectors)
+/*
+ * Starting from the discard feature, we can use this array to properly
+ * set the config size depending on the features enabled.
+ */
+static VirtIOFeature feature_sizes[] = {
+    {.flags = 1ULL << VIRTIO_BLK_F_DISCARD,
+     .end = virtio_endof(struct virtio_blk_config, discard_sector_alignment)},
+    {.flags = 1ULL << VIRTIO_BLK_F_WRITE_ZEROES,
+     .end = virtio_endof(struct virtio_blk_config, write_zeroes_may_unmap)},
+    {}
+};
+
+static void virtio_blk_set_config_size(VirtIOBlock *s, uint64_t host_features)
+{
+    s->config_size = MAX(VIRTIO_BLK_CFG_SIZE,
+        virtio_feature_get_config_size(feature_sizes, host_features));
+
+    assert(s->config_size <= sizeof(struct virtio_blk_config));
+}
 
 static void virtio_blk_init_request(VirtIOBlock *s, VirtQueue *vq,
                                     VirtIOBlockReq *req)
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
     blkcfg.alignment_offset = 0;
     blkcfg.wce = blk_enable_write_cache(s->blk);
     virtio_stw_p(vdev, &blkcfg.num_queues, s->conf.num_queues);
-    memcpy(config, &blkcfg, VIRTIO_BLK_CFG_SIZE);
-    QEMU_BUILD_BUG_ON(VIRTIO_BLK_CFG_SIZE > sizeof(blkcfg));
+    memcpy(config, &blkcfg, s->config_size);
 }
 
 static void virtio_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_set_config(VirtIODevice *vdev, const uint8_t *config)
     VirtIOBlock *s = VIRTIO_BLK(vdev);
     struct virtio_blk_config blkcfg;
 
-    memcpy(&blkcfg, config, VIRTIO_BLK_CFG_SIZE);
-    QEMU_BUILD_BUG_ON(VIRTIO_BLK_CFG_SIZE > sizeof(blkcfg));
+    memcpy(&blkcfg, config, s->config_size);
 
     aio_context_acquire(blk_get_aio_context(s->blk));
     blk_set_enable_write_cache(s->blk, blkcfg.wce != 0);
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
         return;
     }
 
-    virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK, VIRTIO_BLK_CFG_SIZE);
+    virtio_blk_set_config_size(s, s->host_features);
+
+    virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK, s->config_size);
 
     s->blk = conf->conf.blk;
     s->rq = NULL;
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

This patch adds the support of DISCARD and WRITE_ZEROES commands,
that have been introduced in the virtio-blk protocol to have
better performance when using SSD backend.

We support only one segment per request since multiple segments
are not widely used and there are no userspace APIs that allow
applications to submit multiple segments in a single call.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-7-sgarzare@redhat.com
Message-Id: <20190221103314.58500-7-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/virtio/virtio-blk.h |   2 +
 hw/block/virtio-blk.c          | 184 +++++++++++++++++++++++++++++++++
 2 files changed, 186 insertions(+)

diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -XXX,XX +XXX,XX @@ struct VirtIOBlkConf
     uint32_t request_merging;
     uint16_t num_queues;
     uint16_t queue_size;
+    uint32_t max_discard_sectors;
+    uint32_t max_write_zeroes_sectors;
 };
 
 struct VirtIOBlockDataPlane;
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ out:
     aio_context_release(blk_get_aio_context(s->conf.conf.blk));
 }
 
+static void virtio_blk_discard_write_zeroes_complete(void *opaque, int ret)
+{
+    VirtIOBlockReq *req = opaque;
+    VirtIOBlock *s = req->dev;
+    bool is_write_zeroes = (virtio_ldl_p(VIRTIO_DEVICE(s), &req->out.type) &
+                            ~VIRTIO_BLK_T_BARRIER) == VIRTIO_BLK_T_WRITE_ZEROES;
+
+    aio_context_acquire(blk_get_aio_context(s->conf.conf.blk));
+    if (ret) {
+        if (virtio_blk_handle_rw_error(req, -ret, false, is_write_zeroes)) {
+            goto out;
+        }
+    }
+
+    virtio_blk_req_complete(req, VIRTIO_BLK_S_OK);
+    if (is_write_zeroes) {
+        block_acct_done(blk_get_stats(s->blk), &req->acct);
+    }
+    virtio_blk_free_request(req);
+
+out:
+    aio_context_release(blk_get_aio_context(s->conf.conf.blk));
+}
+
 #ifdef __linux__
 
 typedef struct {
@@ -XXX,XX +XXX,XX @@ static bool virtio_blk_sect_range_ok(VirtIOBlock *dev,
     return true;
 }
 
+static uint8_t virtio_blk_handle_discard_write_zeroes(VirtIOBlockReq *req,
+    struct virtio_blk_discard_write_zeroes *dwz_hdr, bool is_write_zeroes)
+{
+    VirtIOBlock *s = req->dev;
+    VirtIODevice *vdev = VIRTIO_DEVICE(s);
+    uint64_t sector;
+    uint32_t num_sectors, flags, max_sectors;
+    uint8_t err_status;
+    int bytes;
+
+    sector = virtio_ldq_p(vdev, &dwz_hdr->sector);
+    num_sectors = virtio_ldl_p(vdev, &dwz_hdr->num_sectors);
+    flags = virtio_ldl_p(vdev, &dwz_hdr->flags);
+    max_sectors = is_write_zeroes ? s->conf.max_write_zeroes_sectors :
+                  s->conf.max_discard_sectors;
+
+    /*
+     * max_sectors is at most BDRV_REQUEST_MAX_SECTORS, this check
+     * make us sure that "num_sectors << BDRV_SECTOR_BITS" can fit in
+     * the integer variable.
+     */
+    if (unlikely(num_sectors > max_sectors)) {
+        err_status = VIRTIO_BLK_S_IOERR;
+        goto err;
+    }
+
+    bytes = num_sectors << BDRV_SECTOR_BITS;
+
+    if (unlikely(!virtio_blk_sect_range_ok(s, sector, bytes))) {
+        err_status = VIRTIO_BLK_S_IOERR;
+        goto err;
+    }
+
+    /*
+     * The device MUST set the status byte to VIRTIO_BLK_S_UNSUPP for discard
+     * and write zeroes commands if any unknown flag is set.
+     */
+    if (unlikely(flags & ~VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP)) {
+        err_status = VIRTIO_BLK_S_UNSUPP;
+        goto err;
+    }
+
+    if (is_write_zeroes) { /* VIRTIO_BLK_T_WRITE_ZEROES */
+        int blk_aio_flags = 0;
+
+        if (flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP) {
+            blk_aio_flags |= BDRV_REQ_MAY_UNMAP;
+        }
+
+        block_acct_start(blk_get_stats(s->blk), &req->acct, bytes,
+                         BLOCK_ACCT_WRITE);
+
+        blk_aio_pwrite_zeroes(s->blk, sector << BDRV_SECTOR_BITS,
+                              bytes, blk_aio_flags,
+                              virtio_blk_discard_write_zeroes_complete, req);
+    } else { /* VIRTIO_BLK_T_DISCARD */
+        /*
+         * The device MUST set the status byte to VIRTIO_BLK_S_UNSUPP for
+         * discard commands if the unmap flag is set.
+         */
+        if (unlikely(flags & VIRTIO_BLK_WRITE_ZEROES_FLAG_UNMAP)) {
+            err_status = VIRTIO_BLK_S_UNSUPP;
+            goto err;
+        }
+
+        blk_aio_pdiscard(s->blk, sector << BDRV_SECTOR_BITS, bytes,
+                         virtio_blk_discard_write_zeroes_complete, req);
+    }
+
+    return VIRTIO_BLK_S_OK;
+
+err:
+    if (is_write_zeroes) {
+        block_acct_invalid(blk_get_stats(s->blk), BLOCK_ACCT_WRITE);
+    }
+    return err_status;
+}
+
 static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)
 {
     uint32_t type;
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)
         virtio_blk_free_request(req);
         break;
     }
+    /*
+     * VIRTIO_BLK_T_DISCARD and VIRTIO_BLK_T_WRITE_ZEROES are defined with
+     * VIRTIO_BLK_T_OUT flag set. We masked this flag in the switch statement,
+     * so we must mask it for these requests, then we will check if it is set.
+     */
+    case VIRTIO_BLK_T_DISCARD & ~VIRTIO_BLK_T_OUT:
+    case VIRTIO_BLK_T_WRITE_ZEROES & ~VIRTIO_BLK_T_OUT:
+    {
+        struct virtio_blk_discard_write_zeroes dwz_hdr;
+        size_t out_len = iov_size(out_iov, out_num);
+        bool is_write_zeroes = (type & ~VIRTIO_BLK_T_BARRIER) ==
+                               VIRTIO_BLK_T_WRITE_ZEROES;
+        uint8_t err_status;
+
+        /*
+         * Unsupported if VIRTIO_BLK_T_OUT is not set or the request contains
+         * more than one segment.
+         */
+        if (unlikely(!(type & VIRTIO_BLK_T_OUT) ||
+                     out_len > sizeof(dwz_hdr))) {
+            virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP);
+            virtio_blk_free_request(req);
+            return 0;
+        }
+
+        if (unlikely(iov_to_buf(out_iov, out_num, 0, &dwz_hdr,
+                                sizeof(dwz_hdr)) != sizeof(dwz_hdr))) {
+            virtio_error(vdev, "virtio-blk discard/write_zeroes header"
+                         " too short");
+            return -1;
+        }
+
+        err_status = virtio_blk_handle_discard_write_zeroes(req, &dwz_hdr,
+                                                            is_write_zeroes);
+        if (err_status != VIRTIO_BLK_S_OK) {
+            virtio_blk_req_complete(req, err_status);
+            virtio_blk_free_request(req);
+        }
+
+        break;
+    }
     default:
         virtio_blk_req_complete(req, VIRTIO_BLK_S_UNSUPP);
         virtio_blk_free_request(req);
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_update_config(VirtIODevice *vdev, uint8_t *config)
     blkcfg.alignment_offset = 0;
     blkcfg.wce = blk_enable_write_cache(s->blk);
     virtio_stw_p(vdev, &blkcfg.num_queues, s->conf.num_queues);
+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_DISCARD)) {
+        virtio_stl_p(vdev, &blkcfg.max_discard_sectors,
+                     s->conf.max_discard_sectors);
+        virtio_stl_p(vdev, &blkcfg.discard_sector_alignment,
+                     blk_size >> BDRV_SECTOR_BITS);
+        /*
+         * We support only one segment per request since multiple segments
+         * are not widely used and there are no userspace APIs that allow
+         * applications to submit multiple segments in a single call.
+         */
+        virtio_stl_p(vdev, &blkcfg.max_discard_seg, 1);
+    }
+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_WRITE_ZEROES)) {
+        virtio_stl_p(vdev, &blkcfg.max_write_zeroes_sectors,
+                     s->conf.max_write_zeroes_sectors);
+        blkcfg.write_zeroes_may_unmap = 1;
+        virtio_stl_p(vdev, &blkcfg.max_write_zeroes_seg, 1);
+    }
     memcpy(config, &blkcfg, s->config_size);
 }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
         return;
     }
 
+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_DISCARD) &&
+        (!conf->max_discard_sectors ||
+         conf->max_discard_sectors > BDRV_REQUEST_MAX_SECTORS)) {
+        error_setg(errp, "invalid max-discard-sectors property (%" PRIu32 ")"
+                   ", must be between 1 and %d",
+                   conf->max_discard_sectors, (int)BDRV_REQUEST_MAX_SECTORS);
+        return;
+    }
+
+    if (virtio_has_feature(s->host_features, VIRTIO_BLK_F_WRITE_ZEROES) &&
+        (!conf->max_write_zeroes_sectors ||
+         conf->max_write_zeroes_sectors > BDRV_REQUEST_MAX_SECTORS)) {
+        error_setg(errp, "invalid max-write-zeroes-sectors property (%" PRIu32
+                   "), must be between 1 and %d",
+                   conf->max_write_zeroes_sectors,
+                   (int)BDRV_REQUEST_MAX_SECTORS);
+        return;
+    }
+
     virtio_blk_set_config_size(s, s->host_features);
 
     virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK, s->config_size);
@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
                       VIRTIO_BLK_F_DISCARD, true),
     DEFINE_PROP_BIT64("write-zeroes", VirtIOBlock, host_features,
                       VIRTIO_BLK_F_WRITE_ZEROES, true),
+    DEFINE_PROP_UINT32("max-discard-sectors", VirtIOBlock,
+                       conf.max_discard_sectors, BDRV_REQUEST_MAX_SECTORS),
+    DEFINE_PROP_UINT32("max-write-zeroes-sectors", VirtIOBlock,
+                       conf.max_write_zeroes_sectors, BDRV_REQUEST_MAX_SECTORS),
     DEFINE_PROP_END_OF_LIST(),
 };
 
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

The size of data in the virtio_blk_request must be a multiple
of 512 bytes for IN and OUT requests, or a multiple of the size
of struct virtio_blk_discard_write_zeroes for DISCARD and
WRITE_ZEROES requests.

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-8-sgarzare@redhat.com
Message-Id: <20190221103314.58500-8-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/virtio-blk-test.c | 15 ++++++++++++++-
 1 file changed, 14 insertions(+), 1 deletion(-)

diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/virtio-blk-test.c
+++ b/tests/virtio-blk-test.c
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_blk_request(QGuestAllocator *alloc, QVirtioDevice *d,
     uint64_t addr;
     uint8_t status = 0xFF;
 
-    g_assert_cmpuint(data_size % 512, ==, 0);
+    switch (req->type) {
+    case VIRTIO_BLK_T_IN:
+    case VIRTIO_BLK_T_OUT:
+        g_assert_cmpuint(data_size % 512, ==, 0);
+        break;
+    case VIRTIO_BLK_T_DISCARD:
+    case VIRTIO_BLK_T_WRITE_ZEROES:
+        g_assert_cmpuint(data_size %
+                         sizeof(struct virtio_blk_discard_write_zeroes), ==, 0);
+        break;
+    default:
+        g_assert_cmpuint(data_size, ==, 0);
+    }
+
     addr = guest_alloc(alloc, sizeof(*req) + data_size);
 
     virtio_blk_fix_request(d, req);
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

This function is useful to fix the endianness of struct
virtio_blk_discard_write_zeroes headers.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-9-sgarzare@redhat.com
Message-Id: <20190221103314.58500-9-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/virtio-blk-test.c | 23 +++++++++++++++++------
 1 file changed, 17 insertions(+), 6 deletions(-)

diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/virtio-blk-test.c
+++ b/tests/virtio-blk-test.c
@@ -XXX,XX +XXX,XX @@ typedef struct QVirtioBlkReq {
     uint8_t status;
 } QVirtioBlkReq;
 
+#ifdef HOST_WORDS_BIGENDIAN
+const bool host_is_big_endian = true;
+#else
+const bool host_is_big_endian; /* false */
+#endif
+
 static char *drive_create(void)
 {
     int fd, ret;
@@ -XXX,XX +XXX,XX @@ static QVirtioPCIDevice *virtio_blk_pci_init(QPCIBus *bus, int slot)
 
 static inline void virtio_blk_fix_request(QVirtioDevice *d, QVirtioBlkReq *req)
 {
-#ifdef HOST_WORDS_BIGENDIAN
-    const bool host_is_big_endian = true;
-#else
-    const bool host_is_big_endian = false;
-#endif
-
     if (qvirtio_is_big_endian(d) != host_is_big_endian) {
         req->type = bswap32(req->type);
         req->ioprio = bswap32(req->ioprio);
@@ -XXX,XX +XXX,XX @@ static inline void virtio_blk_fix_request(QVirtioDevice *d, QVirtioBlkReq *req)
     }
 }
 
+
+static inline void virtio_blk_fix_dwz_hdr(QVirtioDevice *d,
+    struct virtio_blk_discard_write_zeroes *dwz_hdr)
+{
+    if (qvirtio_is_big_endian(d) != host_is_big_endian) {
+        dwz_hdr->sector = bswap64(dwz_hdr->sector);
+        dwz_hdr->num_sectors = bswap32(dwz_hdr->num_sectors);
+        dwz_hdr->flags = bswap32(dwz_hdr->flags);
+    }
+}
+
 static uint64_t virtio_blk_request(QGuestAllocator *alloc, QVirtioDevice *d,
                                    QVirtioBlkReq *req, uint64_t data_size)
 {
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

If the WRITE_ZEROES feature is enabled, we check this command
in the test_basic().

Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-10-sgarzare@redhat.com
Message-Id: <20190221103314.58500-10-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/virtio-blk-test.c | 62 +++++++++++++++++++++++++++++++++++++++++
 1 file changed, 62 insertions(+)

diff --git a/tests/virtio-blk-test.c b/tests/virtio-blk-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/virtio-blk-test.c
+++ b/tests/virtio-blk-test.c
@@ -XXX,XX +XXX,XX @@ static void test_basic(QVirtioDevice *dev, QGuestAllocator *alloc,
 
     guest_free(alloc, req_addr);
 
+    if (features & (1u << VIRTIO_BLK_F_WRITE_ZEROES)) {
+        struct virtio_blk_discard_write_zeroes dwz_hdr;
+        void *expected;
+
+        /*
+         * WRITE_ZEROES request on the same sector of previous test where
+         * we wrote "TEST".
+         */
+        req.type = VIRTIO_BLK_T_WRITE_ZEROES;
+        req.data = (char *) &dwz_hdr;
+        dwz_hdr.sector = 0;
+        dwz_hdr.num_sectors = 1;
+        dwz_hdr.flags = 0;
+
+        virtio_blk_fix_dwz_hdr(dev, &dwz_hdr);
+
+        req_addr = virtio_blk_request(alloc, dev, &req, sizeof(dwz_hdr));
+
+        free_head = qvirtqueue_add(vq, req_addr, 16, false, true);
+        qvirtqueue_add(vq, req_addr + 16, sizeof(dwz_hdr), false, true);
+        qvirtqueue_add(vq, req_addr + 16 + sizeof(dwz_hdr), 1, true, false);
+
+        qvirtqueue_kick(dev, vq, free_head);
+
+        qvirtio_wait_used_elem(dev, vq, free_head, NULL,
+                               QVIRTIO_BLK_TIMEOUT_US);
+        status = readb(req_addr + 16 + sizeof(dwz_hdr));
+        g_assert_cmpint(status, ==, 0);
+
+        guest_free(alloc, req_addr);
+
+        /* Read request to check if the sector contains all zeroes */
+        req.type = VIRTIO_BLK_T_IN;
+        req.ioprio = 1;
+        req.sector = 0;
+        req.data = g_malloc0(512);
+
+        req_addr = virtio_blk_request(alloc, dev, &req, 512);
+
+        g_free(req.data);
+
+        free_head = qvirtqueue_add(vq, req_addr, 16, false, true);
+        qvirtqueue_add(vq, req_addr + 16, 512, true, true);
+        qvirtqueue_add(vq, req_addr + 528, 1, true, false);
+
+        qvirtqueue_kick(dev, vq, free_head);
+
+        qvirtio_wait_used_elem(dev, vq, free_head, NULL,
+                               QVIRTIO_BLK_TIMEOUT_US);
+        status = readb(req_addr + 528);
+        g_assert_cmpint(status, ==, 0);
+
+        data = g_malloc(512);
+        expected = g_malloc0(512);
+        memread(req_addr + 16, data, 512);
+        g_assert_cmpmem(data, 512, expected, 512);
+        g_free(expected);
+        g_free(data);
+
+        guest_free(alloc, req_addr);
+    }
+
     if (features & (1u << VIRTIO_F_ANY_LAYOUT)) {
         /* Write and read with 2 descriptor layout */
         /* Write request */
-- 
2.20.1

From: Stefano Garzarella <sgarzare@redhat.com>

If the DISCARD feature is enabled, we try this command in the
test_basic(), checking only the status returned by the request.

Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20190221103314.58500-11-sgarzare@redhat.com
Message-Id: <20190221103314.58500-11-sgarzare@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/virtio-blk-test.c | 27 +++++++++++++++++++++++++++
 1 file changed, 27 insertions(+)

From: Denis Rastyogin <gerben@altlinux.org>

This error was discovered by fuzzing qemu-img.

In the QED block driver, the need_check_timer timer is freed in
bdrv_qed_detach_aio_context, but the pointer to the timer is not
set to NULL. This can lead to a use-after-free scenario
in bdrv_qed_drain_begin().

The need_check_timer pointer is set to NULL after freeing the timer.
Which helps catch this condition when checking in bdrv_qed_drain_begin().

Closes: https://gitlab.com/qemu-project/qemu/-/issues/2852
Signed-off-by: Denis Rastyogin <gerben@altlinux.org>
Message-ID: <20250304083927.37681-1-gerben@altlinux.org>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/qed.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_qed_detach_aio_context(BlockDriverState *bs)
 
     qed_cancel_need_check_timer(s);
     timer_free(s->need_check_timer);
+    s->need_check_timer = NULL;
 }
 
 static void bdrv_qed_attach_aio_context(BlockDriverState *bs,
-- 
2.48.1