[Qemu-devel] [PATCH] fix qemu_aio_flush

[Andrea Arcangeli <aarcange@redhat.com>]

Hello,

Kevin has good point that when highlevel callback handler completes we
should be guaranteed all underlying layers of callbacks events
completed for that specific aio operation. So it seems the main bug
was only in qemu_aio_flush() (only made visible by the debug code
included in the ide_dma_cancel patch). I guess that's a problem for
savevm/reset that assumes there is no outstanding aio waiting to be
run while in fact there can be because of the bug. Patch is much
simpler as seen below:

----------

From: Andrea Arcangeli <aarcange@redhat.com>

qemu_aio_wait by invoking the bh or one of the aio completion
callbacks, could end up submitting new pending aio, breaking the
invariant that qemu_aio_poll returns only when no pending aio is
outstanding (possibly a problem for migration as such).

Signed-off-by: Andrea Arcangeli <aarcange@redhat.com>
---

diff --git a/aio.c b/aio.c
index 11fbb6c..dc9b85d 100644
--- a/aio.c
+++ b/aio.c
@@ -103,11 +103,15 @@ void qemu_aio_flush(void)
     do {
         ret = 0;
 
+	/*
+	 * If there are pending emulated aio start them now so flush
+	 * will be able to return 1.
+	 */
+        qemu_aio_wait();
+
         LIST_FOREACH(node, &aio_handlers, node) {
             ret |= node->io_flush(node->opaque);
         }
-
-        qemu_aio_wait();
     } while (ret > 0);
 }
 
diff --git a/qemu-aio.h b/qemu-aio.h
index 7967829..f262344 100644
--- a/qemu-aio.h
+++ b/qemu-aio.h
@@ -24,9 +24,10 @@ typedef int (AioFlushHandler)(void *opaque);
  * outstanding AIO operations have been completed or cancelled. */
 void qemu_aio_flush(void);
 
-/* Wait for a single AIO completion to occur.  This function will until a
- * single AIO opeartion has completed.  It is intended to be used as a looping
- * primative when simulating synchronous IO based on asynchronous IO. */
+/* Wait for a single AIO completion to occur.  This function will wait
+ * until a single AIO event has completed and it will ensure something
+ * has moved before returning. This can issue new pending aio as
+ * result of executing I/O completion or bh callbacks. */
 void qemu_aio_wait(void);
 
 /* Register a file descriptor and associated callbacks.  Behaves very similarly