Series comparison

-[libvirt] [PULL 0/3] Block patches
+[PULL 0/3] Block patches
-The following changes since commit aceeaa69d28e6f08a24395d0aa6915b687d0a681:
+The following changes since commit d0ed6a69d399ae193959225cdeaa9382746c91cc:
-  Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2019-12-17' into staging (2019-12-17 15:55:20 +0000)
+  Update version for v5.1.0 release (2020-08-11 17:07:03 +0100)
 are available in the Git repository at:
   https://github.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to 725fe5d10dbd4259b1853b7d253cef83a3c0d22a:
+for you to fetch changes up to 44277bf914471962c9e88e09c859aae65ae109c4:
-  virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh (2019-12-19 16:20:25 +0000)
+  aio-posix: keep aio_notify_me disabled during polling (2020-08-13 13:34:14 =
 +0100)
 ----------------------------------------------------------------
 Pull request
 ----------------------------------------------------------------
-Li Hangjing (1):
+Stefan Hajnoczi (3):
-  virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh
+  async: rename event_notifier_dummy_cb/poll()
   async: always set ctx->notified in aio_notify()
   aio-posix: keep aio_notify_me disabled during polling
-Stefan Hajnoczi (2):
+ util/aio-posix.c | 47 +++++++++++++++++++++++++----------------------
-  virtio-blk: deprecate SCSI passthrough
+ util/async.c     | 36 +++++++++++++++++++++++-------------
-  docs: fix rst syntax errors in unbuilt docs
+files changed, 48 insertions(+), 35 deletions(-)
- docs/arm-cpu-features.rst       |  6 +++---
+--=20
- docs/virtio-net-failover.rst    |  4 ++--
+.26.2
  docs/virtio-pmem.rst            | 19 ++++++++++---------
  hw/block/dataplane/virtio-blk.c |  2 +-
  qemu-deprecated.texi            | 11 +++++++++++
 files changed, 27 insertions(+), 15 deletions(-)
---
-.23.0
---
-libvir-list mailing list
-libvir-list@redhat.com
-https://www.redhat.com/mailman/listinfo/libvir-list

-[libvirt] [PULL 3/3] virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh
+[PULL 1/3] async: rename event_notifier_dummy_cb/poll()
-From: Li Hangjing <lihangjing@baidu.com>
+The event_notifier_*() prefix can be confused with the EventNotifier
 APIs that are also called event_notifier_*().
-When the number of a virtio-blk device's virtqueues is larger than
+Rename the functions to aio_context_notifier_*() to make it clear that
-BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.
+they relate to the AioContext::notifier field.
-Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Cc: qemu-stable@nongnu.org
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Cc: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Li Hangjing <lihangjing@baidu.com>
+Message-id: 20200806131802.569478-2-stefanha@redhat.com
 Reviewed-by: Xie Yongji <xieyongji@baidu.com>
 Reviewed-by: Chai Wen <chaiwen@baidu.com>
 Message-id: 20191216023050.48620-1-lihangjing@baidu.com
 Message-Id: <20191216023050.48620-1-lihangjing@baidu.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- hw/block/dataplane/virtio-blk.c | 2 +-
+ util/async.c | 8 ++++----
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
+diff --git a/util/async.c b/util/async.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/dataplane/virtio-blk.c
+--- a/util/async.c
-+++ b/hw/block/dataplane/virtio-blk.c
++++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ static void notify_guest_bh(void *opaque)
+@@ -XXX,XX +XXX,XX @@ static void aio_timerlist_notify(void *opaque, QEMUClockType type)
-     memset(s->batch_notify_vqs, 0, sizeof(bitmap));
+     aio_notify(opaque);
+ }
-     for (j = 0; j < nvqs; j += BITS_PER_LONG) {
--        unsigned long bits = bitmap[j];
+-static void event_notifier_dummy_cb(EventNotifier *e)
-+        unsigned long bits = bitmap[j / BITS_PER_LONG];
++static void aio_context_notifier_dummy_cb(EventNotifier *e)
+ {
-         while (bits != 0) {
+ }
-             unsigned i = j + ctzl(bits);
  /* Returns true if aio_notify() was called (e.g. a BH was scheduled) */
 -static bool event_notifier_poll(void *opaque)
 +static bool aio_context_notifier_poll(void *opaque)
  {
      EventNotifier *e = opaque;
      AioContext *ctx = container_of(e, AioContext, notifier);
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
      aio_set_event_notifier(ctx, &ctx->notifier,
                             false,
 -                           event_notifier_dummy_cb,
 -                           event_notifier_poll);
 +                           aio_context_notifier_dummy_cb,
 +                           aio_context_notifier_poll);
  #ifdef CONFIG_LINUX_AIO
      ctx->linux_aio = NULL;
  #endif
 --
-.23.0
+.26.2
---
-libvir-list mailing list
-libvir-list@redhat.com
-https://www.redhat.com/mailman/listinfo/libvir-list

-[libvirt] [PULL 2/3] docs: fix rst syntax errors in unbuilt docs
+[PULL 2/3] async: always set ctx->notified in aio_notify()
-The .rst files outside docs/{devel,interop,specs} aren't built yet and
+aio_notify() does not set ctx->notified when called with
-therefore a few syntax errors have slipped through.  Fix them.
+ctx->aio_notify_me disabled. Therefore aio_notify_me needs to be enabled
 during polling.
 This is suboptimal since expensive event_notifier_set(&ctx->notifier)
 and event_notifier_test_and_clear(&ctx->notifier) calls are required
 when ctx->aio_notify_me is enabled.
 Change aio_notify() so that aio->notified is always set, regardless of
 ctx->aio_notify_me. This will make polling cheaper since
 ctx->aio_notify_me can remain disabled. Move the
 event_notifier_test_and_clear() to the fd handler function (which is now
 no longer an empty function so "dummy" has been dropped from its name).
 The next patch takes advantage of this by optimizing polling in
 util/aio-posix.c.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Message-Id: <20191111094411.427174-1-stefanha@redhat.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Message-id: 20200806131802.569478-3-stefanha@redhat.com
 [Paolo Bonzini pointed out that the smp_wmb() in aio_notify_accept()
 should be smp_wb() but the comment should be smp_wmb() instead of
 smp_wb(). Fixed.
 --Stefan]
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- docs/arm-cpu-features.rst    |  6 +++---
+ util/async.c | 32 +++++++++++++++++++++-----------
- docs/virtio-net-failover.rst |  4 ++--
+file changed, 21 insertions(+), 11 deletions(-)
  docs/virtio-pmem.rst         | 19 ++++++++++---------
 files changed, 15 insertions(+), 14 deletions(-)
-diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
+diff --git a/util/async.c b/util/async.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/arm-cpu-features.rst
+--- a/util/async.c
-+++ b/docs/arm-cpu-features.rst
++++ b/util/async.c
-@@ -XXX,XX +XXX,XX @@ CPU type is possible with the `query-cpu-model-expansion` QMP command.
+@@ -XXX,XX +XXX,XX @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
- Below are some examples where `scripts/qmp/qmp-shell` (see the top comment
- block in the script for usage) is used to issue the QMP commands.
+ void aio_notify(AioContext *ctx)
+ {
--(1) Determine which CPU features are available for the `max` CPU type
+-    /* Write e.g. bh->scheduled before reading ctx->notify_me.  Pairs
--    (Note, we started QEMU with qemu-system-aarch64, so `max` is
++    /*
--     implementing the ARMv8-A reference manual in this case)::
++     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
-+1. Determine which CPU features are available for the `max` CPU type
++     * aio_notify_accept.
-+   (Note, we started QEMU with qemu-system-aarch64, so `max` is
++     */
-+   implementing the ARMv8-A reference manual in this case)::
++    smp_wmb();
++    atomic_set(&ctx->notified, true);
        (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
        { "return": {
 diff --git a/docs/virtio-net-failover.rst b/docs/virtio-net-failover.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/virtio-net-failover.rst
 +++ b/docs/virtio-net-failover.rst
@@ -XXX,XX +XXX,XX @@
 -========================
 +======================================
  QEMU virtio-net standby (net_failover)
 -========================
 +======================================
  This document explains the setup and usage of virtio-net standby feature which
  is used to create a net_failover pair of devices.
 diff --git a/docs/virtio-pmem.rst b/docs/virtio-pmem.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/virtio-pmem.rst
 +++ b/docs/virtio-pmem.rst
@@ -XXX,XX +XXX,XX @@ virtio pmem usage
  -----------------
    A virtio pmem device backed by a memory-backend-file can be created on
 -  the QEMU command line as in the following example:
 +  the QEMU command line as in the following example::
 -  -object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G
 -  -device virtio-pmem-pci,memdev=mem1,id=nv1
 +    -object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G
 +    -device virtio-pmem-pci,memdev=mem1,id=nv1
 -   where:
 -   - "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"
 -     creates a backend file with the specified size.
 +  where:
 -   - "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem
 -     pci device whose storage is provided by above memory backend device.
 +  - "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"
 +    creates a backend file with the specified size.
 +
-+  - "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem
++    /*
-+    pci device whose storage is provided by above memory backend device.
++     * Write ctx->notified before reading ctx->notify_me.  Pairs
+      * with smp_mb in aio_ctx_prepare or aio_poll.
-   Multiple virtio pmem devices can be created if multiple pairs of "-object"
+      */
-   and "-device" are provided.
+     smp_mb();
-@@ -XXX,XX +XXX,XX @@ memory backing has to be added via 'object_add'; afterwards, the virtio
+     if (atomic_read(&ctx->notify_me)) {
- pmem device can be added via 'device_add'.
+         event_notifier_set(&ctx->notifier);
+-        atomic_mb_set(&ctx->notified, true);
- For example, the following commands add another 4GB virtio pmem device to
+     }
--the guest:
+ }
-+the guest::
+ void aio_notify_accept(AioContext *ctx)
-  (qemu) object_add memory-backend-file,id=mem2,share=on,mem-path=virtio_pmem2.img,size=4G
+ {
-  (qemu) device_add virtio-pmem-pci,id=virtio_pmem2,memdev=mem2
+-    if (atomic_xchg(&ctx->notified, false)
 -#ifdef WIN32
 -        || true
 -#endif
 -    ) {
 -        event_notifier_test_and_clear(&ctx->notifier);
 -    }
 +    atomic_set(&ctx->notified, false);
 +
 +    /*
 +     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
 +     * in aio_notify.
 +     */
 +    smp_mb();
  }
  static void aio_timerlist_notify(void *opaque, QEMUClockType type)
@@ -XXX,XX +XXX,XX @@ static void aio_timerlist_notify(void *opaque, QEMUClockType type)
      aio_notify(opaque);
  }
 -static void aio_context_notifier_dummy_cb(EventNotifier *e)
 +static void aio_context_notifier_cb(EventNotifier *e)
  {
 +    AioContext *ctx = container_of(e, AioContext, notifier);
 +
 +    event_notifier_test_and_clear(&ctx->notifier);
  }
  /* Returns true if aio_notify() was called (e.g. a BH was scheduled) */
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
      aio_set_event_notifier(ctx, &ctx->notifier,
                             false,
 -                           aio_context_notifier_dummy_cb,
 +                           aio_context_notifier_cb,
                             aio_context_notifier_poll);
  #ifdef CONFIG_LINUX_AIO
      ctx->linux_aio = NULL;
 --
-.23.0
+.26.2
---
-libvir-list mailing list
-libvir-list@redhat.com
-https://www.redhat.com/mailman/listinfo/libvir-list

-[libvirt] [PULL 1/3] virtio-blk: deprecate SCSI passthrough
+[PULL 3/3] aio-posix: keep aio_notify_me disabled during polling
-The Linux virtio_blk.ko guest driver is removing legacy SCSI passthrough
+Polling only monitors the ctx->notified field and does not need the
-support.  Deprecate this feature in QEMU too.
+ctx->notifier EventNotifier to be signalled. Keep ctx->aio_notify_me
 disabled while polling to avoid unnecessary EventNotifier syscalls.
 This optimization improves virtio-blk 4KB random read performance by
 %. The following results are with an IOThread and the null-co block
 driver:
 Test         IOPS   Error
 Before  244518.62 ± 1.20%
 After   290706.11 ± 0.44%
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Reviewed-by: Christoph Hellwig <hch@lst.de>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Thomas Huth <thuth@redhat.com>
+Message-id: 20200806131802.569478-4-stefanha@redhat.com
 Message-id: 20191213144626.1208237-1-stefanha@redhat.com
 Message-Id: <20191213144626.1208237-1-stefanha@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- qemu-deprecated.texi | 11 +++++++++++
+ util/aio-posix.c | 47 +++++++++++++++++++++++++----------------------
-file changed, 11 insertions(+)
+file changed, 25 insertions(+), 22 deletions(-)
-diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi
+diff --git a/util/aio-posix.c b/util/aio-posix.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-deprecated.texi
+--- a/util/aio-posix.c
-+++ b/qemu-deprecated.texi
++++ b/util/aio-posix.c
-@@ -XXX,XX +XXX,XX @@ spec you can use the ``-cpu rv64gcsu,priv_spec=v1.9.1`` command line argument.
+@@ -XXX,XX +XXX,XX @@ static bool remove_idle_poll_handlers(AioContext *ctx, int64_t now)
+  *
- @section Device options
+  * Polls for a given time.
+  *
-+@subsection Emulated device options
+- * Note that ctx->notify_me must be non-zero so this function can detect
 - * aio_notify().
 - *
   * Note that the caller must have incremented ctx->list_lock.
   *
   * Returns: true if progress was made, false otherwise
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
      bool progress;
      int64_t start_time, elapsed_time;
 -    assert(ctx->notify_me);
      assert(qemu_lockcnt_count(&ctx->list_lock) > 0);
      trace_run_poll_handlers_begin(ctx, max_ns, *timeout);
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
   * @timeout: timeout for blocking wait, computed by the caller and updated if
   *    polling succeeds.
   *
 - * ctx->notify_me must be non-zero so this function can detect aio_notify().
 - *
   * Note that the caller must have incremented ctx->list_lock.
   *
   * Returns: true if progress was made, false otherwise
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list);
      int ret = 0;
      bool progress;
 +    bool use_notify_me;
      int64_t timeout;
      int64_t start = 0;
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
       */
      assert(in_aio_context_home_thread(ctx));
 -    /* aio_notify can avoid the expensive event_notifier_set if
 +    qemu_lockcnt_inc(&ctx->list_lock);
 +
-+@subsubsection -device virtio-blk,scsi=on|off (since 5.0.0)
++    if (ctx->poll_max_ns) {
 +        start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
 +    }
 +
-+The virtio-blk SCSI passthrough feature is a legacy VIRTIO feature.  VIRTIO 1.0
++    timeout = blocking ? aio_compute_timeout(ctx) : 0;
-+and later do not support it because the virtio-scsi device was introduced for
++    progress = try_poll_mode(ctx, &timeout);
-+full SCSI support.  Use virtio-scsi instead when SCSI passthrough is required.
++    assert(!(timeout && progress));
 +
-+Note this also applies to ``-device virtio-blk-pci,scsi=on|off'', which is an
++    /*
-+alias.
++     * aio_notify can avoid the expensive event_notifier_set if
       * everything (file descriptors, bottom halves, timers) will
       * be re-evaluated before the next blocking poll().  This is
       * already true when aio_poll is called with blocking == false;
       * if blocking == true, it is only true after poll() returns,
       * so disable the optimization now.
       */
 -    if (blocking) {
 +    use_notify_me = timeout != 0;
 +    if (use_notify_me) {
          atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
          /*
 -         * Write ctx->notify_me before computing the timeout
 -         * (reading bottom half flags, etc.).  Pairs with
 +         * Write ctx->notify_me before reading ctx->notified.  Pairs with
           * smp_mb in aio_notify().
           */
          smp_mb();
 -    }
 -
 -    qemu_lockcnt_inc(&ctx->list_lock);
 -    if (ctx->poll_max_ns) {
 -        start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
 +        /* Don't block if aio_notify() was called */
 +        if (atomic_read(&ctx->notified)) {
 +            timeout = 0;
 +        }
      }
 -    timeout = blocking ? aio_compute_timeout(ctx) : 0;
 -    progress = try_poll_mode(ctx, &timeout);
 -    assert(!(timeout && progress));
 -
      /* If polling is allowed, non-blocking aio_poll does not need the
       * system call---a single round of run_poll_handlers_once suffices.
       */
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
          ret = ctx->fdmon_ops->wait(ctx, &ready_list, timeout);
      }
 -    if (blocking) {
 +    if (use_notify_me) {
          /* Finish the poll before clearing the flag.  */
 -        atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
 -        aio_notify_accept(ctx);
 +        atomic_store_release(&ctx->notify_me,
 +                             atomic_read(&ctx->notify_me) - 2);
      }
 +    aio_notify_accept(ctx);
 +
- @subsection Block device options
+     /* Adjust polling time */
+     if (ctx->poll_max_ns) {
- @subsubsection "backing": "" (since 2.12.0)
+         int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
 --
-.23.0
+.26.2
---
-libvir-list mailing list
-libvir-list@redhat.com
-https://www.redhat.com/mailman/listinfo/libvir-list

The following changes since commit aceeaa69d28e6f08a24395d0aa6915b687d0a681:

Merge remote-tracking branch 'remotes/huth-gitlab/tags/pull-request-2019-12-17' into staging (2019-12-17 15:55:20 +0000)

are available in the Git repository at:

https://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 725fe5d10dbd4259b1853b7d253cef83a3c0d22a:

virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh (2019-12-19 16:20:25 +0000)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Li Hangjing (1):
  virtio-blk: fix out-of-bounds access to bitmap in notify_guest_bh

Stefan Hajnoczi (2):
  virtio-blk: deprecate SCSI passthrough
  docs: fix rst syntax errors in unbuilt docs

-- 
2.23.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

The Linux virtio_blk.ko guest driver is removing legacy SCSI passthrough
support.  Deprecate this feature in QEMU too.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Christoph Hellwig <hch@lst.de>
Reviewed-by: Thomas Huth <thuth@redhat.com>
Message-id: 20191213144626.1208237-1-stefanha@redhat.com
Message-Id: <20191213144626.1208237-1-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qemu-deprecated.texi | 11 +++++++++++
 1 file changed, 11 insertions(+)

diff --git a/qemu-deprecated.texi b/qemu-deprecated.texi
index XXXXXXX..XXXXXXX 100644
--- a/qemu-deprecated.texi
+++ b/qemu-deprecated.texi
@@ -XXX,XX +XXX,XX @@ spec you can use the ``-cpu rv64gcsu,priv_spec=v1.9.1`` command line argument.
 
 @section Device options
 
+@subsection Emulated device options
+
+@subsubsection -device virtio-blk,scsi=on|off (since 5.0.0)
+
+The virtio-blk SCSI passthrough feature is a legacy VIRTIO feature.  VIRTIO 1.0
+and later do not support it because the virtio-scsi device was introduced for
+full SCSI support.  Use virtio-scsi instead when SCSI passthrough is required.
+
+Note this also applies to ``-device virtio-blk-pci,scsi=on|off'', which is an
+alias.
+
 @subsection Block device options
 
 @subsubsection "backing": "" (since 2.12.0)
-- 
2.23.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

The .rst files outside docs/{devel,interop,specs} aren't built yet and
therefore a few syntax errors have slipped through.  Fix them.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Message-Id: <20191111094411.427174-1-stefanha@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/arm-cpu-features.rst    |  6 +++---
 docs/virtio-net-failover.rst |  4 ++--
 docs/virtio-pmem.rst         | 19 ++++++++++---------
 3 files changed, 15 insertions(+), 14 deletions(-)

diff --git a/docs/arm-cpu-features.rst b/docs/arm-cpu-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/arm-cpu-features.rst
+++ b/docs/arm-cpu-features.rst
@@ -XXX,XX +XXX,XX @@ CPU type is possible with the `query-cpu-model-expansion` QMP command.
 Below are some examples where `scripts/qmp/qmp-shell` (see the top comment
 block in the script for usage) is used to issue the QMP commands.
 
-(1) Determine which CPU features are available for the `max` CPU type
-    (Note, we started QEMU with qemu-system-aarch64, so `max` is
-     implementing the ARMv8-A reference manual in this case)::
+1. Determine which CPU features are available for the `max` CPU type
+   (Note, we started QEMU with qemu-system-aarch64, so `max` is
+   implementing the ARMv8-A reference manual in this case)::
 
       (QEMU) query-cpu-model-expansion type=full model={"name":"max"}
       { "return": {
diff --git a/docs/virtio-net-failover.rst b/docs/virtio-net-failover.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/virtio-net-failover.rst
+++ b/docs/virtio-net-failover.rst
@@ -XXX,XX +XXX,XX @@
-========================
+======================================
 QEMU virtio-net standby (net_failover)
-========================
+======================================
 
 This document explains the setup and usage of virtio-net standby feature which
 is used to create a net_failover pair of devices.
diff --git a/docs/virtio-pmem.rst b/docs/virtio-pmem.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/virtio-pmem.rst
+++ b/docs/virtio-pmem.rst
@@ -XXX,XX +XXX,XX @@ virtio pmem usage
 -----------------
 
   A virtio pmem device backed by a memory-backend-file can be created on
-  the QEMU command line as in the following example:
+  the QEMU command line as in the following example::
 
-  -object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G
-  -device virtio-pmem-pci,memdev=mem1,id=nv1
+    -object memory-backend-file,id=mem1,share,mem-path=./virtio_pmem.img,size=4G
+    -device virtio-pmem-pci,memdev=mem1,id=nv1
 
-   where:
-   - "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"
-     creates a backend file with the specified size.
+  where:
 
-   - "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem
-     pci device whose storage is provided by above memory backend device.
+  - "object memory-backend-file,id=mem1,share,mem-path=<image>, size=<image size>"
+    creates a backend file with the specified size.
+
+  - "device virtio-pmem-pci,id=nvdimm1,memdev=mem1" creates a virtio pmem
+    pci device whose storage is provided by above memory backend device.
 
   Multiple virtio pmem devices can be created if multiple pairs of "-object"
   and "-device" are provided.
@@ -XXX,XX +XXX,XX @@ memory backing has to be added via 'object_add'; afterwards, the virtio
 pmem device can be added via 'device_add'.
 
 For example, the following commands add another 4GB virtio pmem device to
-the guest:
+the guest::
 
  (qemu) object_add memory-backend-file,id=mem2,share=on,mem-path=virtio_pmem2.img,size=4G
  (qemu) device_add virtio-pmem-pci,id=virtio_pmem2,memdev=mem2
-- 
2.23.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

From: Li Hangjing <lihangjing@baidu.com>

When the number of a virtio-blk device's virtqueues is larger than
BITS_PER_LONG, the out-of-bounds access to bitmap[ ] will occur.

Fixes: e21737ab15 ("virtio-blk: multiqueue batch notify")
Cc: qemu-stable@nongnu.org
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Li Hangjing <lihangjing@baidu.com>
Reviewed-by: Xie Yongji <xieyongji@baidu.com>
Reviewed-by: Chai Wen <chaiwen@baidu.com>
Message-id: 20191216023050.48620-1-lihangjing@baidu.com
Message-Id: <20191216023050.48620-1-lihangjing@baidu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/dataplane/virtio-blk.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void notify_guest_bh(void *opaque)
     memset(s->batch_notify_vqs, 0, sizeof(bitmap));
 
     for (j = 0; j < nvqs; j += BITS_PER_LONG) {
-        unsigned long bits = bitmap[j];
+        unsigned long bits = bitmap[j / BITS_PER_LONG];
 
         while (bits != 0) {
             unsigned i = j + ctzl(bits);
-- 
2.23.0

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

The event_notifier_*() prefix can be confused with the EventNotifier
APIs that are also called event_notifier_*().

Rename the functions to aio_context_notifier_*() to make it clear that
they relate to the AioContext::notifier field.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Message-id: 20200806131802.569478-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/async.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ static void aio_timerlist_notify(void *opaque, QEMUClockType type)
     aio_notify(opaque);
 }
 
-static void event_notifier_dummy_cb(EventNotifier *e)
+static void aio_context_notifier_dummy_cb(EventNotifier *e)
 {
 }
 
 /* Returns true if aio_notify() was called (e.g. a BH was scheduled) */
-static bool event_notifier_poll(void *opaque)
+static bool aio_context_notifier_poll(void *opaque)
 {
     EventNotifier *e = opaque;
     AioContext *ctx = container_of(e, AioContext, notifier);
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
 
     aio_set_event_notifier(ctx, &ctx->notifier,
                            false,
-                           event_notifier_dummy_cb,
-                           event_notifier_poll);
+                           aio_context_notifier_dummy_cb,
+                           aio_context_notifier_poll);
 #ifdef CONFIG_LINUX_AIO
     ctx->linux_aio = NULL;
 #endif
-- 
2.26.2

aio_notify() does not set ctx->notified when called with
ctx->aio_notify_me disabled. Therefore aio_notify_me needs to be enabled
during polling.

This is suboptimal since expensive event_notifier_set(&ctx->notifier)
and event_notifier_test_and_clear(&ctx->notifier) calls are required
when ctx->aio_notify_me is enabled.

Change aio_notify() so that aio->notified is always set, regardless of
ctx->aio_notify_me. This will make polling cheaper since
ctx->aio_notify_me can remain disabled. Move the
event_notifier_test_and_clear() to the fd handler function (which is now
no longer an empty function so "dummy" has been dropped from its name).

The next patch takes advantage of this by optimizing polling in
util/aio-posix.c.

[Paolo Bonzini pointed out that the smp_wmb() in aio_notify_accept()
should be smp_wb() but the comment should be smp_wmb() instead of
smp_wb(). Fixed.
--Stefan]

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/async.c | 32 +++++++++++++++++++++-----------
 1 file changed, 21 insertions(+), 11 deletions(-)

diff --git a/util/async.c b/util/async.c
index XXXXXXX..XXXXXXX 100644
--- a/util/async.c
+++ b/util/async.c
@@ -XXX,XX +XXX,XX @@ LuringState *aio_get_linux_io_uring(AioContext *ctx)
 
 void aio_notify(AioContext *ctx)
 {
-    /* Write e.g. bh->scheduled before reading ctx->notify_me.  Pairs
+    /*
+     * Write e.g. bh->flags before writing ctx->notified.  Pairs with smp_mb in
+     * aio_notify_accept.
+     */
+    smp_wmb();
+    atomic_set(&ctx->notified, true);
+
+    /*
+     * Write ctx->notified before reading ctx->notify_me.  Pairs
      * with smp_mb in aio_ctx_prepare or aio_poll.
      */
     smp_mb();
     if (atomic_read(&ctx->notify_me)) {
         event_notifier_set(&ctx->notifier);
-        atomic_mb_set(&ctx->notified, true);
     }
 }
 
 void aio_notify_accept(AioContext *ctx)
 {
-    if (atomic_xchg(&ctx->notified, false)
-#ifdef WIN32
-        || true
-#endif
-    ) {
-        event_notifier_test_and_clear(&ctx->notifier);
-    }
+    atomic_set(&ctx->notified, false);
+
+    /*
+     * Write ctx->notified before reading e.g. bh->flags.  Pairs with smp_wmb
+     * in aio_notify.
+     */
+    smp_mb();
 }
 
 static void aio_timerlist_notify(void *opaque, QEMUClockType type)
@@ -XXX,XX +XXX,XX @@ static void aio_timerlist_notify(void *opaque, QEMUClockType type)
     aio_notify(opaque);
 }
 
-static void aio_context_notifier_dummy_cb(EventNotifier *e)
+static void aio_context_notifier_cb(EventNotifier *e)
 {
+    AioContext *ctx = container_of(e, AioContext, notifier);
+
+    event_notifier_test_and_clear(&ctx->notifier);
 }
 
 /* Returns true if aio_notify() was called (e.g. a BH was scheduled) */
@@ -XXX,XX +XXX,XX @@ AioContext *aio_context_new(Error **errp)
 
     aio_set_event_notifier(ctx, &ctx->notifier,
                            false,
-                           aio_context_notifier_dummy_cb,
+                           aio_context_notifier_cb,
                            aio_context_notifier_poll);
 #ifdef CONFIG_LINUX_AIO
     ctx->linux_aio = NULL;
-- 
2.26.2

Polling only monitors the ctx->notified field and does not need the
ctx->notifier EventNotifier to be signalled. Keep ctx->aio_notify_me
disabled while polling to avoid unnecessary EventNotifier syscalls.

This optimization improves virtio-blk 4KB random read performance by
18%. The following results are with an IOThread and the null-co block
driver:

Test         IOPS   Error
Before  244518.62 ± 1.20%
After   290706.11 ± 0.44%

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-id: 20200806131802.569478-4-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 util/aio-posix.c | 47 +++++++++++++++++++++++++----------------------
 1 file changed, 25 insertions(+), 22 deletions(-)

diff --git a/util/aio-posix.c b/util/aio-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/util/aio-posix.c
+++ b/util/aio-posix.c
@@ -XXX,XX +XXX,XX @@ static bool remove_idle_poll_handlers(AioContext *ctx, int64_t now)
  *
  * Polls for a given time.
  *
- * Note that ctx->notify_me must be non-zero so this function can detect
- * aio_notify().
- *
  * Note that the caller must have incremented ctx->list_lock.
  *
  * Returns: true if progress was made, false otherwise
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
     bool progress;
     int64_t start_time, elapsed_time;
 
-    assert(ctx->notify_me);
     assert(qemu_lockcnt_count(&ctx->list_lock) > 0);
 
     trace_run_poll_handlers_begin(ctx, max_ns, *timeout);
@@ -XXX,XX +XXX,XX @@ static bool run_poll_handlers(AioContext *ctx, int64_t max_ns, int64_t *timeout)
  * @timeout: timeout for blocking wait, computed by the caller and updated if
  *    polling succeeds.
  *
- * ctx->notify_me must be non-zero so this function can detect aio_notify().
- *
  * Note that the caller must have incremented ctx->list_lock.
  *
  * Returns: true if progress was made, false otherwise
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
     AioHandlerList ready_list = QLIST_HEAD_INITIALIZER(ready_list);
     int ret = 0;
     bool progress;
+    bool use_notify_me;
     int64_t timeout;
     int64_t start = 0;
 
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
      */
     assert(in_aio_context_home_thread(ctx));
 
-    /* aio_notify can avoid the expensive event_notifier_set if
+    qemu_lockcnt_inc(&ctx->list_lock);
+
+    if (ctx->poll_max_ns) {
+        start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
+    }
+
+    timeout = blocking ? aio_compute_timeout(ctx) : 0;
+    progress = try_poll_mode(ctx, &timeout);
+    assert(!(timeout && progress));
+
+    /*
+     * aio_notify can avoid the expensive event_notifier_set if
      * everything (file descriptors, bottom halves, timers) will
      * be re-evaluated before the next blocking poll().  This is
      * already true when aio_poll is called with blocking == false;
      * if blocking == true, it is only true after poll() returns,
      * so disable the optimization now.
      */
-    if (blocking) {
+    use_notify_me = timeout != 0;
+    if (use_notify_me) {
         atomic_set(&ctx->notify_me, atomic_read(&ctx->notify_me) + 2);
         /*
-         * Write ctx->notify_me before computing the timeout
-         * (reading bottom half flags, etc.).  Pairs with
+         * Write ctx->notify_me before reading ctx->notified.  Pairs with
          * smp_mb in aio_notify().
          */
         smp_mb();
-    }
-
-    qemu_lockcnt_inc(&ctx->list_lock);
 
-    if (ctx->poll_max_ns) {
-        start = qemu_clock_get_ns(QEMU_CLOCK_REALTIME);
+        /* Don't block if aio_notify() was called */
+        if (atomic_read(&ctx->notified)) {
+            timeout = 0;
+        }
     }
 
-    timeout = blocking ? aio_compute_timeout(ctx) : 0;
-    progress = try_poll_mode(ctx, &timeout);
-    assert(!(timeout && progress));
-
     /* If polling is allowed, non-blocking aio_poll does not need the
      * system call---a single round of run_poll_handlers_once suffices.
      */
@@ -XXX,XX +XXX,XX @@ bool aio_poll(AioContext *ctx, bool blocking)
         ret = ctx->fdmon_ops->wait(ctx, &ready_list, timeout);
     }
 
-    if (blocking) {
+    if (use_notify_me) {
         /* Finish the poll before clearing the flag.  */
-        atomic_store_release(&ctx->notify_me, atomic_read(&ctx->notify_me) - 2);
-        aio_notify_accept(ctx);
+        atomic_store_release(&ctx->notify_me,
+                             atomic_read(&ctx->notify_me) - 2);
     }
 
+    aio_notify_accept(ctx);
+
     /* Adjust polling time */
     if (ctx->poll_max_ns) {
         int64_t block_ns = qemu_clock_get_ns(QEMU_CLOCK_REALTIME) - start;
-- 
2.26.2