The following changes since commit 1d60bb4b14601e38ed17384277aa4c30c57925d3:

Merge tag 'pull-request-2022-03-15v2' of https://gitlab.com/thuth/qemu into staging (2022-03-16 10:43:58 +0000)

are available in the Git repository at:

https://gitlab.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to fc8796465c6cd4091efe6a2f8b353f07324f49c7:

aio-posix: fix spurious ->poll_ready() callbacks in main loop (2022-03-17 11:23:18 +0000)

Bug fixes for 7.0.

Haiyue Wang (1):

aio-posix: fix build failure io_uring 2.2

aio-posix: fix spurious ->poll_ready() callbacks in main loop

util/aio-posix.h | 1 +

util/aio-posix.c | 32 ++++++++++++++++++--------------

util/fdmon-io_uring.c | 4 ++++

3 files changed, 23 insertions(+), 14 deletions(-)

2.35.1

When ->poll() succeeds the AioHandler is placed on the ready list with

revents set to the magic value 0. This magic value causes

aio_dispatch_handler() to invoke ->poll_ready() instead of ->io_read()

for G_IO_IN or ->io_write() for G_IO_OUT.

This magic value 0 hack works for the IOThread where AioHandlers are

placed on ->ready_list and processed by aio_dispatch_ready_handlers().

It does not work for the main loop where all AioHandlers are processed

by aio_dispatch_handlers(), even those that are not ready and have a

revents value of 0.

As a result the main loop invokes ->poll_ready() on AioHandlers that are

not ready. These spurious ->poll_ready() calls waste CPU cycles and

could lead to crashes if the code assumes ->poll() must have succeeded

before ->poll_ready() is called (a reasonable asumption but I haven't

seen it in practice).

Stop using revents to track whether ->poll_ready() will be called on an

AioHandler. Introduce a separate AioHandler->poll_ready field instead.

This eliminates spurious ->poll_ready() calls in the main loop.

Fixes: 826cc32423db2a99d184dbf4f507c737d7e7a4ae ("aio-posix: split poll check from ready handler")

Reported-by: Jason Wang <jasowang@redhat.com>

Tested-by: Jason Wang <jasowang@redhat.com>

Message-id: 20220223155703.136833-1-stefanha@redhat.com

util/aio-posix.h | 1 +

util/aio-posix.c | 32 ++++++++++++++++++--------------

2 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/util/aio-posix.h b/util/aio-posix.h

--- a/util/aio-posix.h

+++ b/util/aio-posix.h

@@ -XXX,XX +XXX,XX @@ struct AioHandler {

unsigned flags; /* see fdmon-io_uring.c */

#endif

int64_t poll_idle_timeout; /* when to stop userspace polling */

+ bool poll_ready; /* has polling detected an event? */

bool is_external;

};

diff --git a/util/aio-posix.c b/util/aio-posix.c

index XXXXXXX..XXXXXXX 100644

--- a/util/aio-posix.c

+++ b/util/aio-posix.c

@@ -XXX,XX +XXX,XX @@

#include "trace.h"

#include "aio-posix.h"

-/*

- * G_IO_IN and G_IO_OUT are not appropriate revents values for polling, since

- * the handler may not need to access the file descriptor. For example, the

- * handler doesn't need to read from an EventNotifier if it polled a memory

- * location and a read syscall would be slow. Define our own unique revents

- * value to indicate that polling determined this AioHandler is ready.

- */

-#define REVENTS_POLL_READY 0

/* Stop userspace polling on a handler if it isn't active for some time */

#define POLL_IDLE_INTERVAL_NS (7 * NANOSECONDS_PER_SECOND)

@@ -XXX,XX +XXX,XX @@ void aio_add_ready_handler(AioHandlerList *ready_list,

QLIST_INSERT_HEAD(ready_list, node, node_ready);

2.35.1

From: Haiyue Wang <haiyue.wang@intel.com>

The io_uring fixed "Don't truncate addr fields to 32-bit on 32-bit":

https://git.kernel.dk/cgit/liburing/commit/?id=d84c29b19ed0b130000619cff40141bb1fc3615b

This leads to build failure:

../util/fdmon-io_uring.c: In function ‘add_poll_remove_sqe’:

../util/fdmon-io_uring.c:182:36: error: passing argument 2 of ‘io_uring_prep_poll_remove’ makes integer from pointer without a cast [-Werror=int-conversion]

182 | io_uring_prep_poll_remove(sqe, node);

| ^~~~

| |

| AioHandler *

In file included from /root/io/qemu/include/block/aio.h:18,

from ../util/aio-posix.h:20,

from ../util/fdmon-io_uring.c:49:

/usr/include/liburing.h:415:17: note: expected ‘__u64’ {aka ‘long long unsigned int’} but argument is of type ‘AioHandler *’

415 | __u64 user_data)

| ~~~~~~^~~~~~~~~

cc1: all warnings being treated as errors

Use LIBURING_HAVE_DATA64 to check whether the io_uring supports 64-bit

variants of the get/set userdata, to convert the paramter to the right

data type.

Signed-off-by: Haiyue Wang <haiyue.wang@intel.com>

Message-Id: <20220221162401.45415-1-haiyue.wang@intel.com>

util/fdmon-io_uring.c | 4 ++++

1 file changed, 4 insertions(+)

diff --git a/util/fdmon-io_uring.c b/util/fdmon-io_uring.c

--- a/util/fdmon-io_uring.c

+++ b/util/fdmon-io_uring.c

@@ -XXX,XX +XXX,XX @@ static void add_poll_remove_sqe(AioContext *ctx, AioHandler *node)

struct io_uring_sqe *sqe = get_sqe(ctx);

+#ifdef LIBURING_HAVE_DATA64

+ io_uring_prep_poll_remove(sqe, (__u64)(uintptr_t)node);

+#else

io_uring_prep_poll_remove(sqe, node);

+#endif

/* Add a timeout that self-cancels when another cqe becomes ready */

2.35.1