[Qemu-devel] [PULL 00/14] Block patches

[Qemu-devel] [PULL 00/14] Block patches

[Kevin Wolf]

The following changes since commit 222f23f508a8d778f56eddef14752dfd26d225b4:

  tcg/arm: remove fixed map code buffer restriction (2011-12-14 21:58:18 +0100)

are available in the git repository at:
  git://repo.or.cz/qemu/kevin.git for-anthony

Avi Kivity (1):
      coroutine: switch per-thread free pool to a global pool

Josh Durgin (1):
      rbd: always set out parameter in qemu_rbd_snap_list

Kevin Wolf (3):
      qemu-img rebase: Fix for undersized backing files
      Documentation: Add qemu-img -t parameter in man page
      qcow2: Allow >4 GB VM state

Li Zhi Hui (2):
      block/qcow2.c: call qcow2_free_snapshots in the function of qcow2_close
      block/cow: Return real error code

Paolo Bonzini (7):
      block: bdrv_aio_* do not return NULL
      block: simplify failure handling for bdrv_aio_multiwrite
      block: qemu_aio_get does not return NULL
      dma: the passed io_func does not return NULL
      block: dma_bdrv_* does not return NULL
      block: avoid useless checks on acb->bh
      qiov: prevent double free or use-after-free

 block-migration.c      |   13 ---------
 block.c                |   56 +++-------------------------------------
 block.h                |    2 +-
 block/blkverify.c      |   24 ++++++-----------
 block/cow.c            |   44 +++++++++++++++++++++-----------
 block/curl.c           |    4 ---
 block/qcow2-snapshot.c |   34 +++++++++++++++++++++++-
 block/qcow2.c          |    1 +
 block/qcow2.h          |    2 +-
 block/qed-table.c      |   22 +++++-----------
 block/qed.c            |   60 +++++++++++--------------------------------
 block/rbd.c            |    6 +---
 block/vdi.c            |   66 +++++++++++++----------------------------------
 coroutine-ucontext.c   |   30 +++++++++++----------
 cutils.c               |    3 ++
 dma-helpers.c          |    4 +--
 docs/specs/qcow2.txt   |    8 +++++-
 hw/ide/atapi.c         |    8 +-----
 hw/ide/core.c          |   13 +--------
 hw/ide/macio.c         |   11 +-------
 hw/scsi-disk.c         |    9 ------
 hw/scsi-generic.c      |    4 ---
 hw/virtio-blk.c        |   19 +++-----------
 linux-aio.c            |    2 -
 posix-aio-compat.c     |    4 ---
 qemu-img-cmds.hx       |    6 ++--
 qemu-img.c             |   42 ++++++++++++++++++++++++------
 qemu-img.texi          |   10 +++++--
 qemu-io.c              |   39 ++++++----------------------
 savevm.c               |    2 +-
 trace-events           |    2 -
 31 files changed, 205 insertions(+), 345 deletions(-)

[Qemu-devel] [PATCH 01/14] block: bdrv_aio_* do not return NULL

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

Initially done with the following semantic patch:

@ rule1 @
expression E;
statement S;
@@
  E =
(
   bdrv_aio_readv
|  bdrv_aio_writev
|  bdrv_aio_flush
|  bdrv_aio_discard
|  bdrv_aio_ioctl
)
     (...);
(
- if (E == NULL) { ... }
|
- if (E)
    { <... S ...> }
)

which however missed the occurrence in block/blkverify.c
(as it should have done), and left behind some unused
variables.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block-migration.c |   13 -----------
 block.c           |   24 +--------------------
 block/blkverify.c |   24 +++++++--------------
 block/qed-table.c |   22 ++++++-------------
 block/qed.c       |   60 ++++++++++++++--------------------------------------
 block/vdi.c       |   20 -----------------
 hw/ide/atapi.c    |    8 +------
 hw/ide/core.c     |    7 +-----
 hw/ide/macio.c    |    7 ------
 hw/scsi-disk.c    |    9 --------
 hw/scsi-generic.c |    4 ---
 hw/virtio-blk.c   |   19 +++-------------
 qemu-io.c         |   39 +++++++---------------------------
 trace-events      |    2 -
 14 files changed, 46 insertions(+), 212 deletions(-)

diff --git a/block-migration.c b/block-migration.c
index 423c5a0..2b7edbc 100644
--- a/block-migration.c
+++ b/block-migration.c
@@ -251,22 +251,12 @@ static int mig_save_device_bulk(Monitor *mon, QEMUFile *f,
 
     blk->aiocb = bdrv_aio_readv(bs, cur_sector, &blk->qiov,
                                 nr_sectors, blk_mig_read_cb, blk);
-    if (!blk->aiocb) {
-        goto error;
-    }
     block_mig_state.submitted++;
 
     bdrv_reset_dirty(bs, cur_sector, nr_sectors);
     bmds->cur_sector = cur_sector + nr_sectors;
 
     return (bmds->cur_sector >= total_sectors);
-
-error:
-    monitor_printf(mon, "Error reading sector %" PRId64 "\n", cur_sector);
-    qemu_file_set_error(f, -EIO);
-    g_free(blk->buf);
-    g_free(blk);
-    return 0;
 }
 
 static void set_dirty_tracking(int enable)
@@ -413,9 +403,6 @@ static int mig_save_device_dirty(Monitor *mon, QEMUFile *f,
 
                 blk->aiocb = bdrv_aio_readv(bmds->bs, sector, &blk->qiov,
                                             nr_sectors, blk_mig_read_cb, blk);
-                if (!blk->aiocb) {
-                    goto error;
-                }
                 block_mig_state.submitted++;
                 bmds_set_aio_inflight(bmds, sector, nr_sectors, 1);
             } else {
diff --git a/block.c b/block.c
index aa9d142..434c13d 100644
--- a/block.c
+++ b/block.c
@@ -2812,7 +2812,6 @@ static int multiwrite_merge(BlockDriverState *bs, BlockRequest *reqs,
  */
 int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
 {
-    BlockDriverAIOCB *acb;
     MultiwriteCB *mcb;
     int i;
 
@@ -2867,35 +2866,14 @@ int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
     // Run the aio requests
     for (i = 0; i < num_reqs; i++) {
         mcb->num_requests++;
-        acb = bdrv_aio_writev(bs, reqs[i].sector, reqs[i].qiov,
+        bdrv_aio_writev(bs, reqs[i].sector, reqs[i].qiov,
             reqs[i].nb_sectors, multiwrite_cb, mcb);
-
-        if (acb == NULL) {
-            // We can only fail the whole thing if no request has been
-            // submitted yet. Otherwise we'll wait for the submitted AIOs to
-            // complete and report the error in the callback.
-            if (i == 0) {
-                trace_bdrv_aio_multiwrite_earlyfail(mcb);
-                goto fail;
-            } else {
-                trace_bdrv_aio_multiwrite_latefail(mcb, i);
-                multiwrite_cb(mcb, -EIO);
-                break;
-            }
-        }
     }
 
     /* Complete the dummy request */
     multiwrite_cb(mcb, 0);
 
     return 0;
-
-fail:
-    for (i = 0; i < mcb->num_callbacks; i++) {
-        reqs[i].error = -EIO;
-    }
-    g_free(mcb);
-    return -1;
 }
 
 void bdrv_aio_cancel(BlockDriverAIOCB *acb)
diff --git a/block/blkverify.c b/block/blkverify.c
index 483f3b3..4ca8584 100644
--- a/block/blkverify.c
+++ b/block/blkverify.c
@@ -310,14 +310,10 @@ static BlockDriverAIOCB *blkverify_aio_readv(BlockDriverState *bs,
     qemu_iovec_init(&acb->raw_qiov, acb->qiov->niov);
     blkverify_iovec_clone(&acb->raw_qiov, qiov, acb->buf);
 
-    if (!bdrv_aio_readv(s->test_file, sector_num, qiov, nb_sectors,
-                        blkverify_aio_cb, acb)) {
-        blkverify_aio_cb(acb, -EIO);
-    }
-    if (!bdrv_aio_readv(bs->file, sector_num, &acb->raw_qiov, nb_sectors,
-                        blkverify_aio_cb, acb)) {
-        blkverify_aio_cb(acb, -EIO);
-    }
+    bdrv_aio_readv(s->test_file, sector_num, qiov, nb_sectors,
+                   blkverify_aio_cb, acb);
+    bdrv_aio_readv(bs->file, sector_num, &acb->raw_qiov, nb_sectors,
+                   blkverify_aio_cb, acb);
     return &acb->common;
 }
 
@@ -329,14 +325,10 @@ static BlockDriverAIOCB *blkverify_aio_writev(BlockDriverState *bs,
     BlkverifyAIOCB *acb = blkverify_aio_get(bs, true, sector_num, qiov,
                                             nb_sectors, cb, opaque);
 
-    if (!bdrv_aio_writev(s->test_file, sector_num, qiov, nb_sectors,
-                         blkverify_aio_cb, acb)) {
-        blkverify_aio_cb(acb, -EIO);
-    }
-    if (!bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors,
-                         blkverify_aio_cb, acb)) {
-        blkverify_aio_cb(acb, -EIO);
-    }
+    bdrv_aio_writev(s->test_file, sector_num, qiov, nb_sectors,
+                    blkverify_aio_cb, acb);
+    bdrv_aio_writev(bs->file, sector_num, qiov, nb_sectors,
+                    blkverify_aio_cb, acb);
     return &acb->common;
 }
 
diff --git a/block/qed-table.c b/block/qed-table.c
index 8ee8443..ce07b05 100644
--- a/block/qed-table.c
+++ b/block/qed-table.c
@@ -54,7 +54,6 @@ static void qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
     QEDReadTableCB *read_table_cb = gencb_alloc(sizeof(*read_table_cb),
                                                 cb, opaque);
     QEMUIOVector *qiov = &read_table_cb->qiov;
-    BlockDriverAIOCB *aiocb;
 
     trace_qed_read_table(s, offset, table);
 
@@ -64,12 +63,9 @@ static void qed_read_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
     read_table_cb->iov.iov_len = s->header.cluster_size * s->header.table_size,
 
     qemu_iovec_init_external(qiov, &read_table_cb->iov, 1);
-    aiocb = bdrv_aio_readv(s->bs->file, offset / BDRV_SECTOR_SIZE, qiov,
-                           qiov->size / BDRV_SECTOR_SIZE,
-                           qed_read_table_cb, read_table_cb);
-    if (!aiocb) {
-        qed_read_table_cb(read_table_cb, -EIO);
-    }
+    bdrv_aio_readv(s->bs->file, offset / BDRV_SECTOR_SIZE, qiov,
+                   qiov->size / BDRV_SECTOR_SIZE,
+                   qed_read_table_cb, read_table_cb);
 }
 
 typedef struct {
@@ -127,7 +123,6 @@ static void qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
                             BlockDriverCompletionFunc *cb, void *opaque)
 {
     QEDWriteTableCB *write_table_cb;
-    BlockDriverAIOCB *aiocb;
     unsigned int sector_mask = BDRV_SECTOR_SIZE / sizeof(uint64_t) - 1;
     unsigned int start, end, i;
     size_t len_bytes;
@@ -158,13 +153,10 @@ static void qed_write_table(BDRVQEDState *s, uint64_t offset, QEDTable *table,
     /* Adjust for offset into table */
     offset += start * sizeof(uint64_t);
 
-    aiocb = bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
-                            &write_table_cb->qiov,
-                            write_table_cb->qiov.size / BDRV_SECTOR_SIZE,
-                            qed_write_table_cb, write_table_cb);
-    if (!aiocb) {
-        qed_write_table_cb(write_table_cb, -EIO);
-    }
+    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
+                    &write_table_cb->qiov,
+                    write_table_cb->qiov.size / BDRV_SECTOR_SIZE,
+                    qed_write_table_cb, write_table_cb);
 }
 
 /**
diff --git a/block/qed.c b/block/qed.c
index 22e4672..8da3ebe 100644
--- a/block/qed.c
+++ b/block/qed.c
@@ -123,7 +123,6 @@ static void qed_write_header_read_cb(void *opaque, int ret)
 {
     QEDWriteHeaderCB *write_header_cb = opaque;
     BDRVQEDState *s = write_header_cb->s;
-    BlockDriverAIOCB *acb;
 
     if (ret) {
         qed_write_header_cb(write_header_cb, ret);
@@ -133,12 +132,9 @@ static void qed_write_header_read_cb(void *opaque, int ret)
     /* Update header */
     qed_header_cpu_to_le(&s->header, (QEDHeader *)write_header_cb->buf);
 
-    acb = bdrv_aio_writev(s->bs->file, 0, &write_header_cb->qiov,
-                          write_header_cb->nsectors, qed_write_header_cb,
-                          write_header_cb);
-    if (!acb) {
-        qed_write_header_cb(write_header_cb, -EIO);
-    }
+    bdrv_aio_writev(s->bs->file, 0, &write_header_cb->qiov,
+                    write_header_cb->nsectors, qed_write_header_cb,
+                    write_header_cb);
 }
 
 /**
@@ -156,7 +152,6 @@ static void qed_write_header(BDRVQEDState *s, BlockDriverCompletionFunc cb,
      * them, and write back.
      */
 
-    BlockDriverAIOCB *acb;
     int nsectors = (sizeof(QEDHeader) + BDRV_SECTOR_SIZE - 1) /
                    BDRV_SECTOR_SIZE;
     size_t len = nsectors * BDRV_SECTOR_SIZE;
@@ -170,11 +165,8 @@ static void qed_write_header(BDRVQEDState *s, BlockDriverCompletionFunc cb,
     write_header_cb->iov.iov_len = len;
     qemu_iovec_init_external(&write_header_cb->qiov, &write_header_cb->iov, 1);
 
-    acb = bdrv_aio_readv(s->bs->file, 0, &write_header_cb->qiov, nsectors,
-                         qed_write_header_read_cb, write_header_cb);
-    if (!acb) {
-        qed_write_header_cb(write_header_cb, -EIO);
-    }
+    bdrv_aio_readv(s->bs->file, 0, &write_header_cb->qiov, nsectors,
+                   qed_write_header_read_cb, write_header_cb);
 }
 
 static uint64_t qed_max_image_size(uint32_t cluster_size, uint32_t table_size)
@@ -728,7 +720,6 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
                                   QEMUIOVector *qiov,
                                   BlockDriverCompletionFunc *cb, void *opaque)
 {
-    BlockDriverAIOCB *aiocb;
     uint64_t backing_length = 0;
     size_t size;
 
@@ -760,11 +751,8 @@ static void qed_read_backing_file(BDRVQEDState *s, uint64_t pos,
     size = MIN((uint64_t)backing_length - pos, qiov->size);
 
     BLKDBG_EVENT(s->bs->file, BLKDBG_READ_BACKING);
-    aiocb = bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
-                           qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
-    if (!aiocb) {
-        cb(opaque, -EIO);
-    }
+    bdrv_aio_readv(s->bs->backing_hd, pos / BDRV_SECTOR_SIZE,
+                   qiov, size / BDRV_SECTOR_SIZE, cb, opaque);
 }
 
 typedef struct {
@@ -786,7 +774,6 @@ static void qed_copy_from_backing_file_write(void *opaque, int ret)
 {
     CopyFromBackingFileCB *copy_cb = opaque;
     BDRVQEDState *s = copy_cb->s;
-    BlockDriverAIOCB *aiocb;
 
     if (ret) {
         qed_copy_from_backing_file_cb(copy_cb, ret);
@@ -794,13 +781,9 @@ static void qed_copy_from_backing_file_write(void *opaque, int ret)
     }
 
     BLKDBG_EVENT(s->bs->file, BLKDBG_COW_WRITE);
-    aiocb = bdrv_aio_writev(s->bs->file, copy_cb->offset / BDRV_SECTOR_SIZE,
-                            &copy_cb->qiov,
-                            copy_cb->qiov.size / BDRV_SECTOR_SIZE,
-                            qed_copy_from_backing_file_cb, copy_cb);
-    if (!aiocb) {
-        qed_copy_from_backing_file_cb(copy_cb, -EIO);
-    }
+    bdrv_aio_writev(s->bs->file, copy_cb->offset / BDRV_SECTOR_SIZE,
+                    &copy_cb->qiov, copy_cb->qiov.size / BDRV_SECTOR_SIZE,
+                    qed_copy_from_backing_file_cb, copy_cb);
 }
 
 /**
@@ -1022,7 +1005,6 @@ static void qed_aio_write_main(void *opaque, int ret)
     uint64_t offset = acb->cur_cluster +
                       qed_offset_into_cluster(s, acb->cur_pos);
     BlockDriverCompletionFunc *next_fn;
-    BlockDriverAIOCB *file_acb;
 
     trace_qed_aio_write_main(s, acb, ret, offset, acb->cur_qiov.size);
 
@@ -1042,13 +1024,9 @@ static void qed_aio_write_main(void *opaque, int ret)
     }
 
     BLKDBG_EVENT(s->bs->file, BLKDBG_WRITE_AIO);
-    file_acb = bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
-                               &acb->cur_qiov,
-                               acb->cur_qiov.size / BDRV_SECTOR_SIZE,
-                               next_fn, acb);
-    if (!file_acb) {
-        qed_aio_complete(acb, -EIO);
-    }
+    bdrv_aio_writev(s->bs->file, offset / BDRV_SECTOR_SIZE,
+                    &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
+                    next_fn, acb);
 }
 
 /**
@@ -1215,7 +1193,6 @@ static void qed_aio_read_data(void *opaque, int ret,
     QEDAIOCB *acb = opaque;
     BDRVQEDState *s = acb_to_s(acb);
     BlockDriverState *bs = acb->common.bs;
-    BlockDriverAIOCB *file_acb;
 
     /* Adjust offset into cluster */
     offset += qed_offset_into_cluster(s, acb->cur_pos);
@@ -1240,14 +1217,9 @@ static void qed_aio_read_data(void *opaque, int ret,
     }
 
     BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
-    file_acb = bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
-                              &acb->cur_qiov,
-                              acb->cur_qiov.size / BDRV_SECTOR_SIZE,
-                              qed_aio_next_io, acb);
-    if (!file_acb) {
-        ret = -EIO;
-        goto err;
-    }
+    bdrv_aio_readv(bs->file, offset / BDRV_SECTOR_SIZE,
+                   &acb->cur_qiov, acb->cur_qiov.size / BDRV_SECTOR_SIZE,
+                   qed_aio_next_io, acb);
     return;
 
 err:
diff --git a/block/vdi.c b/block/vdi.c
index e1d8cff..6bb43b8 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -633,10 +633,6 @@ static void vdi_aio_read_cb(void *opaque, int ret)
         qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
         acb->hd_aiocb = bdrv_aio_readv(bs->file, offset, &acb->hd_qiov,
                                        n_sectors, vdi_aio_read_cb, acb);
-        if (acb->hd_aiocb == NULL) {
-            ret = -EIO;
-            goto done;
-        }
     }
     return;
 done:
@@ -708,10 +704,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
             qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
             acb->hd_aiocb = bdrv_aio_writev(bs->file, 0, &acb->hd_qiov, 1,
                                             vdi_aio_write_cb, acb);
-            if (acb->hd_aiocb == NULL) {
-                ret = -EIO;
-                goto done;
-            }
             return;
         } else if (VDI_IS_ALLOCATED(acb->bmap_first)) {
             /* One or more new blocks were allocated. */
@@ -738,10 +730,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
                    n_sectors, bmap_first);
             acb->hd_aiocb = bdrv_aio_writev(bs->file, offset, &acb->hd_qiov,
                                             n_sectors, vdi_aio_write_cb, acb);
-            if (acb->hd_aiocb == NULL) {
-                ret = -EIO;
-                goto done;
-            }
             return;
         }
         ret = 0;
@@ -789,10 +777,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
         acb->hd_aiocb = bdrv_aio_writev(bs->file, offset,
                                         &acb->hd_qiov, s->block_sectors,
                                         vdi_aio_write_cb, acb);
-        if (acb->hd_aiocb == NULL) {
-            ret = -EIO;
-            goto done;
-        }
     } else {
         uint64_t offset = s->header.offset_data / SECTOR_SIZE +
                           (uint64_t)bmap_entry * s->block_sectors +
@@ -802,10 +786,6 @@ static void vdi_aio_write_cb(void *opaque, int ret)
         qemu_iovec_init_external(&acb->hd_qiov, &acb->hd_iov, 1);
         acb->hd_aiocb = bdrv_aio_writev(bs->file, offset, &acb->hd_qiov,
                                         n_sectors, vdi_aio_write_cb, acb);
-        if (acb->hd_aiocb == NULL) {
-            ret = -EIO;
-            goto done;
-        }
     }
 
     return;
diff --git a/hw/ide/atapi.c b/hw/ide/atapi.c
index 8af1cfd..0adb27b 100644
--- a/hw/ide/atapi.c
+++ b/hw/ide/atapi.c
@@ -352,14 +352,8 @@ static void ide_atapi_cmd_read_dma_cb(void *opaque, int ret)
     s->bus->dma->aiocb = bdrv_aio_readv(s->bs, (int64_t)s->lba << 2,
                                        &s->bus->dma->qiov, n * 4,
                                        ide_atapi_cmd_read_dma_cb, s);
-    if (!s->bus->dma->aiocb) {
-        /* Note: media not present is the most likely case */
-        ide_atapi_cmd_error(s, NOT_READY,
-                            ASC_MEDIUM_NOT_PRESENT);
-        goto eot;
-    }
-
     return;
+
 eot:
     bdrv_acct_done(s->bs, &s->acct);
     s->bus->dma->ops->add_status(s->bus->dma, BM_STATUS_INT);
diff --git a/hw/ide/core.c b/hw/ide/core.c
index 49847bd..7071326 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -718,18 +718,13 @@ static void ide_flush_cb(void *opaque, int ret)
 
 void ide_flush_cache(IDEState *s)
 {
-    BlockDriverAIOCB *acb;
-
     if (s->bs == NULL) {
         ide_flush_cb(s, 0);
         return;
     }
 
     bdrv_acct_start(s->bs, &s->acct, 0, BDRV_ACCT_FLUSH);
-    acb = bdrv_aio_flush(s->bs, ide_flush_cb, s);
-    if (acb == NULL) {
-        ide_flush_cb(s, -EIO);
-    }
+    bdrv_aio_flush(s->bs, ide_flush_cb, s);
 }
 
 static void ide_cfata_metadata_inquiry(IDEState *s)
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index c09d2e0..40f60f0 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -84,13 +84,6 @@ static void pmac_ide_atapi_transfer_cb(void *opaque, int ret)
     m->aiocb = dma_bdrv_read(s->bs, &s->sg,
                              (int64_t)(s->lba << 2) + (s->io_buffer_index >> 9),
                              pmac_ide_atapi_transfer_cb, io);
-    if (!m->aiocb) {
-        qemu_sglist_destroy(&s->sg);
-        /* Note: media not present is the most likely case */
-        ide_atapi_cmd_error(s, NOT_READY,
-                            ASC_MEDIUM_NOT_PRESENT);
-        goto done;
-    }
     return;
 
 done:
diff --git a/hw/scsi-disk.c b/hw/scsi-disk.c
index 673948c..505accd 100644
--- a/hw/scsi-disk.c
+++ b/hw/scsi-disk.c
@@ -217,9 +217,6 @@ static void scsi_read_data(SCSIRequest *req)
     bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_READ);
     r->req.aiocb = bdrv_aio_readv(s->qdev.conf.bs, r->sector, &r->qiov, n,
                               scsi_read_complete, r);
-    if (r->req.aiocb == NULL) {
-        scsi_read_complete(r, -EIO);
-    }
 }
 
 /*
@@ -327,9 +324,6 @@ static void scsi_write_data(SCSIRequest *req)
         bdrv_acct_start(s->qdev.conf.bs, &r->acct, n * BDRV_SECTOR_SIZE, BDRV_ACCT_WRITE);
         r->req.aiocb = bdrv_aio_writev(s->qdev.conf.bs, r->sector, &r->qiov, n,
                                        scsi_write_complete, r);
-        if (r->req.aiocb == NULL) {
-            scsi_write_complete(r, -ENOMEM);
-        }
     } else {
         /* Called for the first time.  Ask the driver to send us more data.  */
         scsi_write_complete(r, 0);
@@ -1332,9 +1326,6 @@ static int32_t scsi_send_command(SCSIRequest *req, uint8_t *buf)
         scsi_req_ref(&r->req);
         bdrv_acct_start(s->qdev.conf.bs, &r->acct, 0, BDRV_ACCT_FLUSH);
         r->req.aiocb = bdrv_aio_flush(s->qdev.conf.bs, scsi_flush_complete, r);
-        if (r->req.aiocb == NULL) {
-            scsi_flush_complete(r, -EIO);
-        }
         return 0;
     case READ_6:
     case READ_10:
diff --git a/hw/scsi-generic.c b/hw/scsi-generic.c
index e62044f..6f7d3db 100644
--- a/hw/scsi-generic.c
+++ b/hw/scsi-generic.c
@@ -152,10 +152,6 @@ static int execute_command(BlockDriverState *bdrv,
     r->io_header.flags |= SG_FLAG_DIRECT_IO;
 
     r->req.aiocb = bdrv_aio_ioctl(bdrv, SG_IO, &r->io_header, complete, r);
-    if (r->req.aiocb == NULL) {
-        BADF("execute_command: read failed !\n");
-        return -ENOMEM;
-    }
 
     return 0;
 }
diff --git a/hw/virtio-blk.c b/hw/virtio-blk.c
index 4b0d113..ef27421 100644
--- a/hw/virtio-blk.c
+++ b/hw/virtio-blk.c
@@ -288,19 +288,13 @@ static void virtio_submit_multiwrite(BlockDriverState *bs, MultiReqBuffer *mrb)
 
 static void virtio_blk_handle_flush(VirtIOBlockReq *req, MultiReqBuffer *mrb)
 {
-    BlockDriverAIOCB *acb;
-
     bdrv_acct_start(req->dev->bs, &req->acct, 0, BDRV_ACCT_FLUSH);
 
     /*
      * Make sure all outstanding writes are posted to the backing device.
      */
     virtio_submit_multiwrite(req->dev->bs, mrb);
-
-    acb = bdrv_aio_flush(req->dev->bs, virtio_blk_flush_complete, req);
-    if (!acb) {
-        virtio_blk_flush_complete(req, -EIO);
-    }
+    bdrv_aio_flush(req->dev->bs, virtio_blk_flush_complete, req);
 }
 
 static void virtio_blk_handle_write(VirtIOBlockReq *req, MultiReqBuffer *mrb)
@@ -340,7 +334,6 @@ static void virtio_blk_handle_write(VirtIOBlockReq *req, MultiReqBuffer *mrb)
 
 static void virtio_blk_handle_read(VirtIOBlockReq *req)
 {
-    BlockDriverAIOCB *acb;
     uint64_t sector;
 
     sector = ldq_p(&req->out->sector);
@@ -355,13 +348,9 @@ static void virtio_blk_handle_read(VirtIOBlockReq *req)
         virtio_blk_rw_complete(req, -EIO);
         return;
     }
-
-    acb = bdrv_aio_readv(req->dev->bs, sector, &req->qiov,
-                         req->qiov.size / BDRV_SECTOR_SIZE,
-                         virtio_blk_rw_complete, req);
-    if (!acb) {
-        virtio_blk_rw_complete(req, -EIO);
-    }
+    bdrv_aio_readv(req->dev->bs, sector, &req->qiov,
+                   req->qiov.size / BDRV_SECTOR_SIZE,
+                   virtio_blk_rw_complete, req);
 }
 
 static void virtio_blk_handle_request(VirtIOBlockReq *req,
diff --git a/qemu-io.c b/qemu-io.c
index 622debc..ffa62fb 100644
--- a/qemu-io.c
+++ b/qemu-io.c
@@ -244,14 +244,10 @@ static void aio_rw_done(void *opaque, int ret)
 
 static int do_aio_readv(QEMUIOVector *qiov, int64_t offset, int *total)
 {
-    BlockDriverAIOCB *acb;
     int async_ret = NOT_DONE;
 
-    acb = bdrv_aio_readv(bs, offset >> 9, qiov, qiov->size >> 9,
-                         aio_rw_done, &async_ret);
-    if (!acb) {
-        return -EIO;
-    }
+    bdrv_aio_readv(bs, offset >> 9, qiov, qiov->size >> 9,
+                   aio_rw_done, &async_ret);
     while (async_ret == NOT_DONE) {
         qemu_aio_wait();
     }
@@ -262,15 +258,10 @@ static int do_aio_readv(QEMUIOVector *qiov, int64_t offset, int *total)
 
 static int do_aio_writev(QEMUIOVector *qiov, int64_t offset, int *total)
 {
-    BlockDriverAIOCB *acb;
     int async_ret = NOT_DONE;
 
-    acb = bdrv_aio_writev(bs, offset >> 9, qiov, qiov->size >> 9,
-                          aio_rw_done, &async_ret);
-    if (!acb) {
-        return -EIO;
-    }
-
+    bdrv_aio_writev(bs, offset >> 9, qiov, qiov->size >> 9,
+                    aio_rw_done, &async_ret);
     while (async_ret == NOT_DONE) {
         qemu_aio_wait();
     }
@@ -1151,7 +1142,6 @@ static int aio_read_f(int argc, char **argv)
 {
     int nr_iov, c;
     struct aio_ctx *ctx = calloc(1, sizeof(struct aio_ctx));
-    BlockDriverAIOCB *acb;
 
     while ((c = getopt(argc, argv, "CP:qv")) != EOF) {
         switch (c) {
@@ -1206,14 +1196,8 @@ static int aio_read_f(int argc, char **argv)
     }
 
     gettimeofday(&ctx->t1, NULL);
-    acb = bdrv_aio_readv(bs, ctx->offset >> 9, &ctx->qiov,
-                         ctx->qiov.size >> 9, aio_read_done, ctx);
-    if (!acb) {
-        free(ctx->buf);
-        free(ctx);
-        return -EIO;
-    }
-
+    bdrv_aio_readv(bs, ctx->offset >> 9, &ctx->qiov,
+                   ctx->qiov.size >> 9, aio_read_done, ctx);
     return 0;
 }
 
@@ -1254,7 +1238,6 @@ static int aio_write_f(int argc, char **argv)
     int nr_iov, c;
     int pattern = 0xcd;
     struct aio_ctx *ctx = calloc(1, sizeof(struct aio_ctx));
-    BlockDriverAIOCB *acb;
 
     while ((c = getopt(argc, argv, "CqP:")) != EOF) {
         switch (c) {
@@ -1305,14 +1288,8 @@ static int aio_write_f(int argc, char **argv)
     }
 
     gettimeofday(&ctx->t1, NULL);
-    acb = bdrv_aio_writev(bs, ctx->offset >> 9, &ctx->qiov,
-                          ctx->qiov.size >> 9, aio_write_done, ctx);
-    if (!acb) {
-        free(ctx->buf);
-        free(ctx);
-        return -EIO;
-    }
-
+    bdrv_aio_writev(bs, ctx->offset >> 9, &ctx->qiov,
+                    ctx->qiov.size >> 9, aio_write_done, ctx);
     return 0;
 }
 
diff --git a/trace-events b/trace-events
index bf1cf57..514849a 100644
--- a/trace-events
+++ b/trace-events
@@ -59,8 +59,6 @@ virtio_console_chr_event(unsigned int port, int event) "port %u, event %d"
 bdrv_open_common(void *bs, const char *filename, int flags, const char *format_name) "bs %p filename \"%s\" flags %#x format_name \"%s\""
 multiwrite_cb(void *mcb, int ret) "mcb %p ret %d"
 bdrv_aio_multiwrite(void *mcb, int num_callbacks, int num_reqs) "mcb %p num_callbacks %d num_reqs %d"
-bdrv_aio_multiwrite_earlyfail(void *mcb) "mcb %p"
-bdrv_aio_multiwrite_latefail(void *mcb, int i) "mcb %p i %d"
 bdrv_aio_discard(void *bs, int64_t sector_num, int nb_sectors, void *opaque) "bs %p sector_num %"PRId64" nb_sectors %d opaque %p"
 bdrv_aio_flush(void *bs, void *opaque) "bs %p opaque %p"
 bdrv_aio_readv(void *bs, int64_t sector_num, int nb_sectors, void *opaque) "bs %p sector_num %"PRId64" nb_sectors %d opaque %p"
-- 
1.7.6.4

[Qemu-devel] [PATCH 02/14] block: simplify failure handling for bdrv_aio_multiwrite

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

Now that early failure of bdrv_aio_writev is not possible anymore,
mcb->num_requests can be set before the loop starts.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c |   28 ++--------------------------
 1 files changed, 2 insertions(+), 26 deletions(-)

diff --git a/block.c b/block.c
index 434c13d..16a4c42 100644
--- a/block.c
+++ b/block.c
@@ -2842,37 +2842,13 @@ int bdrv_aio_multiwrite(BlockDriverState *bs, BlockRequest *reqs, int num_reqs)
 
     trace_bdrv_aio_multiwrite(mcb, mcb->num_callbacks, num_reqs);
 
-    /*
-     * Run the aio requests. As soon as one request can't be submitted
-     * successfully, fail all requests that are not yet submitted (we must
-     * return failure for all requests anyway)
-     *
-     * num_requests cannot be set to the right value immediately: If
-     * bdrv_aio_writev fails for some request, num_requests would be too high
-     * and therefore multiwrite_cb() would never recognize the multiwrite
-     * request as completed. We also cannot use the loop variable i to set it
-     * when the first request fails because the callback may already have been
-     * called for previously submitted requests. Thus, num_requests must be
-     * incremented for each request that is submitted.
-     *
-     * The problem that callbacks may be called early also means that we need
-     * to take care that num_requests doesn't become 0 before all requests are
-     * submitted - multiwrite_cb() would consider the multiwrite request
-     * completed. A dummy request that is "completed" by a manual call to
-     * multiwrite_cb() takes care of this.
-     */
-    mcb->num_requests = 1;
-
-    // Run the aio requests
+    /* Run the aio requests. */
+    mcb->num_requests = num_reqs;
     for (i = 0; i < num_reqs; i++) {
-        mcb->num_requests++;
         bdrv_aio_writev(bs, reqs[i].sector, reqs[i].qiov,
             reqs[i].nb_sectors, multiwrite_cb, mcb);
     }
 
-    /* Complete the dummy request */
-    multiwrite_cb(mcb, 0);
-
     return 0;
 }
 
-- 
1.7.6.4

[Qemu-devel] [PATCH 03/14] block: qemu_aio_get does not return NULL

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

Initially done with the following semantic patch:

@ rule1 @
expression E;
statement S;
@@
  E = qemu_aio_get (...);
(
- if (E == NULL) { ... }
|
- if (E)
    { <... S ...> }
)

which however missed occurrences in linux-aio.c and posix-aio-compat.c.
Those were done by hand.

The change in vdi_aio_setup's caller was also done by hand.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/curl.c       |    4 ----
 block/rbd.c        |    3 ---
 block/vdi.c        |   46 ++++++++++++++++++----------------------------
 linux-aio.c        |    2 --
 posix-aio-compat.c |    4 ----
 5 files changed, 18 insertions(+), 41 deletions(-)

diff --git a/block/curl.c b/block/curl.c
index 4209ac8..e9102e3 100644
--- a/block/curl.c
+++ b/block/curl.c
@@ -509,10 +509,6 @@ static BlockDriverAIOCB *curl_aio_readv(BlockDriverState *bs,
 
     acb = qemu_aio_get(&curl_aio_pool, bs, cb, opaque);
 
-    if (!acb) {
-        return NULL;
-    }
-
     acb->qiov = qiov;
     acb->sector_num = sector_num;
     acb->nb_sectors = nb_sectors;
diff --git a/block/rbd.c b/block/rbd.c
index 9088c52..312584a 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -632,9 +632,6 @@ static BlockDriverAIOCB *rbd_aio_rw_vector(BlockDriverState *bs,
     BDRVRBDState *s = bs->opaque;
 
     acb = qemu_aio_get(&rbd_aio_pool, bs, cb, opaque);
-    if (!acb) {
-        return NULL;
-    }
     acb->write = write;
     acb->qiov = qiov;
     acb->bounce = qemu_blockalign(bs, qiov->size);
diff --git a/block/vdi.c b/block/vdi.c
index 6bb43b8..31cdfab 100644
--- a/block/vdi.c
+++ b/block/vdi.c
@@ -515,28 +515,26 @@ static VdiAIOCB *vdi_aio_setup(BlockDriverState *bs, int64_t sector_num,
            bs, sector_num, qiov, nb_sectors, cb, opaque, is_write);
 
     acb = qemu_aio_get(&vdi_aio_pool, bs, cb, opaque);
-    if (acb) {
-        acb->hd_aiocb = NULL;
-        acb->sector_num = sector_num;
-        acb->qiov = qiov;
-        acb->is_write = is_write;
-
-        if (qiov->niov > 1) {
-            acb->buf = qemu_blockalign(bs, qiov->size);
-            acb->orig_buf = acb->buf;
-            if (is_write) {
-                qemu_iovec_to_buffer(qiov, acb->buf);
-            }
-        } else {
-            acb->buf = (uint8_t *)qiov->iov->iov_base;
+    acb->hd_aiocb = NULL;
+    acb->sector_num = sector_num;
+    acb->qiov = qiov;
+    acb->is_write = is_write;
+
+    if (qiov->niov > 1) {
+        acb->buf = qemu_blockalign(bs, qiov->size);
+        acb->orig_buf = acb->buf;
+        if (is_write) {
+            qemu_iovec_to_buffer(qiov, acb->buf);
         }
-        acb->nb_sectors = nb_sectors;
-        acb->n_sectors = 0;
-        acb->bmap_first = VDI_UNALLOCATED;
-        acb->bmap_last = VDI_UNALLOCATED;
-        acb->block_buffer = NULL;
-        acb->header_modified = 0;
-    }
+    } else {
+        acb->buf = (uint8_t *)qiov->iov->iov_base;
+    }
+    acb->nb_sectors = nb_sectors;
+    acb->n_sectors = 0;
+    acb->bmap_first = VDI_UNALLOCATED;
+    acb->bmap_last = VDI_UNALLOCATED;
+    acb->block_buffer = NULL;
+    acb->header_modified = 0;
     return acb;
 }
 
@@ -653,10 +651,6 @@ static BlockDriverAIOCB *vdi_aio_readv(BlockDriverState *bs,
 
     logout("\n");
     acb = vdi_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 0);
-    if (!acb) {
-        return NULL;
-    }
-
     ret = vdi_schedule_bh(vdi_aio_rw_bh, acb);
     if (ret < 0) {
         if (acb->qiov->niov > 1) {
@@ -807,10 +801,6 @@ static BlockDriverAIOCB *vdi_aio_writev(BlockDriverState *bs,
 
     logout("\n");
     acb = vdi_aio_setup(bs, sector_num, qiov, nb_sectors, cb, opaque, 1);
-    if (!acb) {
-        return NULL;
-    }
-
     ret = vdi_schedule_bh(vdi_aio_rw_bh, acb);
     if (ret < 0) {
         if (acb->qiov->niov > 1) {
diff --git a/linux-aio.c b/linux-aio.c
index 1c635ef..d2fc2e7 100644
--- a/linux-aio.c
+++ b/linux-aio.c
@@ -166,8 +166,6 @@ BlockDriverAIOCB *laio_submit(BlockDriverState *bs, void *aio_ctx, int fd,
     off_t offset = sector_num * 512;
 
     laiocb = qemu_aio_get(&laio_pool, bs, cb, opaque);
-    if (!laiocb)
-        return NULL;
     laiocb->nbytes = nb_sectors * 512;
     laiocb->ctx = s;
     laiocb->ret = -EINPROGRESS;
diff --git a/posix-aio-compat.c b/posix-aio-compat.c
index c380ec1..cccb673 100644
--- a/posix-aio-compat.c
+++ b/posix-aio-compat.c
@@ -611,8 +611,6 @@ BlockDriverAIOCB *paio_submit(BlockDriverState *bs, int fd,
     struct qemu_paiocb *acb;
 
     acb = qemu_aio_get(&raw_aio_pool, bs, cb, opaque);
-    if (!acb)
-        return NULL;
     acb->aio_type = type;
     acb->aio_fildes = fd;
 
@@ -638,8 +636,6 @@ BlockDriverAIOCB *paio_ioctl(BlockDriverState *bs, int fd,
     struct qemu_paiocb *acb;
 
     acb = qemu_aio_get(&raw_aio_pool, bs, cb, opaque);
-    if (!acb)
-        return NULL;
     acb->aio_type = QEMU_AIO_IOCTL;
     acb->aio_fildes = fd;
     acb->aio_offset = 0;
-- 
1.7.6.4

[Qemu-devel] [PATCH 04/14] dma: the passed io_func does not return NULL

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

Initially found with the following semantic patch:

@ type @
BlockDriverAIOCB *x;
expression E;
@@
  x = E;
- if (x == NULL) { ... }

@ acb1 @
expression E, E1;
@@
  E1->acb = E;
- if (E1->acb == NULL) { ... }

@ aiocb1 @
expression E, E1;
@@
  E1->aiocb = E;
- if (E1->aiocb == NULL) { ... }

@ acb @
expression E, E1;
@@
  E1.acb = E;
- if (E1.acb == NULL) { ... }

@ aiocb @
expression E, E1;
@@
  E1.aiocb = E;
- if (E1.aiocb == NULL) { ... }

but changed manually to include an assert.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 dma-helpers.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/dma-helpers.c b/dma-helpers.c
index 9d6b6fa..f08cdb5 100644
--- a/dma-helpers.c
+++ b/dma-helpers.c
@@ -142,9 +142,7 @@ static void dma_bdrv_cb(void *opaque, int ret)
 
     dbs->acb = dbs->io_func(dbs->bs, dbs->sector_num, &dbs->iov,
                             dbs->iov.size / 512, dma_bdrv_cb, dbs);
-    if (!dbs->acb) {
-        dma_complete(dbs, -EIO);
-    }
+    assert(dbs->acb);
 }
 
 static void dma_aio_cancel(BlockDriverAIOCB *acb)
-- 
1.7.6.4

[Qemu-devel] [PATCH 05/14] block: dma_bdrv_* does not return NULL

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

Initially attempted with the following semantic patch:

@ rule1 @
expression E;
statement S;
@@
  E =
(
   dma_bdrv_io
|  dma_bdrv_read
|  dma_bdrv_write
)
     (...);
(
- if (E == NULL) { ... }
|
- if (E)
    { <... S ...> }
)

which however did not match anything.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/ide/core.c  |    6 ------
 hw/ide/macio.c |    4 +---
 2 files changed, 1 insertions(+), 9 deletions(-)

diff --git a/hw/ide/core.c b/hw/ide/core.c
index 7071326..de9ed41 100644
--- a/hw/ide/core.c
+++ b/hw/ide/core.c
@@ -549,7 +549,6 @@ void ide_dma_cb(void *opaque, int ret)
     int n;
     int64_t sector_num;
 
-handle_rw_error:
     if (ret < 0) {
         int op = BM_STATUS_DMA_RETRY;
 
@@ -608,11 +607,6 @@ handle_rw_error:
                                          ide_issue_trim, ide_dma_cb, s, true);
         break;
     }
-
-    if (!s->bus->dma->aiocb) {
-        ret = -1;
-        goto handle_rw_error;
-    }
     return;
 
 eot:
diff --git a/hw/ide/macio.c b/hw/ide/macio.c
index 40f60f0..abbc41b 100644
--- a/hw/ide/macio.c
+++ b/hw/ide/macio.c
@@ -152,10 +152,8 @@ static void pmac_ide_transfer_cb(void *opaque, int ret)
                                ide_issue_trim, pmac_ide_transfer_cb, s, true);
         break;
     }
-
-    if (!m->aiocb)
-        pmac_ide_transfer_cb(io, -1);
     return;
+
 done:
     if (s->dma_cmd == IDE_DMA_READ || s->dma_cmd == IDE_DMA_WRITE) {
         bdrv_acct_done(s->bs, &s->acct);
-- 
1.7.6.4

[Qemu-devel] [PATCH 06/14] block: avoid useless checks on acb->bh

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

Coverity is confused by this "if" and reports leaks on acb->bh.
The bottom half is always deleted before releasing the AIOCB,
in either bdrv_aio_cancel_em or bdrv_aio_bh_cb.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c |    4 +---
 1 files changed, 1 insertions(+), 3 deletions(-)

diff --git a/block.c b/block.c
index 16a4c42..3f072f6 100644
--- a/block.c
+++ b/block.c
@@ -3077,9 +3077,7 @@ static BlockDriverAIOCB *bdrv_aio_rw_vector(BlockDriverState *bs,
     acb->is_write = is_write;
     acb->qiov = qiov;
     acb->bounce = qemu_blockalign(bs, qiov->size);
-
-    if (!acb->bh)
-        acb->bh = qemu_bh_new(bdrv_aio_bh_cb, acb);
+    acb->bh = qemu_bh_new(bdrv_aio_bh_cb, acb);
 
     if (is_write) {
         qemu_iovec_to_buffer(acb->qiov, acb->bounce);
-- 
1.7.6.4

[Qemu-devel] [PATCH 07/14] block/qcow2.c: call qcow2_free_snapshots in the function of qcow2_close

[Kevin Wolf]

From: Li Zhi Hui <zhihuili@linux.vnet.ibm.com>

Signed-off-by: Li Zhi Hui <zhihuili@linux.vnet.ibm.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c |    1 +
 1 files changed, 1 insertions(+), 0 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index 37cd442..aa32e8d 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -635,6 +635,7 @@ static void qcow2_close(BlockDriverState *bs)
     g_free(s->cluster_cache);
     qemu_vfree(s->cluster_data);
     qcow2_refcount_close(bs);
+    qcow2_free_snapshots(bs);
 }
 
 static void qcow2_invalidate_cache(BlockDriverState *bs)
-- 
1.7.6.4

[Qemu-devel] [PATCH 08/14] rbd: always set out parameter in qemu_rbd_snap_list

[Kevin Wolf]

From: Josh Durgin <josh.durgin@dreamhost.com>

The caller expects psn_tab to be NULL when there are no snapshots or
an error occurs. This results in calling g_free on an invalid address.

Reported-by: Oliver Francke <Oliver@filoo.de>
Signed-off-by: Josh Durgin <josh.durgin@dreamhost.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c |    3 ++-
 1 files changed, 2 insertions(+), 1 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index 312584a..7a2384c 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -805,7 +805,7 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
     } while (snap_count == -ERANGE);
 
     if (snap_count <= 0) {
-        return snap_count;
+        goto done;
     }
 
     sn_tab = g_malloc0(snap_count * sizeof(QEMUSnapshotInfo));
@@ -824,6 +824,7 @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
     }
     rbd_snap_list_end(snaps);
 
+ done:
     *psn_tab = sn_tab;
     return snap_count;
 }
-- 
1.7.6.4

[Qemu-devel] [PATCH 09/14] qemu-img rebase: Fix for undersized backing files

[Kevin Wolf]

Backing files may be smaller than the corresponding COW file. When
reading directly from the backing file, qemu-img rebase must consider
this and assume zero sectors after the end of backing files.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 qemu-img.c |   42 +++++++++++++++++++++++++++++++++---------
 1 files changed, 33 insertions(+), 9 deletions(-)

diff --git a/qemu-img.c b/qemu-img.c
index 8bdae66..01cc0d3 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -1420,6 +1420,8 @@ static int img_rebase(int argc, char **argv)
      */
     if (!unsafe) {
         uint64_t num_sectors;
+        uint64_t old_backing_num_sectors;
+        uint64_t new_backing_num_sectors;
         uint64_t sector;
         int n;
         uint8_t * buf_old;
@@ -1430,6 +1432,8 @@ static int img_rebase(int argc, char **argv)
         buf_new = qemu_blockalign(bs, IO_BUF_SIZE);
 
         bdrv_get_geometry(bs, &num_sectors);
+        bdrv_get_geometry(bs_old_backing, &old_backing_num_sectors);
+        bdrv_get_geometry(bs_new_backing, &new_backing_num_sectors);
 
         local_progress = (float)100 /
             (num_sectors / MIN(num_sectors, IO_BUF_SIZE / 512));
@@ -1448,16 +1452,36 @@ static int img_rebase(int argc, char **argv)
                 continue;
             }
 
-            /* Read old and new backing file */
-            ret = bdrv_read(bs_old_backing, sector, buf_old, n);
-            if (ret < 0) {
-                error_report("error while reading from old backing file");
-                goto out;
+            /*
+             * Read old and new backing file and take into consideration that
+             * backing files may be smaller than the COW image.
+             */
+            if (sector >= old_backing_num_sectors) {
+                memset(buf_old, 0, n * BDRV_SECTOR_SIZE);
+            } else {
+                if (sector + n > old_backing_num_sectors) {
+                    n = old_backing_num_sectors - sector;
+                }
+
+                ret = bdrv_read(bs_old_backing, sector, buf_old, n);
+                if (ret < 0) {
+                    error_report("error while reading from old backing file");
+                    goto out;
+                }
             }
-            ret = bdrv_read(bs_new_backing, sector, buf_new, n);
-            if (ret < 0) {
-                error_report("error while reading from new backing file");
-                goto out;
+
+            if (sector >= new_backing_num_sectors) {
+                memset(buf_new, 0, n * BDRV_SECTOR_SIZE);
+            } else {
+                if (sector + n > new_backing_num_sectors) {
+                    n = new_backing_num_sectors - sector;
+                }
+
+                ret = bdrv_read(bs_new_backing, sector, buf_new, n);
+                if (ret < 0) {
+                    error_report("error while reading from new backing file");
+                    goto out;
+                }
             }
 
             /* If they differ, we need to write to the COW file */
-- 
1.7.6.4

[Qemu-devel] [PATCH 10/14] Documentation: Add qemu-img -t parameter in man page

[Kevin Wolf]

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>
---
 qemu-img-cmds.hx |    6 +++---
 qemu-img.texi    |   10 +++++++---
 2 files changed, 10 insertions(+), 6 deletions(-)

diff --git a/qemu-img-cmds.hx b/qemu-img-cmds.hx
index 4be00a5..49dce7c 100644
--- a/qemu-img-cmds.hx
+++ b/qemu-img-cmds.hx
@@ -24,13 +24,13 @@ ETEXI
 DEF("commit", img_commit,
     "commit [-f fmt] [-t cache] filename")
 STEXI
-@item commit [-f @var{fmt}] @var{filename}
+@item commit [-f @var{fmt}] [-t @var{cache}] @var{filename}
 ETEXI
 
 DEF("convert", img_convert,
     "convert [-c] [-p] [-f fmt] [-t cache] [-O output_fmt] [-o options] [-s snapshot_name] [-S sparse_size] filename [filename2 [...]] output_filename")
 STEXI
-@item convert [-c] [-p] [-f @var{fmt}] [-O @var{output_fmt}] [-o @var{options}] [-s @var{snapshot_name}] [-S @var{sparse_size}] @var{filename} [@var{filename2} [...]] @var{output_filename}
+@item convert [-c] [-p] [-f @var{fmt}] [-t @var{cache}] [-O @var{output_fmt}] [-o @var{options}] [-s @var{snapshot_name}] [-S @var{sparse_size}] @var{filename} [@var{filename2} [...]] @var{output_filename}
 ETEXI
 
 DEF("info", img_info,
@@ -48,7 +48,7 @@ ETEXI
 DEF("rebase", img_rebase,
     "rebase [-f fmt] [-t cache] [-p] [-u] -b backing_file [-F backing_fmt] filename")
 STEXI
-@item rebase [-f @var{fmt}] [-p] [-u] -b @var{backing_file} [-F @var{backing_fmt}] @var{filename}
+@item rebase [-f @var{fmt}] [-t @var{cache}] [-p] [-u] -b @var{backing_file} [-F @var{backing_fmt}] @var{filename}
 ETEXI
 
 DEF("resize", img_resize,
diff --git a/qemu-img.texi b/qemu-img.texi
index 70fa321..b2ca3a5 100644
--- a/qemu-img.texi
+++ b/qemu-img.texi
@@ -45,6 +45,10 @@ indicates the consecutive number of bytes that must contain only zeros
 for qemu-img to create a sparse image during conversion. This value is rounded
 down to the nearest 512 bytes. You may use the common size suffixes like
 @code{k} for kilobytes.
+@item -t @var{cache}
+specifies the cache mode that should be used with the (destination) file. See
+the documentation of the emulator's @code{-drive cache=...} option for allowed
+values.
 @end table
 
 Parameters to snapshot subcommand:
@@ -87,11 +91,11 @@ this case. @var{backing_file} will never be modified unless you use the
 The size can also be specified using the @var{size} option with @code{-o},
 it doesn't need to be specified separately in this case.
 
-@item commit [-f @var{fmt}] @var{filename}
+@item commit [-f @var{fmt}] [-t @var{cache}] @var{filename}
 
 Commit the changes recorded in @var{filename} in its base image.
 
-@item convert [-c] [-p] [-f @var{fmt}] [-O @var{output_fmt}] [-o @var{options}] [-s @var{snapshot_name}] [-S @var{sparse_size}] @var{filename} [@var{filename2} [...]] @var{output_filename}
+@item convert [-c] [-p] [-f @var{fmt}] [-t @var{cache}] [-O @var{output_fmt}] [-o @var{options}] [-s @var{snapshot_name}] [-S @var{sparse_size}] @var{filename} [@var{filename2} [...]] @var{output_filename}
 
 Convert the disk image @var{filename} or a snapshot @var{snapshot_name} to disk image @var{output_filename}
 using format @var{output_fmt}. It can be optionally compressed (@code{-c}
@@ -121,7 +125,7 @@ they are displayed too.
 
 List, apply, create or delete snapshots in image @var{filename}.
 
-@item rebase [-f @var{fmt}] [-p] [-u] -b @var{backing_file} [-F @var{backing_fmt}] @var{filename}
+@item rebase [-f @var{fmt}] [-t @var{cache}] [-p] [-u] -b @var{backing_file} [-F @var{backing_fmt}] @var{filename}
 
 Changes the backing file of an image. Only the formats @code{qcow2} and
 @code{qed} support changing the backing file.
-- 
1.7.6.4

[Qemu-devel] [PATCH 11/14] qcow2: Allow >4 GB VM state

[Kevin Wolf]

This is a compatible extension to the snapshot header format that allows
saving a 64 bit VM state size.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.h                |    2 +-
 block/qcow2-snapshot.c |   34 ++++++++++++++++++++++++++++++++--
 block/qcow2.h          |    2 +-
 docs/specs/qcow2.txt   |    8 +++++++-
 savevm.c               |    2 +-
 5 files changed, 42 insertions(+), 6 deletions(-)

diff --git a/block.h b/block.h
index 0e3ff9f..3bd4398 100644
--- a/block.h
+++ b/block.h
@@ -22,7 +22,7 @@ typedef struct QEMUSnapshotInfo {
     /* the following fields are informative. They are not needed for
        the consistency of the snapshot */
     char name[256]; /* user chosen name */
-    uint32_t vm_state_size; /* VM state info size */
+    uint64_t vm_state_size; /* VM state info size */
     uint32_t date_sec; /* UTC date of the snapshot */
     uint32_t date_nsec;
     uint64_t vm_clock_nsec; /* VM clock relative to boot */
diff --git a/block/qcow2-snapshot.c b/block/qcow2-snapshot.c
index c3112bf..7d3fde5 100644
--- a/block/qcow2-snapshot.c
+++ b/block/qcow2-snapshot.c
@@ -46,6 +46,10 @@ typedef struct QEMU_PACKED QCowSnapshotHeader {
     /* name follows  */
 } QCowSnapshotHeader;
 
+typedef struct QEMU_PACKED QCowSnapshotExtraData {
+    uint64_t vm_state_size_large;
+} QCowSnapshotExtraData;
+
 void qcow2_free_snapshots(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
@@ -64,6 +68,7 @@ int qcow2_read_snapshots(BlockDriverState *bs)
 {
     BDRVQcowState *s = bs->opaque;
     QCowSnapshotHeader h;
+    QCowSnapshotExtraData extra;
     QCowSnapshot *sn;
     int i, id_str_size, name_size;
     int64_t offset;
@@ -100,9 +105,18 @@ int qcow2_read_snapshots(BlockDriverState *bs)
         id_str_size = be16_to_cpu(h.id_str_size);
         name_size = be16_to_cpu(h.name_size);
 
-        /* Skip extra data */
+        /* Read extra data */
+        ret = bdrv_pread(bs->file, offset, &extra,
+                         MIN(sizeof(extra), extra_data_size));
+        if (ret < 0) {
+            goto fail;
+        }
         offset += extra_data_size;
 
+        if (extra_data_size >= 8) {
+            sn->vm_state_size = be64_to_cpu(extra.vm_state_size_large);
+        }
+
         /* Read snapshot ID */
         sn->id_str = g_malloc(id_str_size + 1);
         ret = bdrv_pread(bs->file, offset, sn->id_str, id_str_size);
@@ -136,6 +150,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
     BDRVQcowState *s = bs->opaque;
     QCowSnapshot *sn;
     QCowSnapshotHeader h;
+    QCowSnapshotExtraData extra;
     int i, name_size, id_str_size, snapshots_size;
     struct {
         uint32_t nb_snapshots;
@@ -150,6 +165,7 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
         sn = s->snapshots + i;
         offset = align_offset(offset, 8);
         offset += sizeof(h);
+        offset += sizeof(extra);
         offset += strlen(sn->id_str);
         offset += strlen(sn->name);
     }
@@ -169,10 +185,18 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
         memset(&h, 0, sizeof(h));
         h.l1_table_offset = cpu_to_be64(sn->l1_table_offset);
         h.l1_size = cpu_to_be32(sn->l1_size);
-        h.vm_state_size = cpu_to_be32(sn->vm_state_size);
+        /* If it doesn't fit in 32 bit, older implementations should treat it
+         * as a disk-only snapshot rather than truncate the VM state */
+        if (sn->vm_state_size <= 0xffffffff) {
+            h.vm_state_size = cpu_to_be32(sn->vm_state_size);
+        }
         h.date_sec = cpu_to_be32(sn->date_sec);
         h.date_nsec = cpu_to_be32(sn->date_nsec);
         h.vm_clock_nsec = cpu_to_be64(sn->vm_clock_nsec);
+        h.extra_data_size = cpu_to_be32(sizeof(extra));
+
+        memset(&extra, 0, sizeof(extra));
+        extra.vm_state_size_large = cpu_to_be64(sn->vm_state_size);
 
         id_str_size = strlen(sn->id_str);
         name_size = strlen(sn->name);
@@ -186,6 +210,12 @@ static int qcow2_write_snapshots(BlockDriverState *bs)
         }
         offset += sizeof(h);
 
+        ret = bdrv_pwrite(bs->file, offset, &extra, sizeof(extra));
+        if (ret < 0) {
+            goto fail;
+        }
+        offset += sizeof(extra);
+
         ret = bdrv_pwrite(bs->file, offset, sn->id_str, id_str_size);
         if (ret < 0) {
             goto fail;
diff --git a/block/qcow2.h b/block/qcow2.h
index 4e44eea..99e4536 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -78,7 +78,7 @@ typedef struct QCowSnapshot {
     uint32_t l1_size;
     char *id_str;
     char *name;
-    uint32_t vm_state_size;
+    uint64_t vm_state_size;
     uint32_t date_sec;
     uint32_t date_nsec;
     uint64_t vm_clock_nsec;
diff --git a/docs/specs/qcow2.txt b/docs/specs/qcow2.txt
index e792953..b6adcad 100644
--- a/docs/specs/qcow2.txt
+++ b/docs/specs/qcow2.txt
@@ -253,7 +253,13 @@ Snapshot table entry:
         36 - 39:    Size of extra data in the table entry (used for future
                     extensions of the format)
 
-        variable:   Extra data for future extensions. Must be ignored.
+        variable:   Extra data for future extensions. Unknown fields must be
+                    ignored. Currently defined are (offset relative to snapshot
+                    table entry):
+
+                    Byte 40 - 47:   Size of the VM state in bytes. 0 if no VM
+                                    state is saved. If this field is present,
+                                    the 32-bit value in bytes 32-35 is ignored.
 
         variable:   Unique ID string for the snapshot (not null terminated)
 
diff --git a/savevm.c b/savevm.c
index b72f6c0..f153c25 100644
--- a/savevm.c
+++ b/savevm.c
@@ -2002,7 +2002,7 @@ void do_savevm(Monitor *mon, const QDict *qdict)
     int ret;
     QEMUFile *f;
     int saved_vm_running;
-    uint32_t vm_state_size;
+    uint64_t vm_state_size;
 #ifdef _WIN32
     struct _timeb tb;
     struct tm *ptm;
-- 
1.7.6.4

[Qemu-devel] [PATCH 12/14] coroutine: switch per-thread free pool to a global pool

[Kevin Wolf]

From: Avi Kivity <avi@redhat.com>

ucontext-based coroutines use a free pool to reduce allocations and
deallocations of coroutine objects.  The pool is per-thread, presumably
to improve locality.  However, as coroutines are usually allocated in
a vcpu thread and freed in the I/O thread, the pool accounting gets
screwed up and we end allocating and freeing a coroutine for every I/O
request.  This is expensive since large objects are allocated via the
kernel, and are not cached by the C runtime.

Fix by switching to a global pool.  This is safe since we're protected
by the global mutex.

Signed-off-by: Avi Kivity <avi@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 coroutine-ucontext.c |   30 ++++++++++++++++--------------
 1 files changed, 16 insertions(+), 14 deletions(-)

diff --git a/coroutine-ucontext.c b/coroutine-ucontext.c
index 2b8d3e9..3d01075 100644
--- a/coroutine-ucontext.c
+++ b/coroutine-ucontext.c
@@ -35,6 +35,10 @@ enum {
     POOL_MAX_SIZE = 64,
 };
 
+/** Free list to speed up creation */
+static QLIST_HEAD(, Coroutine) pool = QLIST_HEAD_INITIALIZER(pool);
+static unsigned int pool_size;
+
 typedef struct {
     Coroutine base;
     void *stack;
@@ -48,10 +52,6 @@ typedef struct {
     /** Currently executing coroutine */
     Coroutine *current;
 
-    /** Free list to speed up creation */
-    QLIST_HEAD(, Coroutine) pool;
-    unsigned int pool_size;
-
     /** The default coroutine */
     CoroutineUContext leader;
 } CoroutineThreadState;
@@ -75,7 +75,6 @@ static CoroutineThreadState *coroutine_get_thread_state(void)
     if (!s) {
         s = g_malloc0(sizeof(*s));
         s->current = &s->leader.base;
-        QLIST_INIT(&s->pool);
         pthread_setspecific(thread_state_key, s);
     }
     return s;
@@ -84,14 +83,19 @@ static CoroutineThreadState *coroutine_get_thread_state(void)
 static void qemu_coroutine_thread_cleanup(void *opaque)
 {
     CoroutineThreadState *s = opaque;
+
+    g_free(s);
+}
+
+static void __attribute__((destructor)) coroutine_cleanup(void)
+{
     Coroutine *co;
     Coroutine *tmp;
 
-    QLIST_FOREACH_SAFE(co, &s->pool, pool_next, tmp) {
+    QLIST_FOREACH_SAFE(co, &pool, pool_next, tmp) {
         g_free(DO_UPCAST(CoroutineUContext, base, co)->stack);
         g_free(co);
     }
-    g_free(s);
 }
 
 static void __attribute__((constructor)) coroutine_init(void)
@@ -169,13 +173,12 @@ static Coroutine *coroutine_new(void)
 
 Coroutine *qemu_coroutine_new(void)
 {
-    CoroutineThreadState *s = coroutine_get_thread_state();
     Coroutine *co;
 
-    co = QLIST_FIRST(&s->pool);
+    co = QLIST_FIRST(&pool);
     if (co) {
         QLIST_REMOVE(co, pool_next);
-        s->pool_size--;
+        pool_size--;
     } else {
         co = coroutine_new();
     }
@@ -184,13 +187,12 @@ Coroutine *qemu_coroutine_new(void)
 
 void qemu_coroutine_delete(Coroutine *co_)
 {
-    CoroutineThreadState *s = coroutine_get_thread_state();
     CoroutineUContext *co = DO_UPCAST(CoroutineUContext, base, co_);
 
-    if (s->pool_size < POOL_MAX_SIZE) {
-        QLIST_INSERT_HEAD(&s->pool, &co->base, pool_next);
+    if (pool_size < POOL_MAX_SIZE) {
+        QLIST_INSERT_HEAD(&pool, &co->base, pool_next);
         co->base.caller = NULL;
-        s->pool_size++;
+        pool_size++;
         return;
     }
 
-- 
1.7.6.4

[Qemu-devel] [PATCH 13/14] block/cow: Return real error code

[Kevin Wolf]

From: Li Zhi Hui <zhihuili@linux.vnet.ibm.com>

Signed-off-by: Li Zhi Hui <zhihuili@linux.vnet.ibm.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/cow.c |   44 +++++++++++++++++++++++++++++---------------
 1 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/block/cow.c b/block/cow.c
index 3c52735..bb5927c 100644
--- a/block/cow.c
+++ b/block/cow.c
@@ -64,15 +64,26 @@ static int cow_open(BlockDriverState *bs, int flags)
     struct cow_header_v2 cow_header;
     int bitmap_size;
     int64_t size;
+    int ret;
 
     /* see if it is a cow image */
-    if (bdrv_pread(bs->file, 0, &cow_header, sizeof(cow_header)) !=
-            sizeof(cow_header)) {
+    ret = bdrv_pread(bs->file, 0, &cow_header, sizeof(cow_header));
+    if (ret < 0) {
+        goto fail;
+    }
+
+    if (be32_to_cpu(cow_header.magic) != COW_MAGIC) {
+        ret = -EINVAL;
         goto fail;
     }
 
-    if (be32_to_cpu(cow_header.magic) != COW_MAGIC ||
-        be32_to_cpu(cow_header.version) != COW_VERSION) {
+    if (be32_to_cpu(cow_header.version) != COW_VERSION) {
+        char version[64];
+        snprintf(version, sizeof(version),
+               "COW version %d", cow_header.version);
+        qerror_report(QERR_UNKNOWN_BLOCK_FORMAT_FEATURE,
+            bs->device_name, "cow", version);
+        ret = -ENOTSUP;
         goto fail;
     }
 
@@ -88,7 +99,7 @@ static int cow_open(BlockDriverState *bs, int flags)
     qemu_co_mutex_init(&s->lock);
     return 0;
  fail:
-    return -1;
+    return ret;
 }
 
 /*
@@ -182,17 +193,19 @@ static int coroutine_fn cow_read(BlockDriverState *bs, int64_t sector_num,
             ret = bdrv_pread(bs->file,
                         s->cow_sectors_offset + sector_num * 512,
                         buf, n * 512);
-            if (ret != n * 512)
-                return -1;
+            if (ret < 0) {
+                return ret;
+            }
         } else {
             if (bs->backing_hd) {
                 /* read from the base image */
                 ret = bdrv_read(bs->backing_hd, sector_num, buf, n);
-                if (ret < 0)
-                    return -1;
+                if (ret < 0) {
+                    return ret;
+                }
             } else {
-            memset(buf, 0, n * 512);
-        }
+                memset(buf, 0, n * 512);
+            }
         }
         nb_sectors -= n;
         sector_num += n;
@@ -220,8 +233,9 @@ static int cow_write(BlockDriverState *bs, int64_t sector_num,
 
     ret = bdrv_pwrite(bs->file, s->cow_sectors_offset + sector_num * 512,
                       buf, nb_sectors * 512);
-    if (ret != nb_sectors * 512)
-        return -1;
+    if (ret < 0) {
+        return ret;
+    }
 
     return cow_update_bitmap(bs, sector_num, nb_sectors);
 }
@@ -288,14 +302,14 @@ static int cow_create(const char *filename, QEMUOptionParameter *options)
     cow_header.sectorsize = cpu_to_be32(512);
     cow_header.size = cpu_to_be64(image_sectors * 512);
     ret = bdrv_pwrite(cow_bs, 0, &cow_header, sizeof(cow_header));
-    if (ret != sizeof(cow_header)) {
+    if (ret < 0) {
         goto exit;
     }
 
     /* resize to include at least all the bitmap */
     ret = bdrv_truncate(cow_bs,
         sizeof(cow_header) + ((image_sectors + 7) >> 3));
-    if (ret) {
+    if (ret < 0) {
         goto exit;
     }
 
-- 
1.7.6.4

[Qemu-devel] [PATCH 14/14] qiov: prevent double free or use-after-free

[Kevin Wolf]

From: Paolo Bonzini <pbonzini@redhat.com>

qemu_iovec_destroy does not clear the QEMUIOVector fully, and the data
could thus be used after free or freed again.  While I do not know any
example in the tree, I observed this using virtio-scsi (and SCSI
scatter/gather) when canceling DMA requests.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 cutils.c |    3 +++
 1 files changed, 3 insertions(+), 0 deletions(-)

diff --git a/cutils.c b/cutils.c
index 6db6304..24b3fe3 100644
--- a/cutils.c
+++ b/cutils.c
@@ -217,7 +217,10 @@ void qemu_iovec_destroy(QEMUIOVector *qiov)
 {
     assert(qiov->nalloc != -1);
 
+    qemu_iovec_reset(qiov);
     g_free(qiov->iov);
+    qiov->nalloc = 0;
+    qiov->iov = NULL;
 }
 
 void qemu_iovec_reset(QEMUIOVector *qiov)
-- 
1.7.6.4

Re: [Qemu-devel] [PULL 00/14] Block patches

[Anthony Liguori]

On 12/15/2011 08:09 AM, Kevin Wolf wrote:
> The following changes since commit 222f23f508a8d778f56eddef14752dfd26d225b4:
>
>    tcg/arm: remove fixed map code buffer restriction (2011-12-14 21:58:18 +0100)
>
> are available in the git repository at:
>    git://repo.or.cz/qemu/kevin.git for-anthony

Pulled.  Thanks.

Regards,

Anthony Liguori

>
> Avi Kivity (1):
>        coroutine: switch per-thread free pool to a global pool
>
> Josh Durgin (1):
>        rbd: always set out parameter in qemu_rbd_snap_list
>
> Kevin Wolf (3):
>        qemu-img rebase: Fix for undersized backing files
>        Documentation: Add qemu-img -t parameter in man page
>        qcow2: Allow>4 GB VM state
>
> Li Zhi Hui (2):
>        block/qcow2.c: call qcow2_free_snapshots in the function of qcow2_close
>        block/cow: Return real error code
>
> Paolo Bonzini (7):
>        block: bdrv_aio_* do not return NULL
>        block: simplify failure handling for bdrv_aio_multiwrite
>        block: qemu_aio_get does not return NULL
>        dma: the passed io_func does not return NULL
>        block: dma_bdrv_* does not return NULL
>        block: avoid useless checks on acb->bh
>        qiov: prevent double free or use-after-free
>
>   block-migration.c      |   13 ---------
>   block.c                |   56 +++-------------------------------------
>   block.h                |    2 +-
>   block/blkverify.c      |   24 ++++++-----------
>   block/cow.c            |   44 +++++++++++++++++++++-----------
>   block/curl.c           |    4 ---
>   block/qcow2-snapshot.c |   34 +++++++++++++++++++++++-
>   block/qcow2.c          |    1 +
>   block/qcow2.h          |    2 +-
>   block/qed-table.c      |   22 +++++-----------
>   block/qed.c            |   60 +++++++++++--------------------------------
>   block/rbd.c            |    6 +---
>   block/vdi.c            |   66 +++++++++++++----------------------------------
>   coroutine-ucontext.c   |   30 +++++++++++----------
>   cutils.c               |    3 ++
>   dma-helpers.c          |    4 +--
>   docs/specs/qcow2.txt   |    8 +++++-
>   hw/ide/atapi.c         |    8 +-----
>   hw/ide/core.c          |   13 +--------
>   hw/ide/macio.c         |   11 +-------
>   hw/scsi-disk.c         |    9 ------
>   hw/scsi-generic.c      |    4 ---
>   hw/virtio-blk.c        |   19 +++-----------
>   linux-aio.c            |    2 -
>   posix-aio-compat.c     |    4 ---
>   qemu-img-cmds.hx       |    6 ++--
>   qemu-img.c             |   42 ++++++++++++++++++++++++------
>   qemu-img.texi          |   10 +++++--
>   qemu-io.c              |   39 ++++++----------------------
>   savevm.c               |    2 +-
>   trace-events           |    2 -
>   31 files changed, 205 insertions(+), 345 deletions(-)
>
>

[Qemu-devel] [PULL 00/14] Block patches

[Stefan Hajnoczi]

The following changes since commit dbe2b65566e76d3c3a0c3358285c0336ac61e757:

  Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-2.9-pull-request' into staging (2016-12-28 17:11:11 +0000)

are available in the git repository at:

  git://github.com/stefanha/qemu.git tags/block-pull-request

for you to fetch changes up to 5e5db49953e31689c1c70060870f0a7a6de26fcb:

  iothread: add poll-grow and poll-shrink parameters (2017-01-03 16:38:50 +0000)

----------------------------------------------------------------

----------------------------------------------------------------

Stefan Hajnoczi (14):
  HACKING: document #include order
  aio: add flag to skip fds to aio_dispatch()
  aio: add AioPollFn and io_poll() interface
  aio: add polling mode to AioContext
  virtio: poll virtqueues for new buffers
  linux-aio: poll ring for completions
  iothread: add polling parameters
  virtio-blk: suppress virtqueue kick during processing
  virtio-scsi: suppress virtqueue kick during processing
  virtio: turn vq->notification into a nested counter
  aio: add .io_poll_begin/end() callbacks
  virtio: disable virtqueue notifications during polling
  aio: self-tune polling time
  iothread: add poll-grow and poll-shrink parameters

 include/block/aio.h         |  53 +++++++-
 include/sysemu/iothread.h   |   5 +
 aio-posix.c                 | 308 +++++++++++++++++++++++++++++++++++++++-----
 aio-win32.c                 |  32 ++++-
 async.c                     |  21 ++-
 block/curl.c                |   8 +-
 block/iscsi.c               |   3 +-
 block/linux-aio.c           |  19 ++-
 block/nbd-client.c          |   8 +-
 block/nfs.c                 |   7 +-
 block/sheepdog.c            |  26 ++--
 block/ssh.c                 |   4 +-
 block/win32-aio.c           |   4 +-
 hw/block/virtio-blk.c       |  18 ++-
 hw/scsi/virtio-scsi.c       |  36 +++---
 hw/virtio/virtio.c          |  54 ++++++--
 iohandler.c                 |   2 +-
 iothread.c                  |  84 ++++++++++++
 nbd/server.c                |   9 +-
 stubs/set-fd-handler.c      |   1 +
 tests/test-aio.c            |   4 +-
 util/event_notifier-posix.c |   2 +-
 HACKING                     |  18 +++
 trace-events                |   6 +
 24 files changed, 622 insertions(+), 110 deletions(-)

-- 
2.9.3

Re: [Qemu-devel] [PULL 00/14] Block patches

[Peter Maydell]

On 4 January 2017 at 13:34, Stefan Hajnoczi <stefanha@redhat.com> wrote:
> The following changes since commit dbe2b65566e76d3c3a0c3358285c0336ac61e757:
>
>   Merge remote-tracking branch 'remotes/vivier/tags/m68k-for-2.9-pull-request' into staging (2016-12-28 17:11:11 +0000)
>
> are available in the git repository at:
>
>   git://github.com/stefanha/qemu.git tags/block-pull-request
>
> for you to fetch changes up to 5e5db49953e31689c1c70060870f0a7a6de26fcb:
>
>   iothread: add poll-grow and poll-shrink parameters (2017-01-03 16:38:50 +0000)
>
> ----------------------------------------------------------------
>
> ----------------------------------------------------------------

Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/14] Block patches

[Jeff Cody]

The following changes since commit 5d3217340adcb6c4f0e4af5d2b865331eb2ff63d:

  disas: Fix ATTRIBUTE_UNUSED define clash with ALSA headers (2016-07-19 16:40:39 +0100)

are available in the git repository at:

  git@github.com:codyprime/qemu-kvm-jtc.git tags/block-pull-request

for you to fetch changes up to 6c7189bb29de9fa2202f613f3c6caf028f96f261:

  block/gluster: add support for multiple gluster servers (2016-07-19 17:38:50 -0400)

----------------------------------------------------------------
Block pull for 2.7
----------------------------------------------------------------

Denis V. Lunev (9):
  dirty-bitmap: operate with int64_t amount
  mirror: make sectors_in_flight int64_t
  mirror: create mirror_throttle helper
  mirror: create mirror_dirty_init helper for mirror_run
  block: remove extra condition in bdrv_can_write_zeroes_with_unmap
  mirror: optimize dirty bitmap filling in mirror_run a bit
  mirror: efficiently zero out target
  mirror: improve performance of mirroring of empty disk
  mirror: fix request throttling in drive-mirror

Prasanna Kumar Kalever (5):
  block/gluster: rename [server, volname, image] -> [host, volume, path]
  block/gluster: code cleanup
  block/gluster: deprecate rdma support
  block/gluster: using new qapi schema
  block/gluster: add support for multiple gluster servers

 block.c                      |   2 +-
 block/dirty-bitmap.c         |   6 +-
 block/gluster.c              | 631 +++++++++++++++++++++++++++++++++----------
 block/mirror.c               | 152 +++++++----
 include/block/block_int.h    |   2 +-
 include/block/dirty-bitmap.h |   4 +-
 qapi/block-core.json         |  68 ++++-
 7 files changed, 659 insertions(+), 206 deletions(-)

-- 
1.9.3

Re: [Qemu-devel] [PULL 00/14] Block patches

[Peter Maydell]

On 20 July 2016 at 01:20, Jeff Cody <jcody@redhat.com> wrote:
> The following changes since commit 5d3217340adcb6c4f0e4af5d2b865331eb2ff63d:
>
>   disas: Fix ATTRIBUTE_UNUSED define clash with ALSA headers (2016-07-19 16:40:39 +0100)
>
> are available in the git repository at:
>
>   git@github.com:codyprime/qemu-kvm-jtc.git tags/block-pull-request
>
> for you to fetch changes up to 6c7189bb29de9fa2202f613f3c6caf028f96f261:
>
>   block/gluster: add support for multiple gluster servers (2016-07-19 17:38:50 -0400)
>
> ----------------------------------------------------------------
> Block pull for 2.7
> ----------------------------------------------------------------


Applied, thanks.

-- PMM

[Qemu-devel] [PULL 00/14] Block patches

[Kevin Wolf]

The following changes since commit afed26082219b49443193b4ac32d113bbcf967fd:

  microblaze: Ignore non-cpu accesses to unmapped areas (2013-03-19 17:34:47 +0100)

are available in the git repository at:

  git://repo.or.cz/qemu/kevin.git for-anthony

for you to fetch changes up to 681e7ad024d80123a1ae8e35f86fb1a7f03b1bc9:

  nbd: Check against invalid option combinations (2013-03-22 17:51:32 +0100)

----------------------------------------------------------------
Kevin Wolf (12):
      block: Add options QDict to bdrv_file_open() prototypes
      block: Pass bdrv_file_open() options to block drivers
      qemu-socket: Make socket_optslist public
      nbd: Keep hostname and port separate
      nbd: Remove unused functions
      nbd: Accept -drive options for the network connection
      block: Introduce .bdrv_parse_filename callback
      block: Rename variable to avoid shadowing
      block: Make find_image_format safe with NULL filename
      block: Allow omitting the file name when using driver-specific options
      nbd: Use default port if only host is specified
      nbd: Check against invalid option combinations

Peter Lieven (2):
      Revert "block: complete all IOs before .bdrv_truncate"
      block: complete all IOs before resizing a device

 block.c                   | 143 +++++++++++++++++++++++++++++++++++++++-------
 block/blkdebug.c          |   5 +-
 block/blkverify.c         |   5 +-
 block/cow.c               |   2 +-
 block/curl.c              |   3 +-
 block/dmg.c               |  13 ++++-
 block/gluster.c           |   2 +-
 block/iscsi.c             |   5 +-
 block/nbd.c               | 135 ++++++++++++++++++++++++++++++++-----------
 block/qcow.c              |   2 +-
 block/qcow2.c             |   2 +-
 block/qed.c               |   2 +-
 block/raw-posix.c         |  15 +++--
 block/sheepdog.c          |   7 ++-
 block/vmdk.c              |   2 +-
 block/vvfat.c             |   3 +-
 blockdev.c                |  13 ++++-
 include/block/block.h     |   3 +-
 include/block/block_int.h |   7 ++-
 include/block/nbd.h       |   4 +-
 include/qemu/sockets.h    |   3 +
 nbd.c                     |  13 +----
 qemu-io.c                 |   2 +-
 util/qemu-sockets.c       |  30 +++++-----
 24 files changed, 308 insertions(+), 113 deletions(-)

[Qemu-devel] [PULL 00/14] Block patches

[Kevin Wolf]

The following changes since commit 0b862cedf36d927818c50584ddd611b0370673df:

  configure: Detect and don't try to use older libcurl (2011-06-13 21:16:27 +0200)

are available in the git repository at:
  git://repo.or.cz/qemu/kevin.git for-anthony

Christoph Hellwig (3):
      make dma_bdrv_io available to drivers
      ide: allow other dma comands than read and write
      ide: add TRIM support

Devin Nakamura (1):
      Replaced tabs with spaces in block.h and block_int.h

Kevin Wolf (9):
      qcow2: Avoid direct AIO callback
      qcow: Avoid direct AIO callback
      vdi: Avoid direct AIO callback
      qcow2: Fix in-flight list after qcow2_cache_put failure
      ide: Split error status from status register
      ide: Fix ide_drive_pio_state_needed()
      ide: Add forgotten VMSTATE_END_OF_LIST in subsection
      ide: Clear error_status after restarting flush
      Allow nested qemu_bh_poll() after BH deletion

Stefan Weil (1):
      block/rbd: Remove unused local variable

 async.c               |    5 +-
 block.h               |    6 +-
 block/qcow.c          |   58 ++++++++++++++++++-
 block/qcow2-cluster.c |   12 +++-
 block/qcow2.c         |   39 ++++++++++---
 block/rbd.c           |    4 -
 block/vdi.c           |   41 +++++++++++--
 block_int.h           |    4 +-
 dma-helpers.c         |   23 +++----
 dma.h                 |    8 +++
 hw/ide/core.c         |  154 ++++++++++++++++++++++++++++++++++++++++++++-----
 hw/ide/internal.h     |   32 ++++++++++-
 hw/ide/macio.c        |   13 ++++-
 hw/ide/pci.c          |   88 +++++++++++++++++++++++++---
 hw/ide/pci.h          |    4 +
 hw/ide/qdev.c         |    5 ++
 16 files changed, 423 insertions(+), 73 deletions(-)

Re: [Qemu-devel] [PULL 00/14] Block patches

[Anthony Liguori]

On 06/15/2011 09:02 AM, Kevin Wolf wrote:
> The following changes since commit 0b862cedf36d927818c50584ddd611b0370673df:
>
>    configure: Detect and don't try to use older libcurl (2011-06-13 21:16:27 +0200)
>
> are available in the git repository at:
>    git://repo.or.cz/qemu/kevin.git for-anthony

Pulled.  Thanks.

Regards,

Anthony Liguori

> Christoph Hellwig (3):
>        make dma_bdrv_io available to drivers
>        ide: allow other dma comands than read and write
>        ide: add TRIM support
>
> Devin Nakamura (1):
>        Replaced tabs with spaces in block.h and block_int.h
>
> Kevin Wolf (9):
>        qcow2: Avoid direct AIO callback
>        qcow: Avoid direct AIO callback
>        vdi: Avoid direct AIO callback
>        qcow2: Fix in-flight list after qcow2_cache_put failure
>        ide: Split error status from status register
>        ide: Fix ide_drive_pio_state_needed()
>        ide: Add forgotten VMSTATE_END_OF_LIST in subsection
>        ide: Clear error_status after restarting flush
>        Allow nested qemu_bh_poll() after BH deletion
>
> Stefan Weil (1):
>        block/rbd: Remove unused local variable
>
>   async.c               |    5 +-
>   block.h               |    6 +-
>   block/qcow.c          |   58 ++++++++++++++++++-
>   block/qcow2-cluster.c |   12 +++-
>   block/qcow2.c         |   39 ++++++++++---
>   block/rbd.c           |    4 -
>   block/vdi.c           |   41 +++++++++++--
>   block_int.h           |    4 +-
>   dma-helpers.c         |   23 +++----
>   dma.h                 |    8 +++
>   hw/ide/core.c         |  154 ++++++++++++++++++++++++++++++++++++++++++++-----
>   hw/ide/internal.h     |   32 ++++++++++-
>   hw/ide/macio.c        |   13 ++++-
>   hw/ide/pci.c          |   88 +++++++++++++++++++++++++---
>   hw/ide/pci.h          |    4 +
>   hw/ide/qdev.c         |    5 ++
>   16 files changed, 423 insertions(+), 73 deletions(-)

[Qemu-devel] [PULL 00/14] Block patches

[Kevin Wolf]

The following changes since commit 138b38b61bf92d4e9588acf934e532499c94e185:

  ppc: kvm: fix signedness warning (2010-12-08 21:30:19 +0100)

are available in the git repository at:
  git://repo.or.cz/qemu/kevin.git for-anthony

Christian Brunner (1):
      ceph/rbd block driver for qemu-kvm

Jes Sorensen (8):
      Add missing tracing to qemu_mallocz()
      Use qemu_mallocz() instead of calloc() in img_convert()
      img_convert(): Only try to free bs[] entries if bs is valid.
      Consolidate printing of block driver options
      Fix formatting and missing braces in qemu-img.c
      Fail if detecting an unknown option
      Make error handling more consistent in img_create() and img_resize()
      qemu-img: Deprecate obsolete -6 and -e options

Stefan Hajnoczi (5):
      block: Make bdrv_create_file() ':' handling consistent
      qemu-option: Don't reinvent append_option_parameters()
      qemu-option: Fix parse_option_parameters() documentation typo
      qemu-img: Free option parameter lists in img_create()
      qemu-img: Fail creation if backing format is invalid

 Makefile.objs     |    1 +
 block.c           |    2 +-
 block/rbd.c       | 1059 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 block/rbd_types.h |   71 ++++
 block_int.h       |    1 -
 configure         |   52 +++
 qemu-img.c        |  247 ++++++++-----
 qemu-malloc.c     |    5 +-
 qemu-option.c     |   13 +-
 9 files changed, 1344 insertions(+), 107 deletions(-)
 create mode 100644 block/rbd.c
 create mode 100644 block/rbd_types.h

Re: [Qemu-devel] [PULL 00/14] Block patches

[Anthony Liguori]

On 12/09/2010 05:09 AM, Kevin Wolf wrote:
> The following changes since commit 138b38b61bf92d4e9588acf934e532499c94e185:
>
>    ppc: kvm: fix signedness warning (2010-12-08 21:30:19 +0100)
>
> are available in the git repository at:
>    git://repo.or.cz/qemu/kevin.git for-anthony
>
> Christian Brunner (1):
>        ceph/rbd block driver for qemu-kvm
>    

Pulled.  Thanks.

Regards,

Anthony Liguori
> Jes Sorensen (8):
>        Add missing tracing to qemu_mallocz()
>        Use qemu_mallocz() instead of calloc() in img_convert()
>        img_convert(): Only try to free bs[] entries if bs is valid.
>        Consolidate printing of block driver options
>        Fix formatting and missing braces in qemu-img.c
>        Fail if detecting an unknown option
>        Make error handling more consistent in img_create() and img_resize()
>        qemu-img: Deprecate obsolete -6 and -e options
>
> Stefan Hajnoczi (5):
>        block: Make bdrv_create_file() ':' handling consistent
>        qemu-option: Don't reinvent append_option_parameters()
>        qemu-option: Fix parse_option_parameters() documentation typo
>        qemu-img: Free option parameter lists in img_create()
>        qemu-img: Fail creation if backing format is invalid
>
>   Makefile.objs     |    1 +
>   block.c           |    2 +-
>   block/rbd.c       | 1059 +++++++++++++++++++++++++++++++++++++++++++++++++++++
>   block/rbd_types.h |   71 ++++
>   block_int.h       |    1 -
>   configure         |   52 +++
>   qemu-img.c        |  247 ++++++++-----
>   qemu-malloc.c     |    5 +-
>   qemu-option.c     |   13 +-
>   9 files changed, 1344 insertions(+), 107 deletions(-)
>   create mode 100644 block/rbd.c
>   create mode 100644 block/rbd_types.h
>
>
>    

[Qemu-devel] [PULL 00/14] Block patches

[Kevin Wolf]

The following changes since commit cada87c432e3b9cd55869a24055baf2b7bc0b70c:
  Blue Swirl (1):
        Update OpenBIOS images

are available in the git repository at:

  git://repo.or.cz/qemu/kevin.git for-anthony

Christoph Hellwig (1):
      block: fix physical_block_size calculation

Eduardo Habkost (1):
      monitor: allow device to be ejected if no disk is inserted

Kevin Wolf (8):
      block: Add bdrv_(p)write_sync
      cow: Use bdrv_(p)write_sync for metadata writes
      qcow: Use bdrv_(p)write_sync for metadata writes
      qcow2: Use bdrv_(p)write_sync for metadata writes
      vmdk: Use bdrv_(p)write_sync for metadata writes
      vpc: Use bdrv_(p)write_sync for metadata writes
      qcow2: Fix qemu-img check segfault on corrupted images
      qcow2: Don't try to check tables that couldn't be loaded

MORITA Kazutaka (1):
      qemu-io: check registered fds in command_loop()

Nicholas Bellinger (2):
      scsi-bus: Add PERSISTENT_RESERVE_OUT SCSIRequest->cmd.mode setup
      scsi-bus: Add MAINTENANCE_IN and MAINTENANCE_OUT SCSIRequest xfer and mode assignments

Yoshiaki Tamura (1):
      virtio-blk: fix the list operation in virtio_blk_load().

 block.c                |   37 +++++++++++++++++++++++++++++++++++++
 block.h                |    4 ++++
 block/cow.c            |   20 +++++++++++---------
 block/qcow.c           |   18 ++++++++++--------
 block/qcow2-cluster.c  |   24 ++++++++++++------------
 block/qcow2-refcount.c |   39 ++++++++++++++++++++++++---------------
 block/qcow2-snapshot.c |   23 +++++++++++------------
 block/qcow2.c          |   10 +++++-----
 block/vmdk.c           |   10 +++++-----
 block/vpc.c            |    9 +++++----
 block_int.h            |    4 +++-
 blockdev.c             |   22 ++++++++++------------
 cmd.c                  |   33 ++++++++++++++++++++++++++++++---
 hw/scsi-bus.c          |   11 +++++++++++
 hw/scsi-defs.h         |    2 ++
 hw/virtio-blk.c        |    2 +-
 16 files changed, 181 insertions(+), 87 deletions(-)

[Qemu-devel] [PULL 00/14] Block patches

[Kevin Wolf]

Hi Anthony,

this includes again some patches that should be applied to stable-0.12, too:

    86fa8da qcow2: Fix corruption after error in update_refcount
    25408c0 qcow2: Fix corruption after refblock allocation
    cbf1dff block: Fix multiwrite with overlapping requests
    175e115 qcow2: Fix error handling in l2_allocate
    1b7c801 qcow2: Clear L2 table cache after write error

Kevin


The following changes since commit 29f91781bd300b228d9c38b9f6c1e0b6a38f25fb:
  Jes Sorensen (1):
        vhost_net.c: v2 Fix build failure introduced by 0bfcd599e3f5c5679cc7d0165a0a1822e2f60de2

are available in the git repository at:

  git://repo.or.cz/qemu/kevin.git for-anthony

Gerd Hoffmann (1):
      drive: allow rerror, werror and readonly for if=none

Jes Sorensen (1):
      block.h: Make BDRV_SECTOR_SIZE 64 bit safe

Kevin Wolf (9):
      qcow2: Clear L2 table cache after write error
      qcow2: Fix error handling in l2_allocate
      block: Fix multiwrite with overlapping requests
      qemu-io: Add multiwrite command
      qcow2: Allow qcow2_get_cluster_offset to return errors
      qcow2: Change l2_load to return 0/-errno
      qcow2: Return right error code in write_refcount_block_entries
      qcow2: Fix corruption after refblock allocation
      qcow2: Fix corruption after error in update_refcount

MORITA Kazutaka (1):
      add support for protocol driver create_options

Nicholas A. Bellinger (1):
      block: Add missing bdrv_delete() for SG_IO BlockDriver in find_image_format()

Stefan Hajnoczi (1):
      posix-aio-compat: Expand tabs that have crept in

 block.c                |   13 ++--
 block.h                |    3 +-
 block/qcow2-cluster.c  |   94 ++++++++++++++----------
 block/qcow2-refcount.c |   42 +++++++----
 block/qcow2.c          |   16 +++-
 block/qcow2.h          |    4 +-
 posix-aio-compat.c     |   58 +++++++-------
 qemu-img.c             |   49 +++++++++----
 qemu-io.c              |  192 ++++++++++++++++++++++++++++++++++++++++++++++++
 qemu-option.c          |   53 ++++++++++++--
 qemu-option.h          |    2 +
 vl.c                   |    6 +-
 12 files changed, 414 insertions(+), 118 deletions(-)