Series comparison

-[PULL 00/13] Block patches
+[Qemu-devel] [PULL v2 00/23] Block patches
-The following changes since commit 79fc2fb685f35a5e71e23629760ef4025d6aba31:
+The following changes since commit eaefea537b476cb853e2edbdc68e969ec777e4bb:
-  Merge tag 'trivial-branch-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-10-25 11:37:17 -0400)
+  Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into staging (2017-12-18 14:17:42 +0000)
 are available in the Git repository at:
-  https://gitlab.com/stefanha/qemu.git tags/block-pull-request
+  git://github.com/stefanha/qemu.git tags/block-pull-request
-for you to fetch changes up to baf422684d73c7bf38e2c18815e18d44fcf395b6:
+for you to fetch changes up to 7a9dda0d7f9831c2432620dcfefdadbb7ae888dc:
-  virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint (2022-10-26 14:56:42 -0400)
+  qemu-iotests: add 203 savevm with IOThreads test (2017-12-19 10:25:09 +0000)
 ----------------------------------------------------------------
 Pull request
+v2:
+ * Fixed incorrect virtio_blk_data_plane_create() local_err refactoring in
+   "hw/block: Use errp directly rather than local_err" that broke virtio-blk
+   over virtio-mmio [Peter]
 ----------------------------------------------------------------
-Stefan Hajnoczi (13):
+Mao Zhongyi (4):
-  coroutine: add flag to re-queue at front of CoQueue
+  hw/block/nvme: Convert to realize
-  blkio: add libblkio block driver
+  hw/block: Fix the return type
-  numa: call ->ram_block_removed() in ram_block_notifer_remove()
+  hw/block: Use errp directly rather than local_err
-  block: pass size to bdrv_unregister_buf()
+  dev-storage: Fix the unusual function name
   block: use BdrvRequestFlags type for supported flag fields
   block: add BDRV_REQ_REGISTERED_BUF request flag
   block: return errors from bdrv_register_buf()
   numa: use QLIST_FOREACH_SAFE() for RAM block notifiers
   block: add BlockRAMRegistrar
   exec/cpu-common: add qemu_ram_get_fd()
   stubs: add qemu_ram_block_from_host() and qemu_ram_get_fd()
   blkio: implement BDRV_REQ_REGISTERED_BUF optimization
   virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint
- MAINTAINERS                                 |    7 +
+Mark Kanda (2):
- meson_options.txt                           |    2 +
+  virtio-blk: make queue size configurable
- qapi/block-core.json                        |   77 +-
+  virtio-blk: reject configs with logical block size > physical block
- meson.build                                 |    9 +
+    size
- include/block/block-common.h                |    9 +
- include/block/block-global-state.h          |   10 +-
+Paolo Bonzini (1):
- include/block/block_int-common.h            |   15 +-
+  block: avoid recursive AioContext acquire in bdrv_inactivate_all()
- include/exec/cpu-common.h                   |    1 +
- include/hw/virtio/virtio-blk.h              |    2 +
+Stefan Hajnoczi (16):
- include/qemu/coroutine.h                    |   15 +-
+  coroutine: simplify co_aio_sleep_ns() prototype
- include/sysemu/block-backend-global-state.h |    4 +-
+  qdev: drop unused #include "sysemu/iothread.h"
- include/sysemu/block-ram-registrar.h        |   37 +
+  blockdev: hold AioContext for bdrv_unref() in
- block.c                                     |   14 +
+    external_snapshot_clean()
- block/blkio.c                               | 1008 +++++++++++++++++++
+  block: don't keep AioContext acquired after
- block/blkverify.c                           |    4 +-
+    external_snapshot_prepare()
- block/block-backend.c                       |    8 +-
+  block: don't keep AioContext acquired after drive_backup_prepare()
- block/block-ram-registrar.c                 |   58 ++
+  block: don't keep AioContext acquired after blockdev_backup_prepare()
- block/crypto.c                              |    4 +-
+  block: don't keep AioContext acquired after
- block/file-posix.c                          |    1 -
+    internal_snapshot_prepare()
- block/gluster.c                             |    1 -
+  block: drop unused BlockDirtyBitmapState->aio_context field
- block/io.c                                  |  101 +-
+  iothread: add iothread_by_id() API
- block/mirror.c                              |    2 +
+  blockdev: add x-blockdev-set-iothread testing command
- block/nbd.c                                 |    1 -
+  qemu-iotests: add 202 external snapshots IOThread test
- block/nvme.c                                |   20 +-
+  docs: mark nested AioContext locking as a legacy API
- block/parallels.c                           |    1 -
+  blockdev: add x-blockdev-set-iothread force boolean
- block/qcow.c                                |    2 -
+  iotests: add VM.add_object()
- block/qed.c                                 |    1 -
+  iothread: fix iothread_stop() race condition
- block/raw-format.c                          |    2 +
+  qemu-iotests: add 203 savevm with IOThreads test
- block/replication.c                         |    1 -
- block/ssh.c                                 |    1 -
+ docs/devel/multiple-iothreads.txt |   7 +-
- block/vhdx.c                                |    1 -
+ qapi/block-core.json              |  40 ++++++
- hw/block/virtio-blk.c                       |   39 +-
+ hw/block/dataplane/virtio-blk.h   |   2 +-
- hw/core/numa.c                              |   26 +-
+ include/hw/block/block.h          |   4 +-
- qemu-img.c                                  |    6 +-
+ include/hw/virtio/virtio-blk.h    |   1 +
- softmmu/physmem.c                           |    5 +
+ include/qemu/coroutine.h          |   6 +-
- stubs/physmem.c                             |   13 +
+ include/sysemu/iothread.h         |   4 +-
- tests/qtest/modules-test.c                  |    3 +
+ block.c                           |  14 ++-
- util/qemu-coroutine-lock.c                  |    9 +-
+ block/null.c                      |   3 +-
- util/vfio-helpers.c                         |    5 +-
+ block/sheepdog.c                  |   3 +-
- block/meson.build                           |    2 +
+ blockdev.c                        | 259 +++++++++++++++++++++++++++-----------
- scripts/meson-buildoptions.sh               |    3 +
+ hw/block/block.c                  |  15 ++-
- stubs/meson.build                           |    1 +
+ hw/block/dataplane/virtio-blk.c   |  12 +-
-files changed, 1435 insertions(+), 96 deletions(-)
+ hw/block/fdc.c                    |  17 +--
- create mode 100644 include/sysemu/block-ram-registrar.h
+ hw/block/nvme.c                   |  23 ++--
- create mode 100644 block/blkio.c
+ hw/block/virtio-blk.c             |  30 +++--
- create mode 100644 block/block-ram-registrar.c
+ hw/core/qdev-properties-system.c  |   1 -
- create mode 100644 stubs/physmem.c
+ hw/ide/qdev.c                     |  12 +-
  hw/scsi/scsi-disk.c               |  13 +-
  hw/usb/dev-storage.c              |  29 ++---
  iothread.c                        |  27 +++-
  util/qemu-coroutine-sleep.c       |   4 +-
  tests/qemu-iotests/202            |  95 ++++++++++++++
  tests/qemu-iotests/202.out        |  11 ++
  tests/qemu-iotests/203            |  59 +++++++++
  tests/qemu-iotests/203.out        |   6 +
  tests/qemu-iotests/group          |   2 +
  tests/qemu-iotests/iotests.py     |   5 +
 files changed, 531 insertions(+), 173 deletions(-)
  create mode 100755 tests/qemu-iotests/202
  create mode 100644 tests/qemu-iotests/202.out
  create mode 100755 tests/qemu-iotests/203
  create mode 100644 tests/qemu-iotests/203.out
 --
-.37.3
+.14.3

-[PULL 01/13] coroutine: add flag to re-queue at front of CoQueue
+[Qemu-devel] [PULL v2 01/23] coroutine: simplify co_aio_sleep_ns() prototype
-When a coroutine wakes up it may determine that it must re-queue.
+The AioContext pointer argument to co_aio_sleep_ns() is only used for
-Normally coroutines are pushed onto the back of the CoQueue, but for
+the sleep timer.  It does not affect where the caller coroutine is
-fairness it may be necessary to push it onto the front of the CoQueue.
+resumed.
-Add a flag to specify that the coroutine should be pushed onto the front
+Due to changes to coroutine and AIO APIs it is now possible to drop the
-of the CoQueue. A later patch will use this to ensure fairness in the
+AioContext pointer argument.  This is safe to do since no caller has
-bounce buffer CoQueue used by the blkio BlockDriver.
+specific requirements for which AioContext the timer must run in.
+This patch drops the AioContext pointer argument and renames the
+function to simplify the API.
+Reported-by: Paolo Bonzini <pbonzini@redhat.com>
+Reported-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20221013185908.1297568-2-stefanha@redhat.com
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171109102652.6360-1-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/qemu/coroutine.h   | 15 +++++++++++++--
+ include/qemu/coroutine.h    | 6 +-----
- util/qemu-coroutine-lock.c |  9 +++++++--
+ block/null.c                | 3 +--
-files changed, 20 insertions(+), 4 deletions(-)
+ block/sheepdog.c            | 3 +--
  util/qemu-coroutine-sleep.c | 4 ++--
 files changed, 5 insertions(+), 11 deletions(-)
 diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/qemu/coroutine.h
 +++ b/include/qemu/coroutine.h
-@@ -XXX,XX +XXX,XX @@ typedef struct CoQueue {
+@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_unlock(CoRwlock *lock);
  /**
   * Yield the coroutine for a given duration
 - *
 - * Behaves similarly to co_sleep_ns(), but the sleeping coroutine will be
 - * resumed when using aio_poll().
   */
- void qemu_co_queue_init(CoQueue *queue);
+-void coroutine_fn co_aio_sleep_ns(AioContext *ctx, QEMUClockType type,
+-                                  int64_t ns);
-+typedef enum {
++void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns);
-+    /*
 +     * Enqueue at front instead of back. Use this to re-queue a request when
 +     * its wait condition is not satisfied after being woken up.
 +     */
 +    CO_QUEUE_WAIT_FRONT = 0x1,
 +} CoQueueWaitFlags;
 +
  /**
-  * Adds the current coroutine to the CoQueue and transfers control to the
+  * Yield until a file descriptor becomes readable
-  * caller of the coroutine.  The mutex is unlocked during the wait and
+diff --git a/block/null.c b/block/null.c
   * locked again afterwards.
   */
  #define qemu_co_queue_wait(queue, lock) \
 -    qemu_co_queue_wait_impl(queue, QEMU_MAKE_LOCKABLE(lock))
 -void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock);
 +    qemu_co_queue_wait_impl(queue, QEMU_MAKE_LOCKABLE(lock), 0)
 +#define qemu_co_queue_wait_flags(queue, lock, flags) \
 +    qemu_co_queue_wait_impl(queue, QEMU_MAKE_LOCKABLE(lock), (flags))
 +void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock,
 +                                          CoQueueWaitFlags flags);
  /**
   * Removes the next coroutine from the CoQueue, and queue it to run after
 diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
 index XXXXXXX..XXXXXXX 100644
---- a/util/qemu-coroutine-lock.c
+--- a/block/null.c
-+++ b/util/qemu-coroutine-lock.c
++++ b/block/null.c
-@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_init(CoQueue *queue)
+@@ -XXX,XX +XXX,XX @@ static coroutine_fn int null_co_common(BlockDriverState *bs)
-     QSIMPLEQ_INIT(&queue->entries);
+     BDRVNullState *s = bs->opaque;
      if (s->latency_ns) {
 -        co_aio_sleep_ns(bdrv_get_aio_context(bs), QEMU_CLOCK_REALTIME,
 -                        s->latency_ns);
 +        qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, s->latency_ns);
      }
      return 0;
  }
+diff --git a/block/sheepdog.c b/block/sheepdog.c
--void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock)
+index XXXXXXX..XXXXXXX 100644
-+void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock,
+--- a/block/sheepdog.c
-+                                          CoQueueWaitFlags flags)
++++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
          if (s->fd < 0) {
              DPRINTF("Wait for connection to be established\n");
              error_report_err(local_err);
 -            co_aio_sleep_ns(bdrv_get_aio_context(s->bs), QEMU_CLOCK_REALTIME,
 -                            1000000000ULL);
 +            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000000ULL);
          }
      };
 diff --git a/util/qemu-coroutine-sleep.c b/util/qemu-coroutine-sleep.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/qemu-coroutine-sleep.c
 +++ b/util/qemu-coroutine-sleep.c
@@ -XXX,XX +XXX,XX @@ static void co_sleep_cb(void *opaque)
      aio_co_wake(sleep_cb->co);
  }
 -void coroutine_fn co_aio_sleep_ns(AioContext *ctx, QEMUClockType type,
 -                                  int64_t ns)
 +void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns)
  {
-     Coroutine *self = qemu_coroutine_self();
++    AioContext *ctx = qemu_get_current_aio_context();
--    QSIMPLEQ_INSERT_TAIL(&queue->entries, self, co_queue_next);
+     CoSleepCB sleep_cb = {
-+    if (flags & CO_QUEUE_WAIT_FRONT) {
+         .co = qemu_coroutine_self(),
-+        QSIMPLEQ_INSERT_HEAD(&queue->entries, self, co_queue_next);
+     };
 +    } else {
 +        QSIMPLEQ_INSERT_TAIL(&queue->entries, self, co_queue_next);
 +    }
      if (lock) {
          qemu_lockable_unlock(lock);
 --
-.37.3
+.14.3

-New patch
+[Qemu-devel] [PULL v2 02/23] hw/block/nvme: Convert to realize
+From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+Convert nvme_init() to realize and rename it to nvme_realize().
+Cc: John Snow <jsnow@redhat.com>
+Cc: Keith Busch <keith.busch@intel.com>
+Cc: Kevin Wolf <kwolf@redhat.com>
+Cc: Max Reitz <mreitz@redhat.com>
+Cc: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+Message-id: 2882e72d795e04cbe2120f569d551aef2467ac60.1511317952.git.maozy.fnst@cn.fujitsu.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/block/nvme.c | 18 ++++++++++--------
+file changed, 10 insertions(+), 8 deletions(-)
+diff --git a/hw/block/nvme.c b/hw/block/nvme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/block/nvme.c
++++ b/hw/block/nvme.c
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvme_cmb_ops = {
+     },
+ };
+-static int nvme_init(PCIDevice *pci_dev)
++static void nvme_realize(PCIDevice *pci_dev, Error **errp)
+ {
+     NvmeCtrl *n = NVME(pci_dev);
+     NvmeIdCtrl *id = &n->id_ctrl;
+@@ -XXX,XX +XXX,XX @@ static int nvme_init(PCIDevice *pci_dev)
+     Error *local_err = NULL;
+     if (!n->conf.blk) {
+-        return -1;
++        error_setg(errp, "drive property not set");
++        return;
+     }
+     bs_size = blk_getlength(n->conf.blk);
+     if (bs_size < 0) {
+-        return -1;
++        error_setg(errp, "could not get backing file size");
++        return;
+     }
+     blkconf_serial(&n->conf, &n->serial);
+     if (!n->serial) {
+-        return -1;
++        error_setg(errp, "serial property not set");
++        return;
+     }
+     blkconf_blocksizes(&n->conf);
+     blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
+                                   false, &local_err);
+     if (local_err) {
+-        error_report_err(local_err);
+-        return -1;
++        error_propagate(errp, local_err);
++        return;
+     }
+     pci_conf = pci_dev->config;
+@@ -XXX,XX +XXX,XX @@ static int nvme_init(PCIDevice *pci_dev)
+             cpu_to_le64(n->ns_size >>
+                 id_ns->lbaf[NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas)].ds);
+     }
+-    return 0;
+ }
+ static void nvme_exit(PCIDevice *pci_dev)
+@@ -XXX,XX +XXX,XX @@ static void nvme_class_init(ObjectClass *oc, void *data)
+     DeviceClass *dc = DEVICE_CLASS(oc);
+     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
+-    pc->init = nvme_init;
++    pc->realize = nvme_realize;
+     pc->exit = nvme_exit;
+     pc->class_id = PCI_CLASS_STORAGE_EXPRESS;
+     pc->vendor_id = PCI_VENDOR_ID_INTEL;
+--
+.14.3

-[PULL 07/13] block: return errors from bdrv_register_buf()
+[Qemu-devel] [PULL v2 03/23] hw/block: Fix the return type
-Registering an I/O buffer is only a performance optimization hint but it
+From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 is still necessary to return errors when it fails.
-Later patches will need to detect errors when registering buffers but an
+When the function no success value to transmit, it usually make the
-immediate advantage is that error_report() calls are no longer needed in
+function return void. It has turned out not to be a success, because
-block driver .bdrv_register_buf() functions.
+it means that the extra local_err variable and error_propagate() will
 be needed. It leads to cumbersome code, therefore, transmit success/
 failure in the return value is worth.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+So fix the return type of blkconf_apply_backend_options(),
-Message-id: 20221013185908.1297568-8-stefanha@redhat.com
+blkconf_geometry() and virtio_blk_data_plane_create() to avoid it.
 Cc: John Snow <jsnow@redhat.com>
 Cc: Kevin Wolf <kwolf@redhat.com>
 Cc: Max Reitz <mreitz@redhat.com>
 Cc: Stefan Hajnoczi <stefanha@redhat.com>
 Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: ac0edc1fc70c4457e5cec94405eb7d1f89f9c2c1.1511317952.git.maozy.fnst@cn.fujitsu.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/block/block-global-state.h          |  5 ++-
+ hw/block/dataplane/virtio-blk.h |  2 +-
- include/block/block_int-common.h            |  5 ++-
+ include/hw/block/block.h        |  4 ++--
- include/sysemu/block-backend-global-state.h |  2 +-
+ hw/block/block.c                | 15 +++++++++------
- block/block-backend.c                       |  4 +--
+ hw/block/dataplane/virtio-blk.c | 12 +++++++-----
- block/io.c                                  | 34 +++++++++++++++++++--
+files changed, 19 insertions(+), 14 deletions(-)
  block/nvme.c                                | 18 +++++------
  qemu-img.c                                  |  2 +-
 files changed, 52 insertions(+), 18 deletions(-)
-diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
+diff --git a/hw/block/dataplane/virtio-blk.h b/hw/block/dataplane/virtio-blk.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/block/block-global-state.h
+--- a/hw/block/dataplane/virtio-blk.h
-+++ b/include/block/block-global-state.h
++++ b/hw/block/dataplane/virtio-blk.h
-@@ -XXX,XX +XXX,XX @@ void bdrv_del_child(BlockDriverState *parent, BdrvChild *child, Error **errp);
+@@ -XXX,XX +XXX,XX @@
-  *
-  * Buffers must not overlap and they must be unregistered with the same <host,
+ typedef struct VirtIOBlockDataPlane VirtIOBlockDataPlane;
-  * size> values that they were registered with.
-+ *
+-void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
-+ * Returns: true on success, false on failure
++bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
-  */
+                                   VirtIOBlockDataPlane **dataplane,
--void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size);
+                                   Error **errp);
-+bool bdrv_register_buf(BlockDriverState *bs, void *host, size_t size,
+ void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s);
-+                       Error **errp);
+diff --git a/include/hw/block/block.h b/include/hw/block/block.h
  void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size);
  void bdrv_cancel_in_flight(BlockDriverState *bs);
 diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
 index XXXXXXX..XXXXXXX 100644
---- a/include/block/block_int-common.h
+--- a/include/hw/block/block.h
-+++ b/include/block/block_int-common.h
++++ b/include/hw/block/block.h
-@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
+@@ -XXX,XX +XXX,XX @@ static inline unsigned int get_physical_block_exp(BlockConf *conf)
-      * that it can do IOMMU mapping with VFIO etc., in order to get better
+ /* Configuration helpers */
-      * performance. In the case of VFIO drivers, this callback is used to do
-      * DMA mapping for hot buffers.
+ void blkconf_serial(BlockConf *conf, char **serial);
-+     *
+-void blkconf_geometry(BlockConf *conf, int *trans,
-+     * Returns: true on success, false on failure
++bool blkconf_geometry(BlockConf *conf, int *trans,
-      */
+                       unsigned cyls_max, unsigned heads_max, unsigned secs_max,
--    void (*bdrv_register_buf)(BlockDriverState *bs, void *host, size_t size);
+                       Error **errp);
-+    bool (*bdrv_register_buf)(BlockDriverState *bs, void *host, size_t size,
+ void blkconf_blocksizes(BlockConf *conf);
-+                              Error **errp);
+-void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
-     void (*bdrv_unregister_buf)(BlockDriverState *bs, void *host, size_t size);
++bool blkconf_apply_backend_options(BlockConf *conf, bool readonly,
+                                    bool resizable, Error **errp);
-     /*
-diff --git a/include/sysemu/block-backend-global-state.h b/include/sysemu/block-backend-global-state.h
+ /* Hard disk geometry */
 diff --git a/hw/block/block.c b/hw/block/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/sysemu/block-backend-global-state.h
+--- a/hw/block/block.c
-+++ b/include/sysemu/block-backend-global-state.h
++++ b/hw/block/block.c
-@@ -XXX,XX +XXX,XX @@ void blk_io_limits_enable(BlockBackend *blk, const char *group);
+@@ -XXX,XX +XXX,XX @@ void blkconf_blocksizes(BlockConf *conf)
  void blk_io_limits_update_group(BlockBackend *blk, const char *group);
  void blk_set_force_allow_inactivate(BlockBackend *blk);
 -void blk_register_buf(BlockBackend *blk, void *host, size_t size);
 +bool blk_register_buf(BlockBackend *blk, void *host, size_t size, Error **errp);
  void blk_unregister_buf(BlockBackend *blk, void *host, size_t size);
  const BdrvChild *blk_root(BlockBackend *blk);
 diff --git a/block/block-backend.c b/block/block-backend.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter)
      }
  }
--void blk_register_buf(BlockBackend *blk, void *host, size_t size)
+-void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
-+bool blk_register_buf(BlockBackend *blk, void *host, size_t size, Error **errp)
++bool blkconf_apply_backend_options(BlockConf *conf, bool readonly,
                                     bool resizable, Error **errp)
  {
-     GLOBAL_STATE_CODE();
+     BlockBackend *blk = conf->blk;
--    bdrv_register_buf(blk_bs(blk), host, size);
+@@ -XXX,XX +XXX,XX @@ void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
-+    return bdrv_register_buf(blk_bs(blk), host, size, errp);
      ret = blk_set_perm(blk, perm, shared_perm, errp);
      if (ret < 0) {
 -        return;
 +        return false;
      }
      switch (conf->wce) {
@@ -XXX,XX +XXX,XX @@ void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
      blk_set_enable_write_cache(blk, wce);
      blk_set_on_error(blk, rerror, werror);
 +
 +    return true;
  }
- void blk_unregister_buf(BlockBackend *blk, void *host, size_t size)
+-void blkconf_geometry(BlockConf *conf, int *ptrans,
-diff --git a/block/io.c b/block/io.c
++bool blkconf_geometry(BlockConf *conf, int *ptrans,
-index XXXXXXX..XXXXXXX 100644
+                       unsigned cyls_max, unsigned heads_max, unsigned secs_max,
---- a/block/io.c
+                       Error **errp)
 +++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_io_unplug(BlockDriverState *bs)
      }
  }
 -void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size)
 +/* Helper that undoes bdrv_register_buf() when it fails partway through */
 +static void bdrv_register_buf_rollback(BlockDriverState *bs,
 +                                       void *host,
 +                                       size_t size,
 +                                       BdrvChild *final_child)
 +{
 +    BdrvChild *child;
 +
 +    QLIST_FOREACH(child, &bs->children, next) {
 +        if (child == final_child) {
 +            break;
 +        }
 +
 +        bdrv_unregister_buf(child->bs, host, size);
 +    }
 +
 +    if (bs->drv && bs->drv->bdrv_unregister_buf) {
 +        bs->drv->bdrv_unregister_buf(bs, host, size);
 +    }
 +}
 +
 +bool bdrv_register_buf(BlockDriverState *bs, void *host, size_t size,
 +                       Error **errp)
  {
-     BdrvChild *child;
+@@ -XXX,XX +XXX,XX @@ void blkconf_geometry(BlockConf *conf, int *ptrans,
+     if (conf->cyls || conf->heads || conf->secs) {
-     GLOBAL_STATE_CODE();
+         if (conf->cyls < 1 || conf->cyls > cyls_max) {
-     if (bs->drv && bs->drv->bdrv_register_buf) {
+             error_setg(errp, "cyls must be between 1 and %u", cyls_max);
--        bs->drv->bdrv_register_buf(bs, host, size);
+-            return;
 +        if (!bs->drv->bdrv_register_buf(bs, host, size, errp)) {
 +            return false;
-+        }
+         }
-     }
+         if (conf->heads < 1 || conf->heads > heads_max) {
-     QLIST_FOREACH(child, &bs->children, next) {
+             error_setg(errp, "heads must be between 1 and %u", heads_max);
--        bdrv_register_buf(child->bs, host, size);
+-            return;
 +        if (!bdrv_register_buf(child->bs, host, size, errp)) {
 +            bdrv_register_buf_rollback(bs, host, size, child);
 +            return false;
-+        }
+         }
          if (conf->secs < 1 || conf->secs > secs_max) {
              error_setg(errp, "secs must be between 1 and %u", secs_max);
 -            return;
 +            return false;
          }
      }
 +    return true;
  }
+diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
  void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size)
 diff --git a/block/nvme.c b/block/nvme.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/nvme.c
+--- a/hw/block/dataplane/virtio-blk.c
-+++ b/block/nvme.c
++++ b/hw/block/dataplane/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@ static void nvme_aio_unplug(BlockDriverState *bs)
+@@ -XXX,XX +XXX,XX @@ static void notify_guest_bh(void *opaque)
  }
  /* Context: QEMU global mutex held */
 -void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
 +bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
                                    VirtIOBlockDataPlane **dataplane,
                                    Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
              error_setg(errp,
                         "device is incompatible with iothread "
                         "(transport does not support notifiers)");
 -            return;
 +            return false;
          }
          if (!virtio_device_ioeventfd_enabled(vdev)) {
              error_setg(errp, "ioeventfd is required for iothread");
 -            return;
 +            return false;
          }
          /* If dataplane is (re-)enabled while the guest is running there could
@@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
           */
          if (blk_op_is_blocked(conf->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
              error_prepend(errp, "cannot start virtio-blk dataplane: ");
 -            return;
 +            return false;
          }
      }
+     /* Don't try if transport does not support notifiers. */
+     if (!virtio_device_ioeventfd_enabled(vdev)) {
+-        return;
++        return false;
+     }
+     s = g_new0(VirtIOBlockDataPlane, 1);
+@@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
+     s->batch_notify_vqs = bitmap_new(conf->num_queues);
+     *dataplane = s;
++
++    return true;
  }
--static void nvme_register_buf(BlockDriverState *bs, void *host, size_t size)
+ /* Context: QEMU global mutex held */
 +static bool nvme_register_buf(BlockDriverState *bs, void *host, size_t size,
 +                              Error **errp)
  {
      int ret;
 -    Error *local_err = NULL;
      BDRVNVMeState *s = bs->opaque;
 -    ret = qemu_vfio_dma_map(s->vfio, host, size, false, NULL, &local_err);
 -    if (ret) {
 -        /* FIXME: we may run out of IOVA addresses after repeated
 -         * bdrv_register_buf/bdrv_unregister_buf, because nvme_vfio_dma_unmap
 -         * doesn't reclaim addresses for fixed mappings. */
 -        error_reportf_err(local_err, "nvme_register_buf failed: ");
 -    }
 +    /*
 +     * FIXME: we may run out of IOVA addresses after repeated
 +     * bdrv_register_buf/bdrv_unregister_buf, because nvme_vfio_dma_unmap
 +     * doesn't reclaim addresses for fixed mappings.
 +     */
 +    ret = qemu_vfio_dma_map(s->vfio, host, size, false, NULL, errp);
 +    return ret == 0;
  }
  static void nvme_unregister_buf(BlockDriverState *bs, void *host, size_t size)
 diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_bench(int argc, char **argv)
      data.buf = blk_blockalign(blk, buf_size);
      memset(data.buf, pattern, data.nrreq * data.bufsize);
 -    blk_register_buf(blk, data.buf, buf_size);
 +    blk_register_buf(blk, data.buf, buf_size, &error_fatal);
      data.qiov = g_new(QEMUIOVector, data.nrreq);
      for (i = 0; i < data.nrreq; i++) {
 --
-.37.3
+.14.3

-New patch
+[Qemu-devel] [PULL v2 04/23] hw/block: Use errp directly rather than local_err
+From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 [Drop virtio_blk_data_plane_create() change that misinterprets return
 value when the virtio transport does not support dataplane.
 --Stefan]
 Cc: John Snow <jsnow@redhat.com>
 Cc: Kevin Wolf <kwolf@redhat.com>
 Cc: Max Reitz <mreitz@redhat.com>
 Cc: Keith Busch <keith.busch@intel.com>
 Cc: Stefan Hajnoczi <stefanha@redhat.com>
 Cc: "Michael S. Tsirkin" <mst@redhat.com>
 Cc: Paolo Bonzini <pbonzini@redhat.com>
 Cc: Gerd Hoffmann <kraxel@redhat.com>
 Cc: Markus Armbruster <armbru@redhat.com>
 Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: e77848d3735ba590f23ffbf8094379c646c33d79.1511317952.git.maozy.fnst@cn.fujitsu.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  hw/block/fdc.c        | 17 ++++++-----------
  hw/block/nvme.c       |  7 ++-----
  hw/block/virtio-blk.c | 13 +++++--------
  hw/ide/qdev.c         | 12 ++++--------
  hw/scsi/scsi-disk.c   | 13 ++++---------
  hw/usb/dev-storage.c  |  9 +++------
 files changed, 24 insertions(+), 47 deletions(-)
 diff --git a/hw/block/fdc.c b/hw/block/fdc.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/block/fdc.c
 +++ b/hw/block/fdc.c
@@ -XXX,XX +XXX,XX @@ static void fd_revalidate(FDrive *drv)
  static void fd_change_cb(void *opaque, bool load, Error **errp)
  {
      FDrive *drive = opaque;
 -    Error *local_err = NULL;
      if (!load) {
          blk_set_perm(drive->blk, 0, BLK_PERM_ALL, &error_abort);
      } else {
 -        blkconf_apply_backend_options(drive->conf,
 -                                      blk_is_read_only(drive->blk), false,
 -                                      &local_err);
 -        if (local_err) {
 -            error_propagate(errp, local_err);
 +        if (!blkconf_apply_backend_options(drive->conf,
 +                                           blk_is_read_only(drive->blk), false,
 +                                           errp)) {
              return;
          }
      }
@@ -XXX,XX +XXX,XX @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp)
      FloppyDrive *dev = FLOPPY_DRIVE(qdev);
      FloppyBus *bus = FLOPPY_BUS(qdev->parent_bus);
      FDrive *drive;
 -    Error *local_err = NULL;
      int ret;
      if (dev->unit == -1) {
@@ -XXX,XX +XXX,XX @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp)
      dev->conf.rerror = BLOCKDEV_ON_ERROR_AUTO;
      dev->conf.werror = BLOCKDEV_ON_ERROR_AUTO;
 -    blkconf_apply_backend_options(&dev->conf, blk_is_read_only(dev->conf.blk),
 -                                  false, &local_err);
 -    if (local_err) {
 -        error_propagate(errp, local_err);
 +    if (!blkconf_apply_backend_options(&dev->conf,
 +                                       blk_is_read_only(dev->conf.blk),
 +                                       false, errp)) {
          return;
      }
 diff --git a/hw/block/nvme.c b/hw/block/nvme.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/block/nvme.c
 +++ b/hw/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
      int i;
      int64_t bs_size;
      uint8_t *pci_conf;
 -    Error *local_err = NULL;
      if (!n->conf.blk) {
          error_setg(errp, "drive property not set");
@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
          return;
      }
      blkconf_blocksizes(&n->conf);
 -    blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
 -                                  false, &local_err);
 -    if (local_err) {
 -        error_propagate(errp, local_err);
 +    if (!blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
 +                                       false, errp)) {
          return;
      }
 diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/block/virtio-blk.c
 +++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
      }
      blkconf_serial(&conf->conf, &conf->serial);
 -    blkconf_apply_backend_options(&conf->conf,
 -                                  blk_is_read_only(conf->conf.blk), true,
 -                                  &err);
 -    if (err) {
 -        error_propagate(errp, err);
 +    if (!blkconf_apply_backend_options(&conf->conf,
 +                                       blk_is_read_only(conf->conf.blk), true,
 +                                       errp)) {
          return;
      }
      s->original_wce = blk_enable_write_cache(conf->conf.blk);
 -    blkconf_geometry(&conf->conf, NULL, 65535, 255, 255, &err);
 -    if (err) {
 -        error_propagate(errp, err);
 +    if (!blkconf_geometry(&conf->conf, NULL, 65535, 255, 255, errp)) {
          return;
      }
 +
      blkconf_blocksizes(&conf->conf);
      virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK,
 diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/ide/qdev.c
 +++ b/hw/ide/qdev.c
@@ -XXX,XX +XXX,XX @@ static void ide_dev_initfn(IDEDevice *dev, IDEDriveKind kind, Error **errp)
  {
      IDEBus *bus = DO_UPCAST(IDEBus, qbus, dev->qdev.parent_bus);
      IDEState *s = bus->ifs + dev->unit;
 -    Error *err = NULL;
      int ret;
      if (!dev->conf.blk) {
@@ -XXX,XX +XXX,XX @@ static void ide_dev_initfn(IDEDevice *dev, IDEDriveKind kind, Error **errp)
      blkconf_serial(&dev->conf, &dev->serial);
      if (kind != IDE_CD) {
 -        blkconf_geometry(&dev->conf, &dev->chs_trans, 65535, 16, 255, &err);
 -        if (err) {
 -            error_propagate(errp, err);
 +        if (!blkconf_geometry(&dev->conf, &dev->chs_trans, 65535, 16, 255,
 +                              errp)) {
              return;
          }
      }
 -    blkconf_apply_backend_options(&dev->conf, kind == IDE_CD, kind != IDE_CD,
 -                                  &err);
 -    if (err) {
 -        error_propagate(errp, err);
 +    if (!blkconf_apply_backend_options(&dev->conf, kind == IDE_CD,
 +                                       kind != IDE_CD, errp)) {
          return;
      }
 diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/scsi/scsi-disk.c
 +++ b/hw/scsi/scsi-disk.c
@@ -XXX,XX +XXX,XX @@ static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
  static void scsi_realize(SCSIDevice *dev, Error **errp)
  {
      SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
 -    Error *err = NULL;
      if (!s->qdev.conf.blk) {
          error_setg(errp, "drive property not set");
@@ -XXX,XX +XXX,XX @@ static void scsi_realize(SCSIDevice *dev, Error **errp)
      }
      if (dev->type == TYPE_DISK) {
 -        blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, &err);
 -        if (err) {
 -            error_propagate(errp, err);
 +        if (!blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, errp)) {
              return;
          }
      }
 -    blkconf_apply_backend_options(&dev->conf,
 -                                  blk_is_read_only(s->qdev.conf.blk),
 -                                  dev->type == TYPE_DISK, &err);
 -    if (err) {
 -        error_propagate(errp, err);
 +    if (!blkconf_apply_backend_options(&dev->conf,
 +                                       blk_is_read_only(s->qdev.conf.blk),
 +                                       dev->type == TYPE_DISK, errp)) {
          return;
      }
 diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/usb/dev-storage.c
 +++ b/hw/usb/dev-storage.c
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
      MSDState *s = USB_STORAGE_DEV(dev);
      BlockBackend *blk = s->conf.blk;
      SCSIDevice *scsi_dev;
 -    Error *err = NULL;
      if (!blk) {
          error_setg(errp, "drive property not set");
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
      blkconf_serial(&s->conf, &dev->serial);
      blkconf_blocksizes(&s->conf);
 -    blkconf_apply_backend_options(&s->conf, blk_is_read_only(blk), true, &err);
 -    if (err) {
 -        error_propagate(errp, err);
 +    if (!blkconf_apply_backend_options(&s->conf, blk_is_read_only(blk), true,
 +                                       errp)) {
          return;
      }
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
                   &usb_msd_scsi_info_storage, NULL);
      scsi_dev = scsi_bus_legacy_add_drive(&s->bus, blk, 0, !!s->removable,
                                           s->conf.bootindex, dev->serial,
 -                                         &err);
 +                                         errp);
      blk_unref(blk);
      if (!scsi_dev) {
 -        error_propagate(errp, err);
          return;
      }
      usb_msd_handle_reset(dev);
 --
 .14.3

-New patch
+[Qemu-devel] [PULL v2 05/23] dev-storage: Fix the unusual function name
+From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+The function name of usb_msd_{realize,unrealize}_*,
+usb_msd_class_initfn_* are unusual. Rename it to
+usb_msd_*_{realize,unrealize}, usb_msd_class_*_initfn.
+Cc: Gerd Hoffmann <kraxel@redhat.com>
+Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Message-id: 11e6003433abce35f3f4970e1acc71ee92dbcf51.1511317952.git.maozy.fnst@cn.fujitsu.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/usb/dev-storage.c | 20 ++++++++++----------
+file changed, 10 insertions(+), 10 deletions(-)
+diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/usb/dev-storage.c
++++ b/hw/usb/dev-storage.c
+@@ -XXX,XX +XXX,XX @@ static void usb_msd_unrealize_storage(USBDevice *dev, Error **errp)
+     object_unref(OBJECT(&s->bus));
+ }
+-static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
++static void usb_msd_storage_realize(USBDevice *dev, Error **errp)
+ {
+     MSDState *s = USB_STORAGE_DEV(dev);
+     BlockBackend *blk = s->conf.blk;
+@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
+     s->scsi_dev = scsi_dev;
+ }
+-static void usb_msd_unrealize_bot(USBDevice *dev, Error **errp)
++static void usb_msd_bot_unrealize(USBDevice *dev, Error **errp)
+ {
+     MSDState *s = USB_STORAGE_DEV(dev);
+     object_unref(OBJECT(&s->bus));
+ }
+-static void usb_msd_realize_bot(USBDevice *dev, Error **errp)
++static void usb_msd_bot_realize(USBDevice *dev, Error **errp)
+ {
+     MSDState *s = USB_STORAGE_DEV(dev);
+     DeviceState *d = DEVICE(dev);
+@@ -XXX,XX +XXX,XX @@ static void usb_msd_class_initfn_common(ObjectClass *klass, void *data)
+     dc->vmsd = &vmstate_usb_msd;
+ }
+-static void usb_msd_class_initfn_storage(ObjectClass *klass, void *data)
++static void usb_msd_class_storage_initfn(ObjectClass *klass, void *data)
+ {
+     DeviceClass *dc = DEVICE_CLASS(klass);
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+-    uc->realize = usb_msd_realize_storage;
++    uc->realize = usb_msd_storage_realize;
+     uc->unrealize = usb_msd_unrealize_storage;
+     dc->props = msd_properties;
+ }
+@@ -XXX,XX +XXX,XX @@ static void usb_msd_instance_init(Object *obj)
+     object_property_set_int(obj, -1, "bootindex", NULL);
+ }
+-static void usb_msd_class_initfn_bot(ObjectClass *klass, void *data)
++static void usb_msd_class_bot_initfn(ObjectClass *klass, void *data)
+ {
+     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
+-    uc->realize = usb_msd_realize_bot;
+-    uc->unrealize = usb_msd_unrealize_bot;
++    uc->realize = usb_msd_bot_realize;
++    uc->unrealize = usb_msd_bot_unrealize;
+     uc->attached_settable = true;
+ }
+ static const TypeInfo msd_info = {
+     .name          = "usb-storage",
+     .parent        = TYPE_USB_STORAGE,
+-    .class_init    = usb_msd_class_initfn_storage,
++    .class_init    = usb_msd_class_storage_initfn,
+     .instance_init = usb_msd_instance_init,
+ };
+ static const TypeInfo bot_info = {
+     .name          = "usb-bot",
+     .parent        = TYPE_USB_STORAGE,
+-    .class_init    = usb_msd_class_initfn_bot,
++    .class_init    = usb_msd_class_bot_initfn,
+ };
+ static void usb_msd_register_types(void)
+--
+.14.3

-New patch
+[Qemu-devel] [PULL v2 06/23] qdev: drop unused #include "sysemu/iothread.h"
+Commit 1351d1ec89eabebc9fdff20451a62c413d7accc1 ("qdev: drop iothread
+property type") forgot to remove this include.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Message-id: 20171205133954.31006-1-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ hw/core/qdev-properties-system.c | 1 -
+file changed, 1 deletion(-)
+diff --git a/hw/core/qdev-properties-system.c b/hw/core/qdev-properties-system.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/core/qdev-properties-system.c
++++ b/hw/core/qdev-properties-system.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qapi/visitor.h"
+ #include "chardev/char-fe.h"
+ #include "sysemu/tpm_backend.h"
+-#include "sysemu/iothread.h"
+ static void get_pointer(Object *obj, Visitor *v, Property *prop,
+                         char *(*print)(void *ptr),
+--
+.14.3

-New patch
+[Qemu-devel] [PULL v2 07/23] blockdev: hold AioContext for bdrv_unref() in external_snapshot_clean()
+bdrv_unref() requires the AioContext lock because bdrv_flush() uses
+BDRV_POLL_WHILE(), which assumes the AioContext is currently held.  If
+BDRV_POLL_WHILE() runs without AioContext held the
+pthread_mutex_unlock() call in aio_context_release() fails.
+This patch moves bdrv_unref() into the AioContext locked region to solve
+the following pthread_mutex_unlock() failure:
+  #0  0x00007f566181969b in raise () at /lib64/libc.so.6
+  #1  0x00007f566181b3b1 in abort () at /lib64/libc.so.6
+  #2  0x00005592cd590458 in error_exit (err=<optimized out>, msg=msg@entry=0x5592cdaf6d60 <__func__.23977> "qemu_mutex_unlock") at util/qemu-thread-posix.c:36
+  #3  0x00005592cd96e738 in qemu_mutex_unlock (mutex=mutex@entry=0x5592ce9505e0) at util/qemu-thread-posix.c:96
+  #4  0x00005592cd969b69 in aio_context_release (ctx=ctx@entry=0x5592ce950580) at util/async.c:507
+  #5  0x00005592cd8ead78 in bdrv_flush (bs=bs@entry=0x5592cfa87210) at block/io.c:2478
+  #6  0x00005592cd89df30 in bdrv_close (bs=0x5592cfa87210) at block.c:3207
+  #7  0x00005592cd89df30 in bdrv_delete (bs=0x5592cfa87210) at block.c:3395
+  #8  0x00005592cd89df30 in bdrv_unref (bs=0x5592cfa87210) at block.c:4418
+  #9  0x00005592cd6b7f86 in qmp_transaction (dev_list=<optimized out>, has_props=<optimized out>, props=<optimized out>, errp=errp@entry=0x7ffe4a1fc9d8) at blockdev.c:2308
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20171206144550.22295-2-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ blockdev.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/blockdev.c b/blockdev.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -XXX,XX +XXX,XX @@ static void external_snapshot_clean(BlkActionState *common)
+                              DO_UPCAST(ExternalSnapshotState, common, common);
+     if (state->aio_context) {
+         bdrv_drained_end(state->old_bs);
+-        aio_context_release(state->aio_context);
+         bdrv_unref(state->new_bs);
++        aio_context_release(state->aio_context);
+     }
+ }
+--
+.14.3

-New patch
+[Qemu-devel] [PULL v2 08/23] block: don't keep AioContext acquired after external_snapshot_prepare()
+It is not necessary to hold AioContext across transactions anymore since
 bdrv_drained_begin/end() is used to keep the nodes quiesced.  In fact,
 using the AioContext lock for this purpose was always buggy.
 This patch reduces the scope of AioContext locked regions.  This is not
 just a cleanup but also fixes hangs that occur in BDRV_POLL_WHILE()
 because it is unware of recursive locking and does not release the
 AioContext the necessary number of times to allow progress to be made.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171206144550.22295-3-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
  blockdev.c | 71 ++++++++++++++++++++++++++++++++++++++++++--------------------
 file changed, 48 insertions(+), 23 deletions(-)
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ typedef struct ExternalSnapshotState {
      BlkActionState common;
      BlockDriverState *old_bs;
      BlockDriverState *new_bs;
 -    AioContext *aio_context;
      bool overlay_appended;
  } ExternalSnapshotState;
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
      ExternalSnapshotState *state =
                               DO_UPCAST(ExternalSnapshotState, common, common);
      TransactionAction *action = common->action;
 +    AioContext *aio_context;
      /* 'blockdev-snapshot' and 'blockdev-snapshot-sync' have similar
       * purpose but a different set of parameters */
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
          return;
      }
 -    /* Acquire AioContext now so any threads operating on old_bs stop */
 -    state->aio_context = bdrv_get_aio_context(state->old_bs);
 -    aio_context_acquire(state->aio_context);
 +    aio_context = bdrv_get_aio_context(state->old_bs);
 +    aio_context_acquire(aio_context);
 +
 +    /* Paired with .clean() */
      bdrv_drained_begin(state->old_bs);
      if (!bdrv_is_inserted(state->old_bs)) {
          error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
 -        return;
 +        goto out;
      }
      if (bdrv_op_is_blocked(state->old_bs,
                             BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT, errp)) {
 -        return;
 +        goto out;
      }
      if (!bdrv_is_read_only(state->old_bs)) {
          if (bdrv_flush(state->old_bs)) {
              error_setg(errp, QERR_IO_ERROR);
 -            return;
 +            goto out;
          }
      }
      if (!bdrv_is_first_non_filter(state->old_bs)) {
          error_setg(errp, QERR_FEATURE_DISABLED, "snapshot");
 -        return;
 +        goto out;
      }
      if (action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC) {
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
          if (node_name && !snapshot_node_name) {
              error_setg(errp, "New snapshot node name missing");
 -            return;
 +            goto out;
          }
          if (snapshot_node_name &&
              bdrv_lookup_bs(snapshot_node_name, snapshot_node_name, NULL)) {
              error_setg(errp, "New snapshot node name already in use");
 -            return;
 +            goto out;
          }
          flags = state->old_bs->open_flags;
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
              int64_t size = bdrv_getlength(state->old_bs);
              if (size < 0) {
                  error_setg_errno(errp, -size, "bdrv_getlength failed");
 -                return;
 +                goto out;
              }
              bdrv_img_create(new_image_file, format,
                              state->old_bs->filename,
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
                              NULL, size, flags, false, &local_err);
              if (local_err) {
                  error_propagate(errp, local_err);
 -                return;
 +                goto out;
              }
          }
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
                                errp);
      /* We will manually add the backing_hd field to the bs later */
      if (!state->new_bs) {
 -        return;
 +        goto out;
      }
      if (bdrv_has_blk(state->new_bs)) {
          error_setg(errp, "The snapshot is already in use");
 -        return;
 +        goto out;
      }
      if (bdrv_op_is_blocked(state->new_bs, BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT,
                             errp)) {
 -        return;
 +        goto out;
      }
      if (state->new_bs->backing != NULL) {
          error_setg(errp, "The snapshot already has a backing image");
 -        return;
 +        goto out;
      }
      if (!state->new_bs->drv->supports_backing) {
          error_setg(errp, "The snapshot does not support backing images");
 -        return;
 +        goto out;
      }
 -    bdrv_set_aio_context(state->new_bs, state->aio_context);
 +    bdrv_set_aio_context(state->new_bs, aio_context);
      /* This removes our old bs and adds the new bs. This is an operation that
       * can fail, so we need to do it in .prepare; undoing it for abort is
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
      bdrv_append(state->new_bs, state->old_bs, &local_err);
      if (local_err) {
          error_propagate(errp, local_err);
 -        return;
 +        goto out;
      }
      state->overlay_appended = true;
 +
 +out:
 +    aio_context_release(aio_context);
  }
  static void external_snapshot_commit(BlkActionState *common)
  {
      ExternalSnapshotState *state =
                               DO_UPCAST(ExternalSnapshotState, common, common);
 +    AioContext *aio_context;
 +
 +    aio_context = bdrv_get_aio_context(state->old_bs);
 +    aio_context_acquire(aio_context);
      /* We don't need (or want) to use the transactional
       * bdrv_reopen_multiple() across all the entries at once, because we
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_commit(BlkActionState *common)
          bdrv_reopen(state->old_bs, state->old_bs->open_flags & ~BDRV_O_RDWR,
                      NULL);
      }
 +
 +    aio_context_release(aio_context);
  }
  static void external_snapshot_abort(BlkActionState *common)
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_abort(BlkActionState *common)
                               DO_UPCAST(ExternalSnapshotState, common, common);
      if (state->new_bs) {
          if (state->overlay_appended) {
 +            AioContext *aio_context;
 +
 +            aio_context = bdrv_get_aio_context(state->old_bs);
 +            aio_context_acquire(aio_context);
 +
              bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
                                            close state->old_bs; we need it */
              bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
              bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
              bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
 +
 +            aio_context_release(aio_context);
          }
      }
  }
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_clean(BlkActionState *common)
  {
      ExternalSnapshotState *state =
                               DO_UPCAST(ExternalSnapshotState, common, common);
 -    if (state->aio_context) {
 -        bdrv_drained_end(state->old_bs);
 -        bdrv_unref(state->new_bs);
 -        aio_context_release(state->aio_context);
 +    AioContext *aio_context;
 +
 +    if (!state->old_bs) {
 +        return;
      }
 +
 +    aio_context = bdrv_get_aio_context(state->old_bs);
 +    aio_context_acquire(aio_context);
 +
 +    bdrv_drained_end(state->old_bs);
 +    bdrv_unref(state->new_bs);
 +
 +    aio_context_release(aio_context);
  }
  typedef struct DriveBackupState {
 --
 .14.3

-New patch
+[Qemu-devel] [PULL v2 09/23] block: don't keep AioContext acquired after drive_backup_prepare()
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20171206144550.22295-4-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ blockdev.c | 42 ++++++++++++++++++++++++++++++++++--------
+file changed, 34 insertions(+), 8 deletions(-)
+diff --git a/blockdev.c b/blockdev.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -XXX,XX +XXX,XX @@ static void external_snapshot_clean(BlkActionState *common)
+ typedef struct DriveBackupState {
+     BlkActionState common;
+     BlockDriverState *bs;
+-    AioContext *aio_context;
+     BlockJob *job;
+ } DriveBackupState;
+@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
+     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
+     BlockDriverState *bs;
+     DriveBackup *backup;
++    AioContext *aio_context;
+     Error *local_err = NULL;
+     assert(common->action->type == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);
+@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
+         return;
+     }
+-    /* AioContext is released in .clean() */
+-    state->aio_context = bdrv_get_aio_context(bs);
+-    aio_context_acquire(state->aio_context);
++    aio_context = bdrv_get_aio_context(bs);
++    aio_context_acquire(aio_context);
++
++    /* Paired with .clean() */
+     bdrv_drained_begin(bs);
++
+     state->bs = bs;
+     state->job = do_drive_backup(backup, common->block_job_txn, &local_err);
+     if (local_err) {
+         error_propagate(errp, local_err);
+-        return;
++        goto out;
+     }
++
++out:
++    aio_context_release(aio_context);
+ }
+ static void drive_backup_commit(BlkActionState *common)
+ {
+     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
++    AioContext *aio_context;
++
++    aio_context = bdrv_get_aio_context(state->bs);
++    aio_context_acquire(aio_context);
++
+     assert(state->job);
+     block_job_start(state->job);
++
++    aio_context_release(aio_context);
+ }
+ static void drive_backup_abort(BlkActionState *common)
+@@ -XXX,XX +XXX,XX @@ static void drive_backup_abort(BlkActionState *common)
+     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
+     if (state->job) {
++        AioContext *aio_context;
++
++        aio_context = bdrv_get_aio_context(state->bs);
++        aio_context_acquire(aio_context);
++
+         block_job_cancel_sync(state->job);
++
++        aio_context_release(aio_context);
+     }
+ }
+ static void drive_backup_clean(BlkActionState *common)
+ {
+     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
++    AioContext *aio_context;
+-    if (state->aio_context) {
+-        bdrv_drained_end(state->bs);
+-        aio_context_release(state->aio_context);
++    if (!state->bs) {
++        return;
+     }
++
++    aio_context = bdrv_get_aio_context(state->bs);
++    aio_context_acquire(aio_context);
++
++    bdrv_drained_end(state->bs);
++
++    aio_context_release(aio_context);
+ }
+ typedef struct BlockdevBackupState {
+--
+.14.3

-[PULL 04/13] block: pass size to bdrv_unregister_buf()
+[Qemu-devel] [PULL v2 10/23] block: don't keep AioContext acquired after blockdev_backup_prepare()
-The only implementor of bdrv_register_buf() is block/nvme.c, where the
-size is not needed when unregistering a buffer. This is because
-util/vfio-helpers.c can look up mappings by address.
-Future block drivers that implement bdrv_register_buf() may not be able
-to do their job given only the buffer address. Add a size argument to
-bdrv_unregister_buf().
-Also document the assumptions about
-bdrv_register_buf()/bdrv_unregister_buf() calls. The same <host, size>
-values that were given to bdrv_register_buf() must be given to
-bdrv_unregister_buf().
-gcc 11.2.1 emits a spurious warning that img_bench()'s buf_size local
-variable might be uninitialized, so it's necessary to silence the
-compiler.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-id: 20221013185908.1297568-5-stefanha@redhat.com
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171206144550.22295-5-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/block/block-global-state.h          | 5 ++++-
+ blockdev.c | 44 ++++++++++++++++++++++++++++++++++----------
- include/block/block_int-common.h            | 2 +-
+file changed, 34 insertions(+), 10 deletions(-)
  include/sysemu/block-backend-global-state.h | 2 +-
  block/block-backend.c                       | 4 ++--
  block/io.c                                  | 6 +++---
  block/nvme.c                                | 2 +-
  qemu-img.c                                  | 4 ++--
 files changed, 14 insertions(+), 11 deletions(-)
-diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
+diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/block/block-global-state.h
+--- a/blockdev.c
-+++ b/include/block/block-global-state.h
++++ b/blockdev.c
-@@ -XXX,XX +XXX,XX @@ void bdrv_del_child(BlockDriverState *parent, BdrvChild *child, Error **errp);
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockdevBackupState {
-  * Register/unregister a buffer for I/O. For example, VFIO drivers are
+     BlkActionState common;
-  * interested to know the memory areas that would later be used for I/O, so
+     BlockDriverState *bs;
-  * that they can prepare IOMMU mapping etc., to get better performance.
+     BlockJob *job;
-+ *
+-    AioContext *aio_context;
-+ * Buffers must not overlap and they must be unregistered with the same <host,
+ } BlockdevBackupState;
-+ * size> values that they were registered with.
-  */
+ static BlockJob *do_blockdev_backup(BlockdevBackup *backup, BlockJobTxn *txn,
- void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size);
+@@ -XXX,XX +XXX,XX @@ static void blockdev_backup_prepare(BlkActionState *common, Error **errp)
--void bdrv_unregister_buf(BlockDriverState *bs, void *host);
+     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
-+void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size);
+     BlockdevBackup *backup;
+     BlockDriverState *bs, *target;
- void bdrv_cancel_in_flight(BlockDriverState *bs);
++    AioContext *aio_context;
+     Error *local_err = NULL;
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
-index XXXXXXX..XXXXXXX 100644
+     assert(common->action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_BACKUP);
---- a/include/block/block_int-common.h
+@@ -XXX,XX +XXX,XX @@ static void blockdev_backup_prepare(BlkActionState *common, Error **errp)
-+++ b/include/block/block_int-common.h
+         return;
-@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
+     }
-      * DMA mapping for hot buffers.
-      */
+-    /* AioContext is released in .clean() */
-     void (*bdrv_register_buf)(BlockDriverState *bs, void *host, size_t size);
+-    state->aio_context = bdrv_get_aio_context(bs);
--    void (*bdrv_unregister_buf)(BlockDriverState *bs, void *host);
+-    if (state->aio_context != bdrv_get_aio_context(target)) {
-+    void (*bdrv_unregister_buf)(BlockDriverState *bs, void *host, size_t size);
+-        state->aio_context = NULL;
++    aio_context = bdrv_get_aio_context(bs);
-     /*
++    if (aio_context != bdrv_get_aio_context(target)) {
-      * This field is modified only under the BQL, and is part of
+         error_setg(errp, "Backup between two IO threads is not implemented");
-diff --git a/include/sysemu/block-backend-global-state.h b/include/sysemu/block-backend-global-state.h
+         return;
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/include/sysemu/block-backend-global-state.h
+-    aio_context_acquire(state->aio_context);
-+++ b/include/sysemu/block-backend-global-state.h
++    aio_context_acquire(aio_context);
-@@ -XXX,XX +XXX,XX @@ void blk_io_limits_update_group(BlockBackend *blk, const char *group);
+     state->bs = bs;
- void blk_set_force_allow_inactivate(BlockBackend *blk);
++
++    /* Paired with .clean() */
- void blk_register_buf(BlockBackend *blk, void *host, size_t size);
+     bdrv_drained_begin(state->bs);
--void blk_unregister_buf(BlockBackend *blk, void *host);
-+void blk_unregister_buf(BlockBackend *blk, void *host, size_t size);
+     state->job = do_blockdev_backup(backup, common->block_job_txn, &local_err);
+     if (local_err) {
- const BdrvChild *blk_root(BlockBackend *blk);
+         error_propagate(errp, local_err);
+-        return;
-diff --git a/block/block-backend.c b/block/block-backend.c
++        goto out;
-index XXXXXXX..XXXXXXX 100644
+     }
---- a/block/block-backend.c
++
-+++ b/block/block-backend.c
++out:
-@@ -XXX,XX +XXX,XX @@ void blk_register_buf(BlockBackend *blk, void *host, size_t size)
++    aio_context_release(aio_context);
      bdrv_register_buf(blk_bs(blk), host, size);
  }
--void blk_unregister_buf(BlockBackend *blk, void *host)
+ static void blockdev_backup_commit(BlkActionState *common)
 +void blk_unregister_buf(BlockBackend *blk, void *host, size_t size)
  {
-     GLOBAL_STATE_CODE();
+     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
--    bdrv_unregister_buf(blk_bs(blk), host);
++    AioContext *aio_context;
-+    bdrv_unregister_buf(blk_bs(blk), host, size);
++
 +    aio_context = bdrv_get_aio_context(state->bs);
 +    aio_context_acquire(aio_context);
 +
      assert(state->job);
      block_job_start(state->job);
 +
 +    aio_context_release(aio_context);
  }
- int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
+ static void blockdev_backup_abort(BlkActionState *common)
-diff --git a/block/io.c b/block/io.c
+@@ -XXX,XX +XXX,XX @@ static void blockdev_backup_abort(BlkActionState *common)
-index XXXXXXX..XXXXXXX 100644
+     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
---- a/block/io.c
-+++ b/block/io.c
+     if (state->job) {
-@@ -XXX,XX +XXX,XX @@ void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size)
++        AioContext *aio_context;
 +
 +        aio_context = bdrv_get_aio_context(state->bs);
 +        aio_context_acquire(aio_context);
 +
          block_job_cancel_sync(state->job);
 +
 +        aio_context_release(aio_context);
      }
  }
--void bdrv_unregister_buf(BlockDriverState *bs, void *host)
+ static void blockdev_backup_clean(BlkActionState *common)
 +void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size)
  {
-     BdrvChild *child;
+     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
++    AioContext *aio_context;
-     GLOBAL_STATE_CODE();
-     if (bs->drv && bs->drv->bdrv_unregister_buf) {
+-    if (state->aio_context) {
--        bs->drv->bdrv_unregister_buf(bs, host);
+-        bdrv_drained_end(state->bs);
-+        bs->drv->bdrv_unregister_buf(bs, host, size);
+-        aio_context_release(state->aio_context);
 +    if (!state->bs) {
 +        return;
      }
-     QLIST_FOREACH(child, &bs->children, next) {
++
--        bdrv_unregister_buf(child->bs, host);
++    aio_context = bdrv_get_aio_context(state->bs);
-+        bdrv_unregister_buf(child->bs, host, size);
++    aio_context_acquire(aio_context);
-     }
++
 +    bdrv_drained_end(state->bs);
 +
 +    aio_context_release(aio_context);
  }
-diff --git a/block/nvme.c b/block/nvme.c
+ typedef struct BlockDirtyBitmapState {
 index XXXXXXX..XXXXXXX 100644
 --- a/block/nvme.c
 +++ b/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static void nvme_register_buf(BlockDriverState *bs, void *host, size_t size)
      }
  }
 -static void nvme_unregister_buf(BlockDriverState *bs, void *host)
 +static void nvme_unregister_buf(BlockDriverState *bs, void *host, size_t size)
  {
      BDRVNVMeState *s = bs->opaque;
 diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_bench(int argc, char **argv)
      struct timeval t1, t2;
      int i;
      bool force_share = false;
 -    size_t buf_size;
 +    size_t buf_size = 0;
      for (;;) {
          static const struct option long_options[] = {
@@ -XXX,XX +XXX,XX @@ static int img_bench(int argc, char **argv)
  out:
      if (data.buf) {
 -        blk_unregister_buf(blk, data.buf);
 +        blk_unregister_buf(blk, data.buf, buf_size);
      }
      qemu_vfree(data.buf);
      blk_unref(blk);
 --
-.37.3
+.14.3

-New patch
+[Qemu-devel] [PULL v2 11/23] block: don't keep AioContext acquired after internal_snapshot_prepare()
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20171206144550.22295-6-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ blockdev.c | 47 +++++++++++++++++++++++++++++++----------------
+file changed, 31 insertions(+), 16 deletions(-)
+diff --git a/blockdev.c b/blockdev.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -XXX,XX +XXX,XX @@ struct BlkActionState {
+ typedef struct InternalSnapshotState {
+     BlkActionState common;
+     BlockDriverState *bs;
+-    AioContext *aio_context;
+     QEMUSnapshotInfo sn;
+     bool created;
+ } InternalSnapshotState;
+@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
+     qemu_timeval tv;
+     BlockdevSnapshotInternal *internal;
+     InternalSnapshotState *state;
++    AioContext *aio_context;
+     int ret1;
+     g_assert(common->action->type ==
+@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
+         return;
+     }
+-    /* AioContext is released in .clean() */
+-    state->aio_context = bdrv_get_aio_context(bs);
+-    aio_context_acquire(state->aio_context);
++    aio_context = bdrv_get_aio_context(bs);
++    aio_context_acquire(aio_context);
+     state->bs = bs;
++
++    /* Paired with .clean() */
+     bdrv_drained_begin(bs);
+     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT, errp)) {
+-        return;
++        goto out;
+     }
+     if (bdrv_is_read_only(bs)) {
+         error_setg(errp, "Device '%s' is read only", device);
+-        return;
++        goto out;
+     }
+     if (!bdrv_can_snapshot(bs)) {
+         error_setg(errp, "Block format '%s' used by device '%s' "
+                    "does not support internal snapshots",
+                    bs->drv->format_name, device);
+-        return;
++        goto out;
+     }
+     if (!strlen(name)) {
+         error_setg(errp, "Name is empty");
+-        return;
++        goto out;
+     }
+     /* check whether a snapshot with name exist */
+@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
+                                             &local_err);
+     if (local_err) {
+         error_propagate(errp, local_err);
+-        return;
++        goto out;
+     } else if (ret) {
+         error_setg(errp,
+                    "Snapshot with name '%s' already exists on device '%s'",
+                    name, device);
+-        return;
++        goto out;
+     }
+     /* 3. take the snapshot */
+@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
+         error_setg_errno(errp, -ret1,
+                          "Failed to create snapshot '%s' on device '%s'",
+                          name, device);
+-        return;
++        goto out;
+     }
+     /* 4. succeed, mark a snapshot is created */
+     state->created = true;
++
++out:
++    aio_context_release(aio_context);
+ }
+ static void internal_snapshot_abort(BlkActionState *common)
+@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_abort(BlkActionState *common)
+                              DO_UPCAST(InternalSnapshotState, common, common);
+     BlockDriverState *bs = state->bs;
+     QEMUSnapshotInfo *sn = &state->sn;
++    AioContext *aio_context;
+     Error *local_error = NULL;
+     if (!state->created) {
+         return;
+     }
++    aio_context = bdrv_get_aio_context(state->bs);
++    aio_context_acquire(aio_context);
++
+     if (bdrv_snapshot_delete(bs, sn->id_str, sn->name, &local_error) < 0) {
+         error_reportf_err(local_error,
+                           "Failed to delete snapshot with id '%s' and "
+@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_abort(BlkActionState *common)
+                           sn->id_str, sn->name,
+                           bdrv_get_device_name(bs));
+     }
++
++    aio_context_release(aio_context);
+ }
+ static void internal_snapshot_clean(BlkActionState *common)
+ {
+     InternalSnapshotState *state = DO_UPCAST(InternalSnapshotState,
+                                              common, common);
++    AioContext *aio_context;
+-    if (state->aio_context) {
+-        if (state->bs) {
+-            bdrv_drained_end(state->bs);
+-        }
+-        aio_context_release(state->aio_context);
++    if (!state->bs) {
++        return;
+     }
++
++    aio_context = bdrv_get_aio_context(state->bs);
++    aio_context_acquire(aio_context);
++
++    bdrv_drained_end(state->bs);
++
++    aio_context_release(aio_context);
+ }
+ /* external snapshot private data */
+--
+.14.3

-New patch
+[Qemu-devel] [PULL v2 12/23] block: drop unused BlockDirtyBitmapState->aio_context field
+The dirty bitmap actions in qmp_transaction have not used AioContext
+since the dirty bitmap locking discipline was introduced in commit
+2119882c7eb7e2c612b24fc0c8d86f5887d6f1c3 ("block: introduce
+dirty_bitmap_mutex").  Remove the unused field.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20171206144550.22295-7-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ blockdev.c | 13 -------------
+file changed, 13 deletions(-)
+diff --git a/blockdev.c b/blockdev.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -XXX,XX +XXX,XX @@ typedef struct BlockDirtyBitmapState {
+     BlkActionState common;
+     BdrvDirtyBitmap *bitmap;
+     BlockDriverState *bs;
+-    AioContext *aio_context;
+     HBitmap *backup;
+     bool prepared;
+ } BlockDirtyBitmapState;
+@@ -XXX,XX +XXX,XX @@ static void block_dirty_bitmap_clear_prepare(BlkActionState *common,
+     }
+     bdrv_clear_dirty_bitmap(state->bitmap, &state->backup);
+-    /* AioContext is released in .clean() */
+ }
+ static void block_dirty_bitmap_clear_abort(BlkActionState *common)
+@@ -XXX,XX +XXX,XX @@ static void block_dirty_bitmap_clear_commit(BlkActionState *common)
+     hbitmap_free(state->backup);
+ }
+-static void block_dirty_bitmap_clear_clean(BlkActionState *common)
+-{
+-    BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
+-                                             common, common);
+-
+-    if (state->aio_context) {
+-        aio_context_release(state->aio_context);
+-    }
+-}
+-
+ static void abort_prepare(BlkActionState *common, Error **errp)
+ {
+     error_setg(errp, "Transaction aborted using Abort action");
+@@ -XXX,XX +XXX,XX @@ static const BlkActionOps actions[] = {
+         .prepare = block_dirty_bitmap_clear_prepare,
+         .commit = block_dirty_bitmap_clear_commit,
+         .abort = block_dirty_bitmap_clear_abort,
+-        .clean = block_dirty_bitmap_clear_clean,
+     }
+ };
+--
+.14.3

-New patch
+[Qemu-devel] [PULL v2 13/23] iothread: add iothread_by_id() API
+Encapsulate IOThread QOM object lookup so that callers don't need to
+know how and where IOThread objects live.
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Message-id: 20171206144550.22295-8-stefanha@redhat.com
+Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+---
+ include/sysemu/iothread.h | 1 +
+ iothread.c                | 7 +++++++
+files changed, 8 insertions(+)
+diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/sysemu/iothread.h
++++ b/include/sysemu/iothread.h
+@@ -XXX,XX +XXX,XX @@ typedef struct {
+    OBJECT_CHECK(IOThread, obj, TYPE_IOTHREAD)
+ char *iothread_get_id(IOThread *iothread);
++IOThread *iothread_by_id(const char *id);
+ AioContext *iothread_get_aio_context(IOThread *iothread);
+ void iothread_stop_all(void);
+ GMainContext *iothread_get_g_main_context(IOThread *iothread);
+diff --git a/iothread.c b/iothread.c
+index XXXXXXX..XXXXXXX 100644
+--- a/iothread.c
++++ b/iothread.c
+@@ -XXX,XX +XXX,XX @@ void iothread_destroy(IOThread *iothread)
+ {
+     object_unparent(OBJECT(iothread));
+ }
++
++/* Lookup IOThread by its id.  Only finds user-created objects, not internal
++ * iothread_create() objects. */
++IOThread *iothread_by_id(const char *id)
++{
++    return IOTHREAD(object_resolve_path_type(id, TYPE_IOTHREAD, NULL));
++}
+--
+.14.3

-[PULL 02/13] blkio: add libblkio block driver
+[Qemu-devel] [PULL v2 14/23] blockdev: add x-blockdev-set-iothread testing command
-libblkio (https://gitlab.com/libblkio/libblkio/) is a library for
+Currently there is no easy way for iotests to ensure that a BDS is bound
-high-performance disk I/O. It currently supports io_uring,
+to a particular IOThread.  Normally the virtio-blk device calls
-virtio-blk-vhost-user, and virtio-blk-vhost-vdpa with additional drivers
+blk_set_aio_context() when dataplane is enabled during guest driver
-under development.
+initialization.  This never happens in iotests since -machine
 accel=qtest means there is no guest activity (including device driver
 initialization).
-One of the reasons for developing libblkio is that other applications
+This patch adds a QMP command to explicitly assign IOThreads in test
-besides QEMU can use it. This will be particularly useful for
+cases.  See qapi/block-core.json for a description of the command.
 virtio-blk-vhost-user which applications may wish to use for connecting
 to qemu-storage-daemon.
 libblkio also gives us an opportunity to develop in Rust behind a C API
 that is easy to consume from QEMU.
 This commit adds io_uring, nvme-io_uring, virtio-blk-vhost-user, and
 virtio-blk-vhost-vdpa BlockDrivers to QEMU using libblkio. It will be
 easy to add other libblkio drivers since they will share the majority of
 code.
 For now I/O buffers are copied through bounce buffers if the libblkio
 driver requires it. Later commits add an optimization for
 pre-registering guest RAM to avoid bounce buffers.
 The syntax is:
   --blockdev io_uring,node-name=drive0,filename=test.img,readonly=on|off,cache.direct=on|off
   --blockdev nvme-io_uring,node-name=drive0,filename=/dev/ng0n1,readonly=on|off,cache.direct=on
   --blockdev virtio-blk-vhost-vdpa,node-name=drive0,path=/dev/vdpa...,readonly=on|off,cache.direct=on
   --blockdev virtio-blk-vhost-user,node-name=drive0,path=vhost-user-blk.sock,readonly=on|off,cache.direct=on
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Acked-by: Markus Armbruster <armbru@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20221013185908.1297568-3-stefanha@redhat.com
+Message-id: 20171206144550.22295-9-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- MAINTAINERS                   |   6 +
+ qapi/block-core.json | 36 ++++++++++++++++++++++++++++++++++++
- meson_options.txt             |   2 +
+ blockdev.c           | 41 +++++++++++++++++++++++++++++++++++++++++
- qapi/block-core.json          |  77 +++-
+files changed, 77 insertions(+)
  meson.build                   |   9 +
  block/blkio.c                 | 831 ++++++++++++++++++++++++++++++++++
  tests/qtest/modules-test.c    |   3 +
  block/meson.build             |   1 +
  scripts/meson-buildoptions.sh |   3 +
 files changed, 928 insertions(+), 4 deletions(-)
  create mode 100644 block/blkio.c
-diff --git a/MAINTAINERS b/MAINTAINERS
-index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
-+++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org
- S: Maintained
- F: block/vdi.c
-+blkio
-+M: Stefan Hajnoczi <stefanha@redhat.com>
-+L: qemu-block@nongnu.org
-+S: Maintained
-+F: block/blkio.c
-+
- iSCSI
- M: Ronnie Sahlberg <ronniesahlberg@gmail.com>
- M: Paolo Bonzini <pbonzini@redhat.com>
-diff --git a/meson_options.txt b/meson_options.txt
-index XXXXXXX..XXXXXXX 100644
---- a/meson_options.txt
-+++ b/meson_options.txt
-@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
-        description: 'bzip2 support for DMG images')
- option('cap_ng', type : 'feature', value : 'auto',
-        description: 'cap_ng support')
-+option('blkio', type : 'feature', value : 'auto',
-+       description: 'libblkio block device driver')
- option('bpf', type : 'feature', value : 'auto',
-         description: 'eBPF support')
- option('cocoa', type : 'feature', value : 'auto',
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -XXX,XX +XXX,XX @@
-             'file', 'snapshot-access', 'ftp', 'ftps', 'gluster',
+   'data' : { 'parent': 'str',
-             {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
+              '*child': 'str',
-             {'name': 'host_device', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
+              '*node': 'str' } }
 -            'http', 'https', 'iscsi',
 -            'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
 -            'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
 +            'http', 'https',
 +            { 'name': 'io_uring', 'if': 'CONFIG_BLKIO' },
 +            'iscsi',
 +            'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme',
 +            { 'name': 'nvme-io_uring', 'if': 'CONFIG_BLKIO' },
 +            'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
 +            'raw', 'rbd',
              { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
 -            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
 +            'ssh', 'throttle', 'vdi', 'vhdx',
 +            { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
 +            { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
 +            'vmdk', 'vpc', 'vvfat' ] }
  ##
  # @BlockdevOptionsFile:
@@ -XXX,XX +XXX,XX @@
              '*debug': 'int',
              '*logfile': 'str' } }
 +##
 +# @BlockdevOptionsIoUring:
 +#
 +# Driver specific block device options for the io_uring backend.
 +#
 +# @filename: path to the image file
 +#
 +# Since: 7.2
 +##
 +{ 'struct': 'BlockdevOptionsIoUring',
 +  'data': { 'filename': 'str' },
 +  'if': 'CONFIG_BLKIO' }
 +
 +##
-+# @BlockdevOptionsNvmeIoUring:
++# @x-blockdev-set-iothread:
 +#
-+# Driver specific block device options for the nvme-io_uring backend.
++# Move @node and its children into the @iothread.  If @iothread is null then
 +# move @node and its children into the main loop.
 +#
-+# @filename: path to the image file
++# The node must not be attached to a BlockBackend.
 +#
-+# Since: 7.2
++# @node-name: the name of the block driver node
 +#
 +# @iothread: the name of the IOThread object or null for the main loop
 +#
 +# Note: this command is experimental and intended for test cases that need
 +# control over IOThreads only.
 +#
 +# Since: 2.12
 +#
 +# Example:
 +#
 +# 1. Move a node into an IOThread
 +# -> { "execute": "x-blockdev-set-iothread",
 +#      "arguments": { "node-name": "disk1",
 +#                     "iothread": "iothread0" } }
 +# <- { "return": {} }
 +#
 +# 2. Move a node into the main loop
 +# -> { "execute": "x-blockdev-set-iothread",
 +#      "arguments": { "node-name": "disk1",
 +#                     "iothread": null } }
 +# <- { "return": {} }
 +#
 +##
-+{ 'struct': 'BlockdevOptionsNvmeIoUring',
++{ 'command': 'x-blockdev-set-iothread',
-+  'data': { 'filename': 'str' },
++  'data' : { 'node-name': 'str',
-+  'if': 'CONFIG_BLKIO' }
++             'iothread': 'StrOrNull' } }
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@
  #include "qapi/qmp/qerror.h"
  #include "qapi/qobject-output-visitor.h"
  #include "sysemu/sysemu.h"
 +#include "sysemu/iothread.h"
  #include "block/block_int.h"
  #include "qmp-commands.h"
  #include "block/trace.h"
@@ -XXX,XX +XXX,XX @@ BlockJobInfoList *qmp_query_block_jobs(Error **errp)
      return head;
  }
 +void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
 +                                 Error **errp)
 +{
 +    AioContext *old_context;
 +    AioContext *new_context;
 +    BlockDriverState *bs;
 +
-+##
++    bs = bdrv_find_node(node_name);
-+# @BlockdevOptionsVirtioBlkVhostUser:
++    if (!bs) {
-+#
++        error_setg(errp, "Cannot find node %s", node_name);
 +# Driver specific block device options for the virtio-blk-vhost-user backend.
 +#
 +# @path: path to the vhost-user UNIX domain socket.
 +#
 +# Since: 7.2
 +##
 +{ 'struct': 'BlockdevOptionsVirtioBlkVhostUser',
 +  'data': { 'path': 'str' },
 +  'if': 'CONFIG_BLKIO' }
 +
 +##
 +# @BlockdevOptionsVirtioBlkVhostVdpa:
 +#
 +# Driver specific block device options for the virtio-blk-vhost-vdpa backend.
 +#
 +# @path: path to the vhost-vdpa character device.
 +#
 +# Since: 7.2
 +##
 +{ 'struct': 'BlockdevOptionsVirtioBlkVhostVdpa',
 +  'data': { 'path': 'str' },
 +  'if': 'CONFIG_BLKIO' }
 +
  ##
  # @IscsiTransport:
  #
@@ -XXX,XX +XXX,XX @@
                         'if': 'HAVE_HOST_BLOCK_DEVICE' },
        'http':       'BlockdevOptionsCurlHttp',
        'https':      'BlockdevOptionsCurlHttps',
 +      'io_uring':   { 'type': 'BlockdevOptionsIoUring',
 +                      'if': 'CONFIG_BLKIO' },
        'iscsi':      'BlockdevOptionsIscsi',
        'luks':       'BlockdevOptionsLUKS',
        'nbd':        'BlockdevOptionsNbd',
@@ -XXX,XX +XXX,XX @@
        'null-aio':   'BlockdevOptionsNull',
        'null-co':    'BlockdevOptionsNull',
        'nvme':       'BlockdevOptionsNVMe',
 +      'nvme-io_uring': { 'type': 'BlockdevOptionsNvmeIoUring',
 +                         'if': 'CONFIG_BLKIO' },
        'parallels':  'BlockdevOptionsGenericFormat',
        'preallocate':'BlockdevOptionsPreallocate',
        'qcow2':      'BlockdevOptionsQcow2',
@@ -XXX,XX +XXX,XX @@
        'throttle':   'BlockdevOptionsThrottle',
        'vdi':        'BlockdevOptionsGenericFormat',
        'vhdx':       'BlockdevOptionsGenericFormat',
 +      'virtio-blk-vhost-user':
 +                    { 'type': 'BlockdevOptionsVirtioBlkVhostUser',
 +                      'if': 'CONFIG_BLKIO' },
 +      'virtio-blk-vhost-vdpa':
 +                    { 'type': 'BlockdevOptionsVirtioBlkVhostVdpa',
 +                      'if': 'CONFIG_BLKIO' },
        'vmdk':       'BlockdevOptionsGenericCOWFormat',
        'vpc':        'BlockdevOptionsGenericFormat',
        'vvfat':      'BlockdevOptionsVVFAT'
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('virglrenderer').auto() or have_system or have_vhost_user_gpu
                       required: get_option('virglrenderer'),
                       kwargs: static_kwargs)
  endif
 +blkio = not_found
 +if not get_option('blkio').auto() or have_block
 +  blkio = dependency('blkio',
 +                     method: 'pkg-config',
 +                     required: get_option('blkio'),
 +                     kwargs: static_kwargs)
 +endif
  curl = not_found
  if not get_option('curl').auto() or have_block
    curl = dependency('libcurl', version: '>=7.29.0',
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_LIBUDEV', libudev.found())
  config_host_data.set('CONFIG_LZO', lzo.found())
  config_host_data.set('CONFIG_MPATH', mpathpersist.found())
  config_host_data.set('CONFIG_MPATH_NEW_API', mpathpersist_new_api)
 +config_host_data.set('CONFIG_BLKIO', blkio.found())
  config_host_data.set('CONFIG_CURL', curl.found())
  config_host_data.set('CONFIG_CURSES', curses.found())
  config_host_data.set('CONFIG_GBM', gbm.found())
@@ -XXX,XX +XXX,XX @@ summary_info += {'PAM':               pam}
  summary_info += {'iconv support':     iconv}
  summary_info += {'curses support':    curses}
  summary_info += {'virgl support':     virgl}
 +summary_info += {'blkio support':     blkio}
  summary_info += {'curl support':      curl}
  summary_info += {'Multipath support': mpathpersist}
  summary_info += {'PNG support':       png}
 diff --git a/block/blkio.c b/block/blkio.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/block/blkio.c
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: LGPL-2.1-or-later */
 +/*
 + * libblkio BlockDriver
 + *
 + * Copyright Red Hat, Inc.
 + *
 + * Author:
 + *   Stefan Hajnoczi <stefanha@redhat.com>
 + */
 +
 +#include "qemu/osdep.h"
 +#include <blkio.h>
 +#include "block/block_int.h"
 +#include "qapi/error.h"
 +#include "qapi/qmp/qdict.h"
 +#include "qemu/module.h"
 +
 +/*
 + * Keep the QEMU BlockDriver names identical to the libblkio driver names.
 + * Using macros instead of typing out the string literals avoids typos.
 + */
 +#define DRIVER_IO_URING "io_uring"
 +#define DRIVER_NVME_IO_URING "nvme-io_uring"
 +#define DRIVER_VIRTIO_BLK_VHOST_USER "virtio-blk-vhost-user"
 +#define DRIVER_VIRTIO_BLK_VHOST_VDPA "virtio-blk-vhost-vdpa"
 +
 +/*
 + * Allocated bounce buffers are kept in a list sorted by buffer address.
 + */
 +typedef struct BlkioBounceBuf {
 +    QLIST_ENTRY(BlkioBounceBuf) next;
 +
 +    /* The bounce buffer */
 +    struct iovec buf;
 +} BlkioBounceBuf;
 +
 +typedef struct {
 +    /*
 +     * libblkio is not thread-safe so this lock protects ->blkio and
 +     * ->blkioq.
 +     */
 +    QemuMutex blkio_lock;
 +    struct blkio *blkio;
 +    struct blkioq *blkioq; /* make this multi-queue in the future... */
 +    int completion_fd;
 +
 +    /*
 +     * Polling fetches the next completion into this field.
 +     *
 +     * No lock is necessary since only one thread calls aio_poll() and invokes
 +     * fd and poll handlers.
 +     */
 +    struct blkio_completion poll_completion;
 +
 +    /*
 +     * Protects ->bounce_pool, ->bounce_bufs, ->bounce_available.
 +     *
 +     * Lock ordering: ->bounce_lock before ->blkio_lock.
 +     */
 +    CoMutex bounce_lock;
 +
 +    /* Bounce buffer pool */
 +    struct blkio_mem_region bounce_pool;
 +
 +    /* Sorted list of allocated bounce buffers */
 +    QLIST_HEAD(, BlkioBounceBuf) bounce_bufs;
 +
 +    /* Queue for coroutines waiting for bounce buffer space */
 +    CoQueue bounce_available;
 +
 +    /* The value of the "mem-region-alignment" property */
 +    size_t mem_region_alignment;
 +
 +    /* Can we skip adding/deleting blkio_mem_regions? */
 +    bool needs_mem_regions;
 +} BDRVBlkioState;
 +
 +/* Called with s->bounce_lock held */
 +static int blkio_resize_bounce_pool(BDRVBlkioState *s, int64_t bytes)
 +{
 +    /* There can be no allocated bounce buffers during resize */
 +    assert(QLIST_EMPTY(&s->bounce_bufs));
 +
 +    /* Pad size to reduce frequency of resize calls */
 +    bytes += 128 * 1024;
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        int ret;
 +
 +        if (s->bounce_pool.addr) {
 +            blkio_unmap_mem_region(s->blkio, &s->bounce_pool);
 +            blkio_free_mem_region(s->blkio, &s->bounce_pool);
 +            memset(&s->bounce_pool, 0, sizeof(s->bounce_pool));
 +        }
 +
 +        /* Automatically freed when s->blkio is destroyed */
 +        ret = blkio_alloc_mem_region(s->blkio, &s->bounce_pool, bytes);
 +        if (ret < 0) {
 +            return ret;
 +        }
 +
 +        ret = blkio_map_mem_region(s->blkio, &s->bounce_pool);
 +        if (ret < 0) {
 +            blkio_free_mem_region(s->blkio, &s->bounce_pool);
 +            memset(&s->bounce_pool, 0, sizeof(s->bounce_pool));
 +            return ret;
 +        }
 +    }
 +
 +    return 0;
 +}
 +
 +/* Called with s->bounce_lock held */
 +static bool
 +blkio_do_alloc_bounce_buffer(BDRVBlkioState *s, BlkioBounceBuf *bounce,
 +                             int64_t bytes)
 +{
 +    void *addr = s->bounce_pool.addr;
 +    BlkioBounceBuf *cur = NULL;
 +    BlkioBounceBuf *prev = NULL;
 +    ptrdiff_t space;
 +
 +    /*
 +     * This is just a linear search over the holes between requests. An
 +     * efficient allocator would be nice.
 +     */
 +    QLIST_FOREACH(cur, &s->bounce_bufs, next) {
 +        space = cur->buf.iov_base - addr;
 +        if (bytes <= space) {
 +            QLIST_INSERT_BEFORE(cur, bounce, next);
 +            bounce->buf.iov_base = addr;
 +            bounce->buf.iov_len = bytes;
 +            return true;
 +        }
 +
 +        addr = cur->buf.iov_base + cur->buf.iov_len;
 +        prev = cur;
 +    }
 +
 +    /* Is there space after the last request? */
 +    space = s->bounce_pool.addr + s->bounce_pool.len - addr;
 +    if (bytes > space) {
 +        return false;
 +    }
 +    if (prev) {
 +        QLIST_INSERT_AFTER(prev, bounce, next);
 +    } else {
 +        QLIST_INSERT_HEAD(&s->bounce_bufs, bounce, next);
 +    }
 +    bounce->buf.iov_base = addr;
 +    bounce->buf.iov_len = bytes;
 +    return true;
 +}
 +
 +static int coroutine_fn
 +blkio_alloc_bounce_buffer(BDRVBlkioState *s, BlkioBounceBuf *bounce,
 +                          int64_t bytes)
 +{
 +    /*
 +     * Ensure fairness: first time around we join the back of the queue,
 +     * subsequently we join the front so we don't lose our place.
 +     */
 +    CoQueueWaitFlags wait_flags = 0;
 +
 +    QEMU_LOCK_GUARD(&s->bounce_lock);
 +
 +    /* Ensure fairness: don't even try if other requests are already waiting */
 +    if (!qemu_co_queue_empty(&s->bounce_available)) {
 +        qemu_co_queue_wait_flags(&s->bounce_available, &s->bounce_lock,
 +                                 wait_flags);
 +        wait_flags = CO_QUEUE_WAIT_FRONT;
 +    }
 +
 +    while (true) {
 +        if (blkio_do_alloc_bounce_buffer(s, bounce, bytes)) {
 +            /* Kick the next queued request since there may be space */
 +            qemu_co_queue_next(&s->bounce_available);
 +            return 0;
 +        }
 +
 +        /*
 +         * If there are no in-flight requests then the pool was simply too
 +         * small.
 +         */
 +        if (QLIST_EMPTY(&s->bounce_bufs)) {
 +            bool ok;
 +            int ret;
 +
 +            ret = blkio_resize_bounce_pool(s, bytes);
 +            if (ret < 0) {
 +                /* Kick the next queued request since that may fail too */
 +                qemu_co_queue_next(&s->bounce_available);
 +                return ret;
 +            }
 +
 +            ok = blkio_do_alloc_bounce_buffer(s, bounce, bytes);
 +            assert(ok); /* must have space this time */
 +            return 0;
 +        }
 +
 +        qemu_co_queue_wait_flags(&s->bounce_available, &s->bounce_lock,
 +                                 wait_flags);
 +        wait_flags = CO_QUEUE_WAIT_FRONT;
 +    }
 +}
 +
 +static void coroutine_fn blkio_free_bounce_buffer(BDRVBlkioState *s,
 +                                                  BlkioBounceBuf *bounce)
 +{
 +    QEMU_LOCK_GUARD(&s->bounce_lock);
 +
 +    QLIST_REMOVE(bounce, next);
 +
 +    /* Wake up waiting coroutines since space may now be available */
 +    qemu_co_queue_next(&s->bounce_available);
 +}
 +
 +/* For async to .bdrv_co_*() conversion */
 +typedef struct {
 +    Coroutine *coroutine;
 +    int ret;
 +} BlkioCoData;
 +
 +static void blkio_completion_fd_read(void *opaque)
 +{
 +    BlockDriverState *bs = opaque;
 +    BDRVBlkioState *s = bs->opaque;
 +    uint64_t val;
 +    int ret;
 +
 +    /* Polling may have already fetched a completion */
 +    if (s->poll_completion.user_data != NULL) {
 +        BlkioCoData *cod = s->poll_completion.user_data;
 +        cod->ret = s->poll_completion.ret;
 +
 +        /* Clear it in case aio_co_wake() enters a nested event loop */
 +        s->poll_completion.user_data = NULL;
 +
 +        aio_co_wake(cod->coroutine);
 +    }
 +
 +    /* Reset completion fd status */
 +    ret = read(s->completion_fd, &val, sizeof(val));
 +
 +    /* Ignore errors, there's nothing we can do */
 +    (void)ret;
 +
 +    /*
 +     * Reading one completion at a time makes nested event loop re-entrancy
 +     * simple. Change this loop to get multiple completions in one go if it
 +     * becomes a performance bottleneck.
 +     */
 +    while (true) {
 +        struct blkio_completion completion;
 +
 +        WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +            ret = blkioq_do_io(s->blkioq, &completion, 0, 1, NULL);
 +        }
 +        if (ret != 1) {
 +            break;
 +        }
 +
 +        BlkioCoData *cod = completion.user_data;
 +        cod->ret = completion.ret;
 +        aio_co_wake(cod->coroutine);
 +    }
 +}
 +
 +static bool blkio_completion_fd_poll(void *opaque)
 +{
 +    BlockDriverState *bs = opaque;
 +    BDRVBlkioState *s = bs->opaque;
 +    int ret;
 +
 +    /* Just in case we already fetched a completion */
 +    if (s->poll_completion.user_data != NULL) {
 +        return true;
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        ret = blkioq_do_io(s->blkioq, &s->poll_completion, 0, 1, NULL);
 +    }
 +    return ret == 1;
 +}
 +
 +static void blkio_completion_fd_poll_ready(void *opaque)
 +{
 +    blkio_completion_fd_read(opaque);
 +}
 +
 +static void blkio_attach_aio_context(BlockDriverState *bs,
 +                                     AioContext *new_context)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +
 +    aio_set_fd_handler(new_context,
 +                       s->completion_fd,
 +                       false,
 +                       blkio_completion_fd_read,
 +                       NULL,
 +                       blkio_completion_fd_poll,
 +                       blkio_completion_fd_poll_ready,
 +                       bs);
 +}
 +
 +static void blkio_detach_aio_context(BlockDriverState *bs)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +
 +    aio_set_fd_handler(bdrv_get_aio_context(bs),
 +                       s->completion_fd,
 +                       false, NULL, NULL, NULL, NULL, NULL);
 +}
 +
 +/* Call with s->blkio_lock held to submit I/O after enqueuing a new request */
 +static void blkio_submit_io(BlockDriverState *bs)
 +{
 +    if (qatomic_read(&bs->io_plugged) == 0) {
 +        BDRVBlkioState *s = bs->opaque;
 +
 +        blkioq_do_io(s->blkioq, NULL, 0, 0, NULL);
 +    }
 +}
 +
 +static int coroutine_fn
 +blkio_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    BlkioCoData cod = {
 +        .coroutine = qemu_coroutine_self(),
 +    };
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkioq_discard(s->blkioq, offset, bytes, &cod, 0);
 +        blkio_submit_io(bs);
 +    }
 +
 +    qemu_coroutine_yield();
 +    return cod.ret;
 +}
 +
 +static int coroutine_fn
 +blkio_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
 +                QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    BlkioCoData cod = {
 +        .coroutine = qemu_coroutine_self(),
 +    };
 +    BDRVBlkioState *s = bs->opaque;
 +    bool use_bounce_buffer = s->needs_mem_regions;
 +    BlkioBounceBuf bounce;
 +    struct iovec *iov = qiov->iov;
 +    int iovcnt = qiov->niov;
 +
 +    if (use_bounce_buffer) {
 +        int ret = blkio_alloc_bounce_buffer(s, &bounce, bytes);
 +        if (ret < 0) {
 +            return ret;
 +        }
 +
 +        iov = &bounce.buf;
 +        iovcnt = 1;
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkioq_readv(s->blkioq, offset, iov, iovcnt, &cod, 0);
 +        blkio_submit_io(bs);
 +    }
 +
 +    qemu_coroutine_yield();
 +
 +    if (use_bounce_buffer) {
 +        if (cod.ret == 0) {
 +            qemu_iovec_from_buf(qiov, 0,
 +                                bounce.buf.iov_base,
 +                                bounce.buf.iov_len);
 +        }
 +
 +        blkio_free_bounce_buffer(s, &bounce);
 +    }
 +
 +    return cod.ret;
 +}
 +
 +static int coroutine_fn blkio_co_pwritev(BlockDriverState *bs, int64_t offset,
 +        int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
 +{
 +    uint32_t blkio_flags = (flags & BDRV_REQ_FUA) ? BLKIO_REQ_FUA : 0;
 +    BlkioCoData cod = {
 +        .coroutine = qemu_coroutine_self(),
 +    };
 +    BDRVBlkioState *s = bs->opaque;
 +    bool use_bounce_buffer = s->needs_mem_regions;
 +    BlkioBounceBuf bounce;
 +    struct iovec *iov = qiov->iov;
 +    int iovcnt = qiov->niov;
 +
 +    if (use_bounce_buffer) {
 +        int ret = blkio_alloc_bounce_buffer(s, &bounce, bytes);
 +        if (ret < 0) {
 +            return ret;
 +        }
 +
 +        qemu_iovec_to_buf(qiov, 0, bounce.buf.iov_base, bytes);
 +        iov = &bounce.buf;
 +        iovcnt = 1;
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkioq_writev(s->blkioq, offset, iov, iovcnt, &cod, blkio_flags);
 +        blkio_submit_io(bs);
 +    }
 +
 +    qemu_coroutine_yield();
 +
 +    if (use_bounce_buffer) {
 +        blkio_free_bounce_buffer(s, &bounce);
 +    }
 +
 +    return cod.ret;
 +}
 +
 +static int coroutine_fn blkio_co_flush(BlockDriverState *bs)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    BlkioCoData cod = {
 +        .coroutine = qemu_coroutine_self(),
 +    };
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkioq_flush(s->blkioq, &cod, 0);
 +        blkio_submit_io(bs);
 +    }
 +
 +    qemu_coroutine_yield();
 +    return cod.ret;
 +}
 +
 +static int coroutine_fn blkio_co_pwrite_zeroes(BlockDriverState *bs,
 +    int64_t offset, int64_t bytes, BdrvRequestFlags flags)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    BlkioCoData cod = {
 +        .coroutine = qemu_coroutine_self(),
 +    };
 +    uint32_t blkio_flags = 0;
 +
 +    if (flags & BDRV_REQ_FUA) {
 +        blkio_flags |= BLKIO_REQ_FUA;
 +    }
 +    if (!(flags & BDRV_REQ_MAY_UNMAP)) {
 +        blkio_flags |= BLKIO_REQ_NO_UNMAP;
 +    }
 +    if (flags & BDRV_REQ_NO_FALLBACK) {
 +        blkio_flags |= BLKIO_REQ_NO_FALLBACK;
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkioq_write_zeroes(s->blkioq, offset, bytes, &cod, blkio_flags);
 +        blkio_submit_io(bs);
 +    }
 +
 +    qemu_coroutine_yield();
 +    return cod.ret;
 +}
 +
 +static void blkio_io_unplug(BlockDriverState *bs)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkio_submit_io(bs);
 +    }
 +}
 +
 +static int blkio_io_uring_open(BlockDriverState *bs, QDict *options, int flags,
 +                               Error **errp)
 +{
 +    const char *filename = qdict_get_str(options, "filename");
 +    BDRVBlkioState *s = bs->opaque;
 +    int ret;
 +
 +    ret = blkio_set_str(s->blkio, "path", filename);
 +    qdict_del(options, "filename");
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "failed to set path: %s",
 +                         blkio_get_error_msg());
 +        return ret;
 +    }
 +
 +    if (flags & BDRV_O_NOCACHE) {
 +        ret = blkio_set_bool(s->blkio, "direct", true);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret, "failed to set direct: %s",
 +                             blkio_get_error_msg());
 +            return ret;
 +        }
 +    }
 +
 +    return 0;
 +}
 +
 +static int blkio_nvme_io_uring(BlockDriverState *bs, QDict *options, int flags,
 +                               Error **errp)
 +{
 +    const char *filename = qdict_get_str(options, "filename");
 +    BDRVBlkioState *s = bs->opaque;
 +    int ret;
 +
 +    ret = blkio_set_str(s->blkio, "path", filename);
 +    qdict_del(options, "filename");
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "failed to set path: %s",
 +                         blkio_get_error_msg());
 +        return ret;
 +    }
 +
 +    if (!(flags & BDRV_O_NOCACHE)) {
 +        error_setg(errp, "cache.direct=off is not supported");
 +        return -EINVAL;
 +    }
 +
 +    return 0;
 +}
 +
 +static int blkio_virtio_blk_common_open(BlockDriverState *bs,
 +        QDict *options, int flags, Error **errp)
 +{
 +    const char *path = qdict_get_try_str(options, "path");
 +    BDRVBlkioState *s = bs->opaque;
 +    int ret;
 +
 +    if (!path) {
 +        error_setg(errp, "missing 'path' option");
 +        return -EINVAL;
 +    }
 +
 +    ret = blkio_set_str(s->blkio, "path", path);
 +    qdict_del(options, "path");
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "failed to set path: %s",
 +                         blkio_get_error_msg());
 +        return ret;
 +    }
 +
 +    if (!(flags & BDRV_O_NOCACHE)) {
 +        error_setg(errp, "cache.direct=off is not supported");
 +        return -EINVAL;
 +    }
 +    return 0;
 +}
 +
 +static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
 +                           Error **errp)
 +{
 +    const char *blkio_driver = bs->drv->protocol_name;
 +    BDRVBlkioState *s = bs->opaque;
 +    int ret;
 +
 +    ret = blkio_create(blkio_driver, &s->blkio);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "blkio_create failed: %s",
 +                         blkio_get_error_msg());
 +        return ret;
 +    }
 +
 +    if (strcmp(blkio_driver, DRIVER_IO_URING) == 0) {
 +        ret = blkio_io_uring_open(bs, options, flags, errp);
 +    } else if (strcmp(blkio_driver, DRIVER_NVME_IO_URING) == 0) {
 +        ret = blkio_nvme_io_uring(bs, options, flags, errp);
 +    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_USER) == 0) {
 +        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
 +    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_VDPA) == 0) {
 +        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
 +    } else {
 +        g_assert_not_reached();
 +    }
 +    if (ret < 0) {
 +        blkio_destroy(&s->blkio);
 +        return ret;
 +    }
 +
 +    if (!(flags & BDRV_O_RDWR)) {
 +        ret = blkio_set_bool(s->blkio, "read-only", true);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret, "failed to set read-only: %s",
 +                             blkio_get_error_msg());
 +            blkio_destroy(&s->blkio);
 +            return ret;
 +        }
 +    }
 +
 +    ret = blkio_connect(s->blkio);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "blkio_connect failed: %s",
 +                         blkio_get_error_msg());
 +        blkio_destroy(&s->blkio);
 +        return ret;
 +    }
 +
 +    ret = blkio_get_bool(s->blkio,
 +                         "needs-mem-regions",
 +                         &s->needs_mem_regions);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret,
 +                         "failed to get needs-mem-regions: %s",
 +                         blkio_get_error_msg());
 +        blkio_destroy(&s->blkio);
 +        return ret;
 +    }
 +
 +    ret = blkio_get_uint64(s->blkio,
 +                           "mem-region-alignment",
 +                           &s->mem_region_alignment);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret,
 +                         "failed to get mem-region-alignment: %s",
 +                         blkio_get_error_msg());
 +        blkio_destroy(&s->blkio);
 +        return ret;
 +    }
 +
 +    ret = blkio_start(s->blkio);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "blkio_start failed: %s",
 +                         blkio_get_error_msg());
 +        blkio_destroy(&s->blkio);
 +        return ret;
 +    }
 +
 +    bs->supported_write_flags = BDRV_REQ_FUA;
 +    bs->supported_zero_flags = BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP |
 +                               BDRV_REQ_NO_FALLBACK;
 +
 +    qemu_mutex_init(&s->blkio_lock);
 +    qemu_co_mutex_init(&s->bounce_lock);
 +    qemu_co_queue_init(&s->bounce_available);
 +    QLIST_INIT(&s->bounce_bufs);
 +    s->blkioq = blkio_get_queue(s->blkio, 0);
 +    s->completion_fd = blkioq_get_completion_fd(s->blkioq);
 +
 +    blkio_attach_aio_context(bs, bdrv_get_aio_context(bs));
 +    return 0;
 +}
 +
 +static void blkio_close(BlockDriverState *bs)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +
 +    /* There is no destroy() API for s->bounce_lock */
 +
 +    qemu_mutex_destroy(&s->blkio_lock);
 +    blkio_detach_aio_context(bs);
 +    blkio_destroy(&s->blkio);
 +}
 +
 +static int64_t blkio_getlength(BlockDriverState *bs)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    uint64_t capacity;
 +    int ret;
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        ret = blkio_get_uint64(s->blkio, "capacity", &capacity);
 +    }
 +    if (ret < 0) {
 +        return -ret;
 +    }
 +
 +    return capacity;
 +}
 +
 +static int blkio_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 +{
 +    return 0;
 +}
 +
 +static void blkio_refresh_limits(BlockDriverState *bs, Error **errp)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    QEMU_LOCK_GUARD(&s->blkio_lock);
 +    int value;
 +    int ret;
 +
 +    ret = blkio_get_int(s->blkio, "request-alignment", &value);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "failed to get \"request-alignment\": %s",
 +                         blkio_get_error_msg());
 +        return;
 +    }
 +    bs->bl.request_alignment = value;
 +    if (bs->bl.request_alignment < 1 ||
 +        bs->bl.request_alignment >= INT_MAX ||
 +        !is_power_of_2(bs->bl.request_alignment)) {
 +        error_setg(errp, "invalid \"request-alignment\" value %" PRIu32 ", "
 +                   "must be a power of 2 less than INT_MAX",
 +                   bs->bl.request_alignment);
 +        return;
 +    }
 +
-+    ret = blkio_get_int(s->blkio, "optimal-io-size", &value);
++    /* If we want to allow more extreme test scenarios this guard could be
-+    if (ret < 0) {
++     * removed.  For now it protects against accidents. */
-+        error_setg_errno(errp, -ret, "failed to get \"optimal-io-size\": %s",
++    if (bdrv_has_blk(bs)) {
-+                         blkio_get_error_msg());
++        error_setg(errp, "Node %s is in use", node_name);
 +        return;
 +    }
 +    bs->bl.opt_transfer = value;
 +    if (bs->bl.opt_transfer > INT_MAX ||
 +        (bs->bl.opt_transfer % bs->bl.request_alignment)) {
 +        error_setg(errp, "invalid \"optimal-io-size\" value %" PRIu32 ", must "
 +                   "be a multiple of %" PRIu32, bs->bl.opt_transfer,
 +                   bs->bl.request_alignment);
 +        return;
 +    }
 +
-+    ret = blkio_get_int(s->blkio, "max-transfer", &value);
++    if (iothread->type == QTYPE_QSTRING) {
-+    if (ret < 0) {
++        IOThread *obj = iothread_by_id(iothread->u.s);
-+        error_setg_errno(errp, -ret, "failed to get \"max-transfer\": %s",
++        if (!obj) {
-+                         blkio_get_error_msg());
++            error_setg(errp, "Cannot find iothread %s", iothread->u.s);
-+        return;
++            return;
-+    }
++        }
-+    bs->bl.max_transfer = value;
++
-+    if ((bs->bl.max_transfer % bs->bl.request_alignment) ||
++        new_context = iothread_get_aio_context(obj);
-+        (bs->bl.opt_transfer && (bs->bl.max_transfer % bs->bl.opt_transfer))) {
++    } else {
-+        error_setg(errp, "invalid \"max-transfer\" value %" PRIu32 ", must be "
++        new_context = qemu_get_aio_context();
 +                   "a multiple of %" PRIu32 " and %" PRIu32 " (if non-zero)",
 +                   bs->bl.max_transfer, bs->bl.request_alignment,
 +                   bs->bl.opt_transfer);
 +        return;
 +    }
 +
-+    ret = blkio_get_int(s->blkio, "buf-alignment", &value);
++    old_context = bdrv_get_aio_context(bs);
-+    if (ret < 0) {
++    aio_context_acquire(old_context);
 +        error_setg_errno(errp, -ret, "failed to get \"buf-alignment\": %s",
 +                         blkio_get_error_msg());
 +        return;
 +    }
 +    if (value < 1) {
 +        error_setg(errp, "invalid \"buf-alignment\" value %d, must be "
 +                   "positive", value);
 +        return;
 +    }
 +    bs->bl.min_mem_alignment = value;
 +
-+    ret = blkio_get_int(s->blkio, "optimal-buf-alignment", &value);
++    bdrv_set_aio_context(bs, new_context);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret,
 +                         "failed to get \"optimal-buf-alignment\": %s",
 +                         blkio_get_error_msg());
 +        return;
 +    }
 +    if (value < 1) {
 +        error_setg(errp, "invalid \"optimal-buf-alignment\" value %d, "
 +                   "must be positive", value);
 +        return;
 +    }
 +    bs->bl.opt_mem_alignment = value;
 +
-+    ret = blkio_get_int(s->blkio, "max-segments", &value);
++    aio_context_release(old_context);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret, "failed to get \"max-segments\": %s",
 +                         blkio_get_error_msg());
 +        return;
 +    }
 +    if (value < 1) {
 +        error_setg(errp, "invalid \"max-segments\" value %d, must be positive",
 +                   value);
 +        return;
 +    }
 +    bs->bl.max_iov = value;
 +}
 +
-+/*
+ QemuOptsList qemu_common_drive_opts = {
-+ * TODO
+     .name = "drive",
-+ * Missing libblkio APIs:
+     .head = QTAILQ_HEAD_INITIALIZER(qemu_common_drive_opts.head),
 + * - block_status
 + * - co_invalidate_cache
 + *
 + * Out of scope?
 + * - create
 + * - truncate
 + */
 +
 +#define BLKIO_DRIVER(name, ...) \
 +    { \
 +        .format_name             = name, \
 +        .protocol_name           = name, \
 +        .instance_size           = sizeof(BDRVBlkioState), \
 +        .bdrv_file_open          = blkio_file_open, \
 +        .bdrv_close              = blkio_close, \
 +        .bdrv_getlength          = blkio_getlength, \
 +        .bdrv_get_info           = blkio_get_info, \
 +        .bdrv_attach_aio_context = blkio_attach_aio_context, \
 +        .bdrv_detach_aio_context = blkio_detach_aio_context, \
 +        .bdrv_co_pdiscard        = blkio_co_pdiscard, \
 +        .bdrv_co_preadv          = blkio_co_preadv, \
 +        .bdrv_co_pwritev         = blkio_co_pwritev, \
 +        .bdrv_co_flush_to_disk   = blkio_co_flush, \
 +        .bdrv_co_pwrite_zeroes   = blkio_co_pwrite_zeroes, \
 +        .bdrv_io_unplug          = blkio_io_unplug, \
 +        .bdrv_refresh_limits     = blkio_refresh_limits, \
 +        __VA_ARGS__ \
 +    }
 +
 +static BlockDriver bdrv_io_uring = BLKIO_DRIVER(
 +    DRIVER_IO_URING,
 +    .bdrv_needs_filename = true,
 +);
 +
 +static BlockDriver bdrv_nvme_io_uring = BLKIO_DRIVER(
 +    DRIVER_NVME_IO_URING,
 +    .bdrv_needs_filename = true,
 +);
 +
 +static BlockDriver bdrv_virtio_blk_vhost_user = BLKIO_DRIVER(
 +    DRIVER_VIRTIO_BLK_VHOST_USER
 +);
 +
 +static BlockDriver bdrv_virtio_blk_vhost_vdpa = BLKIO_DRIVER(
 +    DRIVER_VIRTIO_BLK_VHOST_VDPA
 +);
 +
 +static void bdrv_blkio_init(void)
 +{
 +    bdrv_register(&bdrv_io_uring);
 +    bdrv_register(&bdrv_nvme_io_uring);
 +    bdrv_register(&bdrv_virtio_blk_vhost_user);
 +    bdrv_register(&bdrv_virtio_blk_vhost_vdpa);
 +}
 +
 +block_init(bdrv_blkio_init);
 diff --git a/tests/qtest/modules-test.c b/tests/qtest/modules-test.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/modules-test.c
 +++ b/tests/qtest/modules-test.c
@@ -XXX,XX +XXX,XX @@ static void test_modules_load(const void *data)
  int main(int argc, char *argv[])
  {
      const char *modules[] = {
 +#ifdef CONFIG_BLKIO
 +        "block-", "blkio",
 +#endif
  #ifdef CONFIG_CURL
          "block-", "curl",
  #endif
 diff --git a/block/meson.build b/block/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_modules = {}
  modsrc = []
  foreach m : [
 +  [blkio, 'blkio', files('blkio.c')],
    [curl, 'curl', files('curl.c')],
    [glusterfs, 'gluster', files('gluster.c')],
    [libiscsi, 'iscsi', [files('iscsi.c'), libm]],
 diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
 index XXXXXXX..XXXXXXX 100644
 --- a/scripts/meson-buildoptions.sh
 +++ b/scripts/meson-buildoptions.sh
@@ -XXX,XX +XXX,XX @@ meson_options_help() {
    printf "%s\n" '  auth-pam        PAM access control'
    printf "%s\n" '  avx2            AVX2 optimizations'
    printf "%s\n" '  avx512f         AVX512F optimizations'
 +  printf "%s\n" '  blkio           libblkio block device driver'
    printf "%s\n" '  bochs           bochs image format support'
    printf "%s\n" '  bpf             eBPF support'
    printf "%s\n" '  brlapi          brlapi character device driver'
@@ -XXX,XX +XXX,XX @@ _meson_option_parse() {
      --disable-gcov) printf "%s" -Db_coverage=false ;;
      --enable-lto) printf "%s" -Db_lto=true ;;
      --disable-lto) printf "%s" -Db_lto=false ;;
 +    --enable-blkio) printf "%s" -Dblkio=enabled ;;
 +    --disable-blkio) printf "%s" -Dblkio=disabled ;;
      --block-drv-ro-whitelist=*) quote_sh "-Dblock_drv_ro_whitelist=$2" ;;
      --block-drv-rw-whitelist=*) quote_sh "-Dblock_drv_rw_whitelist=$2" ;;
      --enable-block-drv-whitelist-in-tools) printf "%s" -Dblock_drv_whitelist_in_tools=true ;;
 --
-.37.3
+.14.3

-[PULL 09/13] block: add BlockRAMRegistrar
+[Qemu-devel] [PULL v2 15/23] qemu-iotests: add 202 external snapshots IOThread test
-Emulated devices and other BlockBackend users wishing to take advantage
+QMP 'transaction' blockdev-snapshot-sync with multiple disks in an
-of blk_register_buf() all have the same repetitive job: register
+IOThread is an untested code path.  Several bugs have been found in
-RAMBlocks with the BlockBackend using RAMBlockNotifier.
+connection with this command.  This patch adds a test case to prevent
+future regressions.
 Add a BlockRAMRegistrar API to do this. A later commit will use this
 from hw/block/virtio-blk.c.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Message-id: 20221013185908.1297568-10-stefanha@redhat.com
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171206144550.22295-10-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- MAINTAINERS                          |  1 +
+ tests/qemu-iotests/202     | 95 ++++++++++++++++++++++++++++++++++++++++++++++
- include/sysemu/block-ram-registrar.h | 37 ++++++++++++++++++
+ tests/qemu-iotests/202.out | 11 ++++++
- block/block-ram-registrar.c          | 58 ++++++++++++++++++++++++++++
+ tests/qemu-iotests/group   |  1 +
- block/meson.build                    |  1 +
+files changed, 107 insertions(+)
-files changed, 97 insertions(+)
+ create mode 100755 tests/qemu-iotests/202
- create mode 100644 include/sysemu/block-ram-registrar.h
+ create mode 100644 tests/qemu-iotests/202.out
  create mode 100644 block/block-ram-registrar.c
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/tests/qemu-iotests/202 b/tests/qemu-iotests/202
-index XXXXXXX..XXXXXXX 100644
+new file mode 100755
---- a/MAINTAINERS
+index XXXXXXX..XXXXXXX
-+++ b/MAINTAINERS
+--- /dev/null
-@@ -XXX,XX +XXX,XX @@ F: block*
++++ b/tests/qemu-iotests/202
- F: block/
+@@ -XXX,XX +XXX,XX @@
- F: hw/block/
++#!/usr/bin/env python
- F: include/block/
++#
-+F: include/sysemu/block-*.h
++# Copyright (C) 2017 Red Hat, Inc.
- F: qemu-img*
++#
- F: docs/tools/qemu-img.rst
++# This program is free software; you can redistribute it and/or modify
- F: qemu-io*
++# it under the terms of the GNU General Public License as published by
-diff --git a/include/sysemu/block-ram-registrar.h b/include/sysemu/block-ram-registrar.h
++# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 +#
 +# This program is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
 +# Creator/Owner: Stefan Hajnoczi <stefanha@redhat.com>
 +#
 +# Check that QMP 'transaction' blockdev-snapshot-sync with multiple drives on a
 +# single IOThread completes successfully.  This particular command triggered a
 +# hang due to recursive AioContext locking and BDRV_POLL_WHILE().  Protect
 +# against regressions.
 +
 +import iotests
 +
 +iotests.verify_image_format(supported_fmts=['qcow2'])
 +iotests.verify_platform(['linux'])
 +
 +with iotests.FilePath('disk0.img') as disk0_img_path, \
 +     iotests.FilePath('disk1.img') as disk1_img_path, \
 +     iotests.FilePath('disk0-snap.img') as disk0_snap_img_path, \
 +     iotests.FilePath('disk1-snap.img') as disk1_snap_img_path, \
 +     iotests.VM() as vm:
 +
 +    img_size = '10M'
 +    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk0_img_path, img_size)
 +    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk1_img_path, img_size)
 +
 +    iotests.log('Launching VM...')
 +    vm.launch()
 +
 +    iotests.log('Adding IOThread...')
 +    iotests.log(vm.qmp('object-add',
 +                       qom_type='iothread',
 +                       id='iothread0'))
 +
 +    iotests.log('Adding blockdevs...')
 +    iotests.log(vm.qmp('blockdev-add',
 +                       driver=iotests.imgfmt,
 +                       node_name='disk0',
 +                       file={
 +                           'driver': 'file',
 +                           'filename': disk0_img_path,
 +                       }))
 +    iotests.log(vm.qmp('blockdev-add',
 +                       driver=iotests.imgfmt,
 +                       node_name='disk1',
 +                       file={
 +                           'driver': 'file',
 +                           'filename': disk1_img_path,
 +                       }))
 +
 +    iotests.log('Setting iothread...')
 +    iotests.log(vm.qmp('x-blockdev-set-iothread',
 +                       node_name='disk0',
 +                       iothread='iothread0'))
 +    iotests.log(vm.qmp('x-blockdev-set-iothread',
 +                       node_name='disk1',
 +                       iothread='iothread0'))
 +
 +    iotests.log('Creating external snapshots...')
 +    iotests.log(vm.qmp(
 +                  'transaction',
 +                  actions=[
 +                      {
 +                          'data': {
 +                              'node-name': 'disk0',
 +                              'snapshot-file': disk0_snap_img_path,
 +                              'snapshot-node-name': 'disk0-snap',
 +                              'mode': 'absolute-paths',
 +                              'format': iotests.imgfmt,
 +                          },
 +                          'type': 'blockdev-snapshot-sync'
 +                      }, {
 +                          'data': {
 +                              'node-name': 'disk1',
 +                              'snapshot-file': disk1_snap_img_path,
 +                              'snapshot-node-name': 'disk1-snap',
 +                              'mode': 'absolute-paths',
 +                              'format': iotests.imgfmt
 +                          },
 +                          'type': 'blockdev-snapshot-sync'
 +                      }
 +                  ]))
 diff --git a/tests/qemu-iotests/202.out b/tests/qemu-iotests/202.out
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/include/sysemu/block-ram-registrar.h
++++ b/tests/qemu-iotests/202.out
 @@ -XXX,XX +XXX,XX @@
-+/*
++Launching VM...
-+ * BlockBackend RAM Registrar
++Adding IOThread...
-+ *
++{u'return': {}}
-+ * SPDX-License-Identifier: GPL-2.0-or-later
++Adding blockdevs...
-+ */
++{u'return': {}}
-+
++{u'return': {}}
-+#ifndef BLOCK_RAM_REGISTRAR_H
++Setting iothread...
-+#define BLOCK_RAM_REGISTRAR_H
++{u'return': {}}
-+
++{u'return': {}}
-+#include "exec/ramlist.h"
++Creating external snapshots...
-+
++{u'return': {}}
-+/**
+diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
-+ * struct BlockRAMRegistrar:
+index XXXXXXX..XXXXXXX 100644
-+ *
+--- a/tests/qemu-iotests/group
-+ * Keeps RAMBlock memory registered with a BlockBackend using
++++ b/tests/qemu-iotests/group
 + * blk_register_buf() including hotplugged memory.
 + *
 + * Emulated devices or other BlockBackend users initialize a BlockRAMRegistrar
 + * with blk_ram_registrar_init() before submitting I/O requests with the
 + * BDRV_REQ_REGISTERED_BUF flag set.
 + */
 +typedef struct {
 +    BlockBackend *blk;
 +    RAMBlockNotifier notifier;
 +    bool ok;
 +} BlockRAMRegistrar;
 +
 +void blk_ram_registrar_init(BlockRAMRegistrar *r, BlockBackend *blk);
 +void blk_ram_registrar_destroy(BlockRAMRegistrar *r);
 +
 +/* Have all RAMBlocks been registered successfully? */
 +static inline bool blk_ram_registrar_ok(BlockRAMRegistrar *r)
 +{
 +    return r->ok;
 +}
 +
 +#endif /* BLOCK_RAM_REGISTRAR_H */
 diff --git a/block/block-ram-registrar.c b/block/block-ram-registrar.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/block/block-ram-registrar.c
 @@ -XXX,XX +XXX,XX @@
-+/*
+rw auto quick
-+ * BlockBackend RAM Registrar
+rw auto
-+ *
+rw auto
-+ * SPDX-License-Identifier: GPL-2.0-or-later
++202 rw auto quick
 + */
 +
 +#include "qemu/osdep.h"
 +#include "sysemu/block-backend.h"
 +#include "sysemu/block-ram-registrar.h"
 +#include "qapi/error.h"
 +
 +static void ram_block_added(RAMBlockNotifier *n, void *host, size_t size,
 +                            size_t max_size)
 +{
 +    BlockRAMRegistrar *r = container_of(n, BlockRAMRegistrar, notifier);
 +    Error *err = NULL;
 +
 +    if (!r->ok) {
 +        return; /* don't try again if we've already failed */
 +    }
 +
 +    if (!blk_register_buf(r->blk, host, max_size, &err)) {
 +        error_report_err(err);
 +        ram_block_notifier_remove(&r->notifier);
 +        r->ok = false;
 +    }
 +}
 +
 +static void ram_block_removed(RAMBlockNotifier *n, void *host, size_t size,
 +                              size_t max_size)
 +{
 +    BlockRAMRegistrar *r = container_of(n, BlockRAMRegistrar, notifier);
 +    blk_unregister_buf(r->blk, host, max_size);
 +}
 +
 +void blk_ram_registrar_init(BlockRAMRegistrar *r, BlockBackend *blk)
 +{
 +    r->blk = blk;
 +    r->notifier = (RAMBlockNotifier){
 +        .ram_block_added = ram_block_added,
 +        .ram_block_removed = ram_block_removed,
 +
 +        /*
 +         * .ram_block_resized() is not necessary because we use the max_size
 +         * value that does not change across resize.
 +         */
 +    };
 +    r->ok = true;
 +
 +    ram_block_notifier_add(&r->notifier);
 +}
 +
 +void blk_ram_registrar_destroy(BlockRAMRegistrar *r)
 +{
 +    if (r->ok) {
 +        ram_block_notifier_remove(&r->notifier);
 +    }
 +}
 diff --git a/block/meson.build b/block/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/block/meson.build
 +++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(files(
  ), zstd, zlib, gnutls)
  softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
 +softmmu_ss.add(files('block-ram-registrar.c'))
  if get_option('qcow1').allowed()
    block_ss.add(files('qcow.c'))
 --
-.37.3
+.14.3

-[PULL 13/13] virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint
+[Qemu-devel] [PULL v2 16/23] virtio-blk: make queue size configurable
-Register guest RAM using BlockRAMRegistrar and set the
+From: Mark Kanda <mark.kanda@oracle.com>
 BDRV_REQ_REGISTERED_BUF flag so block drivers can optimize memory
 accesses in I/O requests.
-This is for vdpa-blk, vhost-user-blk, and other I/O interfaces that rely
+Depending on the configuration, it can be beneficial to adjust the virtio-blk
-on DMA mapping/unmapping.
+queue size to something other than the current default of 128. Add a new
 property to make the queue size configurable.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Mark Kanda <mark.kanda@oracle.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
-Message-id: 20221013185908.1297568-14-stefanha@redhat.com
+Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
 Reviewed-by: Ameya More <ameya.more@oracle.com>
 Message-id: 52e6d742811f10dbd16e996e86cf375b9577c187.1513005190.git.mark.kanda@oracle.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/hw/virtio/virtio-blk.h |  2 ++
+ include/hw/virtio/virtio-blk.h |  1 +
- hw/block/virtio-blk.c          | 39 ++++++++++++++++++++++------------
+ hw/block/virtio-blk.c          | 10 +++++++++-
-files changed, 27 insertions(+), 14 deletions(-)
+files changed, 10 insertions(+), 1 deletion(-)
 diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-blk.h
 +++ b/include/hw/virtio/virtio-blk.h
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ struct VirtIOBlkConf
- #include "hw/block/block.h"
+     uint32_t config_wce;
- #include "sysemu/iothread.h"
+     uint32_t request_merging;
- #include "sysemu/block-backend.h"
+     uint16_t num_queues;
-+#include "sysemu/block-ram-registrar.h"
++    uint16_t queue_size;
  #include "qom/object.h"
  #define TYPE_VIRTIO_BLK "virtio-blk-device"
@@ -XXX,XX +XXX,XX @@ struct VirtIOBlock {
      struct VirtIOBlockDataPlane *dataplane;
      uint64_t host_features;
      size_t config_size;
 +    BlockRAMRegistrar blk_ram_registrar;
  };
- typedef struct VirtIOBlockReq {
+ struct VirtIOBlockDataPlane;
 diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/block/virtio-blk.c
 +++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
- #include "hw/block/block.h"
+         error_setg(errp, "num-queues property must be larger than 0");
  #include "hw/qdev-properties.h"
  #include "sysemu/blockdev.h"
 +#include "sysemu/block-ram-registrar.h"
  #include "sysemu/sysemu.h"
  #include "sysemu/runstate.h"
  #include "hw/virtio/virtio-blk.h"
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
      }
  }
 -static inline void submit_requests(BlockBackend *blk, MultiReqBuffer *mrb,
 +static inline void submit_requests(VirtIOBlock *s, MultiReqBuffer *mrb,
                                     int start, int num_reqs, int niov)
  {
 +    BlockBackend *blk = s->blk;
      QEMUIOVector *qiov = &mrb->reqs[start]->qiov;
      int64_t sector_num = mrb->reqs[start]->sector_num;
      bool is_write = mrb->is_write;
 +    BdrvRequestFlags flags = 0;
      if (num_reqs > 1) {
          int i;
@@ -XXX,XX +XXX,XX @@ static inline void submit_requests(BlockBackend *blk, MultiReqBuffer *mrb,
                                num_reqs - 1);
      }
 +    if (blk_ram_registrar_ok(&s->blk_ram_registrar)) {
 +        flags |= BDRV_REQ_REGISTERED_BUF;
 +    }
 +
      if (is_write) {
 -        blk_aio_pwritev(blk, sector_num << BDRV_SECTOR_BITS, qiov, 0,
 -                        virtio_blk_rw_complete, mrb->reqs[start]);
 +        blk_aio_pwritev(blk, sector_num << BDRV_SECTOR_BITS, qiov,
 +                        flags, virtio_blk_rw_complete,
 +                        mrb->reqs[start]);
      } else {
 -        blk_aio_preadv(blk, sector_num << BDRV_SECTOR_BITS, qiov, 0,
 -                       virtio_blk_rw_complete, mrb->reqs[start]);
 +        blk_aio_preadv(blk, sector_num << BDRV_SECTOR_BITS, qiov,
 +                       flags, virtio_blk_rw_complete,
 +                       mrb->reqs[start]);
      }
  }
@@ -XXX,XX +XXX,XX @@ static int multireq_compare(const void *a, const void *b)
      }
  }
 -static void virtio_blk_submit_multireq(BlockBackend *blk, MultiReqBuffer *mrb)
 +static void virtio_blk_submit_multireq(VirtIOBlock *s, MultiReqBuffer *mrb)
  {
      int i = 0, start = 0, num_reqs = 0, niov = 0, nb_sectors = 0;
      uint32_t max_transfer;
      int64_t sector_num = 0;
      if (mrb->num_reqs == 1) {
 -        submit_requests(blk, mrb, 0, 1, -1);
 +        submit_requests(s, mrb, 0, 1, -1);
          mrb->num_reqs = 0;
          return;
      }
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_submit_multireq(BlockBackend *blk, MultiReqBuffer *mrb)
++    if (!is_power_of_2(conf->queue_size) ||
-              * 3. merge would exceed maximum transfer length of backend device
++        conf->queue_size > VIRTQUEUE_MAX_SIZE) {
-              */
++        error_setg(errp, "invalid queue-size property (%" PRIu16 "), "
-             if (sector_num + nb_sectors != req->sector_num ||
++                   "must be a power of 2 (max %d)",
--                niov > blk_get_max_iov(blk) - req->qiov.niov ||
++                   conf->queue_size, VIRTQUEUE_MAX_SIZE);
-+                niov > blk_get_max_iov(s->blk) - req->qiov.niov ||
++        return;
-                 req->qiov.size > max_transfer ||
++    }
-                 nb_sectors > (max_transfer -
-                               req->qiov.size) / BDRV_SECTOR_SIZE) {
+     blkconf_serial(&conf->conf, &conf->serial);
--                submit_requests(blk, mrb, start, num_reqs, niov);
+     if (!blkconf_apply_backend_options(&conf->conf,
-+                submit_requests(s, mrb, start, num_reqs, niov);
+@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
-                 num_reqs = 0;
+     s->sector_mask = (s->conf.conf.logical_block_size / BDRV_SECTOR_SIZE) - 1;
-             }
-         }
+     for (i = 0; i < conf->num_queues; i++) {
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_submit_multireq(BlockBackend *blk, MultiReqBuffer *mrb)
+-        virtio_add_queue(vdev, 128, virtio_blk_handle_output);
-         num_reqs++;
++        virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
      }
+     virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err);
--    submit_requests(blk, mrb, start, num_reqs, niov);
+     if (err != NULL) {
-+    submit_requests(s, mrb, start, num_reqs, niov);
+@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
-     mrb->num_reqs = 0;
+     DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0,
- }
+                     true),
+     DEFINE_PROP_UINT16("num-queues", VirtIOBlock, conf.num_queues, 1),
-@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_flush(VirtIOBlockReq *req, MultiReqBuffer *mrb)
++    DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 128),
-      * Make sure all outstanding writes are posted to the backing device.
+     DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD,
-      */
+                      IOThread *),
-     if (mrb->is_write && mrb->num_reqs > 0) {
+     DEFINE_PROP_END_OF_LIST(),
 -        virtio_blk_submit_multireq(s->blk, mrb);
 +        virtio_blk_submit_multireq(s, mrb);
      }
      blk_aio_flush(s->blk, virtio_blk_flush_complete, req);
  }
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)
          if (mrb->num_reqs > 0 && (mrb->num_reqs == VIRTIO_BLK_MAX_MERGE_REQS ||
                                    is_write != mrb->is_write ||
                                    !s->conf.request_merging)) {
 -            virtio_blk_submit_multireq(s->blk, mrb);
 +            virtio_blk_submit_multireq(s, mrb);
          }
          assert(mrb->num_reqs < VIRTIO_BLK_MAX_MERGE_REQS);
@@ -XXX,XX +XXX,XX @@ void virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
      } while (!virtio_queue_empty(vq));
      if (mrb.num_reqs) {
 -        virtio_blk_submit_multireq(s->blk, &mrb);
 +        virtio_blk_submit_multireq(s, &mrb);
      }
      blk_io_unplug(s->blk);
@@ -XXX,XX +XXX,XX @@ void virtio_blk_process_queued_requests(VirtIOBlock *s, bool is_bh)
      }
      if (mrb.num_reqs) {
 -        virtio_blk_submit_multireq(s->blk, &mrb);
 +        virtio_blk_submit_multireq(s, &mrb);
      }
      if (is_bh) {
          blk_dec_in_flight(s->conf.conf.blk);
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
      }
      s->change = qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
 +    blk_ram_registrar_init(&s->blk_ram_registrar, s->blk);
      blk_set_dev_ops(s->blk, &virtio_block_ops, s);
      blk_iostatus_enable(s->blk);
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_unrealize(DeviceState *dev)
          virtio_del_queue(vdev, i);
      }
      qemu_coroutine_dec_pool_size(conf->num_queues * conf->queue_size / 2);
 +    blk_ram_registrar_destroy(&s->blk_ram_registrar);
      qemu_del_vm_change_state_handler(s->change);
      blockdev_mark_auto_del(s->blk);
      virtio_cleanup(vdev);
 --
-.37.3
+.14.3

-[PULL 12/13] blkio: implement BDRV_REQ_REGISTERED_BUF optimization
+[Qemu-devel] [PULL v2 17/23] virtio-blk: reject configs with logical block size > physical block size
-Avoid bounce buffers when QEMUIOVector elements are within previously
+From: Mark Kanda <mark.kanda@oracle.com>
 registered bdrv_register_buf() buffers.
-The idea is that emulated storage controllers will register guest RAM
+virtio-blk logical block size should never be larger than physical block
-using bdrv_register_buf() and set the BDRV_REQ_REGISTERED_BUF on I/O
+size because it doesn't make sense to have such configurations. QEMU doesn't
-requests. Therefore no blkio_map_mem_region() calls are necessary in the
+have a way to effectively express this condition; the best it can do is
-performance-critical I/O code path.
+report the physical block exponent as 0 - indicating the logical block size
 equals the physical block size.
-This optimization doesn't apply if the I/O buffer is internally
+This is identical to commit 3da023b5827543ee4c022986ea2ad9d1274410b2
-allocated by QEMU (e.g. qcow2 metadata). There we still take the slow
+but applied to virtio-blk (instead of virtio-scsi).
 path because BDRV_REQ_REGISTERED_BUF is not set.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Signed-off-by: Mark Kanda <mark.kanda@oracle.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
-Message-id: 20221013185908.1297568-13-stefanha@redhat.com
+Reviewed-by: Ameya More <ameya.more@oracle.com>
 Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
 Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: 773169891f9f2deb4cb7c4ef2655580dbe24c1d1.1513005190.git.mark.kanda@oracle.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- block/blkio.c | 183 +++++++++++++++++++++++++++++++++++++++++++++++++-
+ hw/block/virtio-blk.c | 7 +++++++
-file changed, 180 insertions(+), 3 deletions(-)
+file changed, 7 insertions(+)
-diff --git a/block/blkio.c b/block/blkio.c
+diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/blkio.c
+--- a/hw/block/virtio-blk.c
-+++ b/block/blkio.c
++++ b/hw/block/virtio-blk.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
- #include "qemu/osdep.h"
- #include <blkio.h>
+     blkconf_blocksizes(&conf->conf);
- #include "block/block_int.h"
-+#include "exec/memory.h"
++    if (conf->conf.logical_block_size >
-+#include "exec/cpu-common.h" /* for qemu_ram_get_fd() */
++        conf->conf.physical_block_size) {
- #include "qapi/error.h"
++        error_setg(errp,
-+#include "qemu/error-report.h"
++                   "logical_block_size > physical_block_size not supported");
  #include "qapi/qmp/qdict.h"
  #include "qemu/module.h"
 +#include "exec/memory.h" /* for ram_block_discard_disable() */
  /*
   * Keep the QEMU BlockDriver names identical to the libblkio driver names.
@@ -XXX,XX +XXX,XX @@ typedef struct {
      /* Can we skip adding/deleting blkio_mem_regions? */
      bool needs_mem_regions;
 +
 +    /* Are file descriptors necessary for blkio_mem_regions? */
 +    bool needs_mem_region_fd;
 +
 +    /* Are madvise(MADV_DONTNEED)-style operations unavailable? */
 +    bool may_pin_mem_regions;
  } BDRVBlkioState;
  /* Called with s->bounce_lock held */
@@ -XXX,XX +XXX,XX @@ blkio_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
          .coroutine = qemu_coroutine_self(),
      };
      BDRVBlkioState *s = bs->opaque;
 -    bool use_bounce_buffer = s->needs_mem_regions;
 +    bool use_bounce_buffer =
 +        s->needs_mem_regions && !(flags & BDRV_REQ_REGISTERED_BUF);
      BlkioBounceBuf bounce;
      struct iovec *iov = qiov->iov;
      int iovcnt = qiov->niov;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn blkio_co_pwritev(BlockDriverState *bs, int64_t offset,
          .coroutine = qemu_coroutine_self(),
      };
      BDRVBlkioState *s = bs->opaque;
 -    bool use_bounce_buffer = s->needs_mem_regions;
 +    bool use_bounce_buffer =
 +        s->needs_mem_regions && !(flags & BDRV_REQ_REGISTERED_BUF);
      BlkioBounceBuf bounce;
      struct iovec *iov = qiov->iov;
      int iovcnt = qiov->niov;
@@ -XXX,XX +XXX,XX @@ static void blkio_io_unplug(BlockDriverState *bs)
      }
  }
 +typedef enum {
 +    BMRR_OK,
 +    BMRR_SKIP,
 +    BMRR_FAIL,
 +} BlkioMemRegionResult;
 +
 +/*
 + * Produce a struct blkio_mem_region for a given address and size.
 + *
 + * This function produces identical results when called multiple times with the
 + * same arguments. This property is necessary because blkio_unmap_mem_region()
 + * must receive the same struct blkio_mem_region field values that were passed
 + * to blkio_map_mem_region().
 + */
 +static BlkioMemRegionResult
 +blkio_mem_region_from_host(BlockDriverState *bs,
 +                           void *host, size_t size,
 +                           struct blkio_mem_region *region,
 +                           Error **errp)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    int fd = -1;
 +    ram_addr_t fd_offset = 0;
 +
 +    if (((uintptr_t)host | size) % s->mem_region_alignment) {
 +        error_setg(errp, "unaligned buf %p with size %zu", host, size);
 +        return BMRR_FAIL;
 +    }
 +
 +    /* Attempt to find the fd for the underlying memory */
 +    if (s->needs_mem_region_fd) {
 +        RAMBlock *ram_block;
 +        RAMBlock *end_block;
 +        ram_addr_t offset;
 +
 +        /*
 +         * bdrv_register_buf() is called with the BQL held so mr lives at least
 +         * until this function returns.
 +         */
 +        ram_block = qemu_ram_block_from_host(host, false, &fd_offset);
 +        if (ram_block) {
 +            fd = qemu_ram_get_fd(ram_block);
 +        }
 +        if (fd == -1) {
 +            /*
 +             * Ideally every RAMBlock would have an fd. pc-bios and other
 +             * things don't. Luckily they are usually not I/O buffers and we
 +             * can just ignore them.
 +             */
 +            return BMRR_SKIP;
 +        }
 +
 +        /* Make sure the fd covers the entire range */
 +        end_block = qemu_ram_block_from_host(host + size - 1, false, &offset);
 +        if (ram_block != end_block) {
 +            error_setg(errp, "registered buffer at %p with size %zu extends "
 +                       "beyond RAMBlock", host, size);
 +            return BMRR_FAIL;
 +        }
 +    }
 +
 +    *region = (struct blkio_mem_region){
 +        .addr = host,
 +        .len = size,
 +        .fd = fd,
 +        .fd_offset = fd_offset,
 +    };
 +    return BMRR_OK;
 +}
 +
 +static bool blkio_register_buf(BlockDriverState *bs, void *host, size_t size,
 +                               Error **errp)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    struct blkio_mem_region region;
 +    BlkioMemRegionResult region_result;
 +    int ret;
 +
 +    /*
 +     * Mapping memory regions conflicts with RAM discard (virtio-mem) when
 +     * there is pinning, so only do it when necessary.
 +     */
 +    if (!s->needs_mem_regions && s->may_pin_mem_regions) {
 +        return true;
 +    }
 +
 +    region_result = blkio_mem_region_from_host(bs, host, size, &region, errp);
 +    if (region_result == BMRR_SKIP) {
 +        return true;
 +    } else if (region_result != BMRR_OK) {
 +        return false;
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        ret = blkio_map_mem_region(s->blkio, &region);
 +    }
 +
 +    if (ret < 0) {
 +        error_setg(errp, "Failed to add blkio mem region %p with size %zu: %s",
 +                   host, size, blkio_get_error_msg());
 +        return false;
 +    }
 +    return true;
 +}
 +
 +static void blkio_unregister_buf(BlockDriverState *bs, void *host, size_t size)
 +{
 +    BDRVBlkioState *s = bs->opaque;
 +    struct blkio_mem_region region;
 +
 +    /* See blkio_register_buf() */
 +    if (!s->needs_mem_regions && s->may_pin_mem_regions) {
 +        return;
 +    }
 +
-+    if (blkio_mem_region_from_host(bs, host, size, &region, NULL) != BMRR_OK) {
+     virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK,
-+        return;
+                 sizeof(struct virtio_blk_config));
 +    }
 +
 +    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
 +        blkio_unmap_mem_region(s->blkio, &region);
 +    }
 +}
 +
  static int blkio_io_uring_open(BlockDriverState *bs, QDict *options, int flags,
                                 Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
          return ret;
      }
 +    ret = blkio_get_bool(s->blkio,
 +                         "needs-mem-region-fd",
 +                         &s->needs_mem_region_fd);
 +    if (ret < 0) {
 +        error_setg_errno(errp, -ret,
 +                         "failed to get needs-mem-region-fd: %s",
 +                         blkio_get_error_msg());
 +        blkio_destroy(&s->blkio);
 +        return ret;
 +    }
 +
      ret = blkio_get_uint64(s->blkio,
                             "mem-region-alignment",
                             &s->mem_region_alignment);
@@ -XXX,XX +XXX,XX @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
          return ret;
      }
 +    ret = blkio_get_bool(s->blkio,
 +                         "may-pin-mem-regions",
 +                         &s->may_pin_mem_regions);
 +    if (ret < 0) {
 +        /* Be conservative (assume pinning) if the property is not supported */
 +        s->may_pin_mem_regions = s->needs_mem_regions;
 +    }
 +
 +    /*
 +     * Notify if libblkio drivers pin memory and prevent features like
 +     * virtio-mem from working.
 +     */
 +    if (s->may_pin_mem_regions) {
 +        ret = ram_block_discard_disable(true);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret, "ram_block_discard_disable() failed");
 +            blkio_destroy(&s->blkio);
 +            return ret;
 +        }
 +    }
 +
      ret = blkio_start(s->blkio);
      if (ret < 0) {
          error_setg_errno(errp, -ret, "blkio_start failed: %s",
                           blkio_get_error_msg());
          blkio_destroy(&s->blkio);
 +        if (s->may_pin_mem_regions) {
 +            ram_block_discard_disable(false);
 +        }
          return ret;
      }
 -    bs->supported_write_flags = BDRV_REQ_FUA;
 +    bs->supported_write_flags = BDRV_REQ_FUA | BDRV_REQ_REGISTERED_BUF;
      bs->supported_zero_flags = BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP |
                                 BDRV_REQ_NO_FALLBACK;
@@ -XXX,XX +XXX,XX @@ static void blkio_close(BlockDriverState *bs)
      qemu_mutex_destroy(&s->blkio_lock);
      blkio_detach_aio_context(bs);
      blkio_destroy(&s->blkio);
 +
 +    if (s->may_pin_mem_regions) {
 +        ram_block_discard_disable(false);
 +    }
  }
  static int64_t blkio_getlength(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static void blkio_refresh_limits(BlockDriverState *bs, Error **errp)
          .bdrv_co_pwrite_zeroes   = blkio_co_pwrite_zeroes, \
          .bdrv_io_unplug          = blkio_io_unplug, \
          .bdrv_refresh_limits     = blkio_refresh_limits, \
 +        .bdrv_register_buf       = blkio_register_buf, \
 +        .bdrv_unregister_buf     = blkio_unregister_buf, \
          __VA_ARGS__ \
      }
 --
-.37.3
+.14.3

-[PULL 06/13] block: add BDRV_REQ_REGISTERED_BUF request flag
+[Qemu-devel] [PULL v2 18/23] block: avoid recursive AioContext acquire in bdrv_inactivate_all()
-Block drivers may optimize I/O requests accessing buffers previously
+From: Paolo Bonzini <pbonzini@redhat.com>
 registered with bdrv_register_buf(). Checking whether all elements of a
 request's QEMUIOVector are within previously registered buffers is
 expensive, so we need a hint from the user to avoid costly checks.
-Add a BDRV_REQ_REGISTERED_BUF request flag to indicate that all
+BDRV_POLL_WHILE() does not support recursive AioContext locking.  It
-QEMUIOVector elements in an I/O request are known to be within
+only releases the AioContext lock once regardless of how many times the
-previously registered buffers.
+caller has acquired it.  This results in a hang since the IOThread does
 not make progress while the AioContext is still locked.
-Always pass the flag through to driver read/write functions. There is
+The following steps trigger the hang:
 little harm in passing the flag to a driver that does not use it.
 Passing the flag to drivers avoids changes across many block drivers.
 Filter drivers would need to explicitly support the flag and pass
 through to their children when the children support it. That's a lot of
 code changes and it's hard to remember to do that everywhere, leading to
 silent reduced performance when the flag is accidentally dropped.
-The only problematic scenario with the approach in this patch is when a
+  $ qemu-system-x86_64 -M accel=kvm -m 1G -cpu host \
-driver passes the flag through to internal I/O requests that don't use
+                       -object iothread,id=iothread0 \
-the same I/O buffer. In that case the hint may be set when it should
+                       -device virtio-scsi-pci,iothread=iothread0 \
-actually be clear. This is a rare case though so the risk is low.
+                       -drive if=none,id=drive0,file=test.img,format=raw \
                        -device scsi-hd,drive=drive0 \
                        -drive if=none,id=drive1,file=test.img,format=raw \
                        -device scsi-hd,drive=drive1
   $ qemu-system-x86_64 ...same options... \
                        -incoming tcp::1234
   (qemu) migrate tcp:127.0.0.1:1234
   ...hang...
-Some drivers have assert(!flags), which no longer works when
+Tested-by: Stefan Hajnoczi <stefanha@redhat.com>
-BDRV_REQ_REGISTERED_BUF is passed in. These assertions aren't very
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
-useful anyway since the functions are called almost exclusively by
+Reviewed-by: Eric Blake <eblake@redhat.com>
-bdrv_driver_preadv/pwritev() so if we get flags handling right there
+Message-id: 20171207201320.19284-2-stefanha@redhat.com
 then the assertion is not needed.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-id: 20221013185908.1297568-7-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/block/block-common.h |  9 ++++++
+ block.c | 14 +++++++++++---
- block.c                      | 14 +++++++++
+file changed, 11 insertions(+), 3 deletions(-)
  block/blkverify.c            |  4 +--
  block/crypto.c               |  4 +--
  block/file-posix.c           |  1 -
  block/gluster.c              |  1 -
  block/io.c                   | 61 ++++++++++++++++++++++--------------
  block/mirror.c               |  2 ++
  block/nbd.c                  |  1 -
  block/parallels.c            |  1 -
  block/qcow.c                 |  2 --
  block/qed.c                  |  1 -
  block/raw-format.c           |  2 ++
  block/replication.c          |  1 -
  block/ssh.c                  |  1 -
  block/vhdx.c                 |  1 -
 files changed, 69 insertions(+), 37 deletions(-)
-diff --git a/include/block/block-common.h b/include/block/block-common.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/block/block-common.h
-+++ b/include/block/block-common.h
-@@ -XXX,XX +XXX,XX @@ typedef enum {
-      */
-     BDRV_REQ_MAY_UNMAP          = 0x4,
-+    /*
-+     * An optimization hint when all QEMUIOVector elements are within
-+     * previously registered bdrv_register_buf() memory ranges.
-+     *
-+     * Code that replaces the user's QEMUIOVector elements with bounce buffers
-+     * must take care to clear this flag.
-+     */
-+    BDRV_REQ_REGISTERED_BUF     = 0x8,
-+
-     BDRV_REQ_FUA                = 0x10,
-     BDRV_REQ_WRITE_COMPRESSED   = 0x20,
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
-@@ -XXX,XX +XXX,XX @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
+@@ -XXX,XX +XXX,XX @@ int bdrv_inactivate_all(void)
-         goto open_failed;
+     BdrvNextIterator it;
      int ret = 0;
      int pass;
 +    GSList *aio_ctxs = NULL, *ctx;
      for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
 -        aio_context_acquire(bdrv_get_aio_context(bs));
 +        AioContext *aio_context = bdrv_get_aio_context(bs);
 +
 +        if (!g_slist_find(aio_ctxs, aio_context)) {
 +            aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
 +            aio_context_acquire(aio_context);
 +        }
      }
-+    assert(!(bs->supported_read_flags & ~BDRV_REQ_MASK));
+     /* We do two passes of inactivation. The first pass calls to drivers'
-+    assert(!(bs->supported_write_flags & ~BDRV_REQ_MASK));
+@@ -XXX,XX +XXX,XX @@ int bdrv_inactivate_all(void)
-+
+     }
-+    /*
-+     * Always allow the BDRV_REQ_REGISTERED_BUF optimization hint. This saves
+ out:
-+     * drivers that pass read/write requests through to a child the trouble of
+-    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
-+     * declaring support explicitly.
+-        aio_context_release(bdrv_get_aio_context(bs));
-+     *
++    for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
-+     * Drivers must not propagate this flag accidentally when they initiate I/O
++        AioContext *aio_context = ctx->data;
-+     * to a bounce buffer. That case should be rare though.
++        aio_context_release(aio_context);
-+     */
+     }
-+    bs->supported_read_flags |= BDRV_REQ_REGISTERED_BUF;
++    g_slist_free(aio_ctxs);
-+    bs->supported_write_flags |= BDRV_REQ_REGISTERED_BUF;
-+
+     return ret;
      ret = refresh_total_sectors(bs, bs->total_sectors);
      if (ret < 0) {
          error_setg_errno(errp, -ret, "Could not refresh total sector count");
 diff --git a/block/blkverify.c b/block/blkverify.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/blkverify.c
 +++ b/block/blkverify.c
@@ -XXX,XX +XXX,XX @@ blkverify_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
      qemu_iovec_init(&raw_qiov, qiov->niov);
      qemu_iovec_clone(&raw_qiov, qiov, buf);
 -    ret = blkverify_co_prwv(bs, &r, offset, bytes, qiov, &raw_qiov, flags,
 -                            false);
 +    ret = blkverify_co_prwv(bs, &r, offset, bytes, qiov, &raw_qiov,
 +                            flags & ~BDRV_REQ_REGISTERED_BUF, false);
      cmp_offset = qemu_iovec_compare(qiov, &raw_qiov);
      if (cmp_offset != -1) {
 diff --git a/block/crypto.c b/block/crypto.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/crypto.c
 +++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ block_crypto_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
      uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
      uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
 -    assert(!flags);
      assert(payload_offset < INT64_MAX);
      assert(QEMU_IS_ALIGNED(offset, sector_size));
      assert(QEMU_IS_ALIGNED(bytes, sector_size));
@@ -XXX,XX +XXX,XX @@ block_crypto_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
      uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
      uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
 -    assert(!(flags & ~BDRV_REQ_FUA));
 +    flags &= ~BDRV_REQ_REGISTERED_BUF;
 +
      assert(payload_offset < INT64_MAX);
      assert(QEMU_IS_ALIGNED(offset, sector_size));
      assert(QEMU_IS_ALIGNED(bytes, sector_size));
 diff --git a/block/file-posix.c b/block/file-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
                                         int64_t bytes, QEMUIOVector *qiov,
                                         BdrvRequestFlags flags)
  {
 -    assert(flags == 0);
      return raw_co_prw(bs, offset, bytes, qiov, QEMU_AIO_WRITE);
  }
-diff --git a/block/gluster.c b/block/gluster.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/gluster.c
-+++ b/block/gluster.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qemu_gluster_co_writev(BlockDriverState *bs,
-                                                QEMUIOVector *qiov,
-                                                int flags)
- {
--    assert(!flags);
-     return qemu_gluster_co_rw(bs, sector_num, nb_sectors, qiov, 1);
- }
-diff --git a/block/io.c b/block/io.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/io.c
-+++ b/block/io.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
-     int ret;
-     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
--    assert(!(flags & ~BDRV_REQ_MASK));
--    assert(!(flags & BDRV_REQ_NO_FALLBACK));
-+    assert(!(flags & ~bs->supported_read_flags));
-     if (!drv) {
-         return -ENOMEDIUM;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
-                                             BdrvRequestFlags flags)
- {
-     BlockDriver *drv = bs->drv;
-+    bool emulate_fua = false;
-     int64_t sector_num;
-     unsigned int nb_sectors;
-     QEMUIOVector local_qiov;
-     int ret;
-     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
--    assert(!(flags & ~BDRV_REQ_MASK));
--    assert(!(flags & BDRV_REQ_NO_FALLBACK));
-     if (!drv) {
-         return -ENOMEDIUM;
-     }
-+    if ((flags & BDRV_REQ_FUA) &&
-+        (~bs->supported_write_flags & BDRV_REQ_FUA)) {
-+        flags &= ~BDRV_REQ_FUA;
-+        emulate_fua = true;
-+    }
-+
-+    flags &= bs->supported_write_flags;
-+
-     if (drv->bdrv_co_pwritev_part) {
-         ret = drv->bdrv_co_pwritev_part(bs, offset, bytes, qiov, qiov_offset,
--                                        flags & bs->supported_write_flags);
--        flags &= ~bs->supported_write_flags;
-+                                        flags);
-         goto emulate_flags;
-     }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
-     }
-     if (drv->bdrv_co_pwritev) {
--        ret = drv->bdrv_co_pwritev(bs, offset, bytes, qiov,
--                                   flags & bs->supported_write_flags);
--        flags &= ~bs->supported_write_flags;
-+        ret = drv->bdrv_co_pwritev(bs, offset, bytes, qiov, flags);
-         goto emulate_flags;
-     }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
-             .coroutine = qemu_coroutine_self(),
-         };
--        acb = drv->bdrv_aio_pwritev(bs, offset, bytes, qiov,
--                                    flags & bs->supported_write_flags,
-+        acb = drv->bdrv_aio_pwritev(bs, offset, bytes, qiov, flags,
-                                     bdrv_co_io_em_complete, &co);
--        flags &= ~bs->supported_write_flags;
-         if (acb == NULL) {
-             ret = -EIO;
-         } else {
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
-     assert(bytes <= BDRV_REQUEST_MAX_BYTES);
-     assert(drv->bdrv_co_writev);
--    ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov,
--                              flags & bs->supported_write_flags);
--    flags &= ~bs->supported_write_flags;
-+    ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov, flags);
- emulate_flags:
--    if (ret == 0 && (flags & BDRV_REQ_FUA)) {
-+    if (ret == 0 && emulate_fua) {
-         ret = bdrv_co_flush(bs);
-     }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_aligned_preadv(BdrvChild *child,
-     max_transfer = QEMU_ALIGN_DOWN(MIN_NON_ZERO(bs->bl.max_transfer, INT_MAX),
-                                    align);
--    /* TODO: We would need a per-BDS .supported_read_flags and
-+    /*
-+     * TODO: We would need a per-BDS .supported_read_flags and
-      * potential fallback support, if we ever implement any read flags
-      * to pass through to drivers.  For now, there aren't any
--     * passthrough flags.  */
--    assert(!(flags & ~(BDRV_REQ_COPY_ON_READ | BDRV_REQ_PREFETCH)));
-+     * passthrough flags except the BDRV_REQ_REGISTERED_BUF optimization hint.
-+     */
-+    assert(!(flags & ~(BDRV_REQ_COPY_ON_READ | BDRV_REQ_PREFETCH |
-+                       BDRV_REQ_REGISTERED_BUF)));
-     /* Handle Copy on Read and associated serialisation */
-     if (flags & BDRV_REQ_COPY_ON_READ) {
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_aligned_preadv(BdrvChild *child,
-         goto out;
-     }
--    assert(!(flags & ~bs->supported_read_flags));
-+    assert(!(flags & ~(bs->supported_read_flags | BDRV_REQ_REGISTERED_BUF)));
-     max_bytes = ROUND_UP(MAX(0, total_bytes - offset), align);
-     if (bytes <= max_bytes && bytes <= max_transfer) {
-@@ -XXX,XX +XXX,XX @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
- static int bdrv_pad_request(BlockDriverState *bs,
-                             QEMUIOVector **qiov, size_t *qiov_offset,
-                             int64_t *offset, int64_t *bytes,
--                            BdrvRequestPadding *pad, bool *padded)
-+                            BdrvRequestPadding *pad, bool *padded,
-+                            BdrvRequestFlags *flags)
- {
-     int ret;
-@@ -XXX,XX +XXX,XX @@ static int bdrv_pad_request(BlockDriverState *bs,
-     if (padded) {
-         *padded = true;
-     }
-+    if (flags) {
-+        /* Can't use optimization hint with bounce buffer */
-+        *flags &= ~BDRV_REQ_REGISTERED_BUF;
-+    }
-     return 0;
- }
-@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
-     }
-     ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
--                           NULL);
-+                           NULL, &flags);
-     if (ret < 0) {
-         goto fail;
-     }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
-         return -ENOTSUP;
-     }
-+    /* By definition there is no user buffer so this flag doesn't make sense */
-+    if (flags & BDRV_REQ_REGISTERED_BUF) {
-+        return -EINVAL;
-+    }
-+
-     /* Invalidate the cached block-status data range if this write overlaps */
-     bdrv_bsc_invalidate_range(bs, offset, bytes);
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
-     bool padding;
-     BdrvRequestPadding pad;
-+    /* This flag doesn't make sense for padding or zero writes */
-+    flags &= ~BDRV_REQ_REGISTERED_BUF;
-+
-     padding = bdrv_init_padding(bs, offset, bytes, &pad);
-     if (padding) {
-         assert(!(flags & BDRV_REQ_NO_WAIT));
-@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
-          * alignment only if there is no ZERO flag.
-          */
-         ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
--                               &padded);
-+                               &padded, &flags);
-         if (ret < 0) {
-             return ret;
-         }
-diff --git a/block/mirror.c b/block/mirror.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/mirror.c
-+++ b/block/mirror.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_mirror_top_pwritev(BlockDriverState *bs,
-         qemu_iovec_init(&bounce_qiov, 1);
-         qemu_iovec_add(&bounce_qiov, bounce_buf, bytes);
-         qiov = &bounce_qiov;
-+
-+        flags &= ~BDRV_REQ_REGISTERED_BUF;
-     }
-     ret = bdrv_mirror_top_do_write(bs, MIRROR_METHOD_COPY, offset, bytes, qiov,
-diff --git a/block/nbd.c b/block/nbd.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/nbd.c
-+++ b/block/nbd.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nbd_client_co_preadv(BlockDriverState *bs, int64_t offse
-     };
-     assert(bytes <= NBD_MAX_BUFFER_SIZE);
--    assert(!flags);
-     if (!bytes) {
-         return 0;
-diff --git a/block/parallels.c b/block/parallels.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/parallels.c
-+++ b/block/parallels.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int parallels_co_writev(BlockDriverState *bs,
-     QEMUIOVector hd_qiov;
-     int ret = 0;
--    assert(!flags);
-     qemu_iovec_init(&hd_qiov, qiov->niov);
-     while (nb_sectors > 0) {
-diff --git a/block/qcow.c b/block/qcow.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qcow.c
-+++ b/block/qcow.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, int64_t offset,
-     uint8_t *buf;
-     void *orig_buf;
--    assert(!flags);
-     if (qiov->niov > 1) {
-         buf = orig_buf = qemu_try_blockalign(bs, qiov->size);
-         if (buf == NULL) {
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, int64_t offset,
-     uint8_t *buf;
-     void *orig_buf;
--    assert(!flags);
-     s->cluster_cache_offset = -1; /* disable compressed cache */
-     /* We must always copy the iov when encrypting, so we
-diff --git a/block/qed.c b/block/qed.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/qed.c
-+++ b/block/qed.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_writev(BlockDriverState *bs,
-                                            int64_t sector_num, int nb_sectors,
-                                            QEMUIOVector *qiov, int flags)
- {
--    assert(!flags);
-     return qed_co_request(bs, sector_num, qiov, nb_sectors, QED_AIOCB_WRITE);
- }
-diff --git a/block/raw-format.c b/block/raw-format.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/raw-format.c
-+++ b/block/raw-format.c
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
-         qemu_iovec_add(&local_qiov, buf, 512);
-         qemu_iovec_concat(&local_qiov, qiov, 512, qiov->size - 512);
-         qiov = &local_qiov;
-+
-+        flags &= ~BDRV_REQ_REGISTERED_BUF;
-     }
-     ret = raw_adjust_offset(bs, &offset, bytes, true);
-diff --git a/block/replication.c b/block/replication.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/replication.c
-+++ b/block/replication.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int replication_co_writev(BlockDriverState *bs,
-     int ret;
-     int64_t n;
--    assert(!flags);
-     ret = replication_get_io_status(s);
-     if (ret < 0) {
-         goto out;
-diff --git a/block/ssh.c b/block/ssh.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/ssh.c
-+++ b/block/ssh.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_co_writev(BlockDriverState *bs,
-     BDRVSSHState *s = bs->opaque;
-     int ret;
--    assert(!flags);
-     qemu_co_mutex_lock(&s->lock);
-     ret = ssh_write(s, bs, sector_num * BDRV_SECTOR_SIZE,
-                     nb_sectors * BDRV_SECTOR_SIZE, qiov);
-diff --git a/block/vhdx.c b/block/vhdx.c
-index XXXXXXX..XXXXXXX 100644
---- a/block/vhdx.c
-+++ b/block/vhdx.c
-@@ -XXX,XX +XXX,XX @@ static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
-     uint64_t bat_prior_offset = 0;
-     bool bat_update = false;
--    assert(!flags);
-     qemu_iovec_init(&hd_qiov, qiov->niov);
-     qemu_co_mutex_lock(&s->lock);
 --
-.37.3
+.14.3

-[PULL 08/13] numa: use QLIST_FOREACH_SAFE() for RAM block notifiers
+[Qemu-devel] [PULL v2 19/23] docs: mark nested AioContext locking as a legacy API
-Make list traversal work when a callback removes a notifier
+See the patch for why nested AioContext locking is no longer allowed.
 mid-traversal. This is a cleanup to prevent bugs in the future.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: David Hildenbrand <david@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20221013185908.1297568-9-stefanha@redhat.com
+Message-id: 20171207201320.19284-3-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- hw/core/numa.c | 9 ++++++---
+ docs/devel/multiple-iothreads.txt | 7 ++++---
-file changed, 6 insertions(+), 3 deletions(-)
+file changed, 4 insertions(+), 3 deletions(-)
-diff --git a/hw/core/numa.c b/hw/core/numa.c
+diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/numa.c
+--- a/docs/devel/multiple-iothreads.txt
-+++ b/hw/core/numa.c
++++ b/docs/devel/multiple-iothreads.txt
-@@ -XXX,XX +XXX,XX @@ void ram_block_notifier_remove(RAMBlockNotifier *n)
+@@ -XXX,XX +XXX,XX @@
- void ram_block_notify_add(void *host, size_t size, size_t max_size)
+-Copyright (c) 2014 Red Hat Inc.
- {
++Copyright (c) 2014-2017 Red Hat Inc.
-     RAMBlockNotifier *notifier;
-+    RAMBlockNotifier *next;
+ This work is licensed under the terms of the GNU GPL, version 2 or later.  See
+ the COPYING file in the top-level directory.
--    QLIST_FOREACH(notifier, &ram_list.ramblock_notifiers, next) {
+@@ -XXX,XX +XXX,XX @@ aio_context_acquire()/aio_context_release() for mutual exclusion.  Once the
-+    QLIST_FOREACH_SAFE(notifier, &ram_list.ramblock_notifiers, next, next) {
+ context is acquired no other thread can access it or run event loop iterations
-         if (notifier->ram_block_added) {
+ in this AioContext.
-             notifier->ram_block_added(notifier, host, size, max_size);
-         }
+-aio_context_acquire()/aio_context_release() calls may be nested.  This
-@@ -XXX,XX +XXX,XX @@ void ram_block_notify_add(void *host, size_t size, size_t max_size)
+-means you can call them if you're not sure whether #2 applies.
- void ram_block_notify_remove(void *host, size_t size, size_t max_size)
++Legacy code sometimes nests aio_context_acquire()/aio_context_release() calls.
- {
++Do not use nesting anymore, it is incompatible with the BDRV_POLL_WHILE() macro
-     RAMBlockNotifier *notifier;
++used in the block layer and can lead to hangs.
-+    RAMBlockNotifier *next;
+ There is currently no lock ordering rule if a thread needs to acquire multiple
--    QLIST_FOREACH(notifier, &ram_list.ramblock_notifiers, next) {
+ AioContexts simultaneously.  Therefore, it is only safe for code holding the
 +    QLIST_FOREACH_SAFE(notifier, &ram_list.ramblock_notifiers, next, next) {
          if (notifier->ram_block_removed) {
              notifier->ram_block_removed(notifier, host, size, max_size);
          }
@@ -XXX,XX +XXX,XX @@ void ram_block_notify_remove(void *host, size_t size, size_t max_size)
  void ram_block_notify_resize(void *host, size_t old_size, size_t new_size)
  {
      RAMBlockNotifier *notifier;
 +    RAMBlockNotifier *next;
 -    QLIST_FOREACH(notifier, &ram_list.ramblock_notifiers, next) {
 +    QLIST_FOREACH_SAFE(notifier, &ram_list.ramblock_notifiers, next, next) {
          if (notifier->ram_block_resized) {
              notifier->ram_block_resized(notifier, host, old_size, new_size);
          }
 --
-.37.3
+.14.3

-[PULL 10/13] exec/cpu-common: add qemu_ram_get_fd()
+[Qemu-devel] [PULL v2 20/23] blockdev: add x-blockdev-set-iothread force boolean
-Add a function to get the file descriptor for a RAMBlock. Device
+When a node is already associated with a BlockBackend the
-emulation code typically uses the MemoryRegion APIs but vhost-style code
+x-blockdev-set-iothread command refuses to set the IOThread.  This is to
-may use RAMBlock directly for sharing guest memory with another process.
+prevent accidentally changing the IOThread when the nodes are in use.
-This new API will be used by the libblkio block driver so it can share
+When the nodes are created with -drive they automatically get a
-guest memory via .bdrv_register_buf().
+BlockBackend.  In that case we know nothing is using them yet and it's
 safe to set the IOThread.  Add a force boolean to override the check.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20221013185908.1297568-11-stefanha@redhat.com
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171207201320.19284-4-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/exec/cpu-common.h | 1 +
+ qapi/block-core.json |  6 +++++-
- softmmu/physmem.c         | 5 +++++
+ blockdev.c           | 11 ++++++-----
-files changed, 6 insertions(+)
+files changed, 11 insertions(+), 6 deletions(-)
-diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
+diff --git a/qapi/block-core.json b/qapi/block-core.json
 index XXXXXXX..XXXXXXX 100644
---- a/include/exec/cpu-common.h
+--- a/qapi/block-core.json
-+++ b/include/exec/cpu-common.h
++++ b/qapi/block-core.json
-@@ -XXX,XX +XXX,XX @@ void qemu_ram_set_uf_zeroable(RAMBlock *rb);
+@@ -XXX,XX +XXX,XX @@
- bool qemu_ram_is_migratable(RAMBlock *rb);
+ #
- void qemu_ram_set_migratable(RAMBlock *rb);
+ # @iothread: the name of the IOThread object or null for the main loop
- void qemu_ram_unset_migratable(RAMBlock *rb);
+ #
-+int qemu_ram_get_fd(RAMBlock *rb);
++# @force: true if the node and its children should be moved when a BlockBackend
++#         is already attached
- size_t qemu_ram_pagesize(RAMBlock *block);
++#
- size_t qemu_ram_pagesize_largest(void);
+ # Note: this command is experimental and intended for test cases that need
-diff --git a/softmmu/physmem.c b/softmmu/physmem.c
+ # control over IOThreads only.
  #
@@ -XXX,XX +XXX,XX @@
  ##
  { 'command': 'x-blockdev-set-iothread',
    'data' : { 'node-name': 'str',
 -             'iothread': 'StrOrNull' } }
 +             'iothread': 'StrOrNull',
 +             '*force': 'bool' } }
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
---- a/softmmu/physmem.c
+--- a/blockdev.c
-+++ b/softmmu/physmem.c
++++ b/blockdev.c
-@@ -XXX,XX +XXX,XX @@ void qemu_ram_unset_migratable(RAMBlock *rb)
+@@ -XXX,XX +XXX,XX @@ BlockJobInfoList *qmp_query_block_jobs(Error **errp)
      rb->flags &= ~RAM_MIGRATABLE;
  }
-+int qemu_ram_get_fd(RAMBlock *rb)
+ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
-+{
+-                                 Error **errp)
-+    return rb->fd;
++                                 bool has_force, bool force, Error **errp)
 +}
 +
  /* Called with iothread lock held.  */
  void qemu_ram_set_idstr(RAMBlock *new_block, const char *name, DeviceState *dev)
  {
+     AioContext *old_context;
+     AioContext *new_context;
+@@ -XXX,XX +XXX,XX @@ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
+         return;
+     }
+-    /* If we want to allow more extreme test scenarios this guard could be
+-     * removed.  For now it protects against accidents. */
+-    if (bdrv_has_blk(bs)) {
+-        error_setg(errp, "Node %s is in use", node_name);
++    /* Protects against accidents. */
++    if (!(has_force && force) && bdrv_has_blk(bs)) {
++        error_setg(errp, "Node %s is associated with a BlockBackend and could "
++                         "be in use (use force=true to override this check)",
++                         node_name);
+         return;
+     }
 --
-.37.3
+.14.3

-[PULL 05/13] block: use BdrvRequestFlags type for supported flag fields
+[Qemu-devel] [PULL v2 21/23] iotests: add VM.add_object()
-Use the enum type so GDB displays the enum members instead of printing a
+The VM.add_object() method can be used to add IOThreads or memory
-numeric constant.
+backend objects.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-id: 20221013185908.1297568-6-stefanha@redhat.com
+Message-id: 20171207201320.19284-5-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- include/block/block_int-common.h | 8 ++++----
+ tests/qemu-iotests/iotests.py | 5 +++++
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
+diff --git a/tests/qemu-iotests/iotests.py b/tests/qemu-iotests/iotests.py
 index XXXXXXX..XXXXXXX 100644
---- a/include/block/block_int-common.h
+--- a/tests/qemu-iotests/iotests.py
-+++ b/include/block/block_int-common.h
++++ b/tests/qemu-iotests/iotests.py
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
+@@ -XXX,XX +XXX,XX @@ class VM(qtest.QEMUQtestMachine):
-     /*
+                                  socket_scm_helper=socket_scm_helper)
-      * Flags honored during pread
+         self._num_drives = 0
-      */
--    unsigned int supported_read_flags;
++    def add_object(self, opts):
-+    BdrvRequestFlags supported_read_flags;
++        self._args.append('-object')
-     /*
++        self._args.append(opts)
-      * Flags honored during pwrite (so far: BDRV_REQ_FUA,
++        return self
-      * BDRV_REQ_WRITE_UNCHANGED).
++
-@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
+     def add_device(self, opts):
-      * flag), or they have to explicitly take the WRITE permission for
+         self._args.append('-device')
-      * their children.
+         self._args.append(opts)
       */
 -    unsigned int supported_write_flags;
 +    BdrvRequestFlags supported_write_flags;
      /*
       * Flags honored during pwrite_zeroes (so far: BDRV_REQ_FUA,
       * BDRV_REQ_MAY_UNMAP, BDRV_REQ_WRITE_UNCHANGED)
       */
 -    unsigned int supported_zero_flags;
 +    BdrvRequestFlags supported_zero_flags;
      /*
       * Flags honoured during truncate (so far: BDRV_REQ_ZERO_WRITE).
       *
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
       * that any added space reads as all zeros. If this can't be guaranteed,
       * the operation must fail.
       */
 -    unsigned int supported_truncate_flags;
 +    BdrvRequestFlags supported_truncate_flags;
      /* the following member gives a name to every node on the bs graph. */
      char node_name[32];
 --
-.37.3
+.14.3

-[PULL 03/13] numa: call ->ram_block_removed() in ram_block_notifer_remove()
+[Qemu-devel] [PULL v2 22/23] iothread: fix iothread_stop() race condition
-When a RAMBlockNotifier is added, ->ram_block_added() is called with all
+There is a small chance that iothread_stop() hangs as follows:
 existing RAMBlocks. There is no equivalent ->ram_block_removed() call
 when a RAMBlockNotifier is removed.
-The util/vfio-helpers.c code (the sole user of RAMBlockNotifier) is fine
+  Thread 3 (Thread 0x7f63eba5f700 (LWP 16105)):
-with this asymmetry because it does not rely on RAMBlockNotifier for
+  #0  0x00007f64012c09b6 in ppoll () at /lib64/libc.so.6
-cleanup. It walks its internal list of DMA mappings and unmaps them by
+  #1  0x000055959992eac9 in ppoll (__ss=0x0, __timeout=0x0, __nfds=<optimized out>, __fds=<optimized out>) at /usr/include/bits/poll2.h:77
-itself.
+  #2  0x000055959992eac9 in qemu_poll_ns (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at util/qemu-timer.c:322
   #3  0x0000559599930711 in aio_poll (ctx=0x55959bdb83c0, blocking=blocking@entry=true) at util/aio-posix.c:629
   #4  0x00005595996806fe in iothread_run (opaque=0x55959bd78400) at iothread.c:59
   #5  0x00007f640159f609 in start_thread () at /lib64/libpthread.so.0
   #6  0x00007f64012cce6f in clone () at /lib64/libc.so.6
-Future users of RAMBlockNotifier may not have an internal data structure
+  Thread 1 (Thread 0x7f640b45b280 (LWP 16103)):
-that records added RAMBlocks so they will need ->ram_block_removed()
+  #0  0x00007f64015a0b6d in pthread_join () at /lib64/libpthread.so.0
-callbacks.
+  #1  0x00005595999332ef in qemu_thread_join (thread=<optimized out>) at util/qemu-thread-posix.c:547
   #2  0x00005595996808ae in iothread_stop (iothread=<optimized out>) at iothread.c:91
   #3  0x000055959968094d in iothread_stop_iter (object=<optimized out>, opaque=<optimized out>) at iothread.c:102
   #4  0x0000559599857d97 in do_object_child_foreach (obj=obj@entry=0x55959bdb8100, fn=fn@entry=0x559599680930 <iothread_stop_iter>, opaque=opaque@entry=0x0, recurse=recurse@entry=false) at qom/object.c:852
   #5  0x0000559599859477 in object_child_foreach (obj=obj@entry=0x55959bdb8100, fn=fn@entry=0x559599680930 <iothread_stop_iter>, opaque=opaque@entry=0x0) at qom/object.c:867
   #6  0x0000559599680a6e in iothread_stop_all () at iothread.c:341
   #7  0x000055959955b1d5 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4913
-This patch makes ram_block_notifier_remove() symmetric with respect to
+The relevant code from iothread_run() is:
 callbacks. Now util/vfio-helpers.c needs to unmap remaining DMA mappings
 after ram_block_notifier_remove() has been called. This is necessary
 since users like block/nvme.c may create additional DMA mappings that do
 not originate from the RAMBlockNotifier.
-Reviewed-by: David Hildenbrand <david@redhat.com>
+  while (!atomic_read(&iothread->stopping)) {
       aio_poll(iothread->ctx, true);
 and iothread_stop():
   iothread->stopping = true;
   aio_notify(iothread->ctx);
   ...
   qemu_thread_join(&iothread->thread);
 The following scenario can occur:
 . IOThread:
   while (!atomic_read(&iothread->stopping)) -> stopping=false
 . Main loop:
   iothread->stopping = true;
   aio_notify(iothread->ctx);
 . IOThread:
   aio_poll(iothread->ctx, true); -> hang
 The bug is explained by the AioContext->notify_me doc comments:
   "If this field is 0, everything (file descriptors, bottom halves,
   timers) will be re-evaluated before the next blocking poll(), thus the
   event_notifier_set call can be skipped."
 The problem is that "everything" does not include checking
 iothread->stopping.  This means iothread_run() will block in aio_poll()
 if aio_notify() was called just before aio_poll().
 This patch fixes the hang by replacing aio_notify() with
 aio_bh_schedule_oneshot().  This makes aio_poll() or g_main_loop_run()
 to return.
 Implementing this properly required a new bool running flag.  The new
 flag prevents races that are tricky if we try to use iothread->stopping.
 Now iothread->stopping is purely for iothread_stop() and
 iothread->running is purely for the iothread_run() thread.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20221013185908.1297568-4-stefanha@redhat.com
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171207201320.19284-6-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- hw/core/numa.c      | 17 +++++++++++++++++
+ include/sysemu/iothread.h |  3 ++-
- util/vfio-helpers.c |  5 ++++-
+ iothread.c                | 20 +++++++++++++++-----
-files changed, 21 insertions(+), 1 deletion(-)
+files changed, 17 insertions(+), 6 deletions(-)
-diff --git a/hw/core/numa.c b/hw/core/numa.c
+diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/core/numa.c
+--- a/include/sysemu/iothread.h
-+++ b/hw/core/numa.c
++++ b/include/sysemu/iothread.h
-@@ -XXX,XX +XXX,XX @@ static int ram_block_notify_add_single(RAMBlock *rb, void *opaque)
+@@ -XXX,XX +XXX,XX @@ typedef struct {
-     return 0;
+     GOnce once;
      QemuMutex init_done_lock;
      QemuCond init_done_cond;    /* is thread initialization done? */
 -    bool stopping;
 +    bool stopping;              /* has iothread_stop() been called? */
 +    bool running;               /* should iothread_run() continue? */
      int thread_id;
      /* AioContext poll parameters */
 diff --git a/iothread.c b/iothread.c
 index XXXXXXX..XXXXXXX 100644
 --- a/iothread.c
 +++ b/iothread.c
@@ -XXX,XX +XXX,XX @@ static void *iothread_run(void *opaque)
      qemu_cond_signal(&iothread->init_done_cond);
      qemu_mutex_unlock(&iothread->init_done_lock);
 -    while (!atomic_read(&iothread->stopping)) {
 +    while (iothread->running) {
          aio_poll(iothread->ctx, true);
          if (atomic_read(&iothread->worker_context)) {
@@ -XXX,XX +XXX,XX @@ static void *iothread_run(void *opaque)
      return NULL;
  }
-+static int ram_block_notify_remove_single(RAMBlock *rb, void *opaque)
++/* Runs in iothread_run() thread */
 +static void iothread_stop_bh(void *opaque)
 +{
-+    const ram_addr_t max_size = qemu_ram_get_max_length(rb);
++    IOThread *iothread = opaque;
 +    const ram_addr_t size = qemu_ram_get_used_length(rb);
 +    void *host = qemu_ram_get_host_addr(rb);
 +    RAMBlockNotifier *notifier = opaque;
 +
-+    if (host) {
++    iothread->running = false; /* stop iothread_run() */
-+        notifier->ram_block_removed(notifier, host, size, max_size);
++
 +    if (iothread->main_loop) {
 +        g_main_loop_quit(iothread->main_loop);
 +    }
-+    return 0;
 +}
 +
- void ram_block_notifier_add(RAMBlockNotifier *n)
+ void iothread_stop(IOThread *iothread)
  {
-     QLIST_INSERT_HEAD(&ram_list.ramblock_notifiers, n, next);
+     if (!iothread->ctx || iothread->stopping) {
@@ -XXX,XX +XXX,XX @@ void ram_block_notifier_add(RAMBlockNotifier *n)
  void ram_block_notifier_remove(RAMBlockNotifier *n)
  {
      QLIST_REMOVE(n, next);
 +
 +    if (n->ram_block_removed) {
 +        qemu_ram_foreach_block(ram_block_notify_remove_single, n);
 +    }
  }
  void ram_block_notify_add(void *host, size_t size, size_t max_size)
 diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/vfio-helpers.c
 +++ b/util/vfio-helpers.c
@@ -XXX,XX +XXX,XX @@ void qemu_vfio_close(QEMUVFIOState *s)
      if (!s) {
          return;
      }
-+
+     iothread->stopping = true;
-+    ram_block_notifier_remove(&s->ram_notifier);
+-    aio_notify(iothread->ctx);
-+
+-    if (atomic_read(&iothread->main_loop)) {
-     for (i = 0; i < s->nr_mappings; ++i) {
+-        g_main_loop_quit(iothread->main_loop);
-         qemu_vfio_undo_mapping(s, &s->mappings[i], NULL);
+-    }
-     }
++    aio_bh_schedule_oneshot(iothread->ctx, iothread_stop_bh, iothread);
--    ram_block_notifier_remove(&s->ram_notifier);
+     qemu_thread_join(&iothread->thread);
-+
+ }
-     g_free(s->usable_iova_ranges);
-     s->nb_iova_ranges = 0;
+@@ -XXX,XX +XXX,XX @@ static void iothread_complete(UserCreatable *obj, Error **errp)
-     qemu_vfio_reset(s);
+     char *name, *thread_name;
      iothread->stopping = false;
 +    iothread->running = true;
      iothread->thread_id = -1;
      iothread->ctx = aio_context_new(&local_error);
      if (!iothread->ctx) {
 --
-.37.3
+.14.3

-[PULL 11/13] stubs: add qemu_ram_block_from_host() and qemu_ram_get_fd()
+[Qemu-devel] [PULL v2 23/23] qemu-iotests: add 203 savevm with IOThreads test
-The blkio block driver will need to look up the file descriptor for a
+This test case will prevent future regressions with savevm and
-given pointer. This is possible in softmmu builds where the RAMBlock API
+IOThreads.
 is available for querying guest RAM.
 Add stubs so tools like qemu-img that link the block layer still build
 successfully. In this case there is no guest RAM but that is fine.
 Bounce buffers and their file descriptors will be allocated with
 libblkio's blkio_alloc_mem_region() so we won't rely on QEMU's
 qemu_ram_get_fd() in that case.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Message-id: 20221013185908.1297568-12-stefanha@redhat.com
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-id: 20171207201320.19284-7-stefanha@redhat.com
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 ---
- stubs/physmem.c   | 13 +++++++++++++
+ tests/qemu-iotests/203     | 59 ++++++++++++++++++++++++++++++++++++++++++++++
- stubs/meson.build |  1 +
+ tests/qemu-iotests/203.out |  6 +++++
-files changed, 14 insertions(+)
+ tests/qemu-iotests/group   |  1 +
- create mode 100644 stubs/physmem.c
+files changed, 66 insertions(+)
  create mode 100755 tests/qemu-iotests/203
  create mode 100644 tests/qemu-iotests/203.out
-diff --git a/stubs/physmem.c b/stubs/physmem.c
+diff --git a/tests/qemu-iotests/203 b/tests/qemu-iotests/203
 new file mode 100755
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qemu-iotests/203
@@ -XXX,XX +XXX,XX @@
 +#!/usr/bin/env python
 +#
 +# Copyright (C) 2017 Red Hat, Inc.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of the GNU General Public License as published by
 +# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 +#
 +# This program is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
 +# Creator/Owner: Stefan Hajnoczi <stefanha@redhat.com>
 +#
 +# Check that QMP 'migrate' with multiple drives on a single IOThread completes
 +# successfully.  This particular command triggered a hang in the source QEMU
 +# process due to recursive AioContext locking in bdrv_invalidate_all() and
 +# BDRV_POLL_WHILE().
 +
 +import iotests
 +
 +iotests.verify_image_format(supported_fmts=['qcow2'])
 +iotests.verify_platform(['linux'])
 +
 +with iotests.FilePath('disk0.img') as disk0_img_path, \
 +     iotests.FilePath('disk1.img') as disk1_img_path, \
 +     iotests.VM() as vm:
 +
 +    img_size = '10M'
 +    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk0_img_path, img_size)
 +    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk1_img_path, img_size)
 +
 +    iotests.log('Launching VM...')
 +    (vm.add_object('iothread,id=iothread0')
 +       .add_drive(disk0_img_path, 'node-name=drive0-node', interface='none')
 +       .add_drive(disk1_img_path, 'node-name=drive1-node', interface='none')
 +       .launch())
 +
 +    iotests.log('Setting IOThreads...')
 +    iotests.log(vm.qmp('x-blockdev-set-iothread',
 +                       node_name='drive0-node', iothread='iothread0',
 +                       force=True))
 +    iotests.log(vm.qmp('x-blockdev-set-iothread',
 +                       node_name='drive1-node', iothread='iothread0',
 +                       force=True))
 +
 +    iotests.log('Starting migration...')
 +    iotests.log(vm.qmp('migrate', uri='exec:cat >/dev/null'))
 +    while True:
 +        vm.get_qmp_event(wait=60.0)
 +        result = vm.qmp('query-migrate')
 +        status = result.get('return', {}).get('status', None)
 +        if status == 'completed':
 +            break
 diff --git a/tests/qemu-iotests/203.out b/tests/qemu-iotests/203.out
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/stubs/physmem.c
++++ b/tests/qemu-iotests/203.out
 @@ -XXX,XX +XXX,XX @@
-+#include "qemu/osdep.h"
++Launching VM...
-+#include "exec/cpu-common.h"
++Setting IOThreads...
-+
++{u'return': {}}
-+RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
++{u'return': {}}
-+                                   ram_addr_t *offset)
++Starting migration...
-+{
++{u'return': {}}
-+    return NULL;
+diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
 +}
 +
 +int qemu_ram_get_fd(RAMBlock *rb)
 +{
 +    return -1;
 +}
 diff --git a/stubs/meson.build b/stubs/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/stubs/meson.build
+--- a/tests/qemu-iotests/group
-+++ b/stubs/meson.build
++++ b/tests/qemu-iotests/group
-@@ -XXX,XX +XXX,XX @@ stub_ss.add(files('migr-blocker.c'))
+@@ -XXX,XX +XXX,XX @@
- stub_ss.add(files('module-opts.c'))
+rw auto
- stub_ss.add(files('monitor.c'))
+rw auto
- stub_ss.add(files('monitor-core.c'))
+rw auto quick
-+stub_ss.add(files('physmem.c'))
++203 rw auto
  stub_ss.add(files('qemu-timer-notify-cb.c'))
  stub_ss.add(files('qmp_memory_device.c'))
  stub_ss.add(files('qmp-command-available.c'))
 --
-.37.3
+.14.3

The following changes since commit 79fc2fb685f35a5e71e23629760ef4025d6aba31:

Merge tag 'trivial-branch-for-7.2-pull-request' of https://gitlab.com/laurent_vivier/qemu into staging (2022-10-25 11:37:17 -0400)

are available in the Git repository at:

https://gitlab.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to baf422684d73c7bf38e2c18815e18d44fcf395b6:

virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint (2022-10-26 14:56:42 -0400)

----------------------------------------------------------------
Pull request

----------------------------------------------------------------

Stefan Hajnoczi (13):
  coroutine: add flag to re-queue at front of CoQueue
  blkio: add libblkio block driver
  numa: call ->ram_block_removed() in ram_block_notifer_remove()
  block: pass size to bdrv_unregister_buf()
  block: use BdrvRequestFlags type for supported flag fields
  block: add BDRV_REQ_REGISTERED_BUF request flag
  block: return errors from bdrv_register_buf()
  numa: use QLIST_FOREACH_SAFE() for RAM block notifiers
  block: add BlockRAMRegistrar
  exec/cpu-common: add qemu_ram_get_fd()
  stubs: add qemu_ram_block_from_host() and qemu_ram_get_fd()
  blkio: implement BDRV_REQ_REGISTERED_BUF optimization
  virtio-blk: use BDRV_REQ_REGISTERED_BUF optimization hint

-- 
2.37.3

When a coroutine wakes up it may determine that it must re-queue.
Normally coroutines are pushed onto the back of the CoQueue, but for
fairness it may be necessary to push it onto the front of the CoQueue.

Add a flag to specify that the coroutine should be pushed onto the front
of the CoQueue. A later patch will use this to ensure fairness in the
bounce buffer CoQueue used by the blkio BlockDriver.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20221013185908.1297568-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h   | 15 +++++++++++++--
 util/qemu-coroutine-lock.c |  9 +++++++--
 2 files changed, 20 insertions(+), 4 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ typedef struct CoQueue {
  */
 void qemu_co_queue_init(CoQueue *queue);
 
+typedef enum {
+    /*
+     * Enqueue at front instead of back. Use this to re-queue a request when
+     * its wait condition is not satisfied after being woken up.
+     */
+    CO_QUEUE_WAIT_FRONT = 0x1,
+} CoQueueWaitFlags;
+
 /**
  * Adds the current coroutine to the CoQueue and transfers control to the
  * caller of the coroutine.  The mutex is unlocked during the wait and
  * locked again afterwards.
  */
 #define qemu_co_queue_wait(queue, lock) \
-    qemu_co_queue_wait_impl(queue, QEMU_MAKE_LOCKABLE(lock))
-void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock);
+    qemu_co_queue_wait_impl(queue, QEMU_MAKE_LOCKABLE(lock), 0)
+#define qemu_co_queue_wait_flags(queue, lock, flags) \
+    qemu_co_queue_wait_impl(queue, QEMU_MAKE_LOCKABLE(lock), (flags))
+void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock,
+                                          CoQueueWaitFlags flags);
 
 /**
  * Removes the next coroutine from the CoQueue, and queue it to run after
diff --git a/util/qemu-coroutine-lock.c b/util/qemu-coroutine-lock.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-lock.c
+++ b/util/qemu-coroutine-lock.c
@@ -XXX,XX +XXX,XX @@ void qemu_co_queue_init(CoQueue *queue)
     QSIMPLEQ_INIT(&queue->entries);
 }
 
-void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock)
+void coroutine_fn qemu_co_queue_wait_impl(CoQueue *queue, QemuLockable *lock,
+                                          CoQueueWaitFlags flags)
 {
     Coroutine *self = qemu_coroutine_self();
-    QSIMPLEQ_INSERT_TAIL(&queue->entries, self, co_queue_next);
+    if (flags & CO_QUEUE_WAIT_FRONT) {
+        QSIMPLEQ_INSERT_HEAD(&queue->entries, self, co_queue_next);
+    } else {
+        QSIMPLEQ_INSERT_TAIL(&queue->entries, self, co_queue_next);
+    }
 
     if (lock) {
         qemu_lockable_unlock(lock);
-- 
2.37.3

libblkio (https://gitlab.com/libblkio/libblkio/) is a library for
high-performance disk I/O. It currently supports io_uring,
virtio-blk-vhost-user, and virtio-blk-vhost-vdpa with additional drivers
under development.

One of the reasons for developing libblkio is that other applications
besides QEMU can use it. This will be particularly useful for
virtio-blk-vhost-user which applications may wish to use for connecting
to qemu-storage-daemon.

libblkio also gives us an opportunity to develop in Rust behind a C API
that is easy to consume from QEMU.

This commit adds io_uring, nvme-io_uring, virtio-blk-vhost-user, and
virtio-blk-vhost-vdpa BlockDrivers to QEMU using libblkio. It will be
easy to add other libblkio drivers since they will share the majority of
code.

For now I/O buffers are copied through bounce buffers if the libblkio
driver requires it. Later commits add an optimization for
pre-registering guest RAM to avoid bounce buffers.

The syntax is:

--blockdev io_uring,node-name=drive0,filename=test.img,readonly=on|off,cache.direct=on|off

--blockdev nvme-io_uring,node-name=drive0,filename=/dev/ng0n1,readonly=on|off,cache.direct=on

--blockdev virtio-blk-vhost-vdpa,node-name=drive0,path=/dev/vdpa...,readonly=on|off,cache.direct=on

--blockdev virtio-blk-vhost-user,node-name=drive0,path=vhost-user-blk.sock,readonly=on|off,cache.direct=on

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Markus Armbruster <armbru@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20221013185908.1297568-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 MAINTAINERS                   |   6 +
 meson_options.txt             |   2 +
 qapi/block-core.json          |  77 +++-
 meson.build                   |   9 +
 block/blkio.c                 | 831 ++++++++++++++++++++++++++++++++++
 tests/qtest/modules-test.c    |   3 +
 block/meson.build             |   1 +
 scripts/meson-buildoptions.sh |   3 +
 8 files changed, 928 insertions(+), 4 deletions(-)
 create mode 100644 block/blkio.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ L: qemu-block@nongnu.org
 S: Maintained
 F: block/vdi.c
 
+blkio
+M: Stefan Hajnoczi <stefanha@redhat.com>
+L: qemu-block@nongnu.org
+S: Maintained
+F: block/blkio.c
+
 iSCSI
 M: Ronnie Sahlberg <ronniesahlberg@gmail.com>
 M: Paolo Bonzini <pbonzini@redhat.com>
diff --git a/meson_options.txt b/meson_options.txt
index XXXXXXX..XXXXXXX 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
        description: 'bzip2 support for DMG images')
 option('cap_ng', type : 'feature', value : 'auto',
        description: 'cap_ng support')
+option('blkio', type : 'feature', value : 'auto',
+       description: 'libblkio block device driver')
 option('bpf', type : 'feature', value : 'auto',
         description: 'eBPF support')
 option('cocoa', type : 'feature', value : 'auto',
diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
             'file', 'snapshot-access', 'ftp', 'ftps', 'gluster',
             {'name': 'host_cdrom', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
             {'name': 'host_device', 'if': 'HAVE_HOST_BLOCK_DEVICE' },
-            'http', 'https', 'iscsi',
-            'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels',
-            'preallocate', 'qcow', 'qcow2', 'qed', 'quorum', 'raw', 'rbd',
+            'http', 'https',
+            { 'name': 'io_uring', 'if': 'CONFIG_BLKIO' },
+            'iscsi',
+            'luks', 'nbd', 'nfs', 'null-aio', 'null-co', 'nvme',
+            { 'name': 'nvme-io_uring', 'if': 'CONFIG_BLKIO' },
+            'parallels', 'preallocate', 'qcow', 'qcow2', 'qed', 'quorum',
+            'raw', 'rbd',
             { 'name': 'replication', 'if': 'CONFIG_REPLICATION' },
-            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat' ] }
+            'ssh', 'throttle', 'vdi', 'vhdx',
+            { 'name': 'virtio-blk-vhost-user', 'if': 'CONFIG_BLKIO' },
+            { 'name': 'virtio-blk-vhost-vdpa', 'if': 'CONFIG_BLKIO' },
+            'vmdk', 'vpc', 'vvfat' ] }
 
 ##
 # @BlockdevOptionsFile:
@@ -XXX,XX +XXX,XX @@
             '*debug': 'int',
             '*logfile': 'str' } }
 
+##
+# @BlockdevOptionsIoUring:
+#
+# Driver specific block device options for the io_uring backend.
+#
+# @filename: path to the image file
+#
+# Since: 7.2
+##
+{ 'struct': 'BlockdevOptionsIoUring',
+  'data': { 'filename': 'str' },
+  'if': 'CONFIG_BLKIO' }
+
+##
+# @BlockdevOptionsNvmeIoUring:
+#
+# Driver specific block device options for the nvme-io_uring backend.
+#
+# @filename: path to the image file
+#
+# Since: 7.2
+##
+{ 'struct': 'BlockdevOptionsNvmeIoUring',
+  'data': { 'filename': 'str' },
+  'if': 'CONFIG_BLKIO' }
+
+##
+# @BlockdevOptionsVirtioBlkVhostUser:
+#
+# Driver specific block device options for the virtio-blk-vhost-user backend.
+#
+# @path: path to the vhost-user UNIX domain socket.
+#
+# Since: 7.2
+##
+{ 'struct': 'BlockdevOptionsVirtioBlkVhostUser',
+  'data': { 'path': 'str' },
+  'if': 'CONFIG_BLKIO' }
+
+##
+# @BlockdevOptionsVirtioBlkVhostVdpa:
+#
+# Driver specific block device options for the virtio-blk-vhost-vdpa backend.
+#
+# @path: path to the vhost-vdpa character device.
+#
+# Since: 7.2
+##
+{ 'struct': 'BlockdevOptionsVirtioBlkVhostVdpa',
+  'data': { 'path': 'str' },
+  'if': 'CONFIG_BLKIO' }
+
 ##
 # @IscsiTransport:
 #
@@ -XXX,XX +XXX,XX @@
                        'if': 'HAVE_HOST_BLOCK_DEVICE' },
       'http':       'BlockdevOptionsCurlHttp',
       'https':      'BlockdevOptionsCurlHttps',
+      'io_uring':   { 'type': 'BlockdevOptionsIoUring',
+                      'if': 'CONFIG_BLKIO' },
       'iscsi':      'BlockdevOptionsIscsi',
       'luks':       'BlockdevOptionsLUKS',
       'nbd':        'BlockdevOptionsNbd',
@@ -XXX,XX +XXX,XX @@
       'null-aio':   'BlockdevOptionsNull',
       'null-co':    'BlockdevOptionsNull',
       'nvme':       'BlockdevOptionsNVMe',
+      'nvme-io_uring': { 'type': 'BlockdevOptionsNvmeIoUring',
+                         'if': 'CONFIG_BLKIO' },
       'parallels':  'BlockdevOptionsGenericFormat',
       'preallocate':'BlockdevOptionsPreallocate',
       'qcow2':      'BlockdevOptionsQcow2',
@@ -XXX,XX +XXX,XX @@
       'throttle':   'BlockdevOptionsThrottle',
       'vdi':        'BlockdevOptionsGenericFormat',
       'vhdx':       'BlockdevOptionsGenericFormat',
+      'virtio-blk-vhost-user':
+                    { 'type': 'BlockdevOptionsVirtioBlkVhostUser',
+                      'if': 'CONFIG_BLKIO' },
+      'virtio-blk-vhost-vdpa':
+                    { 'type': 'BlockdevOptionsVirtioBlkVhostVdpa',
+                      'if': 'CONFIG_BLKIO' },
       'vmdk':       'BlockdevOptionsGenericCOWFormat',
       'vpc':        'BlockdevOptionsGenericFormat',
       'vvfat':      'BlockdevOptionsVVFAT'
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('virglrenderer').auto() or have_system or have_vhost_user_gpu
                      required: get_option('virglrenderer'),
                      kwargs: static_kwargs)
 endif
+blkio = not_found
+if not get_option('blkio').auto() or have_block
+  blkio = dependency('blkio',
+                     method: 'pkg-config',
+                     required: get_option('blkio'),
+                     kwargs: static_kwargs)
+endif
 curl = not_found
 if not get_option('curl').auto() or have_block
   curl = dependency('libcurl', version: '>=7.29.0',
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_LIBUDEV', libudev.found())
 config_host_data.set('CONFIG_LZO', lzo.found())
 config_host_data.set('CONFIG_MPATH', mpathpersist.found())
 config_host_data.set('CONFIG_MPATH_NEW_API', mpathpersist_new_api)
+config_host_data.set('CONFIG_BLKIO', blkio.found())
 config_host_data.set('CONFIG_CURL', curl.found())
 config_host_data.set('CONFIG_CURSES', curses.found())
 config_host_data.set('CONFIG_GBM', gbm.found())
@@ -XXX,XX +XXX,XX @@ summary_info += {'PAM':               pam}
 summary_info += {'iconv support':     iconv}
 summary_info += {'curses support':    curses}
 summary_info += {'virgl support':     virgl}
+summary_info += {'blkio support':     blkio}
 summary_info += {'curl support':      curl}
 summary_info += {'Multipath support': mpathpersist}
 summary_info += {'PNG support':       png}
diff --git a/block/blkio.c b/block/blkio.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/blkio.c
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+/*
+ * libblkio BlockDriver
+ *
+ * Copyright Red Hat, Inc.
+ *
+ * Author:
+ *   Stefan Hajnoczi <stefanha@redhat.com>
+ */
+
+#include "qemu/osdep.h"
+#include <blkio.h>
+#include "block/block_int.h"
+#include "qapi/error.h"
+#include "qapi/qmp/qdict.h"
+#include "qemu/module.h"
+
+/*
+ * Keep the QEMU BlockDriver names identical to the libblkio driver names.
+ * Using macros instead of typing out the string literals avoids typos.
+ */
+#define DRIVER_IO_URING "io_uring"
+#define DRIVER_NVME_IO_URING "nvme-io_uring"
+#define DRIVER_VIRTIO_BLK_VHOST_USER "virtio-blk-vhost-user"
+#define DRIVER_VIRTIO_BLK_VHOST_VDPA "virtio-blk-vhost-vdpa"
+
+/*
+ * Allocated bounce buffers are kept in a list sorted by buffer address.
+ */
+typedef struct BlkioBounceBuf {
+    QLIST_ENTRY(BlkioBounceBuf) next;
+
+    /* The bounce buffer */
+    struct iovec buf;
+} BlkioBounceBuf;
+
+typedef struct {
+    /*
+     * libblkio is not thread-safe so this lock protects ->blkio and
+     * ->blkioq.
+     */
+    QemuMutex blkio_lock;
+    struct blkio *blkio;
+    struct blkioq *blkioq; /* make this multi-queue in the future... */
+    int completion_fd;
+
+    /*
+     * Polling fetches the next completion into this field.
+     *
+     * No lock is necessary since only one thread calls aio_poll() and invokes
+     * fd and poll handlers.
+     */
+    struct blkio_completion poll_completion;
+
+    /*
+     * Protects ->bounce_pool, ->bounce_bufs, ->bounce_available.
+     *
+     * Lock ordering: ->bounce_lock before ->blkio_lock.
+     */
+    CoMutex bounce_lock;
+
+    /* Bounce buffer pool */
+    struct blkio_mem_region bounce_pool;
+
+    /* Sorted list of allocated bounce buffers */
+    QLIST_HEAD(, BlkioBounceBuf) bounce_bufs;
+
+    /* Queue for coroutines waiting for bounce buffer space */
+    CoQueue bounce_available;
+
+    /* The value of the "mem-region-alignment" property */
+    size_t mem_region_alignment;
+
+    /* Can we skip adding/deleting blkio_mem_regions? */
+    bool needs_mem_regions;
+} BDRVBlkioState;
+
+/* Called with s->bounce_lock held */
+static int blkio_resize_bounce_pool(BDRVBlkioState *s, int64_t bytes)
+{
+    /* There can be no allocated bounce buffers during resize */
+    assert(QLIST_EMPTY(&s->bounce_bufs));
+
+    /* Pad size to reduce frequency of resize calls */
+    bytes += 128 * 1024;
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        int ret;
+
+        if (s->bounce_pool.addr) {
+            blkio_unmap_mem_region(s->blkio, &s->bounce_pool);
+            blkio_free_mem_region(s->blkio, &s->bounce_pool);
+            memset(&s->bounce_pool, 0, sizeof(s->bounce_pool));
+        }
+
+        /* Automatically freed when s->blkio is destroyed */
+        ret = blkio_alloc_mem_region(s->blkio, &s->bounce_pool, bytes);
+        if (ret < 0) {
+            return ret;
+        }
+
+        ret = blkio_map_mem_region(s->blkio, &s->bounce_pool);
+        if (ret < 0) {
+            blkio_free_mem_region(s->blkio, &s->bounce_pool);
+            memset(&s->bounce_pool, 0, sizeof(s->bounce_pool));
+            return ret;
+        }
+    }
+
+    return 0;
+}
+
+/* Called with s->bounce_lock held */
+static bool
+blkio_do_alloc_bounce_buffer(BDRVBlkioState *s, BlkioBounceBuf *bounce,
+                             int64_t bytes)
+{
+    void *addr = s->bounce_pool.addr;
+    BlkioBounceBuf *cur = NULL;
+    BlkioBounceBuf *prev = NULL;
+    ptrdiff_t space;
+
+    /*
+     * This is just a linear search over the holes between requests. An
+     * efficient allocator would be nice.
+     */
+    QLIST_FOREACH(cur, &s->bounce_bufs, next) {
+        space = cur->buf.iov_base - addr;
+        if (bytes <= space) {
+            QLIST_INSERT_BEFORE(cur, bounce, next);
+            bounce->buf.iov_base = addr;
+            bounce->buf.iov_len = bytes;
+            return true;
+        }
+
+        addr = cur->buf.iov_base + cur->buf.iov_len;
+        prev = cur;
+    }
+
+    /* Is there space after the last request? */
+    space = s->bounce_pool.addr + s->bounce_pool.len - addr;
+    if (bytes > space) {
+        return false;
+    }
+    if (prev) {
+        QLIST_INSERT_AFTER(prev, bounce, next);
+    } else {
+        QLIST_INSERT_HEAD(&s->bounce_bufs, bounce, next);
+    }
+    bounce->buf.iov_base = addr;
+    bounce->buf.iov_len = bytes;
+    return true;
+}
+
+static int coroutine_fn
+blkio_alloc_bounce_buffer(BDRVBlkioState *s, BlkioBounceBuf *bounce,
+                          int64_t bytes)
+{
+    /*
+     * Ensure fairness: first time around we join the back of the queue,
+     * subsequently we join the front so we don't lose our place.
+     */
+    CoQueueWaitFlags wait_flags = 0;
+
+    QEMU_LOCK_GUARD(&s->bounce_lock);
+
+    /* Ensure fairness: don't even try if other requests are already waiting */
+    if (!qemu_co_queue_empty(&s->bounce_available)) {
+        qemu_co_queue_wait_flags(&s->bounce_available, &s->bounce_lock,
+                                 wait_flags);
+        wait_flags = CO_QUEUE_WAIT_FRONT;
+    }
+
+    while (true) {
+        if (blkio_do_alloc_bounce_buffer(s, bounce, bytes)) {
+            /* Kick the next queued request since there may be space */
+            qemu_co_queue_next(&s->bounce_available);
+            return 0;
+        }
+
+        /*
+         * If there are no in-flight requests then the pool was simply too
+         * small.
+         */
+        if (QLIST_EMPTY(&s->bounce_bufs)) {
+            bool ok;
+            int ret;
+
+            ret = blkio_resize_bounce_pool(s, bytes);
+            if (ret < 0) {
+                /* Kick the next queued request since that may fail too */
+                qemu_co_queue_next(&s->bounce_available);
+                return ret;
+            }
+
+            ok = blkio_do_alloc_bounce_buffer(s, bounce, bytes);
+            assert(ok); /* must have space this time */
+            return 0;
+        }
+
+        qemu_co_queue_wait_flags(&s->bounce_available, &s->bounce_lock,
+                                 wait_flags);
+        wait_flags = CO_QUEUE_WAIT_FRONT;
+    }
+}
+
+static void coroutine_fn blkio_free_bounce_buffer(BDRVBlkioState *s,
+                                                  BlkioBounceBuf *bounce)
+{
+    QEMU_LOCK_GUARD(&s->bounce_lock);
+
+    QLIST_REMOVE(bounce, next);
+
+    /* Wake up waiting coroutines since space may now be available */
+    qemu_co_queue_next(&s->bounce_available);
+}
+
+/* For async to .bdrv_co_*() conversion */
+typedef struct {
+    Coroutine *coroutine;
+    int ret;
+} BlkioCoData;
+
+static void blkio_completion_fd_read(void *opaque)
+{
+    BlockDriverState *bs = opaque;
+    BDRVBlkioState *s = bs->opaque;
+    uint64_t val;
+    int ret;
+
+    /* Polling may have already fetched a completion */
+    if (s->poll_completion.user_data != NULL) {
+        BlkioCoData *cod = s->poll_completion.user_data;
+        cod->ret = s->poll_completion.ret;
+
+        /* Clear it in case aio_co_wake() enters a nested event loop */
+        s->poll_completion.user_data = NULL;
+
+        aio_co_wake(cod->coroutine);
+    }
+
+    /* Reset completion fd status */
+    ret = read(s->completion_fd, &val, sizeof(val));
+
+    /* Ignore errors, there's nothing we can do */
+    (void)ret;
+
+    /*
+     * Reading one completion at a time makes nested event loop re-entrancy
+     * simple. Change this loop to get multiple completions in one go if it
+     * becomes a performance bottleneck.
+     */
+    while (true) {
+        struct blkio_completion completion;
+
+        WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+            ret = blkioq_do_io(s->blkioq, &completion, 0, 1, NULL);
+        }
+        if (ret != 1) {
+            break;
+        }
+
+        BlkioCoData *cod = completion.user_data;
+        cod->ret = completion.ret;
+        aio_co_wake(cod->coroutine);
+    }
+}
+
+static bool blkio_completion_fd_poll(void *opaque)
+{
+    BlockDriverState *bs = opaque;
+    BDRVBlkioState *s = bs->opaque;
+    int ret;
+
+    /* Just in case we already fetched a completion */
+    if (s->poll_completion.user_data != NULL) {
+        return true;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        ret = blkioq_do_io(s->blkioq, &s->poll_completion, 0, 1, NULL);
+    }
+    return ret == 1;
+}
+
+static void blkio_completion_fd_poll_ready(void *opaque)
+{
+    blkio_completion_fd_read(opaque);
+}
+
+static void blkio_attach_aio_context(BlockDriverState *bs,
+                                     AioContext *new_context)
+{
+    BDRVBlkioState *s = bs->opaque;
+
+    aio_set_fd_handler(new_context,
+                       s->completion_fd,
+                       false,
+                       blkio_completion_fd_read,
+                       NULL,
+                       blkio_completion_fd_poll,
+                       blkio_completion_fd_poll_ready,
+                       bs);
+}
+
+static void blkio_detach_aio_context(BlockDriverState *bs)
+{
+    BDRVBlkioState *s = bs->opaque;
+
+    aio_set_fd_handler(bdrv_get_aio_context(bs),
+                       s->completion_fd,
+                       false, NULL, NULL, NULL, NULL, NULL);
+}
+
+/* Call with s->blkio_lock held to submit I/O after enqueuing a new request */
+static void blkio_submit_io(BlockDriverState *bs)
+{
+    if (qatomic_read(&bs->io_plugged) == 0) {
+        BDRVBlkioState *s = bs->opaque;
+
+        blkioq_do_io(s->blkioq, NULL, 0, 0, NULL);
+    }
+}
+
+static int coroutine_fn
+blkio_co_pdiscard(BlockDriverState *bs, int64_t offset, int64_t bytes)
+{
+    BDRVBlkioState *s = bs->opaque;
+    BlkioCoData cod = {
+        .coroutine = qemu_coroutine_self(),
+    };
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkioq_discard(s->blkioq, offset, bytes, &cod, 0);
+        blkio_submit_io(bs);
+    }
+
+    qemu_coroutine_yield();
+    return cod.ret;
+}
+
+static int coroutine_fn
+blkio_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
+                QEMUIOVector *qiov, BdrvRequestFlags flags)
+{
+    BlkioCoData cod = {
+        .coroutine = qemu_coroutine_self(),
+    };
+    BDRVBlkioState *s = bs->opaque;
+    bool use_bounce_buffer = s->needs_mem_regions;
+    BlkioBounceBuf bounce;
+    struct iovec *iov = qiov->iov;
+    int iovcnt = qiov->niov;
+
+    if (use_bounce_buffer) {
+        int ret = blkio_alloc_bounce_buffer(s, &bounce, bytes);
+        if (ret < 0) {
+            return ret;
+        }
+
+        iov = &bounce.buf;
+        iovcnt = 1;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkioq_readv(s->blkioq, offset, iov, iovcnt, &cod, 0);
+        blkio_submit_io(bs);
+    }
+
+    qemu_coroutine_yield();
+
+    if (use_bounce_buffer) {
+        if (cod.ret == 0) {
+            qemu_iovec_from_buf(qiov, 0,
+                                bounce.buf.iov_base,
+                                bounce.buf.iov_len);
+        }
+
+        blkio_free_bounce_buffer(s, &bounce);
+    }
+
+    return cod.ret;
+}
+
+static int coroutine_fn blkio_co_pwritev(BlockDriverState *bs, int64_t offset,
+        int64_t bytes, QEMUIOVector *qiov, BdrvRequestFlags flags)
+{
+    uint32_t blkio_flags = (flags & BDRV_REQ_FUA) ? BLKIO_REQ_FUA : 0;
+    BlkioCoData cod = {
+        .coroutine = qemu_coroutine_self(),
+    };
+    BDRVBlkioState *s = bs->opaque;
+    bool use_bounce_buffer = s->needs_mem_regions;
+    BlkioBounceBuf bounce;
+    struct iovec *iov = qiov->iov;
+    int iovcnt = qiov->niov;
+
+    if (use_bounce_buffer) {
+        int ret = blkio_alloc_bounce_buffer(s, &bounce, bytes);
+        if (ret < 0) {
+            return ret;
+        }
+
+        qemu_iovec_to_buf(qiov, 0, bounce.buf.iov_base, bytes);
+        iov = &bounce.buf;
+        iovcnt = 1;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkioq_writev(s->blkioq, offset, iov, iovcnt, &cod, blkio_flags);
+        blkio_submit_io(bs);
+    }
+
+    qemu_coroutine_yield();
+
+    if (use_bounce_buffer) {
+        blkio_free_bounce_buffer(s, &bounce);
+    }
+
+    return cod.ret;
+}
+
+static int coroutine_fn blkio_co_flush(BlockDriverState *bs)
+{
+    BDRVBlkioState *s = bs->opaque;
+    BlkioCoData cod = {
+        .coroutine = qemu_coroutine_self(),
+    };
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkioq_flush(s->blkioq, &cod, 0);
+        blkio_submit_io(bs);
+    }
+
+    qemu_coroutine_yield();
+    return cod.ret;
+}
+
+static int coroutine_fn blkio_co_pwrite_zeroes(BlockDriverState *bs,
+    int64_t offset, int64_t bytes, BdrvRequestFlags flags)
+{
+    BDRVBlkioState *s = bs->opaque;
+    BlkioCoData cod = {
+        .coroutine = qemu_coroutine_self(),
+    };
+    uint32_t blkio_flags = 0;
+
+    if (flags & BDRV_REQ_FUA) {
+        blkio_flags |= BLKIO_REQ_FUA;
+    }
+    if (!(flags & BDRV_REQ_MAY_UNMAP)) {
+        blkio_flags |= BLKIO_REQ_NO_UNMAP;
+    }
+    if (flags & BDRV_REQ_NO_FALLBACK) {
+        blkio_flags |= BLKIO_REQ_NO_FALLBACK;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkioq_write_zeroes(s->blkioq, offset, bytes, &cod, blkio_flags);
+        blkio_submit_io(bs);
+    }
+
+    qemu_coroutine_yield();
+    return cod.ret;
+}
+
+static void blkio_io_unplug(BlockDriverState *bs)
+{
+    BDRVBlkioState *s = bs->opaque;
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkio_submit_io(bs);
+    }
+}
+
+static int blkio_io_uring_open(BlockDriverState *bs, QDict *options, int flags,
+                               Error **errp)
+{
+    const char *filename = qdict_get_str(options, "filename");
+    BDRVBlkioState *s = bs->opaque;
+    int ret;
+
+    ret = blkio_set_str(s->blkio, "path", filename);
+    qdict_del(options, "filename");
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to set path: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
+    if (flags & BDRV_O_NOCACHE) {
+        ret = blkio_set_bool(s->blkio, "direct", true);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "failed to set direct: %s",
+                             blkio_get_error_msg());
+            return ret;
+        }
+    }
+
+    return 0;
+}
+
+static int blkio_nvme_io_uring(BlockDriverState *bs, QDict *options, int flags,
+                               Error **errp)
+{
+    const char *filename = qdict_get_str(options, "filename");
+    BDRVBlkioState *s = bs->opaque;
+    int ret;
+
+    ret = blkio_set_str(s->blkio, "path", filename);
+    qdict_del(options, "filename");
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to set path: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
+    if (!(flags & BDRV_O_NOCACHE)) {
+        error_setg(errp, "cache.direct=off is not supported");
+        return -EINVAL;
+    }
+
+    return 0;
+}
+
+static int blkio_virtio_blk_common_open(BlockDriverState *bs,
+        QDict *options, int flags, Error **errp)
+{
+    const char *path = qdict_get_try_str(options, "path");
+    BDRVBlkioState *s = bs->opaque;
+    int ret;
+
+    if (!path) {
+        error_setg(errp, "missing 'path' option");
+        return -EINVAL;
+    }
+
+    ret = blkio_set_str(s->blkio, "path", path);
+    qdict_del(options, "path");
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to set path: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
+    if (!(flags & BDRV_O_NOCACHE)) {
+        error_setg(errp, "cache.direct=off is not supported");
+        return -EINVAL;
+    }
+    return 0;
+}
+
+static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
+                           Error **errp)
+{
+    const char *blkio_driver = bs->drv->protocol_name;
+    BDRVBlkioState *s = bs->opaque;
+    int ret;
+
+    ret = blkio_create(blkio_driver, &s->blkio);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "blkio_create failed: %s",
+                         blkio_get_error_msg());
+        return ret;
+    }
+
+    if (strcmp(blkio_driver, DRIVER_IO_URING) == 0) {
+        ret = blkio_io_uring_open(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, DRIVER_NVME_IO_URING) == 0) {
+        ret = blkio_nvme_io_uring(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_USER) == 0) {
+        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
+    } else if (strcmp(blkio_driver, DRIVER_VIRTIO_BLK_VHOST_VDPA) == 0) {
+        ret = blkio_virtio_blk_common_open(bs, options, flags, errp);
+    } else {
+        g_assert_not_reached();
+    }
+    if (ret < 0) {
+        blkio_destroy(&s->blkio);
+        return ret;
+    }
+
+    if (!(flags & BDRV_O_RDWR)) {
+        ret = blkio_set_bool(s->blkio, "read-only", true);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "failed to set read-only: %s",
+                             blkio_get_error_msg());
+            blkio_destroy(&s->blkio);
+            return ret;
+        }
+    }
+
+    ret = blkio_connect(s->blkio);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "blkio_connect failed: %s",
+                         blkio_get_error_msg());
+        blkio_destroy(&s->blkio);
+        return ret;
+    }
+
+    ret = blkio_get_bool(s->blkio,
+                         "needs-mem-regions",
+                         &s->needs_mem_regions);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret,
+                         "failed to get needs-mem-regions: %s",
+                         blkio_get_error_msg());
+        blkio_destroy(&s->blkio);
+        return ret;
+    }
+
+    ret = blkio_get_uint64(s->blkio,
+                           "mem-region-alignment",
+                           &s->mem_region_alignment);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret,
+                         "failed to get mem-region-alignment: %s",
+                         blkio_get_error_msg());
+        blkio_destroy(&s->blkio);
+        return ret;
+    }
+
+    ret = blkio_start(s->blkio);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "blkio_start failed: %s",
+                         blkio_get_error_msg());
+        blkio_destroy(&s->blkio);
+        return ret;
+    }
+
+    bs->supported_write_flags = BDRV_REQ_FUA;
+    bs->supported_zero_flags = BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP |
+                               BDRV_REQ_NO_FALLBACK;
+
+    qemu_mutex_init(&s->blkio_lock);
+    qemu_co_mutex_init(&s->bounce_lock);
+    qemu_co_queue_init(&s->bounce_available);
+    QLIST_INIT(&s->bounce_bufs);
+    s->blkioq = blkio_get_queue(s->blkio, 0);
+    s->completion_fd = blkioq_get_completion_fd(s->blkioq);
+
+    blkio_attach_aio_context(bs, bdrv_get_aio_context(bs));
+    return 0;
+}
+
+static void blkio_close(BlockDriverState *bs)
+{
+    BDRVBlkioState *s = bs->opaque;
+
+    /* There is no destroy() API for s->bounce_lock */
+
+    qemu_mutex_destroy(&s->blkio_lock);
+    blkio_detach_aio_context(bs);
+    blkio_destroy(&s->blkio);
+}
+
+static int64_t blkio_getlength(BlockDriverState *bs)
+{
+    BDRVBlkioState *s = bs->opaque;
+    uint64_t capacity;
+    int ret;
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        ret = blkio_get_uint64(s->blkio, "capacity", &capacity);
+    }
+    if (ret < 0) {
+        return -ret;
+    }
+
+    return capacity;
+}
+
+static int blkio_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
+{
+    return 0;
+}
+
+static void blkio_refresh_limits(BlockDriverState *bs, Error **errp)
+{
+    BDRVBlkioState *s = bs->opaque;
+    QEMU_LOCK_GUARD(&s->blkio_lock);
+    int value;
+    int ret;
+
+    ret = blkio_get_int(s->blkio, "request-alignment", &value);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to get \"request-alignment\": %s",
+                         blkio_get_error_msg());
+        return;
+    }
+    bs->bl.request_alignment = value;
+    if (bs->bl.request_alignment < 1 ||
+        bs->bl.request_alignment >= INT_MAX ||
+        !is_power_of_2(bs->bl.request_alignment)) {
+        error_setg(errp, "invalid \"request-alignment\" value %" PRIu32 ", "
+                   "must be a power of 2 less than INT_MAX",
+                   bs->bl.request_alignment);
+        return;
+    }
+
+    ret = blkio_get_int(s->blkio, "optimal-io-size", &value);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to get \"optimal-io-size\": %s",
+                         blkio_get_error_msg());
+        return;
+    }
+    bs->bl.opt_transfer = value;
+    if (bs->bl.opt_transfer > INT_MAX ||
+        (bs->bl.opt_transfer % bs->bl.request_alignment)) {
+        error_setg(errp, "invalid \"optimal-io-size\" value %" PRIu32 ", must "
+                   "be a multiple of %" PRIu32, bs->bl.opt_transfer,
+                   bs->bl.request_alignment);
+        return;
+    }
+
+    ret = blkio_get_int(s->blkio, "max-transfer", &value);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to get \"max-transfer\": %s",
+                         blkio_get_error_msg());
+        return;
+    }
+    bs->bl.max_transfer = value;
+    if ((bs->bl.max_transfer % bs->bl.request_alignment) ||
+        (bs->bl.opt_transfer && (bs->bl.max_transfer % bs->bl.opt_transfer))) {
+        error_setg(errp, "invalid \"max-transfer\" value %" PRIu32 ", must be "
+                   "a multiple of %" PRIu32 " and %" PRIu32 " (if non-zero)",
+                   bs->bl.max_transfer, bs->bl.request_alignment,
+                   bs->bl.opt_transfer);
+        return;
+    }
+
+    ret = blkio_get_int(s->blkio, "buf-alignment", &value);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to get \"buf-alignment\": %s",
+                         blkio_get_error_msg());
+        return;
+    }
+    if (value < 1) {
+        error_setg(errp, "invalid \"buf-alignment\" value %d, must be "
+                   "positive", value);
+        return;
+    }
+    bs->bl.min_mem_alignment = value;
+
+    ret = blkio_get_int(s->blkio, "optimal-buf-alignment", &value);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret,
+                         "failed to get \"optimal-buf-alignment\": %s",
+                         blkio_get_error_msg());
+        return;
+    }
+    if (value < 1) {
+        error_setg(errp, "invalid \"optimal-buf-alignment\" value %d, "
+                   "must be positive", value);
+        return;
+    }
+    bs->bl.opt_mem_alignment = value;
+
+    ret = blkio_get_int(s->blkio, "max-segments", &value);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret, "failed to get \"max-segments\": %s",
+                         blkio_get_error_msg());
+        return;
+    }
+    if (value < 1) {
+        error_setg(errp, "invalid \"max-segments\" value %d, must be positive",
+                   value);
+        return;
+    }
+    bs->bl.max_iov = value;
+}
+
+/*
+ * TODO
+ * Missing libblkio APIs:
+ * - block_status
+ * - co_invalidate_cache
+ *
+ * Out of scope?
+ * - create
+ * - truncate
+ */
+
+#define BLKIO_DRIVER(name, ...) \
+    { \
+        .format_name             = name, \
+        .protocol_name           = name, \
+        .instance_size           = sizeof(BDRVBlkioState), \
+        .bdrv_file_open          = blkio_file_open, \
+        .bdrv_close              = blkio_close, \
+        .bdrv_getlength          = blkio_getlength, \
+        .bdrv_get_info           = blkio_get_info, \
+        .bdrv_attach_aio_context = blkio_attach_aio_context, \
+        .bdrv_detach_aio_context = blkio_detach_aio_context, \
+        .bdrv_co_pdiscard        = blkio_co_pdiscard, \
+        .bdrv_co_preadv          = blkio_co_preadv, \
+        .bdrv_co_pwritev         = blkio_co_pwritev, \
+        .bdrv_co_flush_to_disk   = blkio_co_flush, \
+        .bdrv_co_pwrite_zeroes   = blkio_co_pwrite_zeroes, \
+        .bdrv_io_unplug          = blkio_io_unplug, \
+        .bdrv_refresh_limits     = blkio_refresh_limits, \
+        __VA_ARGS__ \
+    }
+
+static BlockDriver bdrv_io_uring = BLKIO_DRIVER(
+    DRIVER_IO_URING,
+    .bdrv_needs_filename = true,
+);
+
+static BlockDriver bdrv_nvme_io_uring = BLKIO_DRIVER(
+    DRIVER_NVME_IO_URING,
+    .bdrv_needs_filename = true,
+);
+
+static BlockDriver bdrv_virtio_blk_vhost_user = BLKIO_DRIVER(
+    DRIVER_VIRTIO_BLK_VHOST_USER
+);
+
+static BlockDriver bdrv_virtio_blk_vhost_vdpa = BLKIO_DRIVER(
+    DRIVER_VIRTIO_BLK_VHOST_VDPA
+);
+
+static void bdrv_blkio_init(void)
+{
+    bdrv_register(&bdrv_io_uring);
+    bdrv_register(&bdrv_nvme_io_uring);
+    bdrv_register(&bdrv_virtio_blk_vhost_user);
+    bdrv_register(&bdrv_virtio_blk_vhost_vdpa);
+}
+
+block_init(bdrv_blkio_init);
diff --git a/tests/qtest/modules-test.c b/tests/qtest/modules-test.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/modules-test.c
+++ b/tests/qtest/modules-test.c
@@ -XXX,XX +XXX,XX @@ static void test_modules_load(const void *data)
 int main(int argc, char *argv[])
 {
     const char *modules[] = {
+#ifdef CONFIG_BLKIO
+        "block-", "blkio",
+#endif
 #ifdef CONFIG_CURL
         "block-", "curl",
 #endif
diff --git a/block/meson.build b/block/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_modules = {}
 
 modsrc = []
 foreach m : [
+  [blkio, 'blkio', files('blkio.c')],
   [curl, 'curl', files('curl.c')],
   [glusterfs, 'gluster', files('gluster.c')],
   [libiscsi, 'iscsi', [files('iscsi.c'), libm]],
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index XXXXXXX..XXXXXXX 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -XXX,XX +XXX,XX @@ meson_options_help() {
   printf "%s\n" '  auth-pam        PAM access control'
   printf "%s\n" '  avx2            AVX2 optimizations'
   printf "%s\n" '  avx512f         AVX512F optimizations'
+  printf "%s\n" '  blkio           libblkio block device driver'
   printf "%s\n" '  bochs           bochs image format support'
   printf "%s\n" '  bpf             eBPF support'
   printf "%s\n" '  brlapi          brlapi character device driver'
@@ -XXX,XX +XXX,XX @@ _meson_option_parse() {
     --disable-gcov) printf "%s" -Db_coverage=false ;;
     --enable-lto) printf "%s" -Db_lto=true ;;
     --disable-lto) printf "%s" -Db_lto=false ;;
+    --enable-blkio) printf "%s" -Dblkio=enabled ;;
+    --disable-blkio) printf "%s" -Dblkio=disabled ;;
     --block-drv-ro-whitelist=*) quote_sh "-Dblock_drv_ro_whitelist=$2" ;;
     --block-drv-rw-whitelist=*) quote_sh "-Dblock_drv_rw_whitelist=$2" ;;
     --enable-block-drv-whitelist-in-tools) printf "%s" -Dblock_drv_whitelist_in_tools=true ;;
-- 
2.37.3

When a RAMBlockNotifier is added, ->ram_block_added() is called with all
existing RAMBlocks. There is no equivalent ->ram_block_removed() call
when a RAMBlockNotifier is removed.

The util/vfio-helpers.c code (the sole user of RAMBlockNotifier) is fine
with this asymmetry because it does not rely on RAMBlockNotifier for
cleanup. It walks its internal list of DMA mappings and unmaps them by
itself.

Future users of RAMBlockNotifier may not have an internal data structure
that records added RAMBlocks so they will need ->ram_block_removed()
callbacks.

This patch makes ram_block_notifier_remove() symmetric with respect to
callbacks. Now util/vfio-helpers.c needs to unmap remaining DMA mappings
after ram_block_notifier_remove() has been called. This is necessary
since users like block/nvme.c may create additional DMA mappings that do
not originate from the RAMBlockNotifier.

Reviewed-by: David Hildenbrand <david@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20221013185908.1297568-4-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/core/numa.c      | 17 +++++++++++++++++
 util/vfio-helpers.c |  5 ++++-
 2 files changed, 21 insertions(+), 1 deletion(-)

diff --git a/hw/core/numa.c b/hw/core/numa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/numa.c
+++ b/hw/core/numa.c
@@ -XXX,XX +XXX,XX @@ static int ram_block_notify_add_single(RAMBlock *rb, void *opaque)
     return 0;
 }
 
+static int ram_block_notify_remove_single(RAMBlock *rb, void *opaque)
+{
+    const ram_addr_t max_size = qemu_ram_get_max_length(rb);
+    const ram_addr_t size = qemu_ram_get_used_length(rb);
+    void *host = qemu_ram_get_host_addr(rb);
+    RAMBlockNotifier *notifier = opaque;
+
+    if (host) {
+        notifier->ram_block_removed(notifier, host, size, max_size);
+    }
+    return 0;
+}
+
 void ram_block_notifier_add(RAMBlockNotifier *n)
 {
     QLIST_INSERT_HEAD(&ram_list.ramblock_notifiers, n, next);
@@ -XXX,XX +XXX,XX @@ void ram_block_notifier_add(RAMBlockNotifier *n)
 void ram_block_notifier_remove(RAMBlockNotifier *n)
 {
     QLIST_REMOVE(n, next);
+
+    if (n->ram_block_removed) {
+        qemu_ram_foreach_block(ram_block_notify_remove_single, n);
+    }
 }
 
 void ram_block_notify_add(void *host, size_t size, size_t max_size)
diff --git a/util/vfio-helpers.c b/util/vfio-helpers.c
index XXXXXXX..XXXXXXX 100644
--- a/util/vfio-helpers.c
+++ b/util/vfio-helpers.c
@@ -XXX,XX +XXX,XX @@ void qemu_vfio_close(QEMUVFIOState *s)
     if (!s) {
         return;
     }
+
+    ram_block_notifier_remove(&s->ram_notifier);
+
     for (i = 0; i < s->nr_mappings; ++i) {
         qemu_vfio_undo_mapping(s, &s->mappings[i], NULL);
     }
-    ram_block_notifier_remove(&s->ram_notifier);
+
     g_free(s->usable_iova_ranges);
     s->nb_iova_ranges = 0;
     qemu_vfio_reset(s);
-- 
2.37.3

The only implementor of bdrv_register_buf() is block/nvme.c, where the
size is not needed when unregistering a buffer. This is because
util/vfio-helpers.c can look up mappings by address.

Future block drivers that implement bdrv_register_buf() may not be able
to do their job given only the buffer address. Add a size argument to
bdrv_unregister_buf().

Also document the assumptions about
bdrv_register_buf()/bdrv_unregister_buf() calls. The same <host, size>
values that were given to bdrv_register_buf() must be given to
bdrv_unregister_buf().

gcc 11.2.1 emits a spurious warning that img_bench()'s buf_size local
variable might be uninitialized, so it's necessary to silence the
compiler.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20221013185908.1297568-5-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/block/block-global-state.h          | 5 ++++-
 include/block/block_int-common.h            | 2 +-
 include/sysemu/block-backend-global-state.h | 2 +-
 block/block-backend.c                       | 4 ++--
 block/io.c                                  | 6 +++---
 block/nvme.c                                | 2 +-
 qemu-img.c                                  | 4 ++--
 7 files changed, 14 insertions(+), 11 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -XXX,XX +XXX,XX @@ void bdrv_del_child(BlockDriverState *parent, BdrvChild *child, Error **errp);
  * Register/unregister a buffer for I/O. For example, VFIO drivers are
  * interested to know the memory areas that would later be used for I/O, so
  * that they can prepare IOMMU mapping etc., to get better performance.
+ *
+ * Buffers must not overlap and they must be unregistered with the same <host,
+ * size> values that they were registered with.
  */
 void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size);
-void bdrv_unregister_buf(BlockDriverState *bs, void *host);
+void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size);
 
 void bdrv_cancel_in_flight(BlockDriverState *bs);
 
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
      * DMA mapping for hot buffers.
      */
     void (*bdrv_register_buf)(BlockDriverState *bs, void *host, size_t size);
-    void (*bdrv_unregister_buf)(BlockDriverState *bs, void *host);
+    void (*bdrv_unregister_buf)(BlockDriverState *bs, void *host, size_t size);
 
     /*
      * This field is modified only under the BQL, and is part of
diff --git a/include/sysemu/block-backend-global-state.h b/include/sysemu/block-backend-global-state.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/block-backend-global-state.h
+++ b/include/sysemu/block-backend-global-state.h
@@ -XXX,XX +XXX,XX @@ void blk_io_limits_update_group(BlockBackend *blk, const char *group);
 void blk_set_force_allow_inactivate(BlockBackend *blk);
 
 void blk_register_buf(BlockBackend *blk, void *host, size_t size);
-void blk_unregister_buf(BlockBackend *blk, void *host);
+void blk_unregister_buf(BlockBackend *blk, void *host, size_t size);
 
 const BdrvChild *blk_root(BlockBackend *blk);
 
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ void blk_register_buf(BlockBackend *blk, void *host, size_t size)
     bdrv_register_buf(blk_bs(blk), host, size);
 }
 
-void blk_unregister_buf(BlockBackend *blk, void *host)
+void blk_unregister_buf(BlockBackend *blk, void *host, size_t size)
 {
     GLOBAL_STATE_CODE();
-    bdrv_unregister_buf(blk_bs(blk), host);
+    bdrv_unregister_buf(blk_bs(blk), host, size);
 }
 
 int coroutine_fn blk_co_copy_range(BlockBackend *blk_in, int64_t off_in,
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size)
     }
 }
 
-void bdrv_unregister_buf(BlockDriverState *bs, void *host)
+void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size)
 {
     BdrvChild *child;
 
     GLOBAL_STATE_CODE();
     if (bs->drv && bs->drv->bdrv_unregister_buf) {
-        bs->drv->bdrv_unregister_buf(bs, host);
+        bs->drv->bdrv_unregister_buf(bs, host, size);
     }
     QLIST_FOREACH(child, &bs->children, next) {
-        bdrv_unregister_buf(child->bs, host);
+        bdrv_unregister_buf(child->bs, host, size);
     }
 }
 
diff --git a/block/nvme.c b/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static void nvme_register_buf(BlockDriverState *bs, void *host, size_t size)
     }
 }
 
-static void nvme_unregister_buf(BlockDriverState *bs, void *host)
+static void nvme_unregister_buf(BlockDriverState *bs, void *host, size_t size)
 {
     BDRVNVMeState *s = bs->opaque;
 
diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_bench(int argc, char **argv)
     struct timeval t1, t2;
     int i;
     bool force_share = false;
-    size_t buf_size;
+    size_t buf_size = 0;
 
     for (;;) {
         static const struct option long_options[] = {
@@ -XXX,XX +XXX,XX @@ static int img_bench(int argc, char **argv)
 
 out:
     if (data.buf) {
-        blk_unregister_buf(blk, data.buf);
+        blk_unregister_buf(blk, data.buf, buf_size);
     }
     qemu_vfree(data.buf);
     blk_unref(blk);
-- 
2.37.3

Use the enum type so GDB displays the enum members instead of printing a
numeric constant.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20221013185908.1297568-6-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/block/block_int-common.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
     /*
      * Flags honored during pread
      */
-    unsigned int supported_read_flags;
+    BdrvRequestFlags supported_read_flags;
     /*
      * Flags honored during pwrite (so far: BDRV_REQ_FUA,
      * BDRV_REQ_WRITE_UNCHANGED).
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
      * flag), or they have to explicitly take the WRITE permission for
      * their children.
      */
-    unsigned int supported_write_flags;
+    BdrvRequestFlags supported_write_flags;
     /*
      * Flags honored during pwrite_zeroes (so far: BDRV_REQ_FUA,
      * BDRV_REQ_MAY_UNMAP, BDRV_REQ_WRITE_UNCHANGED)
      */
-    unsigned int supported_zero_flags;
+    BdrvRequestFlags supported_zero_flags;
     /*
      * Flags honoured during truncate (so far: BDRV_REQ_ZERO_WRITE).
      *
@@ -XXX,XX +XXX,XX @@ struct BlockDriverState {
      * that any added space reads as all zeros. If this can't be guaranteed,
      * the operation must fail.
      */
-    unsigned int supported_truncate_flags;
+    BdrvRequestFlags supported_truncate_flags;
 
     /* the following member gives a name to every node on the bs graph. */
     char node_name[32];
-- 
2.37.3

Block drivers may optimize I/O requests accessing buffers previously
registered with bdrv_register_buf(). Checking whether all elements of a
request's QEMUIOVector are within previously registered buffers is
expensive, so we need a hint from the user to avoid costly checks.

Add a BDRV_REQ_REGISTERED_BUF request flag to indicate that all
QEMUIOVector elements in an I/O request are known to be within
previously registered buffers.

Always pass the flag through to driver read/write functions. There is
little harm in passing the flag to a driver that does not use it.
Passing the flag to drivers avoids changes across many block drivers.
Filter drivers would need to explicitly support the flag and pass
through to their children when the children support it. That's a lot of
code changes and it's hard to remember to do that everywhere, leading to
silent reduced performance when the flag is accidentally dropped.

The only problematic scenario with the approach in this patch is when a
driver passes the flag through to internal I/O requests that don't use
the same I/O buffer. In that case the hint may be set when it should
actually be clear. This is a rare case though so the risk is low.

Some drivers have assert(!flags), which no longer works when
BDRV_REQ_REGISTERED_BUF is passed in. These assertions aren't very
useful anyway since the functions are called almost exclusively by
bdrv_driver_preadv/pwritev() so if we get flags handling right there
then the assertion is not needed.

diff --git a/include/block/block-common.h b/include/block/block-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block-common.h
+++ b/include/block/block-common.h
@@ -XXX,XX +XXX,XX @@ typedef enum {
      */
     BDRV_REQ_MAY_UNMAP          = 0x4,
 
+    /*
+     * An optimization hint when all QEMUIOVector elements are within
+     * previously registered bdrv_register_buf() memory ranges.
+     *
+     * Code that replaces the user's QEMUIOVector elements with bounce buffers
+     * must take care to clear this flag.
+     */
+    BDRV_REQ_REGISTERED_BUF     = 0x8,
+
     BDRV_REQ_FUA                = 0x10,
     BDRV_REQ_WRITE_COMPRESSED   = 0x20,
 
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
         goto open_failed;
     }
 
+    assert(!(bs->supported_read_flags & ~BDRV_REQ_MASK));
+    assert(!(bs->supported_write_flags & ~BDRV_REQ_MASK));
+
+    /*
+     * Always allow the BDRV_REQ_REGISTERED_BUF optimization hint. This saves
+     * drivers that pass read/write requests through to a child the trouble of
+     * declaring support explicitly.
+     *
+     * Drivers must not propagate this flag accidentally when they initiate I/O
+     * to a bounce buffer. That case should be rare though.
+     */
+    bs->supported_read_flags |= BDRV_REQ_REGISTERED_BUF;
+    bs->supported_write_flags |= BDRV_REQ_REGISTERED_BUF;
+
     ret = refresh_total_sectors(bs, bs->total_sectors);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Could not refresh total sector count");
diff --git a/block/blkverify.c b/block/blkverify.c
index XXXXXXX..XXXXXXX 100644
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -XXX,XX +XXX,XX @@ blkverify_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
     qemu_iovec_init(&raw_qiov, qiov->niov);
     qemu_iovec_clone(&raw_qiov, qiov, buf);
 
-    ret = blkverify_co_prwv(bs, &r, offset, bytes, qiov, &raw_qiov, flags,
-                            false);
+    ret = blkverify_co_prwv(bs, &r, offset, bytes, qiov, &raw_qiov,
+                            flags & ~BDRV_REQ_REGISTERED_BUF, false);
 
     cmp_offset = qemu_iovec_compare(qiov, &raw_qiov);
     if (cmp_offset != -1) {
diff --git a/block/crypto.c b/block/crypto.c
index XXXXXXX..XXXXXXX 100644
--- a/block/crypto.c
+++ b/block/crypto.c
@@ -XXX,XX +XXX,XX @@ block_crypto_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
     uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
     uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
 
-    assert(!flags);
     assert(payload_offset < INT64_MAX);
     assert(QEMU_IS_ALIGNED(offset, sector_size));
     assert(QEMU_IS_ALIGNED(bytes, sector_size));
@@ -XXX,XX +XXX,XX @@ block_crypto_co_pwritev(BlockDriverState *bs, int64_t offset, int64_t bytes,
     uint64_t sector_size = qcrypto_block_get_sector_size(crypto->block);
     uint64_t payload_offset = qcrypto_block_get_payload_offset(crypto->block);
 
-    assert(!(flags & ~BDRV_REQ_FUA));
+    flags &= ~BDRV_REQ_REGISTERED_BUF;
+
     assert(payload_offset < INT64_MAX);
     assert(QEMU_IS_ALIGNED(offset, sector_size));
     assert(QEMU_IS_ALIGNED(bytes, sector_size));
diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
                                        int64_t bytes, QEMUIOVector *qiov,
                                        BdrvRequestFlags flags)
 {
-    assert(flags == 0);
     return raw_co_prw(bs, offset, bytes, qiov, QEMU_AIO_WRITE);
 }
 
diff --git a/block/gluster.c b/block/gluster.c
index XXXXXXX..XXXXXXX 100644
--- a/block/gluster.c
+++ b/block/gluster.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qemu_gluster_co_writev(BlockDriverState *bs,
                                                QEMUIOVector *qiov,
                                                int flags)
 {
-    assert(!flags);
     return qemu_gluster_co_rw(bs, sector_num, nb_sectors, qiov, 1);
 }
 
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
     int ret;
 
     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
-    assert(!(flags & ~BDRV_REQ_MASK));
-    assert(!(flags & BDRV_REQ_NO_FALLBACK));
+    assert(!(flags & ~bs->supported_read_flags));
 
     if (!drv) {
         return -ENOMEDIUM;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
                                             BdrvRequestFlags flags)
 {
     BlockDriver *drv = bs->drv;
+    bool emulate_fua = false;
     int64_t sector_num;
     unsigned int nb_sectors;
     QEMUIOVector local_qiov;
     int ret;
 
     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
-    assert(!(flags & ~BDRV_REQ_MASK));
-    assert(!(flags & BDRV_REQ_NO_FALLBACK));
 
     if (!drv) {
         return -ENOMEDIUM;
     }
 
+    if ((flags & BDRV_REQ_FUA) &&
+        (~bs->supported_write_flags & BDRV_REQ_FUA)) {
+        flags &= ~BDRV_REQ_FUA;
+        emulate_fua = true;
+    }
+
+    flags &= bs->supported_write_flags;
+
     if (drv->bdrv_co_pwritev_part) {
         ret = drv->bdrv_co_pwritev_part(bs, offset, bytes, qiov, qiov_offset,
-                                        flags & bs->supported_write_flags);
-        flags &= ~bs->supported_write_flags;
+                                        flags);
         goto emulate_flags;
     }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
     }
 
     if (drv->bdrv_co_pwritev) {
-        ret = drv->bdrv_co_pwritev(bs, offset, bytes, qiov,
-                                   flags & bs->supported_write_flags);
-        flags &= ~bs->supported_write_flags;
+        ret = drv->bdrv_co_pwritev(bs, offset, bytes, qiov, flags);
         goto emulate_flags;
     }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
             .coroutine = qemu_coroutine_self(),
         };
 
-        acb = drv->bdrv_aio_pwritev(bs, offset, bytes, qiov,
-                                    flags & bs->supported_write_flags,
+        acb = drv->bdrv_aio_pwritev(bs, offset, bytes, qiov, flags,
                                     bdrv_co_io_em_complete, &co);
-        flags &= ~bs->supported_write_flags;
         if (acb == NULL) {
             ret = -EIO;
         } else {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
     assert(bytes <= BDRV_REQUEST_MAX_BYTES);
 
     assert(drv->bdrv_co_writev);
-    ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov,
-                              flags & bs->supported_write_flags);
-    flags &= ~bs->supported_write_flags;
+    ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov, flags);
 
 emulate_flags:
-    if (ret == 0 && (flags & BDRV_REQ_FUA)) {
+    if (ret == 0 && emulate_fua) {
         ret = bdrv_co_flush(bs);
     }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_aligned_preadv(BdrvChild *child,
     max_transfer = QEMU_ALIGN_DOWN(MIN_NON_ZERO(bs->bl.max_transfer, INT_MAX),
                                    align);
 
-    /* TODO: We would need a per-BDS .supported_read_flags and
+    /*
+     * TODO: We would need a per-BDS .supported_read_flags and
      * potential fallback support, if we ever implement any read flags
      * to pass through to drivers.  For now, there aren't any
-     * passthrough flags.  */
-    assert(!(flags & ~(BDRV_REQ_COPY_ON_READ | BDRV_REQ_PREFETCH)));
+     * passthrough flags except the BDRV_REQ_REGISTERED_BUF optimization hint.
+     */
+    assert(!(flags & ~(BDRV_REQ_COPY_ON_READ | BDRV_REQ_PREFETCH |
+                       BDRV_REQ_REGISTERED_BUF)));
 
     /* Handle Copy on Read and associated serialisation */
     if (flags & BDRV_REQ_COPY_ON_READ) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_aligned_preadv(BdrvChild *child,
         goto out;
     }
 
-    assert(!(flags & ~bs->supported_read_flags));
+    assert(!(flags & ~(bs->supported_read_flags | BDRV_REQ_REGISTERED_BUF)));
 
     max_bytes = ROUND_UP(MAX(0, total_bytes - offset), align);
     if (bytes <= max_bytes && bytes <= max_transfer) {
@@ -XXX,XX +XXX,XX @@ static void bdrv_padding_destroy(BdrvRequestPadding *pad)
 static int bdrv_pad_request(BlockDriverState *bs,
                             QEMUIOVector **qiov, size_t *qiov_offset,
                             int64_t *offset, int64_t *bytes,
-                            BdrvRequestPadding *pad, bool *padded)
+                            BdrvRequestPadding *pad, bool *padded,
+                            BdrvRequestFlags *flags)
 {
     int ret;
 
@@ -XXX,XX +XXX,XX @@ static int bdrv_pad_request(BlockDriverState *bs,
     if (padded) {
         *padded = true;
     }
+    if (flags) {
+        /* Can't use optimization hint with bounce buffer */
+        *flags &= ~BDRV_REQ_REGISTERED_BUF;
+    }
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
     }
 
     ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
-                           NULL);
+                           NULL, &flags);
     if (ret < 0) {
         goto fail;
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
         return -ENOTSUP;
     }
 
+    /* By definition there is no user buffer so this flag doesn't make sense */
+    if (flags & BDRV_REQ_REGISTERED_BUF) {
+        return -EINVAL;
+    }
+
     /* Invalidate the cached block-status data range if this write overlaps */
     bdrv_bsc_invalidate_range(bs, offset, bytes);
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
     bool padding;
     BdrvRequestPadding pad;
 
+    /* This flag doesn't make sense for padding or zero writes */
+    flags &= ~BDRV_REQ_REGISTERED_BUF;
+
     padding = bdrv_init_padding(bs, offset, bytes, &pad);
     if (padding) {
         assert(!(flags & BDRV_REQ_NO_WAIT));
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
          * alignment only if there is no ZERO flag.
          */
         ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
-                               &padded);
+                               &padded, &flags);
         if (ret < 0) {
             return ret;
         }
diff --git a/block/mirror.c b/block/mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_mirror_top_pwritev(BlockDriverState *bs,
         qemu_iovec_init(&bounce_qiov, 1);
         qemu_iovec_add(&bounce_qiov, bounce_buf, bytes);
         qiov = &bounce_qiov;
+
+        flags &= ~BDRV_REQ_REGISTERED_BUF;
     }
 
     ret = bdrv_mirror_top_do_write(bs, MIRROR_METHOD_COPY, offset, bytes, qiov,
diff --git a/block/nbd.c b/block/nbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nbd.c
+++ b/block/nbd.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn nbd_client_co_preadv(BlockDriverState *bs, int64_t offse
     };
 
     assert(bytes <= NBD_MAX_BUFFER_SIZE);
-    assert(!flags);
 
     if (!bytes) {
         return 0;
diff --git a/block/parallels.c b/block/parallels.c
index XXXXXXX..XXXXXXX 100644
--- a/block/parallels.c
+++ b/block/parallels.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int parallels_co_writev(BlockDriverState *bs,
     QEMUIOVector hd_qiov;
     int ret = 0;
 
-    assert(!flags);
     qemu_iovec_init(&hd_qiov, qiov->niov);
 
     while (nb_sectors > 0) {
diff --git a/block/qcow.c b/block/qcow.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_preadv(BlockDriverState *bs, int64_t offset,
     uint8_t *buf;
     void *orig_buf;
 
-    assert(!flags);
     if (qiov->niov > 1) {
         buf = orig_buf = qemu_try_blockalign(bs, qiov->size);
         if (buf == NULL) {
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int qcow_co_pwritev(BlockDriverState *bs, int64_t offset,
     uint8_t *buf;
     void *orig_buf;
 
-    assert(!flags);
     s->cluster_cache_offset = -1; /* disable compressed cache */
 
     /* We must always copy the iov when encrypting, so we
diff --git a/block/qed.c b/block/qed.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn bdrv_qed_co_writev(BlockDriverState *bs,
                                            int64_t sector_num, int nb_sectors,
                                            QEMUIOVector *qiov, int flags)
 {
-    assert(!flags);
     return qed_co_request(bs, sector_num, qiov, nb_sectors, QED_AIOCB_WRITE);
 }
 
diff --git a/block/raw-format.c b/block/raw-format.c
index XXXXXXX..XXXXXXX 100644
--- a/block/raw-format.c
+++ b/block/raw-format.c
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn raw_co_pwritev(BlockDriverState *bs, int64_t offset,
         qemu_iovec_add(&local_qiov, buf, 512);
         qemu_iovec_concat(&local_qiov, qiov, 512, qiov->size - 512);
         qiov = &local_qiov;
+
+        flags &= ~BDRV_REQ_REGISTERED_BUF;
     }
 
     ret = raw_adjust_offset(bs, &offset, bytes, true);
diff --git a/block/replication.c b/block/replication.c
index XXXXXXX..XXXXXXX 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int replication_co_writev(BlockDriverState *bs,
     int ret;
     int64_t n;
 
-    assert(!flags);
     ret = replication_get_io_status(s);
     if (ret < 0) {
         goto out;
diff --git a/block/ssh.c b/block/ssh.c
index XXXXXXX..XXXXXXX 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int ssh_co_writev(BlockDriverState *bs,
     BDRVSSHState *s = bs->opaque;
     int ret;
 
-    assert(!flags);
     qemu_co_mutex_lock(&s->lock);
     ret = ssh_write(s, bs, sector_num * BDRV_SECTOR_SIZE,
                     nb_sectors * BDRV_SECTOR_SIZE, qiov);
diff --git a/block/vhdx.c b/block/vhdx.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vhdx.c
+++ b/block/vhdx.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int vhdx_co_writev(BlockDriverState *bs, int64_t sector_num,
     uint64_t bat_prior_offset = 0;
     bool bat_update = false;
 
-    assert(!flags);
     qemu_iovec_init(&hd_qiov, qiov->niov);
 
     qemu_co_mutex_lock(&s->lock);
-- 
2.37.3

Registering an I/O buffer is only a performance optimization hint but it
is still necessary to return errors when it fails.

Later patches will need to detect errors when registering buffers but an
immediate advantage is that error_report() calls are no longer needed in
block driver .bdrv_register_buf() functions.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20221013185908.1297568-8-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/block/block-global-state.h          |  5 ++-
 include/block/block_int-common.h            |  5 ++-
 include/sysemu/block-backend-global-state.h |  2 +-
 block/block-backend.c                       |  4 +--
 block/io.c                                  | 34 +++++++++++++++++++--
 block/nvme.c                                | 18 +++++------
 qemu-img.c                                  |  2 +-
 7 files changed, 52 insertions(+), 18 deletions(-)

diff --git a/include/block/block-global-state.h b/include/block/block-global-state.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block-global-state.h
+++ b/include/block/block-global-state.h
@@ -XXX,XX +XXX,XX @@ void bdrv_del_child(BlockDriverState *parent, BdrvChild *child, Error **errp);
  *
  * Buffers must not overlap and they must be unregistered with the same <host,
  * size> values that they were registered with.
+ *
+ * Returns: true on success, false on failure
  */
-void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size);
+bool bdrv_register_buf(BlockDriverState *bs, void *host, size_t size,
+                       Error **errp);
 void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size);
 
 void bdrv_cancel_in_flight(BlockDriverState *bs);
diff --git a/include/block/block_int-common.h b/include/block/block_int-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int-common.h
+++ b/include/block/block_int-common.h
@@ -XXX,XX +XXX,XX @@ struct BlockDriver {
      * that it can do IOMMU mapping with VFIO etc., in order to get better
      * performance. In the case of VFIO drivers, this callback is used to do
      * DMA mapping for hot buffers.
+     *
+     * Returns: true on success, false on failure
      */
-    void (*bdrv_register_buf)(BlockDriverState *bs, void *host, size_t size);
+    bool (*bdrv_register_buf)(BlockDriverState *bs, void *host, size_t size,
+                              Error **errp);
     void (*bdrv_unregister_buf)(BlockDriverState *bs, void *host, size_t size);
 
     /*
diff --git a/include/sysemu/block-backend-global-state.h b/include/sysemu/block-backend-global-state.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/block-backend-global-state.h
+++ b/include/sysemu/block-backend-global-state.h
@@ -XXX,XX +XXX,XX @@ void blk_io_limits_enable(BlockBackend *blk, const char *group);
 void blk_io_limits_update_group(BlockBackend *blk, const char *group);
 void blk_set_force_allow_inactivate(BlockBackend *blk);
 
-void blk_register_buf(BlockBackend *blk, void *host, size_t size);
+bool blk_register_buf(BlockBackend *blk, void *host, size_t size, Error **errp);
 void blk_unregister_buf(BlockBackend *blk, void *host, size_t size);
 
 const BdrvChild *blk_root(BlockBackend *blk);
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ static void blk_root_drained_end(BdrvChild *child, int *drained_end_counter)
     }
 }
 
-void blk_register_buf(BlockBackend *blk, void *host, size_t size)
+bool blk_register_buf(BlockBackend *blk, void *host, size_t size, Error **errp)
 {
     GLOBAL_STATE_CODE();
-    bdrv_register_buf(blk_bs(blk), host, size);
+    return bdrv_register_buf(blk_bs(blk), host, size, errp);
 }
 
 void blk_unregister_buf(BlockBackend *blk, void *host, size_t size)
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ void bdrv_io_unplug(BlockDriverState *bs)
     }
 }
 
-void bdrv_register_buf(BlockDriverState *bs, void *host, size_t size)
+/* Helper that undoes bdrv_register_buf() when it fails partway through */
+static void bdrv_register_buf_rollback(BlockDriverState *bs,
+                                       void *host,
+                                       size_t size,
+                                       BdrvChild *final_child)
+{
+    BdrvChild *child;
+
+    QLIST_FOREACH(child, &bs->children, next) {
+        if (child == final_child) {
+            break;
+        }
+
+        bdrv_unregister_buf(child->bs, host, size);
+    }
+
+    if (bs->drv && bs->drv->bdrv_unregister_buf) {
+        bs->drv->bdrv_unregister_buf(bs, host, size);
+    }
+}
+
+bool bdrv_register_buf(BlockDriverState *bs, void *host, size_t size,
+                       Error **errp)
 {
     BdrvChild *child;
 
     GLOBAL_STATE_CODE();
     if (bs->drv && bs->drv->bdrv_register_buf) {
-        bs->drv->bdrv_register_buf(bs, host, size);
+        if (!bs->drv->bdrv_register_buf(bs, host, size, errp)) {
+            return false;
+        }
     }
     QLIST_FOREACH(child, &bs->children, next) {
-        bdrv_register_buf(child->bs, host, size);
+        if (!bdrv_register_buf(child->bs, host, size, errp)) {
+            bdrv_register_buf_rollback(bs, host, size, child);
+            return false;
+        }
     }
+    return true;
 }
 
 void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size)
diff --git a/block/nvme.c b/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nvme.c
+++ b/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static void nvme_aio_unplug(BlockDriverState *bs)
     }
 }
 
-static void nvme_register_buf(BlockDriverState *bs, void *host, size_t size)
+static bool nvme_register_buf(BlockDriverState *bs, void *host, size_t size,
+                              Error **errp)
 {
     int ret;
-    Error *local_err = NULL;
     BDRVNVMeState *s = bs->opaque;
 
-    ret = qemu_vfio_dma_map(s->vfio, host, size, false, NULL, &local_err);
-    if (ret) {
-        /* FIXME: we may run out of IOVA addresses after repeated
-         * bdrv_register_buf/bdrv_unregister_buf, because nvme_vfio_dma_unmap
-         * doesn't reclaim addresses for fixed mappings. */
-        error_reportf_err(local_err, "nvme_register_buf failed: ");
-    }
+    /*
+     * FIXME: we may run out of IOVA addresses after repeated
+     * bdrv_register_buf/bdrv_unregister_buf, because nvme_vfio_dma_unmap
+     * doesn't reclaim addresses for fixed mappings.
+     */
+    ret = qemu_vfio_dma_map(s->vfio, host, size, false, NULL, errp);
+    return ret == 0;
 }
 
 static void nvme_unregister_buf(BlockDriverState *bs, void *host, size_t size)
diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_bench(int argc, char **argv)
     data.buf = blk_blockalign(blk, buf_size);
     memset(data.buf, pattern, data.nrreq * data.bufsize);
 
-    blk_register_buf(blk, data.buf, buf_size);
+    blk_register_buf(blk, data.buf, buf_size, &error_fatal);
 
     data.qiov = g_new(QEMUIOVector, data.nrreq);
     for (i = 0; i < data.nrreq; i++) {
-- 
2.37.3

Make list traversal work when a callback removes a notifier
mid-traversal. This is a cleanup to prevent bugs in the future.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: David Hildenbrand <david@redhat.com>
Message-id: 20221013185908.1297568-9-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/core/numa.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/hw/core/numa.c b/hw/core/numa.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/core/numa.c
+++ b/hw/core/numa.c
@@ -XXX,XX +XXX,XX @@ void ram_block_notifier_remove(RAMBlockNotifier *n)
 void ram_block_notify_add(void *host, size_t size, size_t max_size)
 {
     RAMBlockNotifier *notifier;
+    RAMBlockNotifier *next;
 
-    QLIST_FOREACH(notifier, &ram_list.ramblock_notifiers, next) {
+    QLIST_FOREACH_SAFE(notifier, &ram_list.ramblock_notifiers, next, next) {
         if (notifier->ram_block_added) {
             notifier->ram_block_added(notifier, host, size, max_size);
         }
@@ -XXX,XX +XXX,XX @@ void ram_block_notify_add(void *host, size_t size, size_t max_size)
 void ram_block_notify_remove(void *host, size_t size, size_t max_size)
 {
     RAMBlockNotifier *notifier;
+    RAMBlockNotifier *next;
 
-    QLIST_FOREACH(notifier, &ram_list.ramblock_notifiers, next) {
+    QLIST_FOREACH_SAFE(notifier, &ram_list.ramblock_notifiers, next, next) {
         if (notifier->ram_block_removed) {
             notifier->ram_block_removed(notifier, host, size, max_size);
         }
@@ -XXX,XX +XXX,XX @@ void ram_block_notify_remove(void *host, size_t size, size_t max_size)
 void ram_block_notify_resize(void *host, size_t old_size, size_t new_size)
 {
     RAMBlockNotifier *notifier;
+    RAMBlockNotifier *next;
 
-    QLIST_FOREACH(notifier, &ram_list.ramblock_notifiers, next) {
+    QLIST_FOREACH_SAFE(notifier, &ram_list.ramblock_notifiers, next, next) {
         if (notifier->ram_block_resized) {
             notifier->ram_block_resized(notifier, host, old_size, new_size);
         }
-- 
2.37.3

Emulated devices and other BlockBackend users wishing to take advantage
of blk_register_buf() all have the same repetitive job: register
RAMBlocks with the BlockBackend using RAMBlockNotifier.

Add a BlockRAMRegistrar API to do this. A later commit will use this
from hw/block/virtio-blk.c.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20221013185908.1297568-10-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 MAINTAINERS                          |  1 +
 include/sysemu/block-ram-registrar.h | 37 ++++++++++++++++++
 block/block-ram-registrar.c          | 58 ++++++++++++++++++++++++++++
 block/meson.build                    |  1 +
 4 files changed, 97 insertions(+)
 create mode 100644 include/sysemu/block-ram-registrar.h
 create mode 100644 block/block-ram-registrar.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: block*
 F: block/
 F: hw/block/
 F: include/block/
+F: include/sysemu/block-*.h
 F: qemu-img*
 F: docs/tools/qemu-img.rst
 F: qemu-io*
diff --git a/include/sysemu/block-ram-registrar.h b/include/sysemu/block-ram-registrar.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/sysemu/block-ram-registrar.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * BlockBackend RAM Registrar
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#ifndef BLOCK_RAM_REGISTRAR_H
+#define BLOCK_RAM_REGISTRAR_H
+
+#include "exec/ramlist.h"
+
+/**
+ * struct BlockRAMRegistrar:
+ *
+ * Keeps RAMBlock memory registered with a BlockBackend using
+ * blk_register_buf() including hotplugged memory.
+ *
+ * Emulated devices or other BlockBackend users initialize a BlockRAMRegistrar
+ * with blk_ram_registrar_init() before submitting I/O requests with the
+ * BDRV_REQ_REGISTERED_BUF flag set.
+ */
+typedef struct {
+    BlockBackend *blk;
+    RAMBlockNotifier notifier;
+    bool ok;
+} BlockRAMRegistrar;
+
+void blk_ram_registrar_init(BlockRAMRegistrar *r, BlockBackend *blk);
+void blk_ram_registrar_destroy(BlockRAMRegistrar *r);
+
+/* Have all RAMBlocks been registered successfully? */
+static inline bool blk_ram_registrar_ok(BlockRAMRegistrar *r)
+{
+    return r->ok;
+}
+
+#endif /* BLOCK_RAM_REGISTRAR_H */
diff --git a/block/block-ram-registrar.c b/block/block-ram-registrar.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/block-ram-registrar.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * BlockBackend RAM Registrar
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+#include "sysemu/block-backend.h"
+#include "sysemu/block-ram-registrar.h"
+#include "qapi/error.h"
+
+static void ram_block_added(RAMBlockNotifier *n, void *host, size_t size,
+                            size_t max_size)
+{
+    BlockRAMRegistrar *r = container_of(n, BlockRAMRegistrar, notifier);
+    Error *err = NULL;
+
+    if (!r->ok) {
+        return; /* don't try again if we've already failed */
+    }
+
+    if (!blk_register_buf(r->blk, host, max_size, &err)) {
+        error_report_err(err);
+        ram_block_notifier_remove(&r->notifier);
+        r->ok = false;
+    }
+}
+
+static void ram_block_removed(RAMBlockNotifier *n, void *host, size_t size,
+                              size_t max_size)
+{
+    BlockRAMRegistrar *r = container_of(n, BlockRAMRegistrar, notifier);
+    blk_unregister_buf(r->blk, host, max_size);
+}
+
+void blk_ram_registrar_init(BlockRAMRegistrar *r, BlockBackend *blk)
+{
+    r->blk = blk;
+    r->notifier = (RAMBlockNotifier){
+        .ram_block_added = ram_block_added,
+        .ram_block_removed = ram_block_removed,
+
+        /*
+         * .ram_block_resized() is not necessary because we use the max_size
+         * value that does not change across resize.
+         */
+    };
+    r->ok = true;
+
+    ram_block_notifier_add(&r->notifier);
+}
+
+void blk_ram_registrar_destroy(BlockRAMRegistrar *r)
+{
+    if (r->ok) {
+        ram_block_notifier_remove(&r->notifier);
+    }
+}
diff --git a/block/meson.build b/block/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/block/meson.build
+++ b/block/meson.build
@@ -XXX,XX +XXX,XX @@ block_ss.add(files(
 ), zstd, zlib, gnutls)
 
 softmmu_ss.add(when: 'CONFIG_TCG', if_true: files('blkreplay.c'))
+softmmu_ss.add(files('block-ram-registrar.c'))
 
 if get_option('qcow1').allowed()
   block_ss.add(files('qcow.c'))
-- 
2.37.3

Add a function to get the file descriptor for a RAMBlock. Device
emulation code typically uses the MemoryRegion APIs but vhost-style code
may use RAMBlock directly for sharing guest memory with another process.

This new API will be used by the libblkio block driver so it can share
guest memory via .bdrv_register_buf().

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20221013185908.1297568-11-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/exec/cpu-common.h | 1 +
 softmmu/physmem.c         | 5 +++++
 2 files changed, 6 insertions(+)

diff --git a/include/exec/cpu-common.h b/include/exec/cpu-common.h
index XXXXXXX..XXXXXXX 100644
--- a/include/exec/cpu-common.h
+++ b/include/exec/cpu-common.h
@@ -XXX,XX +XXX,XX @@ void qemu_ram_set_uf_zeroable(RAMBlock *rb);
 bool qemu_ram_is_migratable(RAMBlock *rb);
 void qemu_ram_set_migratable(RAMBlock *rb);
 void qemu_ram_unset_migratable(RAMBlock *rb);
+int qemu_ram_get_fd(RAMBlock *rb);
 
 size_t qemu_ram_pagesize(RAMBlock *block);
 size_t qemu_ram_pagesize_largest(void);
diff --git a/softmmu/physmem.c b/softmmu/physmem.c
index XXXXXXX..XXXXXXX 100644
--- a/softmmu/physmem.c
+++ b/softmmu/physmem.c
@@ -XXX,XX +XXX,XX @@ void qemu_ram_unset_migratable(RAMBlock *rb)
     rb->flags &= ~RAM_MIGRATABLE;
 }
 
+int qemu_ram_get_fd(RAMBlock *rb)
+{
+    return rb->fd;
+}
+
 /* Called with iothread lock held.  */
 void qemu_ram_set_idstr(RAMBlock *new_block, const char *name, DeviceState *dev)
 {
-- 
2.37.3

The blkio block driver will need to look up the file descriptor for a
given pointer. This is possible in softmmu builds where the RAMBlock API
is available for querying guest RAM.

Add stubs so tools like qemu-img that link the block layer still build
successfully. In this case there is no guest RAM but that is fine.
Bounce buffers and their file descriptors will be allocated with
libblkio's blkio_alloc_mem_region() so we won't rely on QEMU's
qemu_ram_get_fd() in that case.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 20221013185908.1297568-12-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 stubs/physmem.c   | 13 +++++++++++++
 stubs/meson.build |  1 +
 2 files changed, 14 insertions(+)
 create mode 100644 stubs/physmem.c

diff --git a/stubs/physmem.c b/stubs/physmem.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/stubs/physmem.c
@@ -XXX,XX +XXX,XX @@
+#include "qemu/osdep.h"
+#include "exec/cpu-common.h"
+
+RAMBlock *qemu_ram_block_from_host(void *ptr, bool round_offset,
+                                   ram_addr_t *offset)
+{
+    return NULL;
+}
+
+int qemu_ram_get_fd(RAMBlock *rb)
+{
+    return -1;
+}
diff --git a/stubs/meson.build b/stubs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/stubs/meson.build
+++ b/stubs/meson.build
@@ -XXX,XX +XXX,XX @@ stub_ss.add(files('migr-blocker.c'))
 stub_ss.add(files('module-opts.c'))
 stub_ss.add(files('monitor.c'))
 stub_ss.add(files('monitor-core.c'))
+stub_ss.add(files('physmem.c'))
 stub_ss.add(files('qemu-timer-notify-cb.c'))
 stub_ss.add(files('qmp_memory_device.c'))
 stub_ss.add(files('qmp-command-available.c'))
-- 
2.37.3

Avoid bounce buffers when QEMUIOVector elements are within previously
registered bdrv_register_buf() buffers.

The idea is that emulated storage controllers will register guest RAM
using bdrv_register_buf() and set the BDRV_REQ_REGISTERED_BUF on I/O
requests. Therefore no blkio_map_mem_region() calls are necessary in the
performance-critical I/O code path.

This optimization doesn't apply if the I/O buffer is internally
allocated by QEMU (e.g. qcow2 metadata). There we still take the slow
path because BDRV_REQ_REGISTERED_BUF is not set.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20221013185908.1297568-13-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block/blkio.c | 183 +++++++++++++++++++++++++++++++++++++++++++++++++-
 1 file changed, 180 insertions(+), 3 deletions(-)

diff --git a/block/blkio.c b/block/blkio.c
index XXXXXXX..XXXXXXX 100644
--- a/block/blkio.c
+++ b/block/blkio.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/osdep.h"
 #include <blkio.h>
 #include "block/block_int.h"
+#include "exec/memory.h"
+#include "exec/cpu-common.h" /* for qemu_ram_get_fd() */
 #include "qapi/error.h"
+#include "qemu/error-report.h"
 #include "qapi/qmp/qdict.h"
 #include "qemu/module.h"
+#include "exec/memory.h" /* for ram_block_discard_disable() */
 
 /*
  * Keep the QEMU BlockDriver names identical to the libblkio driver names.
@@ -XXX,XX +XXX,XX @@ typedef struct {
 
     /* Can we skip adding/deleting blkio_mem_regions? */
     bool needs_mem_regions;
+
+    /* Are file descriptors necessary for blkio_mem_regions? */
+    bool needs_mem_region_fd;
+
+    /* Are madvise(MADV_DONTNEED)-style operations unavailable? */
+    bool may_pin_mem_regions;
 } BDRVBlkioState;
 
 /* Called with s->bounce_lock held */
@@ -XXX,XX +XXX,XX @@ blkio_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
         .coroutine = qemu_coroutine_self(),
     };
     BDRVBlkioState *s = bs->opaque;
-    bool use_bounce_buffer = s->needs_mem_regions;
+    bool use_bounce_buffer =
+        s->needs_mem_regions && !(flags & BDRV_REQ_REGISTERED_BUF);
     BlkioBounceBuf bounce;
     struct iovec *iov = qiov->iov;
     int iovcnt = qiov->niov;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn blkio_co_pwritev(BlockDriverState *bs, int64_t offset,
         .coroutine = qemu_coroutine_self(),
     };
     BDRVBlkioState *s = bs->opaque;
-    bool use_bounce_buffer = s->needs_mem_regions;
+    bool use_bounce_buffer =
+        s->needs_mem_regions && !(flags & BDRV_REQ_REGISTERED_BUF);
     BlkioBounceBuf bounce;
     struct iovec *iov = qiov->iov;
     int iovcnt = qiov->niov;
@@ -XXX,XX +XXX,XX @@ static void blkio_io_unplug(BlockDriverState *bs)
     }
 }
 
+typedef enum {
+    BMRR_OK,
+    BMRR_SKIP,
+    BMRR_FAIL,
+} BlkioMemRegionResult;
+
+/*
+ * Produce a struct blkio_mem_region for a given address and size.
+ *
+ * This function produces identical results when called multiple times with the
+ * same arguments. This property is necessary because blkio_unmap_mem_region()
+ * must receive the same struct blkio_mem_region field values that were passed
+ * to blkio_map_mem_region().
+ */
+static BlkioMemRegionResult
+blkio_mem_region_from_host(BlockDriverState *bs,
+                           void *host, size_t size,
+                           struct blkio_mem_region *region,
+                           Error **errp)
+{
+    BDRVBlkioState *s = bs->opaque;
+    int fd = -1;
+    ram_addr_t fd_offset = 0;
+
+    if (((uintptr_t)host | size) % s->mem_region_alignment) {
+        error_setg(errp, "unaligned buf %p with size %zu", host, size);
+        return BMRR_FAIL;
+    }
+
+    /* Attempt to find the fd for the underlying memory */
+    if (s->needs_mem_region_fd) {
+        RAMBlock *ram_block;
+        RAMBlock *end_block;
+        ram_addr_t offset;
+
+        /*
+         * bdrv_register_buf() is called with the BQL held so mr lives at least
+         * until this function returns.
+         */
+        ram_block = qemu_ram_block_from_host(host, false, &fd_offset);
+        if (ram_block) {
+            fd = qemu_ram_get_fd(ram_block);
+        }
+        if (fd == -1) {
+            /*
+             * Ideally every RAMBlock would have an fd. pc-bios and other
+             * things don't. Luckily they are usually not I/O buffers and we
+             * can just ignore them.
+             */
+            return BMRR_SKIP;
+        }
+
+        /* Make sure the fd covers the entire range */
+        end_block = qemu_ram_block_from_host(host + size - 1, false, &offset);
+        if (ram_block != end_block) {
+            error_setg(errp, "registered buffer at %p with size %zu extends "
+                       "beyond RAMBlock", host, size);
+            return BMRR_FAIL;
+        }
+    }
+
+    *region = (struct blkio_mem_region){
+        .addr = host,
+        .len = size,
+        .fd = fd,
+        .fd_offset = fd_offset,
+    };
+    return BMRR_OK;
+}
+
+static bool blkio_register_buf(BlockDriverState *bs, void *host, size_t size,
+                               Error **errp)
+{
+    BDRVBlkioState *s = bs->opaque;
+    struct blkio_mem_region region;
+    BlkioMemRegionResult region_result;
+    int ret;
+
+    /*
+     * Mapping memory regions conflicts with RAM discard (virtio-mem) when
+     * there is pinning, so only do it when necessary.
+     */
+    if (!s->needs_mem_regions && s->may_pin_mem_regions) {
+        return true;
+    }
+
+    region_result = blkio_mem_region_from_host(bs, host, size, &region, errp);
+    if (region_result == BMRR_SKIP) {
+        return true;
+    } else if (region_result != BMRR_OK) {
+        return false;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        ret = blkio_map_mem_region(s->blkio, &region);
+    }
+
+    if (ret < 0) {
+        error_setg(errp, "Failed to add blkio mem region %p with size %zu: %s",
+                   host, size, blkio_get_error_msg());
+        return false;
+    }
+    return true;
+}
+
+static void blkio_unregister_buf(BlockDriverState *bs, void *host, size_t size)
+{
+    BDRVBlkioState *s = bs->opaque;
+    struct blkio_mem_region region;
+
+    /* See blkio_register_buf() */
+    if (!s->needs_mem_regions && s->may_pin_mem_regions) {
+        return;
+    }
+
+    if (blkio_mem_region_from_host(bs, host, size, &region, NULL) != BMRR_OK) {
+        return;
+    }
+
+    WITH_QEMU_LOCK_GUARD(&s->blkio_lock) {
+        blkio_unmap_mem_region(s->blkio, &region);
+    }
+}
+
 static int blkio_io_uring_open(BlockDriverState *bs, QDict *options, int flags,
                                Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 
+    ret = blkio_get_bool(s->blkio,
+                         "needs-mem-region-fd",
+                         &s->needs_mem_region_fd);
+    if (ret < 0) {
+        error_setg_errno(errp, -ret,
+                         "failed to get needs-mem-region-fd: %s",
+                         blkio_get_error_msg());
+        blkio_destroy(&s->blkio);
+        return ret;
+    }
+
     ret = blkio_get_uint64(s->blkio,
                            "mem-region-alignment",
                            &s->mem_region_alignment);
@@ -XXX,XX +XXX,XX @@ static int blkio_file_open(BlockDriverState *bs, QDict *options, int flags,
         return ret;
     }
 
+    ret = blkio_get_bool(s->blkio,
+                         "may-pin-mem-regions",
+                         &s->may_pin_mem_regions);
+    if (ret < 0) {
+        /* Be conservative (assume pinning) if the property is not supported */
+        s->may_pin_mem_regions = s->needs_mem_regions;
+    }
+
+    /*
+     * Notify if libblkio drivers pin memory and prevent features like
+     * virtio-mem from working.
+     */
+    if (s->may_pin_mem_regions) {
+        ret = ram_block_discard_disable(true);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "ram_block_discard_disable() failed");
+            blkio_destroy(&s->blkio);
+            return ret;
+        }
+    }
+
     ret = blkio_start(s->blkio);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "blkio_start failed: %s",
                          blkio_get_error_msg());
         blkio_destroy(&s->blkio);
+        if (s->may_pin_mem_regions) {
+            ram_block_discard_disable(false);
+        }
         return ret;
     }
 
-    bs->supported_write_flags = BDRV_REQ_FUA;
+    bs->supported_write_flags = BDRV_REQ_FUA | BDRV_REQ_REGISTERED_BUF;
     bs->supported_zero_flags = BDRV_REQ_FUA | BDRV_REQ_MAY_UNMAP |
                                BDRV_REQ_NO_FALLBACK;
 
@@ -XXX,XX +XXX,XX @@ static void blkio_close(BlockDriverState *bs)
     qemu_mutex_destroy(&s->blkio_lock);
     blkio_detach_aio_context(bs);
     blkio_destroy(&s->blkio);
+
+    if (s->may_pin_mem_regions) {
+        ram_block_discard_disable(false);
+    }
 }
 
 static int64_t blkio_getlength(BlockDriverState *bs)
@@ -XXX,XX +XXX,XX @@ static void blkio_refresh_limits(BlockDriverState *bs, Error **errp)
         .bdrv_co_pwrite_zeroes   = blkio_co_pwrite_zeroes, \
         .bdrv_io_unplug          = blkio_io_unplug, \
         .bdrv_refresh_limits     = blkio_refresh_limits, \
+        .bdrv_register_buf       = blkio_register_buf, \
+        .bdrv_unregister_buf     = blkio_unregister_buf, \
         __VA_ARGS__ \
     }
 
-- 
2.37.3

Register guest RAM using BlockRAMRegistrar and set the
BDRV_REQ_REGISTERED_BUF flag so block drivers can optimize memory
accesses in I/O requests.

This is for vdpa-blk, vhost-user-blk, and other I/O interfaces that rely
on DMA mapping/unmapping.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Message-id: 20221013185908.1297568-14-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/virtio/virtio-blk.h |  2 ++
 hw/block/virtio-blk.c          | 39 ++++++++++++++++++++++------------
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/block/block.h"
 #include "sysemu/iothread.h"
 #include "sysemu/block-backend.h"
+#include "sysemu/block-ram-registrar.h"
 #include "qom/object.h"
 
 #define TYPE_VIRTIO_BLK "virtio-blk-device"
@@ -XXX,XX +XXX,XX @@ struct VirtIOBlock {
     struct VirtIOBlockDataPlane *dataplane;
     uint64_t host_features;
     size_t config_size;
+    BlockRAMRegistrar blk_ram_registrar;
 };
 
 typedef struct VirtIOBlockReq {
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/block/block.h"
 #include "hw/qdev-properties.h"
 #include "sysemu/blockdev.h"
+#include "sysemu/block-ram-registrar.h"
 #include "sysemu/sysemu.h"
 #include "sysemu/runstate.h"
 #include "hw/virtio/virtio-blk.h"
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_scsi(VirtIOBlockReq *req)
     }
 }
 
-static inline void submit_requests(BlockBackend *blk, MultiReqBuffer *mrb,
+static inline void submit_requests(VirtIOBlock *s, MultiReqBuffer *mrb,
                                    int start, int num_reqs, int niov)
 {
+    BlockBackend *blk = s->blk;
     QEMUIOVector *qiov = &mrb->reqs[start]->qiov;
     int64_t sector_num = mrb->reqs[start]->sector_num;
     bool is_write = mrb->is_write;
+    BdrvRequestFlags flags = 0;
 
     if (num_reqs > 1) {
         int i;
@@ -XXX,XX +XXX,XX @@ static inline void submit_requests(BlockBackend *blk, MultiReqBuffer *mrb,
                               num_reqs - 1);
     }
 
+    if (blk_ram_registrar_ok(&s->blk_ram_registrar)) {
+        flags |= BDRV_REQ_REGISTERED_BUF;
+    }
+
     if (is_write) {
-        blk_aio_pwritev(blk, sector_num << BDRV_SECTOR_BITS, qiov, 0,
-                        virtio_blk_rw_complete, mrb->reqs[start]);
+        blk_aio_pwritev(blk, sector_num << BDRV_SECTOR_BITS, qiov,
+                        flags, virtio_blk_rw_complete,
+                        mrb->reqs[start]);
     } else {
-        blk_aio_preadv(blk, sector_num << BDRV_SECTOR_BITS, qiov, 0,
-                       virtio_blk_rw_complete, mrb->reqs[start]);
+        blk_aio_preadv(blk, sector_num << BDRV_SECTOR_BITS, qiov,
+                       flags, virtio_blk_rw_complete,
+                       mrb->reqs[start]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static int multireq_compare(const void *a, const void *b)
     }
 }
 
-static void virtio_blk_submit_multireq(BlockBackend *blk, MultiReqBuffer *mrb)
+static void virtio_blk_submit_multireq(VirtIOBlock *s, MultiReqBuffer *mrb)
 {
     int i = 0, start = 0, num_reqs = 0, niov = 0, nb_sectors = 0;
     uint32_t max_transfer;
     int64_t sector_num = 0;
 
     if (mrb->num_reqs == 1) {
-        submit_requests(blk, mrb, 0, 1, -1);
+        submit_requests(s, mrb, 0, 1, -1);
         mrb->num_reqs = 0;
         return;
     }
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_submit_multireq(BlockBackend *blk, MultiReqBuffer *mrb)
              * 3. merge would exceed maximum transfer length of backend device
              */
             if (sector_num + nb_sectors != req->sector_num ||
-                niov > blk_get_max_iov(blk) - req->qiov.niov ||
+                niov > blk_get_max_iov(s->blk) - req->qiov.niov ||
                 req->qiov.size > max_transfer ||
                 nb_sectors > (max_transfer -
                               req->qiov.size) / BDRV_SECTOR_SIZE) {
-                submit_requests(blk, mrb, start, num_reqs, niov);
+                submit_requests(s, mrb, start, num_reqs, niov);
                 num_reqs = 0;
             }
         }
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_submit_multireq(BlockBackend *blk, MultiReqBuffer *mrb)
         num_reqs++;
     }
 
-    submit_requests(blk, mrb, start, num_reqs, niov);
+    submit_requests(s, mrb, start, num_reqs, niov);
     mrb->num_reqs = 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_handle_flush(VirtIOBlockReq *req, MultiReqBuffer *mrb)
      * Make sure all outstanding writes are posted to the backing device.
      */
     if (mrb->is_write && mrb->num_reqs > 0) {
-        virtio_blk_submit_multireq(s->blk, mrb);
+        virtio_blk_submit_multireq(s, mrb);
     }
     blk_aio_flush(s->blk, virtio_blk_flush_complete, req);
 }
@@ -XXX,XX +XXX,XX @@ static int virtio_blk_handle_request(VirtIOBlockReq *req, MultiReqBuffer *mrb)
         if (mrb->num_reqs > 0 && (mrb->num_reqs == VIRTIO_BLK_MAX_MERGE_REQS ||
                                   is_write != mrb->is_write ||
                                   !s->conf.request_merging)) {
-            virtio_blk_submit_multireq(s->blk, mrb);
+            virtio_blk_submit_multireq(s, mrb);
         }
 
         assert(mrb->num_reqs < VIRTIO_BLK_MAX_MERGE_REQS);
@@ -XXX,XX +XXX,XX @@ void virtio_blk_handle_vq(VirtIOBlock *s, VirtQueue *vq)
     } while (!virtio_queue_empty(vq));
 
     if (mrb.num_reqs) {
-        virtio_blk_submit_multireq(s->blk, &mrb);
+        virtio_blk_submit_multireq(s, &mrb);
     }
 
     blk_io_unplug(s->blk);
@@ -XXX,XX +XXX,XX @@ void virtio_blk_process_queued_requests(VirtIOBlock *s, bool is_bh)
     }
 
     if (mrb.num_reqs) {
-        virtio_blk_submit_multireq(s->blk, &mrb);
+        virtio_blk_submit_multireq(s, &mrb);
     }
     if (is_bh) {
         blk_dec_in_flight(s->conf.conf.blk);
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
     }
 
     s->change = qemu_add_vm_change_state_handler(virtio_blk_dma_restart_cb, s);
+    blk_ram_registrar_init(&s->blk_ram_registrar, s->blk);
     blk_set_dev_ops(s->blk, &virtio_block_ops, s);
 
     blk_iostatus_enable(s->blk);
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_unrealize(DeviceState *dev)
         virtio_del_queue(vdev, i);
     }
     qemu_coroutine_dec_pool_size(conf->num_queues * conf->queue_size / 2);
+    blk_ram_registrar_destroy(&s->blk_ram_registrar);
     qemu_del_vm_change_state_handler(s->change);
     blockdev_mark_auto_del(s->blk);
     virtio_cleanup(vdev);
-- 
2.37.3

The following changes since commit eaefea537b476cb853e2edbdc68e969ec777e4bb:

Merge remote-tracking branch 'remotes/mjt/tags/trivial-patches-fetch' into staging (2017-12-18 14:17:42 +0000)

are available in the Git repository at:

git://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 7a9dda0d7f9831c2432620dcfefdadbb7ae888dc:

qemu-iotests: add 203 savevm with IOThreads test (2017-12-19 10:25:09 +0000)

----------------------------------------------------------------
Pull request

v2:
 * Fixed incorrect virtio_blk_data_plane_create() local_err refactoring in
   "hw/block: Use errp directly rather than local_err" that broke virtio-blk
   over virtio-mmio [Peter]

----------------------------------------------------------------

Mao Zhongyi (4):
  hw/block/nvme: Convert to realize
  hw/block: Fix the return type
  hw/block: Use errp directly rather than local_err
  dev-storage: Fix the unusual function name

Mark Kanda (2):
  virtio-blk: make queue size configurable
  virtio-blk: reject configs with logical block size > physical block
    size

Paolo Bonzini (1):
  block: avoid recursive AioContext acquire in bdrv_inactivate_all()

Stefan Hajnoczi (16):
  coroutine: simplify co_aio_sleep_ns() prototype
  qdev: drop unused #include "sysemu/iothread.h"
  blockdev: hold AioContext for bdrv_unref() in
    external_snapshot_clean()
  block: don't keep AioContext acquired after
    external_snapshot_prepare()
  block: don't keep AioContext acquired after drive_backup_prepare()
  block: don't keep AioContext acquired after blockdev_backup_prepare()
  block: don't keep AioContext acquired after
    internal_snapshot_prepare()
  block: drop unused BlockDirtyBitmapState->aio_context field
  iothread: add iothread_by_id() API
  blockdev: add x-blockdev-set-iothread testing command
  qemu-iotests: add 202 external snapshots IOThread test
  docs: mark nested AioContext locking as a legacy API
  blockdev: add x-blockdev-set-iothread force boolean
  iotests: add VM.add_object()
  iothread: fix iothread_stop() race condition
  qemu-iotests: add 203 savevm with IOThreads test

-- 
2.14.3

The AioContext pointer argument to co_aio_sleep_ns() is only used for
the sleep timer.  It does not affect where the caller coroutine is
resumed.

Due to changes to coroutine and AIO APIs it is now possible to drop the
AioContext pointer argument.  This is safe to do since no caller has
specific requirements for which AioContext the timer must run in.

This patch drops the AioContext pointer argument and renames the
function to simplify the API.

Reported-by: Paolo Bonzini <pbonzini@redhat.com>
Reported-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171109102652.6360-1-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/qemu/coroutine.h    | 6 +-----
 block/null.c                | 3 +--
 block/sheepdog.c            | 3 +--
 util/qemu-coroutine-sleep.c | 4 ++--
 4 files changed, 5 insertions(+), 11 deletions(-)

diff --git a/include/qemu/coroutine.h b/include/qemu/coroutine.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/coroutine.h
+++ b/include/qemu/coroutine.h
@@ -XXX,XX +XXX,XX @@ void qemu_co_rwlock_unlock(CoRwlock *lock);
 
 /**
  * Yield the coroutine for a given duration
- *
- * Behaves similarly to co_sleep_ns(), but the sleeping coroutine will be
- * resumed when using aio_poll().
  */
-void coroutine_fn co_aio_sleep_ns(AioContext *ctx, QEMUClockType type,
-                                  int64_t ns);
+void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns);
 
 /**
  * Yield until a file descriptor becomes readable
diff --git a/block/null.c b/block/null.c
index XXXXXXX..XXXXXXX 100644
--- a/block/null.c
+++ b/block/null.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int null_co_common(BlockDriverState *bs)
     BDRVNullState *s = bs->opaque;
 
     if (s->latency_ns) {
-        co_aio_sleep_ns(bdrv_get_aio_context(bs), QEMU_CLOCK_REALTIME,
-                        s->latency_ns);
+        qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, s->latency_ns);
     }
     return 0;
 }
diff --git a/block/sheepdog.c b/block/sheepdog.c
index XXXXXXX..XXXXXXX 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -XXX,XX +XXX,XX @@ static coroutine_fn void reconnect_to_sdog(void *opaque)
         if (s->fd < 0) {
             DPRINTF("Wait for connection to be established\n");
             error_report_err(local_err);
-            co_aio_sleep_ns(bdrv_get_aio_context(s->bs), QEMU_CLOCK_REALTIME,
-                            1000000000ULL);
+            qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000000ULL);
         }
     };
 
diff --git a/util/qemu-coroutine-sleep.c b/util/qemu-coroutine-sleep.c
index XXXXXXX..XXXXXXX 100644
--- a/util/qemu-coroutine-sleep.c
+++ b/util/qemu-coroutine-sleep.c
@@ -XXX,XX +XXX,XX @@ static void co_sleep_cb(void *opaque)
     aio_co_wake(sleep_cb->co);
 }
 
-void coroutine_fn co_aio_sleep_ns(AioContext *ctx, QEMUClockType type,
-                                  int64_t ns)
+void coroutine_fn qemu_co_sleep_ns(QEMUClockType type, int64_t ns)
 {
+    AioContext *ctx = qemu_get_current_aio_context();
     CoSleepCB sleep_cb = {
         .co = qemu_coroutine_self(),
     };
-- 
2.14.3

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

Convert nvme_init() to realize and rename it to nvme_realize().

Cc: John Snow <jsnow@redhat.com>
Cc: Keith Busch <keith.busch@intel.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Message-id: 2882e72d795e04cbe2120f569d551aef2467ac60.1511317952.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/nvme.c | 18 ++++++++++--------
 1 file changed, 10 insertions(+), 8 deletions(-)

diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps nvme_cmb_ops = {
     },
 };
 
-static int nvme_init(PCIDevice *pci_dev)
+static void nvme_realize(PCIDevice *pci_dev, Error **errp)
 {
     NvmeCtrl *n = NVME(pci_dev);
     NvmeIdCtrl *id = &n->id_ctrl;
@@ -XXX,XX +XXX,XX @@ static int nvme_init(PCIDevice *pci_dev)
     Error *local_err = NULL;
 
     if (!n->conf.blk) {
-        return -1;
+        error_setg(errp, "drive property not set");
+        return;
     }
 
     bs_size = blk_getlength(n->conf.blk);
     if (bs_size < 0) {
-        return -1;
+        error_setg(errp, "could not get backing file size");
+        return;
     }
 
     blkconf_serial(&n->conf, &n->serial);
     if (!n->serial) {
-        return -1;
+        error_setg(errp, "serial property not set");
+        return;
     }
     blkconf_blocksizes(&n->conf);
     blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
                                   false, &local_err);
     if (local_err) {
-        error_report_err(local_err);
-        return -1;
+        error_propagate(errp, local_err);
+        return;
     }
 
     pci_conf = pci_dev->config;
@@ -XXX,XX +XXX,XX @@ static int nvme_init(PCIDevice *pci_dev)
             cpu_to_le64(n->ns_size >>
                 id_ns->lbaf[NVME_ID_NS_FLBAS_INDEX(ns->id_ns.flbas)].ds);
     }
-    return 0;
 }
 
 static void nvme_exit(PCIDevice *pci_dev)
@@ -XXX,XX +XXX,XX @@ static void nvme_class_init(ObjectClass *oc, void *data)
     DeviceClass *dc = DEVICE_CLASS(oc);
     PCIDeviceClass *pc = PCI_DEVICE_CLASS(oc);
 
-    pc->init = nvme_init;
+    pc->realize = nvme_realize;
     pc->exit = nvme_exit;
     pc->class_id = PCI_CLASS_STORAGE_EXPRESS;
     pc->vendor_id = PCI_VENDOR_ID_INTEL;
-- 
2.14.3

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

When the function no success value to transmit, it usually make the
function return void. It has turned out not to be a success, because
it means that the extra local_err variable and error_propagate() will
be needed. It leads to cumbersome code, therefore, transmit success/
failure in the return value is worth.

So fix the return type of blkconf_apply_backend_options(),
blkconf_geometry() and virtio_blk_data_plane_create() to avoid it.

Cc: John Snow <jsnow@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: ac0edc1fc70c4457e5cec94405eb7d1f89f9c2c1.1511317952.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/dataplane/virtio-blk.h |  2 +-
 include/hw/block/block.h        |  4 ++--
 hw/block/block.c                | 15 +++++++++------
 hw/block/dataplane/virtio-blk.c | 12 +++++++-----
 4 files changed, 19 insertions(+), 14 deletions(-)

diff --git a/hw/block/dataplane/virtio-blk.h b/hw/block/dataplane/virtio-blk.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/dataplane/virtio-blk.h
+++ b/hw/block/dataplane/virtio-blk.h
@@ -XXX,XX +XXX,XX @@
 
 typedef struct VirtIOBlockDataPlane VirtIOBlockDataPlane;
 
-void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
+bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
                                   VirtIOBlockDataPlane **dataplane,
                                   Error **errp);
 void virtio_blk_data_plane_destroy(VirtIOBlockDataPlane *s);
diff --git a/include/hw/block/block.h b/include/hw/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/block/block.h
+++ b/include/hw/block/block.h
@@ -XXX,XX +XXX,XX @@ static inline unsigned int get_physical_block_exp(BlockConf *conf)
 /* Configuration helpers */
 
 void blkconf_serial(BlockConf *conf, char **serial);
-void blkconf_geometry(BlockConf *conf, int *trans,
+bool blkconf_geometry(BlockConf *conf, int *trans,
                       unsigned cyls_max, unsigned heads_max, unsigned secs_max,
                       Error **errp);
 void blkconf_blocksizes(BlockConf *conf);
-void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
+bool blkconf_apply_backend_options(BlockConf *conf, bool readonly,
                                    bool resizable, Error **errp);
 
 /* Hard disk geometry */
diff --git a/hw/block/block.c b/hw/block/block.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/block.c
+++ b/hw/block/block.c
@@ -XXX,XX +XXX,XX @@ void blkconf_blocksizes(BlockConf *conf)
     }
 }
 
-void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
+bool blkconf_apply_backend_options(BlockConf *conf, bool readonly,
                                    bool resizable, Error **errp)
 {
     BlockBackend *blk = conf->blk;
@@ -XXX,XX +XXX,XX @@ void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
 
     ret = blk_set_perm(blk, perm, shared_perm, errp);
     if (ret < 0) {
-        return;
+        return false;
     }
 
     switch (conf->wce) {
@@ -XXX,XX +XXX,XX @@ void blkconf_apply_backend_options(BlockConf *conf, bool readonly,
 
     blk_set_enable_write_cache(blk, wce);
     blk_set_on_error(blk, rerror, werror);
+
+    return true;
 }
 
-void blkconf_geometry(BlockConf *conf, int *ptrans,
+bool blkconf_geometry(BlockConf *conf, int *ptrans,
                       unsigned cyls_max, unsigned heads_max, unsigned secs_max,
                       Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ void blkconf_geometry(BlockConf *conf, int *ptrans,
     if (conf->cyls || conf->heads || conf->secs) {
         if (conf->cyls < 1 || conf->cyls > cyls_max) {
             error_setg(errp, "cyls must be between 1 and %u", cyls_max);
-            return;
+            return false;
         }
         if (conf->heads < 1 || conf->heads > heads_max) {
             error_setg(errp, "heads must be between 1 and %u", heads_max);
-            return;
+            return false;
         }
         if (conf->secs < 1 || conf->secs > secs_max) {
             error_setg(errp, "secs must be between 1 and %u", secs_max);
-            return;
+            return false;
         }
     }
+    return true;
 }
diff --git a/hw/block/dataplane/virtio-blk.c b/hw/block/dataplane/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/dataplane/virtio-blk.c
+++ b/hw/block/dataplane/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void notify_guest_bh(void *opaque)
 }
 
 /* Context: QEMU global mutex held */
-void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
+bool virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
                                   VirtIOBlockDataPlane **dataplane,
                                   Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
             error_setg(errp,
                        "device is incompatible with iothread "
                        "(transport does not support notifiers)");
-            return;
+            return false;
         }
         if (!virtio_device_ioeventfd_enabled(vdev)) {
             error_setg(errp, "ioeventfd is required for iothread");
-            return;
+            return false;
         }
 
         /* If dataplane is (re-)enabled while the guest is running there could
@@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
          */
         if (blk_op_is_blocked(conf->conf.blk, BLOCK_OP_TYPE_DATAPLANE, errp)) {
             error_prepend(errp, "cannot start virtio-blk dataplane: ");
-            return;
+            return false;
         }
     }
     /* Don't try if transport does not support notifiers. */
     if (!virtio_device_ioeventfd_enabled(vdev)) {
-        return;
+        return false;
     }
 
     s = g_new0(VirtIOBlockDataPlane, 1);
@@ -XXX,XX +XXX,XX @@ void virtio_blk_data_plane_create(VirtIODevice *vdev, VirtIOBlkConf *conf,
     s->batch_notify_vqs = bitmap_new(conf->num_queues);
 
     *dataplane = s;
+
+    return true;
 }
 
 /* Context: QEMU global mutex held */
-- 
2.14.3

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

[Drop virtio_blk_data_plane_create() change that misinterprets return
value when the virtio transport does not support dataplane.
--Stefan]

Cc: John Snow <jsnow@redhat.com>
Cc: Kevin Wolf <kwolf@redhat.com>
Cc: Max Reitz <mreitz@redhat.com>
Cc: Keith Busch <keith.busch@intel.com>
Cc: Stefan Hajnoczi <stefanha@redhat.com>
Cc: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Paolo Bonzini <pbonzini@redhat.com>
Cc: Gerd Hoffmann <kraxel@redhat.com>
Cc: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: e77848d3735ba590f23ffbf8094379c646c33d79.1511317952.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/fdc.c        | 17 ++++++-----------
 hw/block/nvme.c       |  7 ++-----
 hw/block/virtio-blk.c | 13 +++++--------
 hw/ide/qdev.c         | 12 ++++--------
 hw/scsi/scsi-disk.c   | 13 ++++---------
 hw/usb/dev-storage.c  |  9 +++------
 6 files changed, 24 insertions(+), 47 deletions(-)

diff --git a/hw/block/fdc.c b/hw/block/fdc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/fdc.c
+++ b/hw/block/fdc.c
@@ -XXX,XX +XXX,XX @@ static void fd_revalidate(FDrive *drv)
 static void fd_change_cb(void *opaque, bool load, Error **errp)
 {
     FDrive *drive = opaque;
-    Error *local_err = NULL;
 
     if (!load) {
         blk_set_perm(drive->blk, 0, BLK_PERM_ALL, &error_abort);
     } else {
-        blkconf_apply_backend_options(drive->conf,
-                                      blk_is_read_only(drive->blk), false,
-                                      &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
+        if (!blkconf_apply_backend_options(drive->conf,
+                                           blk_is_read_only(drive->blk), false,
+                                           errp)) {
             return;
         }
     }
@@ -XXX,XX +XXX,XX @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp)
     FloppyDrive *dev = FLOPPY_DRIVE(qdev);
     FloppyBus *bus = FLOPPY_BUS(qdev->parent_bus);
     FDrive *drive;
-    Error *local_err = NULL;
     int ret;
 
     if (dev->unit == -1) {
@@ -XXX,XX +XXX,XX @@ static void floppy_drive_realize(DeviceState *qdev, Error **errp)
     dev->conf.rerror = BLOCKDEV_ON_ERROR_AUTO;
     dev->conf.werror = BLOCKDEV_ON_ERROR_AUTO;
 
-    blkconf_apply_backend_options(&dev->conf, blk_is_read_only(dev->conf.blk),
-                                  false, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
+    if (!blkconf_apply_backend_options(&dev->conf,
+                                       blk_is_read_only(dev->conf.blk),
+                                       false, errp)) {
         return;
     }
 
diff --git a/hw/block/nvme.c b/hw/block/nvme.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nvme.c
+++ b/hw/block/nvme.c
@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
     int i;
     int64_t bs_size;
     uint8_t *pci_conf;
-    Error *local_err = NULL;
 
     if (!n->conf.blk) {
         error_setg(errp, "drive property not set");
@@ -XXX,XX +XXX,XX @@ static void nvme_realize(PCIDevice *pci_dev, Error **errp)
         return;
     }
     blkconf_blocksizes(&n->conf);
-    blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
-                                  false, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
+    if (!blkconf_apply_backend_options(&n->conf, blk_is_read_only(n->conf.blk),
+                                       false, errp)) {
         return;
     }
 
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
     }
 
     blkconf_serial(&conf->conf, &conf->serial);
-    blkconf_apply_backend_options(&conf->conf,
-                                  blk_is_read_only(conf->conf.blk), true,
-                                  &err);
-    if (err) {
-        error_propagate(errp, err);
+    if (!blkconf_apply_backend_options(&conf->conf,
+                                       blk_is_read_only(conf->conf.blk), true,
+                                       errp)) {
         return;
     }
     s->original_wce = blk_enable_write_cache(conf->conf.blk);
-    blkconf_geometry(&conf->conf, NULL, 65535, 255, 255, &err);
-    if (err) {
-        error_propagate(errp, err);
+    if (!blkconf_geometry(&conf->conf, NULL, 65535, 255, 255, errp)) {
         return;
     }
+
     blkconf_blocksizes(&conf->conf);
 
     virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK,
diff --git a/hw/ide/qdev.c b/hw/ide/qdev.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/ide/qdev.c
+++ b/hw/ide/qdev.c
@@ -XXX,XX +XXX,XX @@ static void ide_dev_initfn(IDEDevice *dev, IDEDriveKind kind, Error **errp)
 {
     IDEBus *bus = DO_UPCAST(IDEBus, qbus, dev->qdev.parent_bus);
     IDEState *s = bus->ifs + dev->unit;
-    Error *err = NULL;
     int ret;
 
     if (!dev->conf.blk) {
@@ -XXX,XX +XXX,XX @@ static void ide_dev_initfn(IDEDevice *dev, IDEDriveKind kind, Error **errp)
 
     blkconf_serial(&dev->conf, &dev->serial);
     if (kind != IDE_CD) {
-        blkconf_geometry(&dev->conf, &dev->chs_trans, 65535, 16, 255, &err);
-        if (err) {
-            error_propagate(errp, err);
+        if (!blkconf_geometry(&dev->conf, &dev->chs_trans, 65535, 16, 255,
+                              errp)) {
             return;
         }
     }
-    blkconf_apply_backend_options(&dev->conf, kind == IDE_CD, kind != IDE_CD,
-                                  &err);
-    if (err) {
-        error_propagate(errp, err);
+    if (!blkconf_apply_backend_options(&dev->conf, kind == IDE_CD,
+                                       kind != IDE_CD, errp)) {
         return;
     }
 
diff --git a/hw/scsi/scsi-disk.c b/hw/scsi/scsi-disk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/scsi/scsi-disk.c
+++ b/hw/scsi/scsi-disk.c
@@ -XXX,XX +XXX,XX @@ static void scsi_disk_unit_attention_reported(SCSIDevice *dev)
 static void scsi_realize(SCSIDevice *dev, Error **errp)
 {
     SCSIDiskState *s = DO_UPCAST(SCSIDiskState, qdev, dev);
-    Error *err = NULL;
 
     if (!s->qdev.conf.blk) {
         error_setg(errp, "drive property not set");
@@ -XXX,XX +XXX,XX @@ static void scsi_realize(SCSIDevice *dev, Error **errp)
     }
 
     if (dev->type == TYPE_DISK) {
-        blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, &err);
-        if (err) {
-            error_propagate(errp, err);
+        if (!blkconf_geometry(&dev->conf, NULL, 65535, 255, 255, errp)) {
             return;
         }
     }
-    blkconf_apply_backend_options(&dev->conf,
-                                  blk_is_read_only(s->qdev.conf.blk),
-                                  dev->type == TYPE_DISK, &err);
-    if (err) {
-        error_propagate(errp, err);
+    if (!blkconf_apply_backend_options(&dev->conf,
+                                       blk_is_read_only(s->qdev.conf.blk),
+                                       dev->type == TYPE_DISK, errp)) {
         return;
     }
 
diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
     MSDState *s = USB_STORAGE_DEV(dev);
     BlockBackend *blk = s->conf.blk;
     SCSIDevice *scsi_dev;
-    Error *err = NULL;
 
     if (!blk) {
         error_setg(errp, "drive property not set");
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
 
     blkconf_serial(&s->conf, &dev->serial);
     blkconf_blocksizes(&s->conf);
-    blkconf_apply_backend_options(&s->conf, blk_is_read_only(blk), true, &err);
-    if (err) {
-        error_propagate(errp, err);
+    if (!blkconf_apply_backend_options(&s->conf, blk_is_read_only(blk), true,
+                                       errp)) {
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
                  &usb_msd_scsi_info_storage, NULL);
     scsi_dev = scsi_bus_legacy_add_drive(&s->bus, blk, 0, !!s->removable,
                                          s->conf.bootindex, dev->serial,
-                                         &err);
+                                         errp);
     blk_unref(blk);
     if (!scsi_dev) {
-        error_propagate(errp, err);
         return;
     }
     usb_msd_handle_reset(dev);
-- 
2.14.3

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

The function name of usb_msd_{realize,unrealize}_*,
usb_msd_class_initfn_* are unusual. Rename it to
usb_msd_*_{realize,unrealize}, usb_msd_class_*_initfn.

Cc: Gerd Hoffmann <kraxel@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-id: 11e6003433abce35f3f4970e1acc71ee92dbcf51.1511317952.git.maozy.fnst@cn.fujitsu.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/usb/dev-storage.c | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

diff --git a/hw/usb/dev-storage.c b/hw/usb/dev-storage.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/usb/dev-storage.c
+++ b/hw/usb/dev-storage.c
@@ -XXX,XX +XXX,XX @@ static void usb_msd_unrealize_storage(USBDevice *dev, Error **errp)
     object_unref(OBJECT(&s->bus));
 }
 
-static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
+static void usb_msd_storage_realize(USBDevice *dev, Error **errp)
 {
     MSDState *s = USB_STORAGE_DEV(dev);
     BlockBackend *blk = s->conf.blk;
@@ -XXX,XX +XXX,XX @@ static void usb_msd_realize_storage(USBDevice *dev, Error **errp)
     s->scsi_dev = scsi_dev;
 }
 
-static void usb_msd_unrealize_bot(USBDevice *dev, Error **errp)
+static void usb_msd_bot_unrealize(USBDevice *dev, Error **errp)
 {
     MSDState *s = USB_STORAGE_DEV(dev);
 
     object_unref(OBJECT(&s->bus));
 }
 
-static void usb_msd_realize_bot(USBDevice *dev, Error **errp)
+static void usb_msd_bot_realize(USBDevice *dev, Error **errp)
 {
     MSDState *s = USB_STORAGE_DEV(dev);
     DeviceState *d = DEVICE(dev);
@@ -XXX,XX +XXX,XX @@ static void usb_msd_class_initfn_common(ObjectClass *klass, void *data)
     dc->vmsd = &vmstate_usb_msd;
 }
 
-static void usb_msd_class_initfn_storage(ObjectClass *klass, void *data)
+static void usb_msd_class_storage_initfn(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 
-    uc->realize = usb_msd_realize_storage;
+    uc->realize = usb_msd_storage_realize;
     uc->unrealize = usb_msd_unrealize_storage;
     dc->props = msd_properties;
 }
@@ -XXX,XX +XXX,XX @@ static void usb_msd_instance_init(Object *obj)
     object_property_set_int(obj, -1, "bootindex", NULL);
 }
 
-static void usb_msd_class_initfn_bot(ObjectClass *klass, void *data)
+static void usb_msd_class_bot_initfn(ObjectClass *klass, void *data)
 {
     USBDeviceClass *uc = USB_DEVICE_CLASS(klass);
 
-    uc->realize = usb_msd_realize_bot;
-    uc->unrealize = usb_msd_unrealize_bot;
+    uc->realize = usb_msd_bot_realize;
+    uc->unrealize = usb_msd_bot_unrealize;
     uc->attached_settable = true;
 }
 
 static const TypeInfo msd_info = {
     .name          = "usb-storage",
     .parent        = TYPE_USB_STORAGE,
-    .class_init    = usb_msd_class_initfn_storage,
+    .class_init    = usb_msd_class_storage_initfn,
     .instance_init = usb_msd_instance_init,
 };
 
 static const TypeInfo bot_info = {
     .name          = "usb-bot",
     .parent        = TYPE_USB_STORAGE,
-    .class_init    = usb_msd_class_initfn_bot,
+    .class_init    = usb_msd_class_bot_initfn,
 };
 
 static void usb_msd_register_types(void)
-- 
2.14.3

bdrv_unref() requires the AioContext lock because bdrv_flush() uses
BDRV_POLL_WHILE(), which assumes the AioContext is currently held.  If
BDRV_POLL_WHILE() runs without AioContext held the
pthread_mutex_unlock() call in aio_context_release() fails.

This patch moves bdrv_unref() into the AioContext locked region to solve
the following pthread_mutex_unlock() failure:

#0  0x00007f566181969b in raise () at /lib64/libc.so.6
  #1  0x00007f566181b3b1 in abort () at /lib64/libc.so.6
  #2  0x00005592cd590458 in error_exit (err=<optimized out>, msg=msg@entry=0x5592cdaf6d60 <__func__.23977> "qemu_mutex_unlock") at util/qemu-thread-posix.c:36
  #3  0x00005592cd96e738 in qemu_mutex_unlock (mutex=mutex@entry=0x5592ce9505e0) at util/qemu-thread-posix.c:96
  #4  0x00005592cd969b69 in aio_context_release (ctx=ctx@entry=0x5592ce950580) at util/async.c:507
  #5  0x00005592cd8ead78 in bdrv_flush (bs=bs@entry=0x5592cfa87210) at block/io.c:2478
  #6  0x00005592cd89df30 in bdrv_close (bs=0x5592cfa87210) at block.c:3207
  #7  0x00005592cd89df30 in bdrv_delete (bs=0x5592cfa87210) at block.c:3395
  #8  0x00005592cd89df30 in bdrv_unref (bs=0x5592cfa87210) at block.c:4418
  #9  0x00005592cd6b7f86 in qmp_transaction (dev_list=<optimized out>, has_props=<optimized out>, props=<optimized out>, errp=errp@entry=0x7ffe4a1fc9d8) at blockdev.c:2308

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_clean(BlkActionState *common)
                              DO_UPCAST(ExternalSnapshotState, common, common);
     if (state->aio_context) {
         bdrv_drained_end(state->old_bs);
-        aio_context_release(state->aio_context);
         bdrv_unref(state->new_bs);
+        aio_context_release(state->aio_context);
     }
 }
 
-- 
2.14.3

It is not necessary to hold AioContext across transactions anymore since
bdrv_drained_begin/end() is used to keep the nodes quiesced.  In fact,
using the AioContext lock for this purpose was always buggy.

This patch reduces the scope of AioContext locked regions.  This is not
just a cleanup but also fixes hangs that occur in BDRV_POLL_WHILE()
because it is unware of recursive locking and does not release the
AioContext the necessary number of times to allow progress to be made.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171206144550.22295-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 blockdev.c | 71 ++++++++++++++++++++++++++++++++++++++++++--------------------
 1 file changed, 48 insertions(+), 23 deletions(-)

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ typedef struct ExternalSnapshotState {
     BlkActionState common;
     BlockDriverState *old_bs;
     BlockDriverState *new_bs;
-    AioContext *aio_context;
     bool overlay_appended;
 } ExternalSnapshotState;
 
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
     ExternalSnapshotState *state =
                              DO_UPCAST(ExternalSnapshotState, common, common);
     TransactionAction *action = common->action;
+    AioContext *aio_context;
 
     /* 'blockdev-snapshot' and 'blockdev-snapshot-sync' have similar
      * purpose but a different set of parameters */
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
         return;
     }
 
-    /* Acquire AioContext now so any threads operating on old_bs stop */
-    state->aio_context = bdrv_get_aio_context(state->old_bs);
-    aio_context_acquire(state->aio_context);
+    aio_context = bdrv_get_aio_context(state->old_bs);
+    aio_context_acquire(aio_context);
+
+    /* Paired with .clean() */
     bdrv_drained_begin(state->old_bs);
 
     if (!bdrv_is_inserted(state->old_bs)) {
         error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
-        return;
+        goto out;
     }
 
     if (bdrv_op_is_blocked(state->old_bs,
                            BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT, errp)) {
-        return;
+        goto out;
     }
 
     if (!bdrv_is_read_only(state->old_bs)) {
         if (bdrv_flush(state->old_bs)) {
             error_setg(errp, QERR_IO_ERROR);
-            return;
+            goto out;
         }
     }
 
     if (!bdrv_is_first_non_filter(state->old_bs)) {
         error_setg(errp, QERR_FEATURE_DISABLED, "snapshot");
-        return;
+        goto out;
     }
 
     if (action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC) {
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
 
         if (node_name && !snapshot_node_name) {
             error_setg(errp, "New snapshot node name missing");
-            return;
+            goto out;
         }
 
         if (snapshot_node_name &&
             bdrv_lookup_bs(snapshot_node_name, snapshot_node_name, NULL)) {
             error_setg(errp, "New snapshot node name already in use");
-            return;
+            goto out;
         }
 
         flags = state->old_bs->open_flags;
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
             int64_t size = bdrv_getlength(state->old_bs);
             if (size < 0) {
                 error_setg_errno(errp, -size, "bdrv_getlength failed");
-                return;
+                goto out;
             }
             bdrv_img_create(new_image_file, format,
                             state->old_bs->filename,
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
                             NULL, size, flags, false, &local_err);
             if (local_err) {
                 error_propagate(errp, local_err);
-                return;
+                goto out;
             }
         }
 
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
                               errp);
     /* We will manually add the backing_hd field to the bs later */
     if (!state->new_bs) {
-        return;
+        goto out;
     }
 
     if (bdrv_has_blk(state->new_bs)) {
         error_setg(errp, "The snapshot is already in use");
-        return;
+        goto out;
     }
 
     if (bdrv_op_is_blocked(state->new_bs, BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT,
                            errp)) {
-        return;
+        goto out;
     }
 
     if (state->new_bs->backing != NULL) {
         error_setg(errp, "The snapshot already has a backing image");
-        return;
+        goto out;
     }
 
     if (!state->new_bs->drv->supports_backing) {
         error_setg(errp, "The snapshot does not support backing images");
-        return;
+        goto out;
     }
 
-    bdrv_set_aio_context(state->new_bs, state->aio_context);
+    bdrv_set_aio_context(state->new_bs, aio_context);
 
     /* This removes our old bs and adds the new bs. This is an operation that
      * can fail, so we need to do it in .prepare; undoing it for abort is
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
     bdrv_append(state->new_bs, state->old_bs, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-        return;
+        goto out;
     }
     state->overlay_appended = true;
+
+out:
+    aio_context_release(aio_context);
 }
 
 static void external_snapshot_commit(BlkActionState *common)
 {
     ExternalSnapshotState *state =
                              DO_UPCAST(ExternalSnapshotState, common, common);
+    AioContext *aio_context;
+
+    aio_context = bdrv_get_aio_context(state->old_bs);
+    aio_context_acquire(aio_context);
 
     /* We don't need (or want) to use the transactional
      * bdrv_reopen_multiple() across all the entries at once, because we
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_commit(BlkActionState *common)
         bdrv_reopen(state->old_bs, state->old_bs->open_flags & ~BDRV_O_RDWR,
                     NULL);
     }
+
+    aio_context_release(aio_context);
 }
 
 static void external_snapshot_abort(BlkActionState *common)
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_abort(BlkActionState *common)
                              DO_UPCAST(ExternalSnapshotState, common, common);
     if (state->new_bs) {
         if (state->overlay_appended) {
+            AioContext *aio_context;
+
+            aio_context = bdrv_get_aio_context(state->old_bs);
+            aio_context_acquire(aio_context);
+
             bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
                                           close state->old_bs; we need it */
             bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
             bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
             bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
+
+            aio_context_release(aio_context);
         }
     }
 }
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_clean(BlkActionState *common)
 {
     ExternalSnapshotState *state =
                              DO_UPCAST(ExternalSnapshotState, common, common);
-    if (state->aio_context) {
-        bdrv_drained_end(state->old_bs);
-        bdrv_unref(state->new_bs);
-        aio_context_release(state->aio_context);
+    AioContext *aio_context;
+
+    if (!state->old_bs) {
+        return;
     }
+
+    aio_context = bdrv_get_aio_context(state->old_bs);
+    aio_context_acquire(aio_context);
+
+    bdrv_drained_end(state->old_bs);
+    bdrv_unref(state->new_bs);
+
+    aio_context_release(aio_context);
 }
 
 typedef struct DriveBackupState {
-- 
2.14.3

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_clean(BlkActionState *common)
 typedef struct DriveBackupState {
     BlkActionState common;
     BlockDriverState *bs;
-    AioContext *aio_context;
     BlockJob *job;
 } DriveBackupState;
 
@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
     BlockDriverState *bs;
     DriveBackup *backup;
+    AioContext *aio_context;
     Error *local_err = NULL;
 
     assert(common->action->type == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);
@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
         return;
     }
 
-    /* AioContext is released in .clean() */
-    state->aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(state->aio_context);
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
+
+    /* Paired with .clean() */
     bdrv_drained_begin(bs);
+
     state->bs = bs;
 
     state->job = do_drive_backup(backup, common->block_job_txn, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-        return;
+        goto out;
     }
+
+out:
+    aio_context_release(aio_context);
 }
 
 static void drive_backup_commit(BlkActionState *common)
 {
     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
+    AioContext *aio_context;
+
+    aio_context = bdrv_get_aio_context(state->bs);
+    aio_context_acquire(aio_context);
+
     assert(state->job);
     block_job_start(state->job);
+
+    aio_context_release(aio_context);
 }
 
 static void drive_backup_abort(BlkActionState *common)
@@ -XXX,XX +XXX,XX @@ static void drive_backup_abort(BlkActionState *common)
     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
 
     if (state->job) {
+        AioContext *aio_context;
+
+        aio_context = bdrv_get_aio_context(state->bs);
+        aio_context_acquire(aio_context);
+
         block_job_cancel_sync(state->job);
+
+        aio_context_release(aio_context);
     }
 }
 
 static void drive_backup_clean(BlkActionState *common)
 {
     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
+    AioContext *aio_context;
 
-    if (state->aio_context) {
-        bdrv_drained_end(state->bs);
-        aio_context_release(state->aio_context);
+    if (!state->bs) {
+        return;
     }
+
+    aio_context = bdrv_get_aio_context(state->bs);
+    aio_context_acquire(aio_context);
+
+    bdrv_drained_end(state->bs);
+
+    aio_context_release(aio_context);
 }
 
 typedef struct BlockdevBackupState {
-- 
2.14.3

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ typedef struct BlockdevBackupState {
     BlkActionState common;
     BlockDriverState *bs;
     BlockJob *job;
-    AioContext *aio_context;
 } BlockdevBackupState;
 
 static BlockJob *do_blockdev_backup(BlockdevBackup *backup, BlockJobTxn *txn,
@@ -XXX,XX +XXX,XX @@ static void blockdev_backup_prepare(BlkActionState *common, Error **errp)
     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
     BlockdevBackup *backup;
     BlockDriverState *bs, *target;
+    AioContext *aio_context;
     Error *local_err = NULL;
 
     assert(common->action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_BACKUP);
@@ -XXX,XX +XXX,XX @@ static void blockdev_backup_prepare(BlkActionState *common, Error **errp)
         return;
     }
 
-    /* AioContext is released in .clean() */
-    state->aio_context = bdrv_get_aio_context(bs);
-    if (state->aio_context != bdrv_get_aio_context(target)) {
-        state->aio_context = NULL;
+    aio_context = bdrv_get_aio_context(bs);
+    if (aio_context != bdrv_get_aio_context(target)) {
         error_setg(errp, "Backup between two IO threads is not implemented");
         return;
     }
-    aio_context_acquire(state->aio_context);
+    aio_context_acquire(aio_context);
     state->bs = bs;
+
+    /* Paired with .clean() */
     bdrv_drained_begin(state->bs);
 
     state->job = do_blockdev_backup(backup, common->block_job_txn, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-        return;
+        goto out;
     }
+
+out:
+    aio_context_release(aio_context);
 }
 
 static void blockdev_backup_commit(BlkActionState *common)
 {
     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
+    AioContext *aio_context;
+
+    aio_context = bdrv_get_aio_context(state->bs);
+    aio_context_acquire(aio_context);
+
     assert(state->job);
     block_job_start(state->job);
+
+    aio_context_release(aio_context);
 }
 
 static void blockdev_backup_abort(BlkActionState *common)
@@ -XXX,XX +XXX,XX @@ static void blockdev_backup_abort(BlkActionState *common)
     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
 
     if (state->job) {
+        AioContext *aio_context;
+
+        aio_context = bdrv_get_aio_context(state->bs);
+        aio_context_acquire(aio_context);
+
         block_job_cancel_sync(state->job);
+
+        aio_context_release(aio_context);
     }
 }
 
 static void blockdev_backup_clean(BlkActionState *common)
 {
     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
+    AioContext *aio_context;
 
-    if (state->aio_context) {
-        bdrv_drained_end(state->bs);
-        aio_context_release(state->aio_context);
+    if (!state->bs) {
+        return;
     }
+
+    aio_context = bdrv_get_aio_context(state->bs);
+    aio_context_acquire(aio_context);
+
+    bdrv_drained_end(state->bs);
+
+    aio_context_release(aio_context);
 }
 
 typedef struct BlockDirtyBitmapState {
-- 
2.14.3

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ struct BlkActionState {
 typedef struct InternalSnapshotState {
     BlkActionState common;
     BlockDriverState *bs;
-    AioContext *aio_context;
     QEMUSnapshotInfo sn;
     bool created;
 } InternalSnapshotState;
@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
     qemu_timeval tv;
     BlockdevSnapshotInternal *internal;
     InternalSnapshotState *state;
+    AioContext *aio_context;
     int ret1;
 
     g_assert(common->action->type ==
@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
         return;
     }
 
-    /* AioContext is released in .clean() */
-    state->aio_context = bdrv_get_aio_context(bs);
-    aio_context_acquire(state->aio_context);
+    aio_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(aio_context);
 
     state->bs = bs;
+
+    /* Paired with .clean() */
     bdrv_drained_begin(bs);
 
     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT, errp)) {
-        return;
+        goto out;
     }
 
     if (bdrv_is_read_only(bs)) {
         error_setg(errp, "Device '%s' is read only", device);
-        return;
+        goto out;
     }
 
     if (!bdrv_can_snapshot(bs)) {
         error_setg(errp, "Block format '%s' used by device '%s' "
                    "does not support internal snapshots",
                    bs->drv->format_name, device);
-        return;
+        goto out;
     }
 
     if (!strlen(name)) {
         error_setg(errp, "Name is empty");
-        return;
+        goto out;
     }
 
     /* check whether a snapshot with name exist */
@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
                                             &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
-        return;
+        goto out;
     } else if (ret) {
         error_setg(errp,
                    "Snapshot with name '%s' already exists on device '%s'",
                    name, device);
-        return;
+        goto out;
     }
 
     /* 3. take the snapshot */
@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_prepare(BlkActionState *common,
         error_setg_errno(errp, -ret1,
                          "Failed to create snapshot '%s' on device '%s'",
                          name, device);
-        return;
+        goto out;
     }
 
     /* 4. succeed, mark a snapshot is created */
     state->created = true;
+
+out:
+    aio_context_release(aio_context);
 }
 
 static void internal_snapshot_abort(BlkActionState *common)
@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_abort(BlkActionState *common)
                              DO_UPCAST(InternalSnapshotState, common, common);
     BlockDriverState *bs = state->bs;
     QEMUSnapshotInfo *sn = &state->sn;
+    AioContext *aio_context;
     Error *local_error = NULL;
 
     if (!state->created) {
         return;
     }
 
+    aio_context = bdrv_get_aio_context(state->bs);
+    aio_context_acquire(aio_context);
+
     if (bdrv_snapshot_delete(bs, sn->id_str, sn->name, &local_error) < 0) {
         error_reportf_err(local_error,
                           "Failed to delete snapshot with id '%s' and "
@@ -XXX,XX +XXX,XX @@ static void internal_snapshot_abort(BlkActionState *common)
                           sn->id_str, sn->name,
                           bdrv_get_device_name(bs));
     }
+
+    aio_context_release(aio_context);
 }
 
 static void internal_snapshot_clean(BlkActionState *common)
 {
     InternalSnapshotState *state = DO_UPCAST(InternalSnapshotState,
                                              common, common);
+    AioContext *aio_context;
 
-    if (state->aio_context) {
-        if (state->bs) {
-            bdrv_drained_end(state->bs);
-        }
-        aio_context_release(state->aio_context);
+    if (!state->bs) {
+        return;
     }
+
+    aio_context = bdrv_get_aio_context(state->bs);
+    aio_context_acquire(aio_context);
+
+    bdrv_drained_end(state->bs);
+
+    aio_context_release(aio_context);
 }
 
 /* external snapshot private data */
-- 
2.14.3

The dirty bitmap actions in qmp_transaction have not used AioContext
since the dirty bitmap locking discipline was introduced in commit
2119882c7eb7e2c612b24fc0c8d86f5887d6f1c3 ("block: introduce
dirty_bitmap_mutex").  Remove the unused field.

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ typedef struct BlockDirtyBitmapState {
     BlkActionState common;
     BdrvDirtyBitmap *bitmap;
     BlockDriverState *bs;
-    AioContext *aio_context;
     HBitmap *backup;
     bool prepared;
 } BlockDirtyBitmapState;
@@ -XXX,XX +XXX,XX @@ static void block_dirty_bitmap_clear_prepare(BlkActionState *common,
     }
 
     bdrv_clear_dirty_bitmap(state->bitmap, &state->backup);
-    /* AioContext is released in .clean() */
 }
 
 static void block_dirty_bitmap_clear_abort(BlkActionState *common)
@@ -XXX,XX +XXX,XX @@ static void block_dirty_bitmap_clear_commit(BlkActionState *common)
     hbitmap_free(state->backup);
 }
 
-static void block_dirty_bitmap_clear_clean(BlkActionState *common)
-{
-    BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
-                                             common, common);
-
-    if (state->aio_context) {
-        aio_context_release(state->aio_context);
-    }
-}
-
 static void abort_prepare(BlkActionState *common, Error **errp)
 {
     error_setg(errp, "Transaction aborted using Abort action");
@@ -XXX,XX +XXX,XX @@ static const BlkActionOps actions[] = {
         .prepare = block_dirty_bitmap_clear_prepare,
         .commit = block_dirty_bitmap_clear_commit,
         .abort = block_dirty_bitmap_clear_abort,
-        .clean = block_dirty_bitmap_clear_clean,
     }
 };
 
-- 
2.14.3

Encapsulate IOThread QOM object lookup so that callers don't need to
know how and where IOThread objects live.

diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/iothread.h
+++ b/include/sysemu/iothread.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
    OBJECT_CHECK(IOThread, obj, TYPE_IOTHREAD)
 
 char *iothread_get_id(IOThread *iothread);
+IOThread *iothread_by_id(const char *id);
 AioContext *iothread_get_aio_context(IOThread *iothread);
 void iothread_stop_all(void);
 GMainContext *iothread_get_g_main_context(IOThread *iothread);
diff --git a/iothread.c b/iothread.c
index XXXXXXX..XXXXXXX 100644
--- a/iothread.c
+++ b/iothread.c
@@ -XXX,XX +XXX,XX @@ void iothread_destroy(IOThread *iothread)
 {
     object_unparent(OBJECT(iothread));
 }
+
+/* Lookup IOThread by its id.  Only finds user-created objects, not internal
+ * iothread_create() objects. */
+IOThread *iothread_by_id(const char *id)
+{
+    return IOTHREAD(object_resolve_path_type(id, TYPE_IOTHREAD, NULL));
+}
-- 
2.14.3

Currently there is no easy way for iotests to ensure that a BDS is bound
to a particular IOThread.  Normally the virtio-blk device calls
blk_set_aio_context() when dataplane is enabled during guest driver
initialization.  This never happens in iotests since -machine
accel=qtest means there is no guest activity (including device driver
initialization).

This patch adds a QMP command to explicitly assign IOThreads in test
cases.  See qapi/block-core.json for a description of the command.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171206144550.22295-9-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-core.json | 36 ++++++++++++++++++++++++++++++++++++
 blockdev.c           | 41 +++++++++++++++++++++++++++++++++++++++++
 2 files changed, 77 insertions(+)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
   'data' : { 'parent': 'str',
              '*child': 'str',
              '*node': 'str' } }
+
+##
+# @x-blockdev-set-iothread:
+#
+# Move @node and its children into the @iothread.  If @iothread is null then
+# move @node and its children into the main loop.
+#
+# The node must not be attached to a BlockBackend.
+#
+# @node-name: the name of the block driver node
+#
+# @iothread: the name of the IOThread object or null for the main loop
+#
+# Note: this command is experimental and intended for test cases that need
+# control over IOThreads only.
+#
+# Since: 2.12
+#
+# Example:
+#
+# 1. Move a node into an IOThread
+# -> { "execute": "x-blockdev-set-iothread",
+#      "arguments": { "node-name": "disk1",
+#                     "iothread": "iothread0" } }
+# <- { "return": {} }
+#
+# 2. Move a node into the main loop
+# -> { "execute": "x-blockdev-set-iothread",
+#      "arguments": { "node-name": "disk1",
+#                     "iothread": null } }
+# <- { "return": {} }
+#
+##
+{ 'command': 'x-blockdev-set-iothread',
+  'data' : { 'node-name': 'str',
+             'iothread': 'StrOrNull' } }
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qmp/qerror.h"
 #include "qapi/qobject-output-visitor.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/iothread.h"
 #include "block/block_int.h"
 #include "qmp-commands.h"
 #include "block/trace.h"
@@ -XXX,XX +XXX,XX @@ BlockJobInfoList *qmp_query_block_jobs(Error **errp)
     return head;
 }
 
+void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
+                                 Error **errp)
+{
+    AioContext *old_context;
+    AioContext *new_context;
+    BlockDriverState *bs;
+
+    bs = bdrv_find_node(node_name);
+    if (!bs) {
+        error_setg(errp, "Cannot find node %s", node_name);
+        return;
+    }
+
+    /* If we want to allow more extreme test scenarios this guard could be
+     * removed.  For now it protects against accidents. */
+    if (bdrv_has_blk(bs)) {
+        error_setg(errp, "Node %s is in use", node_name);
+        return;
+    }
+
+    if (iothread->type == QTYPE_QSTRING) {
+        IOThread *obj = iothread_by_id(iothread->u.s);
+        if (!obj) {
+            error_setg(errp, "Cannot find iothread %s", iothread->u.s);
+            return;
+        }
+
+        new_context = iothread_get_aio_context(obj);
+    } else {
+        new_context = qemu_get_aio_context();
+    }
+
+    old_context = bdrv_get_aio_context(bs);
+    aio_context_acquire(old_context);
+
+    bdrv_set_aio_context(bs, new_context);
+
+    aio_context_release(old_context);
+}
+
 QemuOptsList qemu_common_drive_opts = {
     .name = "drive",
     .head = QTAILQ_HEAD_INITIALIZER(qemu_common_drive_opts.head),
-- 
2.14.3

QMP 'transaction' blockdev-snapshot-sync with multiple disks in an
IOThread is an untested code path.  Several bugs have been found in
connection with this command.  This patch adds a test case to prevent
future regressions.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171206144550.22295-10-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qemu-iotests/202     | 95 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/202.out | 11 ++++++
 tests/qemu-iotests/group   |  1 +
 3 files changed, 107 insertions(+)
 create mode 100755 tests/qemu-iotests/202
 create mode 100644 tests/qemu-iotests/202.out

diff --git a/tests/qemu-iotests/202 b/tests/qemu-iotests/202
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/202
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Creator/Owner: Stefan Hajnoczi <stefanha@redhat.com>
+#
+# Check that QMP 'transaction' blockdev-snapshot-sync with multiple drives on a
+# single IOThread completes successfully.  This particular command triggered a
+# hang due to recursive AioContext locking and BDRV_POLL_WHILE().  Protect
+# against regressions.
+
+import iotests
+
+iotests.verify_image_format(supported_fmts=['qcow2'])
+iotests.verify_platform(['linux'])
+
+with iotests.FilePath('disk0.img') as disk0_img_path, \
+     iotests.FilePath('disk1.img') as disk1_img_path, \
+     iotests.FilePath('disk0-snap.img') as disk0_snap_img_path, \
+     iotests.FilePath('disk1-snap.img') as disk1_snap_img_path, \
+     iotests.VM() as vm:
+
+    img_size = '10M'
+    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk0_img_path, img_size)
+    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk1_img_path, img_size)
+
+    iotests.log('Launching VM...')
+    vm.launch()
+
+    iotests.log('Adding IOThread...')
+    iotests.log(vm.qmp('object-add',
+                       qom_type='iothread',
+                       id='iothread0'))
+
+    iotests.log('Adding blockdevs...')
+    iotests.log(vm.qmp('blockdev-add',
+                       driver=iotests.imgfmt,
+                       node_name='disk0',
+                       file={
+                           'driver': 'file',
+                           'filename': disk0_img_path,
+                       }))
+    iotests.log(vm.qmp('blockdev-add',
+                       driver=iotests.imgfmt,
+                       node_name='disk1',
+                       file={
+                           'driver': 'file',
+                           'filename': disk1_img_path,
+                       }))
+
+    iotests.log('Setting iothread...')
+    iotests.log(vm.qmp('x-blockdev-set-iothread',
+                       node_name='disk0',
+                       iothread='iothread0'))
+    iotests.log(vm.qmp('x-blockdev-set-iothread',
+                       node_name='disk1',
+                       iothread='iothread0'))
+
+    iotests.log('Creating external snapshots...')
+    iotests.log(vm.qmp(
+                  'transaction',
+                  actions=[
+                      {
+                          'data': {
+                              'node-name': 'disk0',
+                              'snapshot-file': disk0_snap_img_path,
+                              'snapshot-node-name': 'disk0-snap',
+                              'mode': 'absolute-paths',
+                              'format': iotests.imgfmt,
+                          },
+                          'type': 'blockdev-snapshot-sync'
+                      }, {
+                          'data': {
+                              'node-name': 'disk1',
+                              'snapshot-file': disk1_snap_img_path,
+                              'snapshot-node-name': 'disk1-snap',
+                              'mode': 'absolute-paths',
+                              'format': iotests.imgfmt
+                          },
+                          'type': 'blockdev-snapshot-sync'
+                      }
+                  ]))
diff --git a/tests/qemu-iotests/202.out b/tests/qemu-iotests/202.out
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/202.out
@@ -XXX,XX +XXX,XX @@
+Launching VM...
+Adding IOThread...
+{u'return': {}}
+Adding blockdevs...
+{u'return': {}}
+{u'return': {}}
+Setting iothread...
+{u'return': {}}
+{u'return': {}}
+Creating external snapshots...
+{u'return': {}}
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -XXX,XX +XXX,XX @@
 197 rw auto quick
 198 rw auto
 200 rw auto
+202 rw auto quick
-- 
2.14.3

From: Mark Kanda <mark.kanda@oracle.com>

Depending on the configuration, it can be beneficial to adjust the virtio-blk
queue size to something other than the current default of 128. Add a new
property to make the queue size configurable.

Signed-off-by: Mark Kanda <mark.kanda@oracle.com>
Reviewed-by: Karl Heubaum <karl.heubaum@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Ameya More <ameya.more@oracle.com>
Message-id: 52e6d742811f10dbd16e996e86cf375b9577c187.1513005190.git.mark.kanda@oracle.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/hw/virtio/virtio-blk.h |  1 +
 hw/block/virtio-blk.c          | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/include/hw/virtio/virtio-blk.h b/include/hw/virtio/virtio-blk.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-blk.h
+++ b/include/hw/virtio/virtio-blk.h
@@ -XXX,XX +XXX,XX @@ struct VirtIOBlkConf
     uint32_t config_wce;
     uint32_t request_merging;
     uint16_t num_queues;
+    uint16_t queue_size;
 };
 
 struct VirtIOBlockDataPlane;
diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
         error_setg(errp, "num-queues property must be larger than 0");
         return;
     }
+    if (!is_power_of_2(conf->queue_size) ||
+        conf->queue_size > VIRTQUEUE_MAX_SIZE) {
+        error_setg(errp, "invalid queue-size property (%" PRIu16 "), "
+                   "must be a power of 2 (max %d)",
+                   conf->queue_size, VIRTQUEUE_MAX_SIZE);
+        return;
+    }
 
     blkconf_serial(&conf->conf, &conf->serial);
     if (!blkconf_apply_backend_options(&conf->conf,
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
     s->sector_mask = (s->conf.conf.logical_block_size / BDRV_SECTOR_SIZE) - 1;
 
     for (i = 0; i < conf->num_queues; i++) {
-        virtio_add_queue(vdev, 128, virtio_blk_handle_output);
+        virtio_add_queue(vdev, conf->queue_size, virtio_blk_handle_output);
     }
     virtio_blk_data_plane_create(vdev, conf, &s->dataplane, &err);
     if (err != NULL) {
@@ -XXX,XX +XXX,XX @@ static Property virtio_blk_properties[] = {
     DEFINE_PROP_BIT("request-merging", VirtIOBlock, conf.request_merging, 0,
                     true),
     DEFINE_PROP_UINT16("num-queues", VirtIOBlock, conf.num_queues, 1),
+    DEFINE_PROP_UINT16("queue-size", VirtIOBlock, conf.queue_size, 128),
     DEFINE_PROP_LINK("iothread", VirtIOBlock, conf.iothread, TYPE_IOTHREAD,
                      IOThread *),
     DEFINE_PROP_END_OF_LIST(),
-- 
2.14.3

From: Mark Kanda <mark.kanda@oracle.com>

virtio-blk logical block size should never be larger than physical block
size because it doesn't make sense to have such configurations. QEMU doesn't
have a way to effectively express this condition; the best it can do is
report the physical block exponent as 0 - indicating the logical block size
equals the physical block size.

This is identical to commit 3da023b5827543ee4c022986ea2ad9d1274410b2
but applied to virtio-blk (instead of virtio-scsi).

Signed-off-by: Mark Kanda <mark.kanda@oracle.com>
Reviewed-by: Konrad Rzeszutek Wilk <konrad.wilk@oracle.com>
Reviewed-by: Ameya More <ameya.more@oracle.com>
Reviewed-by: Martin K. Petersen <martin.petersen@oracle.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-id: 773169891f9f2deb4cb7c4ef2655580dbe24c1d1.1513005190.git.mark.kanda@oracle.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 hw/block/virtio-blk.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/hw/block/virtio-blk.c b/hw/block/virtio-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/virtio-blk.c
+++ b/hw/block/virtio-blk.c
@@ -XXX,XX +XXX,XX @@ static void virtio_blk_device_realize(DeviceState *dev, Error **errp)
 
     blkconf_blocksizes(&conf->conf);
 
+    if (conf->conf.logical_block_size >
+        conf->conf.physical_block_size) {
+        error_setg(errp,
+                   "logical_block_size > physical_block_size not supported");
+        return;
+    }
+
     virtio_init(vdev, "virtio-blk", VIRTIO_ID_BLOCK,
                 sizeof(struct virtio_blk_config));
 
-- 
2.14.3

From: Paolo Bonzini <pbonzini@redhat.com>

BDRV_POLL_WHILE() does not support recursive AioContext locking.  It
only releases the AioContext lock once regardless of how many times the
caller has acquired it.  This results in a hang since the IOThread does
not make progress while the AioContext is still locked.

The following steps trigger the hang:

$ qemu-system-x86_64 -M accel=kvm -m 1G -cpu host \
                       -object iothread,id=iothread0 \
                       -device virtio-scsi-pci,iothread=iothread0 \
                       -drive if=none,id=drive0,file=test.img,format=raw \
                       -device scsi-hd,drive=drive0 \
                       -drive if=none,id=drive1,file=test.img,format=raw \
                       -device scsi-hd,drive=drive1
  $ qemu-system-x86_64 ...same options... \
                       -incoming tcp::1234
  (qemu) migrate tcp:127.0.0.1:1234
  ...hang...

Tested-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171207201320.19284-2-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 block.c | 14 +++++++++++---
 1 file changed, 11 insertions(+), 3 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ int bdrv_inactivate_all(void)
     BdrvNextIterator it;
     int ret = 0;
     int pass;
+    GSList *aio_ctxs = NULL, *ctx;
 
     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
-        aio_context_acquire(bdrv_get_aio_context(bs));
+        AioContext *aio_context = bdrv_get_aio_context(bs);
+
+        if (!g_slist_find(aio_ctxs, aio_context)) {
+            aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
+            aio_context_acquire(aio_context);
+        }
     }
 
     /* We do two passes of inactivation. The first pass calls to drivers'
@@ -XXX,XX +XXX,XX @@ int bdrv_inactivate_all(void)
     }
 
 out:
-    for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
-        aio_context_release(bdrv_get_aio_context(bs));
+    for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
+        AioContext *aio_context = ctx->data;
+        aio_context_release(aio_context);
     }
+    g_slist_free(aio_ctxs);
 
     return ret;
 }
-- 
2.14.3

See the patch for why nested AioContext locking is no longer allowed.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171207201320.19284-3-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 docs/devel/multiple-iothreads.txt | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/docs/devel/multiple-iothreads.txt b/docs/devel/multiple-iothreads.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/multiple-iothreads.txt
+++ b/docs/devel/multiple-iothreads.txt
@@ -XXX,XX +XXX,XX @@
-Copyright (c) 2014 Red Hat Inc.
+Copyright (c) 2014-2017 Red Hat Inc.
 
 This work is licensed under the terms of the GNU GPL, version 2 or later.  See
 the COPYING file in the top-level directory.
@@ -XXX,XX +XXX,XX @@ aio_context_acquire()/aio_context_release() for mutual exclusion.  Once the
 context is acquired no other thread can access it or run event loop iterations
 in this AioContext.
 
-aio_context_acquire()/aio_context_release() calls may be nested.  This
-means you can call them if you're not sure whether #2 applies.
+Legacy code sometimes nests aio_context_acquire()/aio_context_release() calls.
+Do not use nesting anymore, it is incompatible with the BDRV_POLL_WHILE() macro
+used in the block layer and can lead to hangs.
 
 There is currently no lock ordering rule if a thread needs to acquire multiple
 AioContexts simultaneously.  Therefore, it is only safe for code holding the
-- 
2.14.3

When a node is already associated with a BlockBackend the
x-blockdev-set-iothread command refuses to set the IOThread.  This is to
prevent accidentally changing the IOThread when the nodes are in use.

When the nodes are created with -drive they automatically get a
BlockBackend.  In that case we know nothing is using them yet and it's
safe to set the IOThread.  Add a force boolean to override the check.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171207201320.19284-4-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 qapi/block-core.json |  6 +++++-
 blockdev.c           | 11 ++++++-----
 2 files changed, 11 insertions(+), 6 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 #
 # @iothread: the name of the IOThread object or null for the main loop
 #
+# @force: true if the node and its children should be moved when a BlockBackend
+#         is already attached
+#
 # Note: this command is experimental and intended for test cases that need
 # control over IOThreads only.
 #
@@ -XXX,XX +XXX,XX @@
 ##
 { 'command': 'x-blockdev-set-iothread',
   'data' : { 'node-name': 'str',
-             'iothread': 'StrOrNull' } }
+             'iothread': 'StrOrNull',
+             '*force': 'bool' } }
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ BlockJobInfoList *qmp_query_block_jobs(Error **errp)
 }
 
 void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
-                                 Error **errp)
+                                 bool has_force, bool force, Error **errp)
 {
     AioContext *old_context;
     AioContext *new_context;
@@ -XXX,XX +XXX,XX @@ void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
         return;
     }
 
-    /* If we want to allow more extreme test scenarios this guard could be
-     * removed.  For now it protects against accidents. */
-    if (bdrv_has_blk(bs)) {
-        error_setg(errp, "Node %s is in use", node_name);
+    /* Protects against accidents. */
+    if (!(has_force && force) && bdrv_has_blk(bs)) {
+        error_setg(errp, "Node %s is associated with a BlockBackend and could "
+                         "be in use (use force=true to override this check)",
+                         node_name);
         return;
     }
 
-- 
2.14.3

There is a small chance that iothread_stop() hangs as follows:

Thread 3 (Thread 0x7f63eba5f700 (LWP 16105)):
  #0  0x00007f64012c09b6 in ppoll () at /lib64/libc.so.6
  #1  0x000055959992eac9 in ppoll (__ss=0x0, __timeout=0x0, __nfds=<optimized out>, __fds=<optimized out>) at /usr/include/bits/poll2.h:77
  #2  0x000055959992eac9 in qemu_poll_ns (fds=<optimized out>, nfds=<optimized out>, timeout=<optimized out>) at util/qemu-timer.c:322
  #3  0x0000559599930711 in aio_poll (ctx=0x55959bdb83c0, blocking=blocking@entry=true) at util/aio-posix.c:629
  #4  0x00005595996806fe in iothread_run (opaque=0x55959bd78400) at iothread.c:59
  #5  0x00007f640159f609 in start_thread () at /lib64/libpthread.so.0
  #6  0x00007f64012cce6f in clone () at /lib64/libc.so.6

Thread 1 (Thread 0x7f640b45b280 (LWP 16103)):
  #0  0x00007f64015a0b6d in pthread_join () at /lib64/libpthread.so.0
  #1  0x00005595999332ef in qemu_thread_join (thread=<optimized out>) at util/qemu-thread-posix.c:547
  #2  0x00005595996808ae in iothread_stop (iothread=<optimized out>) at iothread.c:91
  #3  0x000055959968094d in iothread_stop_iter (object=<optimized out>, opaque=<optimized out>) at iothread.c:102
  #4  0x0000559599857d97 in do_object_child_foreach (obj=obj@entry=0x55959bdb8100, fn=fn@entry=0x559599680930 <iothread_stop_iter>, opaque=opaque@entry=0x0, recurse=recurse@entry=false) at qom/object.c:852
  #5  0x0000559599859477 in object_child_foreach (obj=obj@entry=0x55959bdb8100, fn=fn@entry=0x559599680930 <iothread_stop_iter>, opaque=opaque@entry=0x0) at qom/object.c:867
  #6  0x0000559599680a6e in iothread_stop_all () at iothread.c:341
  #7  0x000055959955b1d5 in main (argc=<optimized out>, argv=<optimized out>, envp=<optimized out>) at vl.c:4913

The relevant code from iothread_run() is:

while (!atomic_read(&iothread->stopping)) {
      aio_poll(iothread->ctx, true);

and iothread_stop():

iothread->stopping = true;
  aio_notify(iothread->ctx);
  ...
  qemu_thread_join(&iothread->thread);

The following scenario can occur:

1. IOThread:
  while (!atomic_read(&iothread->stopping)) -> stopping=false

2. Main loop:
  iothread->stopping = true;
  aio_notify(iothread->ctx);

3. IOThread:
  aio_poll(iothread->ctx, true); -> hang

The bug is explained by the AioContext->notify_me doc comments:

"If this field is 0, everything (file descriptors, bottom halves,
  timers) will be re-evaluated before the next blocking poll(), thus the
  event_notifier_set call can be skipped."

The problem is that "everything" does not include checking
iothread->stopping.  This means iothread_run() will block in aio_poll()
if aio_notify() was called just before aio_poll().

This patch fixes the hang by replacing aio_notify() with
aio_bh_schedule_oneshot().  This makes aio_poll() or g_main_loop_run()
to return.

Implementing this properly required a new bool running flag.  The new
flag prevents races that are tricky if we try to use iothread->stopping.
Now iothread->stopping is purely for iothread_stop() and
iothread->running is purely for the iothread_run() thread.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171207201320.19284-6-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 include/sysemu/iothread.h |  3 ++-
 iothread.c                | 20 +++++++++++++++-----
 2 files changed, 17 insertions(+), 6 deletions(-)

diff --git a/include/sysemu/iothread.h b/include/sysemu/iothread.h
index XXXXXXX..XXXXXXX 100644
--- a/include/sysemu/iothread.h
+++ b/include/sysemu/iothread.h
@@ -XXX,XX +XXX,XX @@ typedef struct {
     GOnce once;
     QemuMutex init_done_lock;
     QemuCond init_done_cond;    /* is thread initialization done? */
-    bool stopping;
+    bool stopping;              /* has iothread_stop() been called? */
+    bool running;               /* should iothread_run() continue? */
     int thread_id;
 
     /* AioContext poll parameters */
diff --git a/iothread.c b/iothread.c
index XXXXXXX..XXXXXXX 100644
--- a/iothread.c
+++ b/iothread.c
@@ -XXX,XX +XXX,XX @@ static void *iothread_run(void *opaque)
     qemu_cond_signal(&iothread->init_done_cond);
     qemu_mutex_unlock(&iothread->init_done_lock);
 
-    while (!atomic_read(&iothread->stopping)) {
+    while (iothread->running) {
         aio_poll(iothread->ctx, true);
 
         if (atomic_read(&iothread->worker_context)) {
@@ -XXX,XX +XXX,XX @@ static void *iothread_run(void *opaque)
     return NULL;
 }
 
+/* Runs in iothread_run() thread */
+static void iothread_stop_bh(void *opaque)
+{
+    IOThread *iothread = opaque;
+
+    iothread->running = false; /* stop iothread_run() */
+
+    if (iothread->main_loop) {
+        g_main_loop_quit(iothread->main_loop);
+    }
+}
+
 void iothread_stop(IOThread *iothread)
 {
     if (!iothread->ctx || iothread->stopping) {
         return;
     }
     iothread->stopping = true;
-    aio_notify(iothread->ctx);
-    if (atomic_read(&iothread->main_loop)) {
-        g_main_loop_quit(iothread->main_loop);
-    }
+    aio_bh_schedule_oneshot(iothread->ctx, iothread_stop_bh, iothread);
     qemu_thread_join(&iothread->thread);
 }
 
@@ -XXX,XX +XXX,XX @@ static void iothread_complete(UserCreatable *obj, Error **errp)
     char *name, *thread_name;
 
     iothread->stopping = false;
+    iothread->running = true;
     iothread->thread_id = -1;
     iothread->ctx = aio_context_new(&local_error);
     if (!iothread->ctx) {
-- 
2.14.3

This test case will prevent future regressions with savevm and
IOThreads.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-id: 20171207201320.19284-7-stefanha@redhat.com
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
 tests/qemu-iotests/203     | 59 ++++++++++++++++++++++++++++++++++++++++++++++
 tests/qemu-iotests/203.out |  6 +++++
 tests/qemu-iotests/group   |  1 +
 3 files changed, 66 insertions(+)
 create mode 100755 tests/qemu-iotests/203
 create mode 100644 tests/qemu-iotests/203.out

diff --git a/tests/qemu-iotests/203 b/tests/qemu-iotests/203
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/203
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env python
+#
+# Copyright (C) 2017 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+# Creator/Owner: Stefan Hajnoczi <stefanha@redhat.com>
+#
+# Check that QMP 'migrate' with multiple drives on a single IOThread completes
+# successfully.  This particular command triggered a hang in the source QEMU
+# process due to recursive AioContext locking in bdrv_invalidate_all() and
+# BDRV_POLL_WHILE().
+
+import iotests
+
+iotests.verify_image_format(supported_fmts=['qcow2'])
+iotests.verify_platform(['linux'])
+
+with iotests.FilePath('disk0.img') as disk0_img_path, \
+     iotests.FilePath('disk1.img') as disk1_img_path, \
+     iotests.VM() as vm:
+
+    img_size = '10M'
+    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk0_img_path, img_size)
+    iotests.qemu_img_pipe('create', '-f', iotests.imgfmt, disk1_img_path, img_size)
+
+    iotests.log('Launching VM...')
+    (vm.add_object('iothread,id=iothread0')
+       .add_drive(disk0_img_path, 'node-name=drive0-node', interface='none')
+       .add_drive(disk1_img_path, 'node-name=drive1-node', interface='none')
+       .launch())
+
+    iotests.log('Setting IOThreads...')
+    iotests.log(vm.qmp('x-blockdev-set-iothread',
+                       node_name='drive0-node', iothread='iothread0',
+                       force=True))
+    iotests.log(vm.qmp('x-blockdev-set-iothread',
+                       node_name='drive1-node', iothread='iothread0',
+                       force=True))
+
+    iotests.log('Starting migration...')
+    iotests.log(vm.qmp('migrate', uri='exec:cat >/dev/null'))
+    while True:
+        vm.get_qmp_event(wait=60.0)
+        result = vm.qmp('query-migrate')
+        status = result.get('return', {}).get('status', None)
+        if status == 'completed':
+            break
diff --git a/tests/qemu-iotests/203.out b/tests/qemu-iotests/203.out
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/203.out
@@ -XXX,XX +XXX,XX @@
+Launching VM...
+Setting IOThreads...
+{u'return': {}}
+{u'return': {}}
+Starting migration...
+{u'return': {}}
diff --git a/tests/qemu-iotests/group b/tests/qemu-iotests/group
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/group
+++ b/tests/qemu-iotests/group
@@ -XXX,XX +XXX,XX @@
 198 rw auto
 200 rw auto
 202 rw auto quick
+203 rw auto
-- 
2.14.3