[pve-devel] [PATCH qemu 1/1] fix qemu 2.9 drive mirroring to nbd target

Alexandre Derumier aderumier at odiso.com
Wed Feb 7 23:40:35 CET 2018


cherry pick from qemu-kvm-ev-2.9.0-16.el7_4.11.1
https://cbs.centos.org/koji/buildinfo?buildID=21003

Tue Jun 13 2017 Miroslav Rezanina <mrezanin at redhat.com> - rhev-2.9.0-10.el7

- kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch [bz#1454582]

Tue Aug 15 2017 Miroslav Rezanina <mrezanin at redhat.com> - rhev-2.9.0-16.el7_4.4
- kvm-nbd-strict-nbd_wr_syncv.patch [bz#1467509]
- kvm-nbd-read_sync-and-friends-return-0-on-success.patch [bz#1467509]
- kvm-nbd-make-nbd_drop-public.patch [bz#1467509]
- kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch [bz#1467509]

Mon Oct 09 2017 Miroslav Rezanina <mrezanin at redhat.com> - rhev-2.9.0-16.el7_4.9
- kvm-nbd-client-Fix-regression-when-server-sends-garbage.patch [bz#1495474]
- kvm-fix-build-failure-in-nbd_read_reply_entry.patch [bz#1495474]
- kvm-nbd-client-avoid-spurious-qio_channel_yield-re-entry.patch [bz#1495474]
- kvm-nbd-client-avoid-read_reply_co-entry-if-send-failed.patch [bz#1495474]
- kvm-qemu-iotests-improve-nbd-fault-injector.py-startup-p.patch [bz#1495474]
- kvm-qemu-iotests-test-NBD-over-UNIX-domain-sockets-in-08.patch [bz#1495474]
- kvm-block-nbd-client-nbd_co_send_request-fix-return-code.patch [bz#1495474]
- Resolves: bz#1495474
---
 ...bd-make-it-thread-safe-fix-qcow2-over-nbd.patch | 136 +++++
 .../extra/0036-kvm-nbd-strict-nbd_wr_syncv.patch   |  66 +++
 ...read_sync-and-friends-return-0-on-success.patch | 620 +++++++++++++++++++++
 .../extra/0038-kvm-nbd-make-nbd_drop-public.patch  | 151 +++++
 ...get-rid-of-nbd_negotiate_read-and-friends.patch | 292 ++++++++++
 ...-Fix-regression-when-server-sends-garbage.patch | 153 +++++
 ...fix-build-failure-in-nbd_read_reply_entry.patch |  55 ++
 ...avoid-spurious-qio_channel_yield-re-entry.patch | 184 ++++++
 ...-avoid-read_reply_co-entry-if-send-failed.patch | 160 ++++++
 ...s-improve-nbd-fault-injector.py-startup-p.patch |  61 ++
 ...s-test-NBD-over-UNIX-domain-sockets-in-08.patch | 454 +++++++++++++++
 ...lient-nbd_co_send_request-fix-return-code.patch |  45 ++
 debian/patches/series                              |  13 +
 13 files changed, 2390 insertions(+)
 create mode 100644 debian/patches/extra/0035-kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch
 create mode 100644 debian/patches/extra/0036-kvm-nbd-strict-nbd_wr_syncv.patch
 create mode 100644 debian/patches/extra/0037-kvm-nbd-read_sync-and-friends-return-0-on-success.patch
 create mode 100644 debian/patches/extra/0038-kvm-nbd-make-nbd_drop-public.patch
 create mode 100644 debian/patches/extra/0039-kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch
 create mode 100644 debian/patches/extra/0040-kvm-nbd-client-Fix-regression-when-server-sends-garbage.patch
 create mode 100644 debian/patches/extra/0041-kvm-fix-build-failure-in-nbd_read_reply_entry.patch
 create mode 100644 debian/patches/extra/0042-kvm-nbd-client-avoid-spurious-qio_channel_yield-re-entry.patch
 create mode 100644 debian/patches/extra/0043-kvm-nbd-client-avoid-read_reply_co-entry-if-send-failed.patch
 create mode 100644 debian/patches/extra/0044-kvm-qemu-iotests-improve-nbd-fault-injector.py-startup-p.patch
 create mode 100644 debian/patches/extra/0045-kvm-qemu-iotests-test-NBD-over-UNIX-domain-sockets-in-08.patch
 create mode 100644 debian/patches/extra/0046-kvm-block-nbd-client-nbd_co_send_request-fix-return-code.patch

diff --git a/debian/patches/extra/0035-kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch b/debian/patches/extra/0035-kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch
new file mode 100644
index 0000000..6b9df0d
--- /dev/null
+++ b/debian/patches/extra/0035-kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch
@@ -0,0 +1,136 @@
+From 689e11115170df5dedec420d78d375e780f3968e Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Sun, 11 Jun 2017 03:30:07 +0200
+Subject: [PATCH 04/13] nbd: make it thread-safe, fix qcow2 over nbd
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170611033007.399-1-eblake at redhat.com>
+Patchwork-id: 75581
+O-Subject: [RHEV-7.4 qemu-kvm-rhev PATCH] nbd: make it thread-safe, fix qcow2 over nbd
+Bugzilla: 1454582
+RH-Acked-by: Laurent Vivier <lvivier at redhat.com>
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+
+From: Paolo Bonzini <pbonzini at redhat.com>
+
+NBD is not thread safe, because it accesses s->in_flight without
+a CoMutex.  Fixing this will be required for multiqueue.
+CoQueue doesn't have spurious wakeups but, when another coroutine can
+run between qemu_co_queue_next's wakeup and qemu_co_queue_wait's
+re-locking of the mutex, the wait condition can become false and
+a loop is necessary.
+
+In fact, it turns out that the loop is necessary even without this
+multi-threaded scenario.  A particular sequence of coroutine wakeups
+is happening ~80% of the time when starting a guest with qcow2 image
+served over NBD (i.e. qemu-nbd --format=raw, and QEMU's -drive option
+has -format=qcow2).  This patch fixes that issue too.
+
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+(cherry picked from commit 6bdcc018a6ed760b9dfe43539124e420aed83092)
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Upstream-status: v6 pull request https://lists.gnu.org/archive/html/qemu-devel/2017-06/msg01841.html
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ block/nbd-client.c | 30 +++++++++---------------------
+ 1 file changed, 9 insertions(+), 21 deletions(-)
+
+diff --git a/block/nbd-client.c b/block/nbd-client.c
+index 1e2952f..43e0292 100644
+--- a/block/nbd-client.c
++++ b/block/nbd-client.c
+@@ -114,6 +114,10 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     int rc, ret, i;
+ 
+     qemu_co_mutex_lock(&s->send_mutex);
++    while (s->in_flight == MAX_NBD_REQUESTS) {
++        qemu_co_queue_wait(&s->free_sema, &s->send_mutex);
++    }
++    s->in_flight++;
+ 
+     for (i = 0; i < MAX_NBD_REQUESTS; i++) {
+         if (s->recv_coroutine[i] == NULL) {
+@@ -176,20 +180,6 @@ static void nbd_co_receive_reply(NBDClientSession *s,
+     }
+ }
+ 
+-static void nbd_coroutine_start(NBDClientSession *s,
+-                                NBDRequest *request)
+-{
+-    /* Poor man semaphore.  The free_sema is locked when no other request
+-     * can be accepted, and unlocked after receiving one reply.  */
+-    if (s->in_flight == MAX_NBD_REQUESTS) {
+-        qemu_co_queue_wait(&s->free_sema, NULL);
+-        assert(s->in_flight < MAX_NBD_REQUESTS);
+-    }
+-    s->in_flight++;
+-
+-    /* s->recv_coroutine[i] is set as soon as we get the send_lock.  */
+-}
+-
+ static void nbd_coroutine_end(BlockDriverState *bs,
+                               NBDRequest *request)
+ {
+@@ -197,13 +187,16 @@ static void nbd_coroutine_end(BlockDriverState *bs,
+     int i = HANDLE_TO_INDEX(s, request->handle);
+ 
+     s->recv_coroutine[i] = NULL;
+-    s->in_flight--;
+-    qemu_co_queue_next(&s->free_sema);
+ 
+     /* Kick the read_reply_co to get the next reply.  */
+     if (s->read_reply_co) {
+         aio_co_wake(s->read_reply_co);
+     }
++
++    qemu_co_mutex_lock(&s->send_mutex);
++    s->in_flight--;
++    qemu_co_queue_next(&s->free_sema);
++    qemu_co_mutex_unlock(&s->send_mutex);
+ }
+ 
+ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
+@@ -221,7 +214,6 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
+     assert(bytes <= NBD_MAX_BUFFER_SIZE);
+     assert(!flags);
+ 
+-    nbd_coroutine_start(client, &request);
+     ret = nbd_co_send_request(bs, &request, NULL);
+     if (ret < 0) {
+         reply.error = -ret;
+@@ -251,7 +243,6 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
+ 
+     assert(bytes <= NBD_MAX_BUFFER_SIZE);
+ 
+-    nbd_coroutine_start(client, &request);
+     ret = nbd_co_send_request(bs, &request, qiov);
+     if (ret < 0) {
+         reply.error = -ret;
+@@ -286,7 +277,6 @@ int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
+         request.flags |= NBD_CMD_FLAG_NO_HOLE;
+     }
+ 
+-    nbd_coroutine_start(client, &request);
+     ret = nbd_co_send_request(bs, &request, NULL);
+     if (ret < 0) {
+         reply.error = -ret;
+@@ -311,7 +301,6 @@ int nbd_client_co_flush(BlockDriverState *bs)
+     request.from = 0;
+     request.len = 0;
+ 
+-    nbd_coroutine_start(client, &request);
+     ret = nbd_co_send_request(bs, &request, NULL);
+     if (ret < 0) {
+         reply.error = -ret;
+@@ -337,7 +326,6 @@ int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
+         return 0;
+     }
+ 
+-    nbd_coroutine_start(client, &request);
+     ret = nbd_co_send_request(bs, &request, NULL);
+     if (ret < 0) {
+         reply.error = -ret;
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0036-kvm-nbd-strict-nbd_wr_syncv.patch b/debian/patches/extra/0036-kvm-nbd-strict-nbd_wr_syncv.patch
new file mode 100644
index 0000000..cbc64a3
--- /dev/null
+++ b/debian/patches/extra/0036-kvm-nbd-strict-nbd_wr_syncv.patch
@@ -0,0 +1,66 @@
+From 10f433100f0778c22762b3dff17cc6bf861c3383 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 19 Jul 2017 18:01:59 +0200
+Subject: [PATCH 1/4] nbd: strict nbd_wr_syncv
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170719180202.23329-2-eblake at redhat.com>
+Patchwork-id: 75817
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 1/4] nbd: strict nbd_wr_syncv
+Bugzilla: 1467509
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+
+From: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+
+nbd_wr_syncv is called either from coroutine or from client negotiation
+code, when socket is in blocking mode. So, -EAGAIN is impossible.
+
+Furthermore, EAGAIN is confusing, as, what to read/write again? With
+EAGAIN as a return code we don't know how much data is already
+read or written by the function, so in case of EAGAIN the whole
+communication is broken.
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Message-Id: <20170516094533.6160-2-vsementsov at virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+(cherry picked from commit f250a42ddaee042ad2eb02022a3ebd18fcf987de)
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ nbd/common.c | 11 ++++++-----
+ 1 file changed, 6 insertions(+), 5 deletions(-)
+
+diff --git a/nbd/common.c b/nbd/common.c
+index dccbb8e..4db45b3 100644
+--- a/nbd/common.c
++++ b/nbd/common.c
+@@ -20,6 +20,10 @@
+ #include "qapi/error.h"
+ #include "nbd-internal.h"
+ 
++/* nbd_wr_syncv
++ * The function may be called from coroutine or from non-coroutine context.
++ * When called from non-coroutine context @ioc must be in blocking mode.
++ */
+ ssize_t nbd_wr_syncv(QIOChannel *ioc,
+                      struct iovec *iov,
+                      size_t niov,
+@@ -42,11 +46,8 @@ ssize_t nbd_wr_syncv(QIOChannel *ioc,
+             len = qio_channel_writev(ioc, local_iov, nlocal_iov, &local_err);
+         }
+         if (len == QIO_CHANNEL_ERR_BLOCK) {
+-            if (qemu_in_coroutine()) {
+-                qio_channel_yield(ioc, do_read ? G_IO_IN : G_IO_OUT);
+-            } else {
+-                return -EAGAIN;
+-            }
++            assert(qemu_in_coroutine());
++            qio_channel_yield(ioc, do_read ? G_IO_IN : G_IO_OUT);
+             continue;
+         }
+         if (len < 0) {
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0037-kvm-nbd-read_sync-and-friends-return-0-on-success.patch b/debian/patches/extra/0037-kvm-nbd-read_sync-and-friends-return-0-on-success.patch
new file mode 100644
index 0000000..e6cac96
--- /dev/null
+++ b/debian/patches/extra/0037-kvm-nbd-read_sync-and-friends-return-0-on-success.patch
@@ -0,0 +1,620 @@
+From d19d12f3a2d189241596e6dc5a5293537904dfb2 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 19 Jul 2017 18:02:00 +0200
+Subject: [PATCH 2/4] nbd: read_sync and friends: return 0 on success
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170719180202.23329-3-eblake at redhat.com>
+Patchwork-id: 75818
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 2/4] nbd: read_sync and friends: return 0 on success
+Bugzilla: 1467509
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+
+From: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+
+functions read_sync, drop_sync, write_sync, and also
+nbd_negotiate_write, nbd_negotiate_read, nbd_negotiate_drop_sync
+returns number of processed bytes. But what this number can be,
+except requested number of bytes?
+
+Actually, underlying nbd_wr_syncv function returns a value >= 0 and
+!= requested_bytes only on eof on read operation. So, firstly, it is
+impossible on write (let's add an assert) and on read it actually
+means, that communication is broken (except nbd_receive_reply, see
+below).
+
+Most of callers operate like this:
+   if (func(..., size) != size) {
+       /* error path */
+   }
+, i.e.:
+  1. They are not interested in partial success
+  2. Extra duplications in code (especially bad are duplications of
+     magic numbers)
+  3. User doesn't see actual error message, as return code is lost.
+     (this patch doesn't fix this point, but it makes fixing easier)
+
+Several callers handles ret >= 0 and != requested-size separately, by
+just returning EINVAL in this case. This patch makes read_sync and
+friends return EINVAL in this case, so final behavior is the same.
+
+And only one caller - nbd_receive_reply() does something not so
+obvious. It returns EINVAL for ret > 0 and != requested-size, like
+previous group, but for ret == 0 it returns 0. The only caller of
+nbd_receive_reply() - nbd_read_reply_entry() handles ret == 0 in the
+same way as ret < 0, so for now it doesn't matter. However, in
+following commits error path handling will be improved and we'll need
+to distinguish success from fail in this case too. So, this patch adds
+separate helper for this case - read_sync_eof.
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Message-Id: <20170516094533.6160-3-vsementsov at virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+(cherry picked from commit f5d406fe86bb28da85824b6581e58980cc1a07f3)
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ nbd/client.c       | 63 ++++++++++++++++------------------------
+ nbd/nbd-internal.h | 34 +++++++++++++++++++---
+ nbd/server.c       | 84 +++++++++++++++++++++---------------------------------
+ 3 files changed, 88 insertions(+), 93 deletions(-)
+
+diff --git a/nbd/client.c b/nbd/client.c
+index a58fb02..6b74a62 100644
+--- a/nbd/client.c
++++ b/nbd/client.c
+@@ -86,9 +86,9 @@ static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);
+ 
+ */
+ 
+-/* Discard length bytes from channel.  Return -errno on failure, or
+- * the amount of bytes consumed. */
+-static ssize_t drop_sync(QIOChannel *ioc, size_t size)
++/* Discard length bytes from channel.  Return -errno on failure and 0 on
++ * success*/
++static int drop_sync(QIOChannel *ioc, size_t size)
+ {
+     ssize_t ret = 0;
+     char small[1024];
+@@ -96,14 +96,13 @@ static ssize_t drop_sync(QIOChannel *ioc, size_t size)
+ 
+     buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
+     while (size > 0) {
+-        ssize_t count = read_sync(ioc, buffer, MIN(65536, size));
++        ssize_t count = MIN(65536, size);
++        ret = read_sync(ioc, buffer, MIN(65536, size));
+ 
+-        if (count <= 0) {
++        if (ret < 0) {
+             goto cleanup;
+         }
+-        assert(count <= size);
+         size -= count;
+-        ret += count;
+     }
+ 
+  cleanup:
+@@ -136,12 +135,12 @@ static int nbd_send_option_request(QIOChannel *ioc, uint32_t opt,
+     stl_be_p(&req.option, opt);
+     stl_be_p(&req.length, len);
+ 
+-    if (write_sync(ioc, &req, sizeof(req)) != sizeof(req)) {
++    if (write_sync(ioc, &req, sizeof(req)) < 0) {
+         error_setg(errp, "Failed to send option request header");
+         return -1;
+     }
+ 
+-    if (len && write_sync(ioc, (char *) data, len) != len) {
++    if (len && write_sync(ioc, (char *) data, len) < 0) {
+         error_setg(errp, "Failed to send option request data");
+         return -1;
+     }
+@@ -170,7 +169,7 @@ static int nbd_receive_option_reply(QIOChannel *ioc, uint32_t opt,
+                                     nbd_opt_reply *reply, Error **errp)
+ {
+     QEMU_BUILD_BUG_ON(sizeof(*reply) != 20);
+-    if (read_sync(ioc, reply, sizeof(*reply)) != sizeof(*reply)) {
++    if (read_sync(ioc, reply, sizeof(*reply)) < 0) {
+         error_setg(errp, "failed to read option reply");
+         nbd_send_opt_abort(ioc);
+         return -1;
+@@ -219,7 +218,7 @@ static int nbd_handle_reply_err(QIOChannel *ioc, nbd_opt_reply *reply,
+             goto cleanup;
+         }
+         msg = g_malloc(reply->length + 1);
+-        if (read_sync(ioc, msg, reply->length) != reply->length) {
++        if (read_sync(ioc, msg, reply->length) < 0) {
+             error_setg(errp, "failed to read option error message");
+             goto cleanup;
+         }
+@@ -321,7 +320,7 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match,
+         nbd_send_opt_abort(ioc);
+         return -1;
+     }
+-    if (read_sync(ioc, &namelen, sizeof(namelen)) != sizeof(namelen)) {
++    if (read_sync(ioc, &namelen, sizeof(namelen)) < 0) {
+         error_setg(errp, "failed to read option name length");
+         nbd_send_opt_abort(ioc);
+         return -1;
+@@ -334,7 +333,7 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match,
+         return -1;
+     }
+     if (namelen != strlen(want)) {
+-        if (drop_sync(ioc, len) != len) {
++        if (drop_sync(ioc, len) < 0) {
+             error_setg(errp, "failed to skip export name with wrong length");
+             nbd_send_opt_abort(ioc);
+             return -1;
+@@ -343,14 +342,14 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match,
+     }
+ 
+     assert(namelen < sizeof(name));
+-    if (read_sync(ioc, name, namelen) != namelen) {
++    if (read_sync(ioc, name, namelen) < 0) {
+         error_setg(errp, "failed to read export name");
+         nbd_send_opt_abort(ioc);
+         return -1;
+     }
+     name[namelen] = '\0';
+     len -= namelen;
+-    if (drop_sync(ioc, len) != len) {
++    if (drop_sync(ioc, len) < 0) {
+         error_setg(errp, "failed to read export description");
+         nbd_send_opt_abort(ioc);
+         return -1;
+@@ -477,7 +476,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+         goto fail;
+     }
+ 
+-    if (read_sync(ioc, buf, 8) != 8) {
++    if (read_sync(ioc, buf, 8) < 0) {
+         error_setg(errp, "Failed to read data");
+         goto fail;
+     }
+@@ -503,7 +502,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+         goto fail;
+     }
+ 
+-    if (read_sync(ioc, &magic, sizeof(magic)) != sizeof(magic)) {
++    if (read_sync(ioc, &magic, sizeof(magic)) < 0) {
+         error_setg(errp, "Failed to read magic");
+         goto fail;
+     }
+@@ -515,8 +514,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+         uint16_t globalflags;
+         bool fixedNewStyle = false;
+ 
+-        if (read_sync(ioc, &globalflags, sizeof(globalflags)) !=
+-            sizeof(globalflags)) {
++        if (read_sync(ioc, &globalflags, sizeof(globalflags)) < 0) {
+             error_setg(errp, "Failed to read server flags");
+             goto fail;
+         }
+@@ -534,8 +532,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+         }
+         /* client requested flags */
+         clientflags = cpu_to_be32(clientflags);
+-        if (write_sync(ioc, &clientflags, sizeof(clientflags)) !=
+-            sizeof(clientflags)) {
++        if (write_sync(ioc, &clientflags, sizeof(clientflags)) < 0) {
+             error_setg(errp, "Failed to send clientflags field");
+             goto fail;
+         }
+@@ -573,13 +570,13 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+         }
+ 
+         /* Read the response */
+-        if (read_sync(ioc, &s, sizeof(s)) != sizeof(s)) {
++        if (read_sync(ioc, &s, sizeof(s)) < 0) {
+             error_setg(errp, "Failed to read export length");
+             goto fail;
+         }
+         *size = be64_to_cpu(s);
+ 
+-        if (read_sync(ioc, flags, sizeof(*flags)) != sizeof(*flags)) {
++        if (read_sync(ioc, flags, sizeof(*flags)) < 0) {
+             error_setg(errp, "Failed to read export flags");
+             goto fail;
+         }
+@@ -596,14 +593,14 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+             goto fail;
+         }
+ 
+-        if (read_sync(ioc, &s, sizeof(s)) != sizeof(s)) {
++        if (read_sync(ioc, &s, sizeof(s)) < 0) {
+             error_setg(errp, "Failed to read export length");
+             goto fail;
+         }
+         *size = be64_to_cpu(s);
+         TRACE("Size is %" PRIu64, *size);
+ 
+-        if (read_sync(ioc, &oldflags, sizeof(oldflags)) != sizeof(oldflags)) {
++        if (read_sync(ioc, &oldflags, sizeof(oldflags)) < 0) {
+             error_setg(errp, "Failed to read export flags");
+             goto fail;
+         }
+@@ -619,7 +616,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+     }
+ 
+     TRACE("Size is %" PRIu64 ", export flags %" PRIx16, *size, *flags);
+-    if (zeroes && drop_sync(ioc, 124) != 124) {
++    if (zeroes && drop_sync(ioc, 124) < 0) {
+         error_setg(errp, "Failed to read reserved block");
+         goto fail;
+     }
+@@ -744,7 +741,6 @@ int nbd_disconnect(int fd)
+ ssize_t nbd_send_request(QIOChannel *ioc, NBDRequest *request)
+ {
+     uint8_t buf[NBD_REQUEST_SIZE];
+-    ssize_t ret;
+ 
+     TRACE("Sending request to server: "
+           "{ .from = %" PRIu64", .len = %" PRIu32 ", .handle = %" PRIu64
+@@ -759,16 +755,7 @@ ssize_t nbd_send_request(QIOChannel *ioc, NBDRequest *request)
+     stq_be_p(buf + 16, request->from);
+     stl_be_p(buf + 24, request->len);
+ 
+-    ret = write_sync(ioc, buf, sizeof(buf));
+-    if (ret < 0) {
+-        return ret;
+-    }
+-
+-    if (ret != sizeof(buf)) {
+-        LOG("writing to socket failed");
+-        return -EINVAL;
+-    }
+-    return 0;
++    return write_sync(ioc, buf, sizeof(buf));
+ }
+ 
+ ssize_t nbd_receive_reply(QIOChannel *ioc, NBDReply *reply)
+@@ -777,7 +764,7 @@ ssize_t nbd_receive_reply(QIOChannel *ioc, NBDReply *reply)
+     uint32_t magic;
+     ssize_t ret;
+ 
+-    ret = read_sync(ioc, buf, sizeof(buf));
++    ret = read_sync_eof(ioc, buf, sizeof(buf));
+     if (ret <= 0) {
+         return ret;
+     }
+diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
+index f43d990..e6bbc7c 100644
+--- a/nbd/nbd-internal.h
++++ b/nbd/nbd-internal.h
+@@ -94,7 +94,13 @@
+ #define NBD_ENOSPC     28
+ #define NBD_ESHUTDOWN  108
+ 
+-static inline ssize_t read_sync(QIOChannel *ioc, void *buffer, size_t size)
++/* read_sync_eof
++ * Tries to read @size bytes from @ioc. Returns number of bytes actually read.
++ * May return a value >= 0 and < size only on EOF, i.e. when iteratively called
++ * qio_channel_readv() returns 0. So, there are no needs to call read_sync_eof
++ * iteratively.
++ */
++static inline ssize_t read_sync_eof(QIOChannel *ioc, void *buffer, size_t size)
+ {
+     struct iovec iov = { .iov_base = buffer, .iov_len = size };
+     /* Sockets are kept in blocking mode in the negotiation phase.  After
+@@ -105,12 +111,32 @@ static inline ssize_t read_sync(QIOChannel *ioc, void *buffer, size_t size)
+     return nbd_wr_syncv(ioc, &iov, 1, size, true);
+ }
+ 
+-static inline ssize_t write_sync(QIOChannel *ioc, const void *buffer,
+-                                 size_t size)
++/* read_sync
++ * Reads @size bytes from @ioc. Returns 0 on success.
++ */
++static inline int read_sync(QIOChannel *ioc, void *buffer, size_t size)
++{
++    ssize_t ret = read_sync_eof(ioc, buffer, size);
++
++    if (ret >= 0 && ret != size) {
++        ret = -EINVAL;
++    }
++
++    return ret < 0 ? ret : 0;
++}
++
++/* write_sync
++ * Writes @size bytes to @ioc. Returns 0 on success.
++ */
++static inline int write_sync(QIOChannel *ioc, const void *buffer, size_t size)
+ {
+     struct iovec iov = { .iov_base = (void *) buffer, .iov_len = size };
+ 
+-    return nbd_wr_syncv(ioc, &iov, 1, size, false);
++    ssize_t ret = nbd_wr_syncv(ioc, &iov, 1, size, false);
++
++    assert(ret < 0 || ret == size);
++
++    return ret < 0 ? ret : 0;
+ }
+ 
+ struct NBDTLSHandshakeData {
+diff --git a/nbd/server.c b/nbd/server.c
+index a98bb21..b44cbe6 100644
+--- a/nbd/server.c
++++ b/nbd/server.c
+@@ -112,7 +112,7 @@ static gboolean nbd_negotiate_continue(QIOChannel *ioc,
+     return TRUE;
+ }
+ 
+-static ssize_t nbd_negotiate_read(QIOChannel *ioc, void *buffer, size_t size)
++static int nbd_negotiate_read(QIOChannel *ioc, void *buffer, size_t size)
+ {
+     ssize_t ret;
+     guint watch;
+@@ -130,8 +130,7 @@ static ssize_t nbd_negotiate_read(QIOChannel *ioc, void *buffer, size_t size)
+ 
+ }
+ 
+-static ssize_t nbd_negotiate_write(QIOChannel *ioc, const void *buffer,
+-                                   size_t size)
++static int nbd_negotiate_write(QIOChannel *ioc, const void *buffer, size_t size)
+ {
+     ssize_t ret;
+     guint watch;
+@@ -148,24 +147,24 @@ static ssize_t nbd_negotiate_write(QIOChannel *ioc, const void *buffer,
+     return ret;
+ }
+ 
+-static ssize_t nbd_negotiate_drop_sync(QIOChannel *ioc, size_t size)
++static int nbd_negotiate_drop_sync(QIOChannel *ioc, size_t size)
+ {
+-    ssize_t ret, dropped = size;
++    ssize_t ret;
+     uint8_t *buffer = g_malloc(MIN(65536, size));
+ 
+     while (size > 0) {
+-        ret = nbd_negotiate_read(ioc, buffer, MIN(65536, size));
++        size_t count = MIN(65536, size);
++        ret = nbd_negotiate_read(ioc, buffer, count);
+         if (ret < 0) {
+             g_free(buffer);
+             return ret;
+         }
+ 
+-        assert(ret <= size);
+-        size -= ret;
++        size -= count;
+     }
+ 
+     g_free(buffer);
+-    return dropped;
++    return 0;
+ }
+ 
+ /* Basic flow for negotiation
+@@ -206,22 +205,22 @@ static int nbd_negotiate_send_rep_len(QIOChannel *ioc, uint32_t type,
+           type, opt, len);
+ 
+     magic = cpu_to_be64(NBD_REP_MAGIC);
+-    if (nbd_negotiate_write(ioc, &magic, sizeof(magic)) != sizeof(magic)) {
++    if (nbd_negotiate_write(ioc, &magic, sizeof(magic)) < 0) {
+         LOG("write failed (rep magic)");
+         return -EINVAL;
+     }
+     opt = cpu_to_be32(opt);
+-    if (nbd_negotiate_write(ioc, &opt, sizeof(opt)) != sizeof(opt)) {
++    if (nbd_negotiate_write(ioc, &opt, sizeof(opt)) < 0) {
+         LOG("write failed (rep opt)");
+         return -EINVAL;
+     }
+     type = cpu_to_be32(type);
+-    if (nbd_negotiate_write(ioc, &type, sizeof(type)) != sizeof(type)) {
++    if (nbd_negotiate_write(ioc, &type, sizeof(type)) < 0) {
+         LOG("write failed (rep type)");
+         return -EINVAL;
+     }
+     len = cpu_to_be32(len);
+-    if (nbd_negotiate_write(ioc, &len, sizeof(len)) != sizeof(len)) {
++    if (nbd_negotiate_write(ioc, &len, sizeof(len)) < 0) {
+         LOG("write failed (rep data length)");
+         return -EINVAL;
+     }
+@@ -256,7 +255,7 @@ nbd_negotiate_send_rep_err(QIOChannel *ioc, uint32_t type,
+     if (ret < 0) {
+         goto out;
+     }
+-    if (nbd_negotiate_write(ioc, msg, len) != len) {
++    if (nbd_negotiate_write(ioc, msg, len) < 0) {
+         LOG("write failed (error message)");
+         ret = -EIO;
+     } else {
+@@ -287,15 +286,15 @@ static int nbd_negotiate_send_rep_list(QIOChannel *ioc, NBDExport *exp)
+     }
+ 
+     len = cpu_to_be32(name_len);
+-    if (nbd_negotiate_write(ioc, &len, sizeof(len)) != sizeof(len)) {
++    if (nbd_negotiate_write(ioc, &len, sizeof(len)) < 0) {
+         LOG("write failed (name length)");
+         return -EINVAL;
+     }
+-    if (nbd_negotiate_write(ioc, name, name_len) != name_len) {
++    if (nbd_negotiate_write(ioc, name, name_len) < 0) {
+         LOG("write failed (name buffer)");
+         return -EINVAL;
+     }
+-    if (nbd_negotiate_write(ioc, desc, desc_len) != desc_len) {
++    if (nbd_negotiate_write(ioc, desc, desc_len) < 0) {
+         LOG("write failed (description buffer)");
+         return -EINVAL;
+     }
+@@ -309,7 +308,7 @@ static int nbd_negotiate_handle_list(NBDClient *client, uint32_t length)
+     NBDExport *exp;
+ 
+     if (length) {
+-        if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
++        if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
+             return -EIO;
+         }
+         return nbd_negotiate_send_rep_err(client->ioc,
+@@ -340,7 +339,7 @@ static int nbd_negotiate_handle_export_name(NBDClient *client, uint32_t length)
+         LOG("Bad length received");
+         goto fail;
+     }
+-    if (nbd_negotiate_read(client->ioc, name, length) != length) {
++    if (nbd_negotiate_read(client->ioc, name, length) < 0) {
+         LOG("read failed");
+         goto fail;
+     }
+@@ -373,7 +372,7 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
+     TRACE("Setting up TLS");
+     ioc = client->ioc;
+     if (length) {
+-        if (nbd_negotiate_drop_sync(ioc, length) != length) {
++        if (nbd_negotiate_drop_sync(ioc, length) < 0) {
+             return NULL;
+         }
+         nbd_negotiate_send_rep_err(ioc, NBD_REP_ERR_INVALID, NBD_OPT_STARTTLS,
+@@ -437,8 +436,7 @@ static int nbd_negotiate_options(NBDClient *client)
+         ...           Rest of request
+     */
+ 
+-    if (nbd_negotiate_read(client->ioc, &flags, sizeof(flags)) !=
+-        sizeof(flags)) {
++    if (nbd_negotiate_read(client->ioc, &flags, sizeof(flags)) < 0) {
+         LOG("read failed");
+         return -EIO;
+     }
+@@ -464,8 +462,7 @@ static int nbd_negotiate_options(NBDClient *client)
+         uint32_t clientflags, length;
+         uint64_t magic;
+ 
+-        if (nbd_negotiate_read(client->ioc, &magic, sizeof(magic)) !=
+-            sizeof(magic)) {
++        if (nbd_negotiate_read(client->ioc, &magic, sizeof(magic)) < 0) {
+             LOG("read failed");
+             return -EINVAL;
+         }
+@@ -476,14 +473,14 @@ static int nbd_negotiate_options(NBDClient *client)
+         }
+ 
+         if (nbd_negotiate_read(client->ioc, &clientflags,
+-                               sizeof(clientflags)) != sizeof(clientflags)) {
++                               sizeof(clientflags)) < 0)
++        {
+             LOG("read failed");
+             return -EINVAL;
+         }
+         clientflags = be32_to_cpu(clientflags);
+ 
+-        if (nbd_negotiate_read(client->ioc, &length, sizeof(length)) !=
+-            sizeof(length)) {
++        if (nbd_negotiate_read(client->ioc, &length, sizeof(length)) < 0) {
+             LOG("read failed");
+             return -EINVAL;
+         }
+@@ -513,7 +510,7 @@ static int nbd_negotiate_options(NBDClient *client)
+                 return -EINVAL;
+ 
+             default:
+-                if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
++                if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
+                     return -EIO;
+                 }
+                 ret = nbd_negotiate_send_rep_err(client->ioc,
+@@ -551,7 +548,7 @@ static int nbd_negotiate_options(NBDClient *client)
+                 return nbd_negotiate_handle_export_name(client, length);
+ 
+             case NBD_OPT_STARTTLS:
+-                if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
++                if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
+                     return -EIO;
+                 }
+                 if (client->tlscreds) {
+@@ -570,7 +567,7 @@ static int nbd_negotiate_options(NBDClient *client)
+                 }
+                 break;
+             default:
+-                if (nbd_negotiate_drop_sync(client->ioc, length) != length) {
++                if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
+                     return -EIO;
+                 }
+                 ret = nbd_negotiate_send_rep_err(client->ioc,
+@@ -659,12 +656,12 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData *data)
+             TRACE("TLS cannot be enabled with oldstyle protocol");
+             goto fail;
+         }
+-        if (nbd_negotiate_write(client->ioc, buf, sizeof(buf)) != sizeof(buf)) {
++        if (nbd_negotiate_write(client->ioc, buf, sizeof(buf)) < 0) {
+             LOG("write failed");
+             goto fail;
+         }
+     } else {
+-        if (nbd_negotiate_write(client->ioc, buf, 18) != 18) {
++        if (nbd_negotiate_write(client->ioc, buf, 18) < 0) {
+             LOG("write failed");
+             goto fail;
+         }
+@@ -679,7 +676,7 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData *data)
+         stq_be_p(buf + 18, client->exp->size);
+         stw_be_p(buf + 26, client->exp->nbdflags | myflags);
+         len = client->no_zeroes ? 10 : sizeof(buf) - 18;
+-        if (nbd_negotiate_write(client->ioc, buf + 18, len) != len) {
++        if (nbd_negotiate_write(client->ioc, buf + 18, len) < 0) {
+             LOG("write failed");
+             goto fail;
+         }
+@@ -702,11 +699,6 @@ static ssize_t nbd_receive_request(QIOChannel *ioc, NBDRequest *request)
+         return ret;
+     }
+ 
+-    if (ret != sizeof(buf)) {
+-        LOG("read failed");
+-        return -EINVAL;
+-    }
+-
+     /* Request
+        [ 0 ..  3]   magic   (NBD_REQUEST_MAGIC)
+        [ 4 ..  5]   flags   (NBD_CMD_FLAG_FUA, ...)
+@@ -737,7 +729,6 @@ static ssize_t nbd_receive_request(QIOChannel *ioc, NBDRequest *request)
+ static ssize_t nbd_send_reply(QIOChannel *ioc, NBDReply *reply)
+ {
+     uint8_t buf[NBD_REPLY_SIZE];
+-    ssize_t ret;
+ 
+     reply->error = system_errno_to_nbd_errno(reply->error);
+ 
+@@ -754,16 +745,7 @@ static ssize_t nbd_send_reply(QIOChannel *ioc, NBDReply *reply)
+     stl_be_p(buf + 4, reply->error);
+     stq_be_p(buf + 8, reply->handle);
+ 
+-    ret = write_sync(ioc, buf, sizeof(buf));
+-    if (ret < 0) {
+-        return ret;
+-    }
+-
+-    if (ret != sizeof(buf)) {
+-        LOG("writing to socket failed");
+-        return -EINVAL;
+-    }
+-    return 0;
++    return write_sync(ioc, buf, sizeof(buf));
+ }
+ 
+ #define MAX_NBD_REQUESTS 16
+@@ -1067,7 +1049,7 @@ static ssize_t nbd_co_send_reply(NBDRequestData *req, NBDReply *reply,
+         rc = nbd_send_reply(client->ioc, reply);
+         if (rc >= 0) {
+             ret = write_sync(client->ioc, req->data, len);
+-            if (ret != len) {
++            if (ret < 0) {
+                 rc = -EIO;
+             }
+         }
+@@ -1141,7 +1123,7 @@ static ssize_t nbd_co_receive_request(NBDRequestData *req,
+     if (request->type == NBD_CMD_WRITE) {
+         TRACE("Reading %" PRIu32 " byte(s)", request->len);
+ 
+-        if (read_sync(client->ioc, req->data, request->len) != request->len) {
++        if (read_sync(client->ioc, req->data, request->len) < 0) {
+             LOG("reading from socket failed");
+             rc = -EIO;
+             goto out;
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0038-kvm-nbd-make-nbd_drop-public.patch b/debian/patches/extra/0038-kvm-nbd-make-nbd_drop-public.patch
new file mode 100644
index 0000000..6ceeb24
--- /dev/null
+++ b/debian/patches/extra/0038-kvm-nbd-make-nbd_drop-public.patch
@@ -0,0 +1,151 @@
+From cca4dbe8daf69ba05d173a260bdee6a6184cd423 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 19 Jul 2017 18:02:01 +0200
+Subject: [PATCH 3/4] nbd: make nbd_drop public
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170719180202.23329-4-eblake at redhat.com>
+Patchwork-id: 75814
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 3/4] nbd: make nbd_drop public
+Bugzilla: 1467509
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+
+From: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+
+Following commit will reuse it for nbd server too.
+
+Reviewed-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Message-Id: <20170602150150.258222-3-vsementsov at virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+(cherry picked from commit 44298024d30ad36439707b89715a76333f58791b)
+
+ Conflicts:
+	nbd/client.c, nbd/nbd_internal.h, nbd/common.c - missing errp
+	addition (e44ed99) and bulk rename (d1fdf25)
+
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ nbd/client.c       | 32 +++-----------------------------
+ nbd/common.c       | 26 ++++++++++++++++++++++++++
+ nbd/nbd-internal.h |  2 ++
+ 3 files changed, 31 insertions(+), 29 deletions(-)
+
+diff --git a/nbd/client.c b/nbd/client.c
+index 6b74a62..1652f28 100644
+--- a/nbd/client.c
++++ b/nbd/client.c
+@@ -86,32 +86,6 @@ static QTAILQ_HEAD(, NBDExport) exports = QTAILQ_HEAD_INITIALIZER(exports);
+ 
+ */
+ 
+-/* Discard length bytes from channel.  Return -errno on failure and 0 on
+- * success*/
+-static int drop_sync(QIOChannel *ioc, size_t size)
+-{
+-    ssize_t ret = 0;
+-    char small[1024];
+-    char *buffer;
+-
+-    buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
+-    while (size > 0) {
+-        ssize_t count = MIN(65536, size);
+-        ret = read_sync(ioc, buffer, MIN(65536, size));
+-
+-        if (ret < 0) {
+-            goto cleanup;
+-        }
+-        size -= count;
+-    }
+-
+- cleanup:
+-    if (buffer != small) {
+-        g_free(buffer);
+-    }
+-    return ret;
+-}
+-
+ /* Send an option request.
+  *
+  * The request is for option @opt, with @data containing @len bytes of
+@@ -333,7 +307,7 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match,
+         return -1;
+     }
+     if (namelen != strlen(want)) {
+-        if (drop_sync(ioc, len) < 0) {
++        if (nbd_drop(ioc, len) < 0) {
+             error_setg(errp, "failed to skip export name with wrong length");
+             nbd_send_opt_abort(ioc);
+             return -1;
+@@ -349,7 +323,7 @@ static int nbd_receive_list(QIOChannel *ioc, const char *want, bool *match,
+     }
+     name[namelen] = '\0';
+     len -= namelen;
+-    if (drop_sync(ioc, len) < 0) {
++    if (nbd_drop(ioc, len) < 0) {
+         error_setg(errp, "failed to read export description");
+         nbd_send_opt_abort(ioc);
+         return -1;
+@@ -616,7 +590,7 @@ int nbd_receive_negotiate(QIOChannel *ioc, const char *name, uint16_t *flags,
+     }
+ 
+     TRACE("Size is %" PRIu64 ", export flags %" PRIx16, *size, *flags);
+-    if (zeroes && drop_sync(ioc, 124) < 0) {
++    if (zeroes && nbd_drop(ioc, 124) < 0) {
+         error_setg(errp, "Failed to read reserved block");
+         goto fail;
+     }
+diff --git a/nbd/common.c b/nbd/common.c
+index 4db45b3..9a54010 100644
+--- a/nbd/common.c
++++ b/nbd/common.c
+@@ -71,6 +71,32 @@ ssize_t nbd_wr_syncv(QIOChannel *ioc,
+     return done;
+ }
+ 
++/* Discard length bytes from channel.  Return -errno on failure and 0 on
++ * success */
++int nbd_drop(QIOChannel *ioc, size_t size)
++{
++    ssize_t ret = 0;
++    char small[1024];
++    char *buffer;
++
++    buffer = sizeof(small) >= size ? small : g_malloc(MIN(65536, size));
++    while (size > 0) {
++        ssize_t count = MIN(65536, size);
++        ret = read_sync(ioc, buffer, MIN(65536, size));
++
++        if (ret < 0) {
++            goto cleanup;
++        }
++        size -= count;
++    }
++
++ cleanup:
++    if (buffer != small) {
++        g_free(buffer);
++    }
++    return ret;
++}
++
+ 
+ void nbd_tls_handshake(QIOTask *task,
+                        void *opaque)
+diff --git a/nbd/nbd-internal.h b/nbd/nbd-internal.h
+index e6bbc7c..c02378c 100644
+--- a/nbd/nbd-internal.h
++++ b/nbd/nbd-internal.h
+@@ -149,4 +149,6 @@ struct NBDTLSHandshakeData {
+ void nbd_tls_handshake(QIOTask *task,
+                        void *opaque);
+ 
++int nbd_drop(QIOChannel *ioc, size_t size);
++
+ #endif
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0039-kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch b/debian/patches/extra/0039-kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch
new file mode 100644
index 0000000..c509554
--- /dev/null
+++ b/debian/patches/extra/0039-kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch
@@ -0,0 +1,292 @@
+From 9b56a823cc4ca9b94ab6b73ad0fe43c2445681e0 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 19 Jul 2017 18:02:02 +0200
+Subject: [PATCH 4/4] nbd/server: get rid of nbd_negotiate_read and friends
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170719180202.23329-5-eblake at redhat.com>
+Patchwork-id: 75816
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 4/4] nbd/server: get rid of nbd_negotiate_read and friends
+Bugzilla: 1467509
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+RH-Acked-by: Paolo Bonzini <pbonzini at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+
+From: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+
+Functions nbd_negotiate_{read,write,drop_sync} were introduced in
+1a6245a5b, when nbd_rwv (was nbd_wr_sync) was working through
+qemu_co_sendv_recvv (the path is nbd_wr_sync -> qemu_co_{recv/send} ->
+qemu_co_send_recv -> qemu_co_sendv_recvv), which just yields, without
+setting any handlers. But starting from ff82911cd nbd_rwv (was
+nbd_wr_syncv) works through qio_channel_yield() which sets handlers, so
+watchers are redundant in nbd_negotiate_{read,write,drop_sync}, then,
+let's just use nbd_{read,write,drop} functions.
+
+Functions nbd_{read,write,drop} has errp parameter, which is unused in
+this patch. This will be fixed later.
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Reviewed-by: Eric Blake <eblake at redhat.com>
+Message-Id: <20170602150150.258222-4-vsementsov at virtuozzo.com>
+Signed-off-by: Paolo Bonzini <pbonzini at redhat.com>
+(cherry picked from commit 2b0bbc4f8809c972bad134bc1a2570dbb01dea0b)
+
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+
+Conflicts:
+	nbd/server.c - missing errp addition (e44ed99) and bulk
+	rename (d1fdf25)
+Fixes CVE-2017-7539
+
+Signed-off-by: Eric Blake <eblake at redhat.com>
+---
+ nbd/server.c | 106 ++++++++++++-----------------------------------------------
+ 1 file changed, 21 insertions(+), 85 deletions(-)
+
+diff --git a/nbd/server.c b/nbd/server.c
+index b44cbe6..8e3b8e5 100644
+--- a/nbd/server.c
++++ b/nbd/server.c
+@@ -104,69 +104,6 @@ struct NBDClient {
+ 
+ static void nbd_client_receive_next_request(NBDClient *client);
+ 
+-static gboolean nbd_negotiate_continue(QIOChannel *ioc,
+-                                       GIOCondition condition,
+-                                       void *opaque)
+-{
+-    qemu_coroutine_enter(opaque);
+-    return TRUE;
+-}
+-
+-static int nbd_negotiate_read(QIOChannel *ioc, void *buffer, size_t size)
+-{
+-    ssize_t ret;
+-    guint watch;
+-
+-    assert(qemu_in_coroutine());
+-    /* Negotiation are always in main loop. */
+-    watch = qio_channel_add_watch(ioc,
+-                                  G_IO_IN,
+-                                  nbd_negotiate_continue,
+-                                  qemu_coroutine_self(),
+-                                  NULL);
+-    ret = read_sync(ioc, buffer, size);
+-    g_source_remove(watch);
+-    return ret;
+-
+-}
+-
+-static int nbd_negotiate_write(QIOChannel *ioc, const void *buffer, size_t size)
+-{
+-    ssize_t ret;
+-    guint watch;
+-
+-    assert(qemu_in_coroutine());
+-    /* Negotiation are always in main loop. */
+-    watch = qio_channel_add_watch(ioc,
+-                                  G_IO_OUT,
+-                                  nbd_negotiate_continue,
+-                                  qemu_coroutine_self(),
+-                                  NULL);
+-    ret = write_sync(ioc, buffer, size);
+-    g_source_remove(watch);
+-    return ret;
+-}
+-
+-static int nbd_negotiate_drop_sync(QIOChannel *ioc, size_t size)
+-{
+-    ssize_t ret;
+-    uint8_t *buffer = g_malloc(MIN(65536, size));
+-
+-    while (size > 0) {
+-        size_t count = MIN(65536, size);
+-        ret = nbd_negotiate_read(ioc, buffer, count);
+-        if (ret < 0) {
+-            g_free(buffer);
+-            return ret;
+-        }
+-
+-        size -= count;
+-    }
+-
+-    g_free(buffer);
+-    return 0;
+-}
+-
+ /* Basic flow for negotiation
+ 
+    Server         Client
+@@ -205,22 +142,22 @@ static int nbd_negotiate_send_rep_len(QIOChannel *ioc, uint32_t type,
+           type, opt, len);
+ 
+     magic = cpu_to_be64(NBD_REP_MAGIC);
+-    if (nbd_negotiate_write(ioc, &magic, sizeof(magic)) < 0) {
++    if (write_sync(ioc, &magic, sizeof(magic)) < 0) {
+         LOG("write failed (rep magic)");
+         return -EINVAL;
+     }
+     opt = cpu_to_be32(opt);
+-    if (nbd_negotiate_write(ioc, &opt, sizeof(opt)) < 0) {
++    if (write_sync(ioc, &opt, sizeof(opt)) < 0) {
+         LOG("write failed (rep opt)");
+         return -EINVAL;
+     }
+     type = cpu_to_be32(type);
+-    if (nbd_negotiate_write(ioc, &type, sizeof(type)) < 0) {
++    if (write_sync(ioc, &type, sizeof(type)) < 0) {
+         LOG("write failed (rep type)");
+         return -EINVAL;
+     }
+     len = cpu_to_be32(len);
+-    if (nbd_negotiate_write(ioc, &len, sizeof(len)) < 0) {
++    if (write_sync(ioc, &len, sizeof(len)) < 0) {
+         LOG("write failed (rep data length)");
+         return -EINVAL;
+     }
+@@ -255,7 +192,7 @@ nbd_negotiate_send_rep_err(QIOChannel *ioc, uint32_t type,
+     if (ret < 0) {
+         goto out;
+     }
+-    if (nbd_negotiate_write(ioc, msg, len) < 0) {
++    if (write_sync(ioc, msg, len) < 0) {
+         LOG("write failed (error message)");
+         ret = -EIO;
+     } else {
+@@ -286,15 +223,15 @@ static int nbd_negotiate_send_rep_list(QIOChannel *ioc, NBDExport *exp)
+     }
+ 
+     len = cpu_to_be32(name_len);
+-    if (nbd_negotiate_write(ioc, &len, sizeof(len)) < 0) {
++    if (write_sync(ioc, &len, sizeof(len)) < 0) {
+         LOG("write failed (name length)");
+         return -EINVAL;
+     }
+-    if (nbd_negotiate_write(ioc, name, name_len) < 0) {
++    if (write_sync(ioc, name, name_len) < 0) {
+         LOG("write failed (name buffer)");
+         return -EINVAL;
+     }
+-    if (nbd_negotiate_write(ioc, desc, desc_len) < 0) {
++    if (write_sync(ioc, desc, desc_len) < 0) {
+         LOG("write failed (description buffer)");
+         return -EINVAL;
+     }
+@@ -308,7 +245,7 @@ static int nbd_negotiate_handle_list(NBDClient *client, uint32_t length)
+     NBDExport *exp;
+ 
+     if (length) {
+-        if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
++        if (nbd_drop(client->ioc, length) < 0) {
+             return -EIO;
+         }
+         return nbd_negotiate_send_rep_err(client->ioc,
+@@ -339,7 +276,7 @@ static int nbd_negotiate_handle_export_name(NBDClient *client, uint32_t length)
+         LOG("Bad length received");
+         goto fail;
+     }
+-    if (nbd_negotiate_read(client->ioc, name, length) < 0) {
++    if (read_sync(client->ioc, name, length) < 0) {
+         LOG("read failed");
+         goto fail;
+     }
+@@ -372,7 +309,7 @@ static QIOChannel *nbd_negotiate_handle_starttls(NBDClient *client,
+     TRACE("Setting up TLS");
+     ioc = client->ioc;
+     if (length) {
+-        if (nbd_negotiate_drop_sync(ioc, length) < 0) {
++        if (nbd_drop(ioc, length) < 0) {
+             return NULL;
+         }
+         nbd_negotiate_send_rep_err(ioc, NBD_REP_ERR_INVALID, NBD_OPT_STARTTLS,
+@@ -436,7 +373,7 @@ static int nbd_negotiate_options(NBDClient *client)
+         ...           Rest of request
+     */
+ 
+-    if (nbd_negotiate_read(client->ioc, &flags, sizeof(flags)) < 0) {
++    if (read_sync(client->ioc, &flags, sizeof(flags)) < 0) {
+         LOG("read failed");
+         return -EIO;
+     }
+@@ -462,7 +399,7 @@ static int nbd_negotiate_options(NBDClient *client)
+         uint32_t clientflags, length;
+         uint64_t magic;
+ 
+-        if (nbd_negotiate_read(client->ioc, &magic, sizeof(magic)) < 0) {
++        if (read_sync(client->ioc, &magic, sizeof(magic)) < 0) {
+             LOG("read failed");
+             return -EINVAL;
+         }
+@@ -472,15 +409,14 @@ static int nbd_negotiate_options(NBDClient *client)
+             return -EINVAL;
+         }
+ 
+-        if (nbd_negotiate_read(client->ioc, &clientflags,
+-                               sizeof(clientflags)) < 0)
++        if (read_sync(client->ioc, &clientflags, sizeof(clientflags)) < 0)
+         {
+             LOG("read failed");
+             return -EINVAL;
+         }
+         clientflags = be32_to_cpu(clientflags);
+ 
+-        if (nbd_negotiate_read(client->ioc, &length, sizeof(length)) < 0) {
++        if (read_sync(client->ioc, &length, sizeof(length)) < 0) {
+             LOG("read failed");
+             return -EINVAL;
+         }
+@@ -510,7 +446,7 @@ static int nbd_negotiate_options(NBDClient *client)
+                 return -EINVAL;
+ 
+             default:
+-                if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
++                if (nbd_drop(client->ioc, length) < 0) {
+                     return -EIO;
+                 }
+                 ret = nbd_negotiate_send_rep_err(client->ioc,
+@@ -548,7 +484,7 @@ static int nbd_negotiate_options(NBDClient *client)
+                 return nbd_negotiate_handle_export_name(client, length);
+ 
+             case NBD_OPT_STARTTLS:
+-                if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
++                if (nbd_drop(client->ioc, length) < 0) {
+                     return -EIO;
+                 }
+                 if (client->tlscreds) {
+@@ -567,7 +503,7 @@ static int nbd_negotiate_options(NBDClient *client)
+                 }
+                 break;
+             default:
+-                if (nbd_negotiate_drop_sync(client->ioc, length) < 0) {
++                if (nbd_drop(client->ioc, length) < 0) {
+                     return -EIO;
+                 }
+                 ret = nbd_negotiate_send_rep_err(client->ioc,
+@@ -656,12 +592,12 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData *data)
+             TRACE("TLS cannot be enabled with oldstyle protocol");
+             goto fail;
+         }
+-        if (nbd_negotiate_write(client->ioc, buf, sizeof(buf)) < 0) {
++        if (write_sync(client->ioc, buf, sizeof(buf)) < 0) {
+             LOG("write failed");
+             goto fail;
+         }
+     } else {
+-        if (nbd_negotiate_write(client->ioc, buf, 18) < 0) {
++        if (write_sync(client->ioc, buf, 18) < 0) {
+             LOG("write failed");
+             goto fail;
+         }
+@@ -676,7 +612,7 @@ static coroutine_fn int nbd_negotiate(NBDClientNewData *data)
+         stq_be_p(buf + 18, client->exp->size);
+         stw_be_p(buf + 26, client->exp->nbdflags | myflags);
+         len = client->no_zeroes ? 10 : sizeof(buf) - 18;
+-        if (nbd_negotiate_write(client->ioc, buf + 18, len) < 0) {
++        if (write_sync(client->ioc, buf + 18, len) < 0) {
+             LOG("write failed");
+             goto fail;
+         }
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0040-kvm-nbd-client-Fix-regression-when-server-sends-garbage.patch b/debian/patches/extra/0040-kvm-nbd-client-Fix-regression-when-server-sends-garbage.patch
new file mode 100644
index 0000000..edac185
--- /dev/null
+++ b/debian/patches/extra/0040-kvm-nbd-client-Fix-regression-when-server-sends-garbage.patch
@@ -0,0 +1,153 @@
+From 8c2960fa9f441707cee94921db5235bbd6b56696 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:19 +0200
+Subject: [PATCH 1/7] nbd-client: Fix regression when server sends garbage
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-2-eblake at redhat.com>
+Patchwork-id: 76672
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 1/7] nbd-client: Fix regression when server sends garbage
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+When we switched NBD to use coroutines for qemu 2.9 (in particular,
+commit a12a712a), we introduced a regression: if a server sends us
+garbage (such as a corrupted magic number), we quit the read loop
+but do not stop sending further queued commands, resulting in the
+client hanging when it never reads the response to those additional
+commands.  In qemu 2.8, we properly detected that the server is no
+longer reliable, and cancelled all existing pending commands with
+EIO, then tore down the socket so that all further command attempts
+get EPIPE.
+
+Restore the proper behavior of quitting (almost) all communication
+with a broken server: Once we know we are out of sync or otherwise
+can't trust the server, we must assume that any further incoming
+data is unreliable and therefore end all pending commands with EIO,
+and quit trying to send any further commands.  As an exception, we
+still (try to) send NBD_CMD_DISC to let the server know we are going
+away (in part, because it is easier to do that than to further
+refactor nbd_teardown_connection, and in part because it is the
+only command where we do not have to wait for a reply).
+
+Based on a patch by Vladimir Sementsov-Ogievskiy.
+
+A malicious server can be created with the following hack,
+followed by setting NBD_SERVER_DEBUG to a non-zero value in the
+environment when running qemu-nbd:
+
+| --- a/nbd/server.c
+| +++ b/nbd/server.c
+| @@ -919,6 +919,17 @@ static int nbd_send_reply(QIOChannel *ioc, NBDReply *reply, Error **errp)
+|      stl_be_p(buf + 4, reply->error);
+|      stq_be_p(buf + 8, reply->handle);
+|
+| +    static int debug;
+| +    static int count;
+| +    if (!count++) {
+| +        const char *str = getenv("NBD_SERVER_DEBUG");
+| +        if (str) {
+| +            debug = atoi(str);
+| +        }
+| +    }
+| +    if (debug && !(count % debug)) {
+| +        buf[0] = 0;
+| +    }
+|      return nbd_write(ioc, buf, sizeof(buf), errp);
+|  }
+
+Reported-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Message-Id: <20170814213426.24681-1-eblake at redhat.com>
+Reviewed-by: Stefan Hajnoczi <stefanha at redhat.com>
+(cherry picked from commit 72b6ffc76653214b69a94a7b1643ff80df134486)
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+
+Conflicts:
+	block/nbd-client.c
+---
+ block/nbd-client.c | 17 +++++++++++++----
+ block/nbd-client.h |  1 +
+ 2 files changed, 14 insertions(+), 4 deletions(-)
+
+diff --git a/block/nbd-client.c b/block/nbd-client.c
+index 282679b..701b4ce 100644
+--- a/block/nbd-client.c
++++ b/block/nbd-client.c
+@@ -71,7 +71,7 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
+     uint64_t i;
+     int ret;
+ 
+-    for (;;) {
++    while (!s->quit) {
+         assert(s->reply.handle == 0);
+         ret = nbd_receive_reply(s->ioc, &s->reply);
+         if (ret <= 0) {
+@@ -102,6 +102,9 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
+         qemu_coroutine_yield();
+     }
+ 
++    if (ret < 0) {
++        s->quit = true;
++    }
+     nbd_recv_coroutines_enter_all(s);
+     s->read_reply_co = NULL;
+ }
+@@ -130,6 +133,10 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     assert(i < MAX_NBD_REQUESTS);
+     request->handle = INDEX_TO_HANDLE(s, i);
+ 
++    if (s->quit) {
++        qemu_co_mutex_unlock(&s->send_mutex);
++        return -EIO;
++    }
+     if (!s->ioc) {
+         qemu_co_mutex_unlock(&s->send_mutex);
+         return -EPIPE;
+@@ -138,7 +145,7 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     if (qiov) {
+         qio_channel_set_cork(s->ioc, true);
+         rc = nbd_send_request(s->ioc, request);
+-        if (rc >= 0) {
++        if (rc >= 0 && !s->quit) {
+             ret = nbd_wr_syncv(s->ioc, qiov->iov, qiov->niov, request->len,
+                                false);
+             if (ret != request->len) {
+@@ -149,6 +156,9 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     } else {
+         rc = nbd_send_request(s->ioc, request);
+     }
++    if (rc < 0) {
++        s->quit = true;
++    }
+     qemu_co_mutex_unlock(&s->send_mutex);
+     return rc;
+ }
+@@ -163,8 +173,7 @@ static void nbd_co_receive_reply(NBDClientSession *s,
+     /* Wait until we're woken up by nbd_read_reply_entry.  */
+     qemu_coroutine_yield();
+     *reply = s->reply;
+-    if (reply->handle != request->handle ||
+-        !s->ioc) {
++    if (reply->handle != request->handle || !s->ioc || s->quit) {
+         reply->error = EIO;
+     } else {
+         if (qiov && reply->error == 0) {
+diff --git a/block/nbd-client.h b/block/nbd-client.h
+index 891ba44..9774a8e 100644
+--- a/block/nbd-client.h
++++ b/block/nbd-client.h
+@@ -30,6 +30,7 @@ typedef struct NBDClientSession {
+ 
+     Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
+     NBDReply reply;
++    bool quit;
+ } NBDClientSession;
+ 
+ NBDClientSession *nbd_get_client_session(BlockDriverState *bs);
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0041-kvm-fix-build-failure-in-nbd_read_reply_entry.patch b/debian/patches/extra/0041-kvm-fix-build-failure-in-nbd_read_reply_entry.patch
new file mode 100644
index 0000000..87bdda6
--- /dev/null
+++ b/debian/patches/extra/0041-kvm-fix-build-failure-in-nbd_read_reply_entry.patch
@@ -0,0 +1,55 @@
+From ee56caf58df25c5552dcf3cc7334fbb42ca57e87 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:20 +0200
+Subject: [PATCH 2/7] fix build failure in nbd_read_reply_entry()
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-3-eblake at redhat.com>
+Patchwork-id: 76668
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 2/7] fix build failure in nbd_read_reply_entry()
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+From: Igor Mammedov <imammedo at redhat.com>
+
+travis builds fail at HEAD at rc3 master with
+
+  block/nbd-client.c: In function ‘nbd_read_reply_entry’:
+  block/nbd-client.c:110:8: error: ‘ret’ may be used uninitialized in this function [-Werror=uninitialized]
+
+fix it by initializing 'ret' to 0
+
+Signed-off-by: Igor Mammedov <imammedo at redhat.com>
+Reviewed-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Peter Maydell <peter.maydell at linaro.org>
+(cherry picked from commit d0a180131c6655487b47ea72e7da0a909a479a3c)
+Signed-off-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+
+Conflicts:
+	block/nbd-client.c - context
+---
+ block/nbd-client.c | 2 +-
+ 1 file changed, 1 insertion(+), 1 deletion(-)
+
+diff --git a/block/nbd-client.c b/block/nbd-client.c
+index 701b4ce..256dabe 100644
+--- a/block/nbd-client.c
++++ b/block/nbd-client.c
+@@ -69,7 +69,7 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
+ {
+     NBDClientSession *s = opaque;
+     uint64_t i;
+-    int ret;
++    int ret = 0;
+ 
+     while (!s->quit) {
+         assert(s->reply.handle == 0);
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0042-kvm-nbd-client-avoid-spurious-qio_channel_yield-re-entry.patch b/debian/patches/extra/0042-kvm-nbd-client-avoid-spurious-qio_channel_yield-re-entry.patch
new file mode 100644
index 0000000..a8b9ecc
--- /dev/null
+++ b/debian/patches/extra/0042-kvm-nbd-client-avoid-spurious-qio_channel_yield-re-entry.patch
@@ -0,0 +1,184 @@
+From e225829b11b5c69e808f89036229bbf8b4900168 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:21 +0200
+Subject: [PATCH 3/7] nbd-client: avoid spurious qio_channel_yield() re-entry
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-4-eblake at redhat.com>
+Patchwork-id: 76671
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 3/7] nbd-client: avoid spurious qio_channel_yield() re-entry
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+From: Stefan Hajnoczi <stefanha at redhat.com>
+
+The following scenario leads to an assertion failure in
+qio_channel_yield():
+
+1. Request coroutine calls qio_channel_yield() successfully when sending
+   would block on the socket.  It is now yielded.
+2. nbd_read_reply_entry() calls nbd_recv_coroutines_enter_all() because
+   nbd_receive_reply() failed.
+3. Request coroutine is entered and returns from qio_channel_yield().
+   Note that the socket fd handler has not fired yet so
+   ioc->write_coroutine is still set.
+4. Request coroutine attempts to send the request body with nbd_rwv()
+   but the socket would still block.  qio_channel_yield() is called
+   again and assert(!ioc->write_coroutine) is hit.
+
+The problem is that nbd_read_reply_entry() does not distinguish between
+request coroutines that are waiting to receive a reply and those that
+are not.
+
+This patch adds a per-request bool receiving flag so
+nbd_read_reply_entry() can avoid spurious aio_wake() calls.
+
+Reported-by: Dr. David Alan Gilbert <dgilbert at redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
+Message-Id: <20170822125113.5025-1-stefanha at redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Tested-by: Eric Blake <eblake at redhat.com>
+Reviewed-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: Eric Blake <eblake at redhat.com>
+(cherry picked from commit 40f4a21895b5a7eae4011593837069f63460d983)
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ block/nbd-client.c | 35 ++++++++++++++++++++++-------------
+ block/nbd-client.h |  7 ++++++-
+ 2 files changed, 28 insertions(+), 14 deletions(-)
+
+diff --git a/block/nbd-client.c b/block/nbd-client.c
+index 256dabe..f7bca3f 100644
+--- a/block/nbd-client.c
++++ b/block/nbd-client.c
+@@ -38,8 +38,10 @@ static void nbd_recv_coroutines_enter_all(NBDClientSession *s)
+     int i;
+ 
+     for (i = 0; i < MAX_NBD_REQUESTS; i++) {
+-        if (s->recv_coroutine[i]) {
+-            aio_co_wake(s->recv_coroutine[i]);
++        NBDClientRequest *req = &s->requests[i];
++
++        if (req->coroutine && req->receiving) {
++            aio_co_wake(req->coroutine);
+         }
+     }
+ }
+@@ -83,28 +85,28 @@ static coroutine_fn void nbd_read_reply_entry(void *opaque)
+          * one coroutine is called until the reply finishes.
+          */
+         i = HANDLE_TO_INDEX(s, s->reply.handle);
+-        if (i >= MAX_NBD_REQUESTS || !s->recv_coroutine[i]) {
++        if (i >= MAX_NBD_REQUESTS ||
++            !s->requests[i].coroutine ||
++            !s->requests[i].receiving) {
+             break;
+         }
+ 
+-        /* We're woken up by the recv_coroutine itself.  Note that there
++        /* We're woken up again by the request itself.  Note that there
+          * is no race between yielding and reentering read_reply_co.  This
+          * is because:
+          *
+-         * - if recv_coroutine[i] runs on the same AioContext, it is only
++         * - if the request runs on the same AioContext, it is only
+          *   entered after we yield
+          *
+-         * - if recv_coroutine[i] runs on a different AioContext, reentering
++         * - if the request runs on a different AioContext, reentering
+          *   read_reply_co happens through a bottom half, which can only
+          *   run after we yield.
+          */
+-        aio_co_wake(s->recv_coroutine[i]);
++        aio_co_wake(s->requests[i].coroutine);
+         qemu_coroutine_yield();
+     }
+ 
+-    if (ret < 0) {
+-        s->quit = true;
+-    }
++    s->quit = true;
+     nbd_recv_coroutines_enter_all(s);
+     s->read_reply_co = NULL;
+ }
+@@ -123,14 +125,17 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     s->in_flight++;
+ 
+     for (i = 0; i < MAX_NBD_REQUESTS; i++) {
+-        if (s->recv_coroutine[i] == NULL) {
+-            s->recv_coroutine[i] = qemu_coroutine_self();
++        if (s->requests[i].coroutine == NULL) {
+             break;
+         }
+     }
+ 
+     g_assert(qemu_in_coroutine());
+     assert(i < MAX_NBD_REQUESTS);
++
++    s->requests[i].coroutine = qemu_coroutine_self();
++    s->requests[i].receiving = false;
++
+     request->handle = INDEX_TO_HANDLE(s, i);
+ 
+     if (s->quit) {
+@@ -168,10 +173,13 @@ static void nbd_co_receive_reply(NBDClientSession *s,
+                                  NBDReply *reply,
+                                  QEMUIOVector *qiov)
+ {
++    int i = HANDLE_TO_INDEX(s, request->handle);
+     int ret;
+ 
+     /* Wait until we're woken up by nbd_read_reply_entry.  */
++    s->requests[i].receiving = true;
+     qemu_coroutine_yield();
++    s->requests[i].receiving = false;
+     *reply = s->reply;
+     if (reply->handle != request->handle || !s->ioc || s->quit) {
+         reply->error = EIO;
+@@ -181,6 +189,7 @@ static void nbd_co_receive_reply(NBDClientSession *s,
+                                true);
+             if (ret != request->len) {
+                 reply->error = EIO;
++                s->quit = true;
+             }
+         }
+ 
+@@ -195,7 +204,7 @@ static void nbd_coroutine_end(BlockDriverState *bs,
+     NBDClientSession *s = nbd_get_client_session(bs);
+     int i = HANDLE_TO_INDEX(s, request->handle);
+ 
+-    s->recv_coroutine[i] = NULL;
++    s->requests[i].coroutine = NULL;
+ 
+     /* Kick the read_reply_co to get the next reply.  */
+     if (s->read_reply_co) {
+diff --git a/block/nbd-client.h b/block/nbd-client.h
+index 9774a8e..f97792f 100644
+--- a/block/nbd-client.h
++++ b/block/nbd-client.h
+@@ -17,6 +17,11 @@
+ 
+ #define MAX_NBD_REQUESTS    16
+ 
++typedef struct {
++    Coroutine *coroutine;
++    bool receiving;         /* waiting for read_reply_co? */
++} NBDClientRequest;
++
+ typedef struct NBDClientSession {
+     QIOChannelSocket *sioc; /* The master data channel */
+     QIOChannel *ioc; /* The current I/O channel which may differ (eg TLS) */
+@@ -28,7 +33,7 @@ typedef struct NBDClientSession {
+     Coroutine *read_reply_co;
+     int in_flight;
+ 
+-    Coroutine *recv_coroutine[MAX_NBD_REQUESTS];
++    NBDClientRequest requests[MAX_NBD_REQUESTS];
+     NBDReply reply;
+     bool quit;
+ } NBDClientSession;
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0043-kvm-nbd-client-avoid-read_reply_co-entry-if-send-failed.patch b/debian/patches/extra/0043-kvm-nbd-client-avoid-read_reply_co-entry-if-send-failed.patch
new file mode 100644
index 0000000..50abec6
--- /dev/null
+++ b/debian/patches/extra/0043-kvm-nbd-client-avoid-read_reply_co-entry-if-send-failed.patch
@@ -0,0 +1,160 @@
+From bfce7738b2f3b918959b8b9f364ac8dcfef624aa Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:22 +0200
+Subject: [PATCH 4/7] nbd-client: avoid read_reply_co entry if send failed
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-5-eblake at redhat.com>
+Patchwork-id: 76674
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 4/7] nbd-client: avoid read_reply_co entry if send failed
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+From: Stefan Hajnoczi <stefanha at redhat.com>
+
+The following segfault is encountered if the NBD server closes the UNIX
+domain socket immediately after negotiation:
+
+  Program terminated with signal SIGSEGV, Segmentation fault.
+  #0  aio_co_schedule (ctx=0x0, co=0xd3c0ff2ef0) at util/async.c:441
+  441       QSLIST_INSERT_HEAD_ATOMIC(&ctx->scheduled_coroutines,
+  (gdb) bt
+  #0  0x000000d3c01a50f8 in aio_co_schedule (ctx=0x0, co=0xd3c0ff2ef0) at util/async.c:441
+  #1  0x000000d3c012fa90 in nbd_coroutine_end (bs=bs at entry=0xd3c0fec650, request=<optimized out>) at block/nbd-client.c:207
+  #2  0x000000d3c012fb58 in nbd_client_co_preadv (bs=0xd3c0fec650, offset=0, bytes=<optimized out>, qiov=0x7ffc10a91b20, flags=0) at block/nbd-client.c:237
+  #3  0x000000d3c0128e63 in bdrv_driver_preadv (bs=bs at entry=0xd3c0fec650, offset=offset at entry=0, bytes=bytes at entry=512, qiov=qiov at entry=0x7ffc10a91b20, flags=0) at block/io.c:836
+  #4  0x000000d3c012c3e0 in bdrv_aligned_preadv (child=child at entry=0xd3c0ff51d0, req=req at entry=0x7f31885d6e90, offset=offset at entry=0, bytes=bytes at entry=512, align=align at entry=1, qiov=qiov at entry=0x7ffc10a91b20, f
++lags=0) at block/io.c:1086
+  #5  0x000000d3c012c6b8 in bdrv_co_preadv (child=0xd3c0ff51d0, offset=offset at entry=0, bytes=bytes at entry=512, qiov=qiov at entry=0x7ffc10a91b20, flags=flags at entry=0) at block/io.c:1182
+  #6  0x000000d3c011cc17 in blk_co_preadv (blk=0xd3c0ff4f80, offset=0, bytes=512, qiov=0x7ffc10a91b20, flags=0) at block/block-backend.c:1032
+  #7  0x000000d3c011ccec in blk_read_entry (opaque=0x7ffc10a91b40) at block/block-backend.c:1079
+  #8  0x000000d3c01bbb96 in coroutine_trampoline (i0=<optimized out>, i1=<optimized out>) at util/coroutine-ucontext.c:79
+  #9  0x00007f3196cb8600 in __start_context () at /lib64/libc.so.6
+
+The problem is that nbd_client_init() uses
+nbd_client_attach_aio_context() -> aio_co_schedule(new_context,
+client->read_reply_co).  Execution of read_reply_co is deferred to a BH
+which doesn't run until later.
+
+In the mean time blk_co_preadv() can be called and nbd_coroutine_end()
+calls aio_wake() on read_reply_co.  At this point in time
+read_reply_co's ctx isn't set because it has never been entered yet.
+
+This patch simplifies the nbd_co_send_request() ->
+nbd_co_receive_reply() -> nbd_coroutine_end() lifecycle to just
+nbd_co_send_request() -> nbd_co_receive_reply().  The request is "ended"
+if an error occurs at any point.  Callers no longer have to invoke
+nbd_coroutine_end().
+
+This cleanup also eliminates the segfault because we don't call
+aio_co_schedule() to wake up s->read_reply_co if sending the request
+failed.  It is only necessary to wake up s->read_reply_co if a reply was
+received.
+
+Note this only happens with UNIX domain sockets on Linux.  It doesn't
+seem possible to reproduce this with TCP sockets.
+
+Suggested-by: Paolo Bonzini <pbonzini at redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
+Message-Id: <20170829122745.14309-2-stefanha at redhat.com>
+Signed-off-by: Eric Blake <eblake at redhat.com>
+(cherry picked from commit 3c2d5183f9fa4eac3d17d841e26da65a0181ae7b)
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ block/nbd-client.c | 25 +++++++++----------------
+ 1 file changed, 9 insertions(+), 16 deletions(-)
+
+diff --git a/block/nbd-client.c b/block/nbd-client.c
+index f7bca3f..434acf6 100644
+--- a/block/nbd-client.c
++++ b/block/nbd-client.c
+@@ -139,12 +139,12 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     request->handle = INDEX_TO_HANDLE(s, i);
+ 
+     if (s->quit) {
+-        qemu_co_mutex_unlock(&s->send_mutex);
+-        return -EIO;
++        rc = -EIO;
++        goto err;
+     }
+     if (!s->ioc) {
+-        qemu_co_mutex_unlock(&s->send_mutex);
+-        return -EPIPE;
++        rc = -EPIPE;
++        goto err;
+     }
+ 
+     if (qiov) {
+@@ -161,8 +161,13 @@ static int nbd_co_send_request(BlockDriverState *bs,
+     } else {
+         rc = nbd_send_request(s->ioc, request);
+     }
++
++err:
+     if (rc < 0) {
+         s->quit = true;
++        s->requests[i].coroutine = NULL;
++        s->in_flight--;
++        qemu_co_queue_next(&s->free_sema);
+     }
+     qemu_co_mutex_unlock(&s->send_mutex);
+     return rc;
+@@ -196,13 +201,6 @@ static void nbd_co_receive_reply(NBDClientSession *s,
+         /* Tell the read handler to read another header.  */
+         s->reply.handle = 0;
+     }
+-}
+-
+-static void nbd_coroutine_end(BlockDriverState *bs,
+-                              NBDRequest *request)
+-{
+-    NBDClientSession *s = nbd_get_client_session(bs);
+-    int i = HANDLE_TO_INDEX(s, request->handle);
+ 
+     s->requests[i].coroutine = NULL;
+ 
+@@ -238,7 +236,6 @@ int nbd_client_co_preadv(BlockDriverState *bs, uint64_t offset,
+     } else {
+         nbd_co_receive_reply(client, &request, &reply, qiov);
+     }
+-    nbd_coroutine_end(bs, &request);
+     return -reply.error;
+ }
+ 
+@@ -267,7 +264,6 @@ int nbd_client_co_pwritev(BlockDriverState *bs, uint64_t offset,
+     } else {
+         nbd_co_receive_reply(client, &request, &reply, NULL);
+     }
+-    nbd_coroutine_end(bs, &request);
+     return -reply.error;
+ }
+ 
+@@ -301,7 +297,6 @@ int nbd_client_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
+     } else {
+         nbd_co_receive_reply(client, &request, &reply, NULL);
+     }
+-    nbd_coroutine_end(bs, &request);
+     return -reply.error;
+ }
+ 
+@@ -325,7 +320,6 @@ int nbd_client_co_flush(BlockDriverState *bs)
+     } else {
+         nbd_co_receive_reply(client, &request, &reply, NULL);
+     }
+-    nbd_coroutine_end(bs, &request);
+     return -reply.error;
+ }
+ 
+@@ -350,7 +344,6 @@ int nbd_client_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
+     } else {
+         nbd_co_receive_reply(client, &request, &reply, NULL);
+     }
+-    nbd_coroutine_end(bs, &request);
+     return -reply.error;
+ 
+ }
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0044-kvm-qemu-iotests-improve-nbd-fault-injector.py-startup-p.patch b/debian/patches/extra/0044-kvm-qemu-iotests-improve-nbd-fault-injector.py-startup-p.patch
new file mode 100644
index 0000000..6d5ed5d
--- /dev/null
+++ b/debian/patches/extra/0044-kvm-qemu-iotests-improve-nbd-fault-injector.py-startup-p.patch
@@ -0,0 +1,61 @@
+From 9fbbee7f59f3edb75b1ea0ff12b04315d4a13bd7 Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:23 +0200
+Subject: [PATCH 5/7] qemu-iotests: improve nbd-fault-injector.py startup
+ protocol
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-6-eblake at redhat.com>
+Patchwork-id: 76675
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 5/7] qemu-iotests: improve nbd-fault-injector.py startup protocol
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+From: Stefan Hajnoczi <stefanha at redhat.com>
+
+Currently 083 waits for the nbd-fault-injector.py server to start up by
+looping until netstat shows the TCP listen socket.
+
+The startup protocol can be simplified by passing a 0 port number to
+nbd-fault-injector.py.  The kernel will allocate a port in bind(2) and
+the final port number can be printed by nbd-fault-injector.py.
+
+This should make it slightly nicer and less TCP-specific to wait for
+server startup.  This patch changes nbd-fault-injector.py, the next one
+will rewrite server startup in 083.
+
+Reviewed-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
+Message-Id: <20170829122745.14309-3-stefanha at redhat.com>
+Signed-off-by: Eric Blake <eblake at redhat.com>
+(cherry picked from commit 6e592fc92234a58c7156c385840633c17dedd24f)
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ tests/qemu-iotests/nbd-fault-injector.py | 4 ++++
+ 1 file changed, 4 insertions(+)
+
+diff --git a/tests/qemu-iotests/nbd-fault-injector.py b/tests/qemu-iotests/nbd-fault-injector.py
+index 6c07191..1c10dcb 100755
+--- a/tests/qemu-iotests/nbd-fault-injector.py
++++ b/tests/qemu-iotests/nbd-fault-injector.py
+@@ -235,11 +235,15 @@ def open_socket(path):
+         sock = socket.socket()
+         sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+         sock.bind((host, int(port)))
++
++        # If given port was 0 the final port number is now available
++        path = '%s:%d' % sock.getsockname()
+     else:
+         sock = socket.socket(socket.AF_UNIX)
+         sock.bind(path)
+     sock.listen(0)
+     print 'Listening on %s' % path
++    sys.stdout.flush() # another process may be waiting, show message now
+     return sock
+ 
+ def usage(args):
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0045-kvm-qemu-iotests-test-NBD-over-UNIX-domain-sockets-in-08.patch b/debian/patches/extra/0045-kvm-qemu-iotests-test-NBD-over-UNIX-domain-sockets-in-08.patch
new file mode 100644
index 0000000..4b83847
--- /dev/null
+++ b/debian/patches/extra/0045-kvm-qemu-iotests-test-NBD-over-UNIX-domain-sockets-in-08.patch
@@ -0,0 +1,454 @@
+From 17123cdd168f84466b1ea00f1825f26814c2bd9b Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:24 +0200
+Subject: [PATCH 6/7] qemu-iotests: test NBD over UNIX domain sockets in 083
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-7-eblake at redhat.com>
+Patchwork-id: 76670
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 6/7] qemu-iotests: test NBD over UNIX domain sockets in 083
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+From: Stefan Hajnoczi <stefanha at redhat.com>
+
+083 only tests TCP.  Some failures might be specific to UNIX domain
+sockets.
+
+A few adjustments are necessary:
+
+1. Generating a port number and waiting for server startup is
+   TCP-specific.  Use the new nbd-fault-injector.py startup protocol to
+   fetch the address.  This is a little more elegant because we don't
+   need netstat anymore.
+
+2. The NBD filter does not work for the UNIX domain sockets URIs we
+   generate and must be extended.
+
+3. Run all tests twice: once for TCP and once for UNIX domain sockets.
+
+Reviewed-by: Eric Blake <eblake at redhat.com>
+Signed-off-by: Stefan Hajnoczi <stefanha at redhat.com>
+Message-Id: <20170829122745.14309-4-stefanha at redhat.com>
+Signed-off-by: Eric Blake <eblake at redhat.com>
+(cherry picked from commit 02d2d860d25e439f0e88658c701668ab684568fb)
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+
+Conflicts:
+	tests/qemu-iotests/083.out - error message improvements not backported
+
+Signed-off-by: Eric Blake <eblake at redhat.com>
+---
+ tests/qemu-iotests/083           | 136 +++++++++++++++++++++++--------------
+ tests/qemu-iotests/083.out       | 143 ++++++++++++++++++++++++++++++++++-----
+ tests/qemu-iotests/common.filter |   4 +-
+ 3 files changed, 212 insertions(+), 71 deletions(-)
+
+diff --git a/tests/qemu-iotests/083 b/tests/qemu-iotests/083
+index bff9360..0306f11 100755
+--- a/tests/qemu-iotests/083
++++ b/tests/qemu-iotests/083
+@@ -27,6 +27,14 @@ echo "QA output created by $seq"
+ here=`pwd`
+ status=1	# failure is the default!
+ 
++_cleanup()
++{
++	rm -f nbd.sock
++	rm -f nbd-fault-injector.out
++	rm -f nbd-fault-injector.conf
++}
++trap "_cleanup; exit \$status" 0 1 2 3 15
++
+ # get standard environment, filters and checks
+ . ./common.rc
+ . ./common.filter
+@@ -35,81 +43,105 @@ _supported_fmt generic
+ _supported_proto nbd
+ _supported_os Linux
+ 
+-# Pick a TCP port based on our pid.  This way multiple instances of this test
+-# can run in parallel without conflicting.
+-choose_tcp_port() {
+-	echo $((($$ % 31744) + 1024)) # 1024 <= port < 32768
+-}
+-
+-wait_for_tcp_port() {
+-	while ! (netstat --tcp --listening --numeric | \
+-		 grep "$1.*0\\.0\\.0\\.0:\\*.*LISTEN") >/dev/null 2>&1; do
+-		sleep 0.1
++check_disconnect() {
++	local event export_name=foo extra_args nbd_addr nbd_url proto when
++
++	while true; do
++		case $1 in
++		--classic-negotiation)
++			shift
++			extra_args=--classic-negotiation
++			export_name=
++			;;
++		--tcp)
++			shift
++			proto=tcp
++			;;
++		--unix)
++			shift
++			proto=unix
++			;;
++		*)
++			break
++			;;
++		esac
+ 	done
+-}
+ 
+-check_disconnect() {
+ 	event=$1
+ 	when=$2
+-	negotiation=$3
+ 	echo "=== Check disconnect $when $event ==="
+ 	echo
+ 
+-	port=$(choose_tcp_port)
+-
+ 	cat > "$TEST_DIR/nbd-fault-injector.conf" <<EOF
+ [inject-error]
+ event=$event
+ when=$when
+ EOF
+ 
+-	if [ "$negotiation" = "--classic-negotiation" ]; then
+-		extra_args=--classic-negotiation
+-		nbd_url="nbd:127.0.0.1:$port"
++	if [ "$proto" = "tcp" ]; then
++		nbd_addr="127.0.0.1:0"
+ 	else
+-		nbd_url="nbd:127.0.0.1:$port:exportname=foo"
++		nbd_addr="$TEST_DIR/nbd.sock"
++	fi
++
++	rm -f "$TEST_DIR/nbd.sock"
++
++	$PYTHON nbd-fault-injector.py $extra_args "$nbd_addr" "$TEST_DIR/nbd-fault-injector.conf" >"$TEST_DIR/nbd-fault-injector.out" 2>&1 &
++
++	# Wait for server to be ready
++	while ! grep -q 'Listening on ' "$TEST_DIR/nbd-fault-injector.out"; do
++		sleep 0.1
++	done
++
++	# Extract the final address (port number has now been assigned in tcp case)
++	nbd_addr=$(sed 's/Listening on \(.*\)$/\1/' "$TEST_DIR/nbd-fault-injector.out")
++
++	if [ "$proto" = "tcp" ]; then
++		nbd_url="nbd+tcp://$nbd_addr/$export_name"
++	else
++		nbd_url="nbd+unix:///$export_name?socket=$nbd_addr"
+ 	fi
+ 
+-	$PYTHON nbd-fault-injector.py $extra_args "127.0.0.1:$port" "$TEST_DIR/nbd-fault-injector.conf" >/dev/null 2>&1 &
+-	wait_for_tcp_port "127\\.0\\.0\\.1:$port"
+ 	$QEMU_IO -c "read 0 512" "$nbd_url" 2>&1 | _filter_qemu_io | _filter_nbd
+ 
+ 	echo
+ }
+ 
+-for event in neg1 "export" neg2 request reply data; do
+-	for when in before after; do
+-		check_disconnect "$event" "$when"
+-	done
+-
+-	# Also inject short replies from the NBD server
+-	case "$event" in
+-	neg1)
+-		for when in 8 16; do
+-			check_disconnect "$event" "$when"
+-		done
+-		;;
+-	"export")
+-		for when in 4 12 16; do
+-			check_disconnect "$event" "$when"
++for proto in tcp unix; do
++	for event in neg1 "export" neg2 request reply data; do
++		for when in before after; do
++			check_disconnect "--$proto" "$event" "$when"
+ 		done
+-		;;
+-	neg2)
+-		for when in 8 10; do
+-			check_disconnect "$event" "$when"
+-		done
+-		;;
+-	reply)
+-		for when in 4 8; do
+-			check_disconnect "$event" "$when"
+-		done
+-		;;
+-	esac
+-done
+ 
+-# Also check classic negotiation without export information
+-for when in before 8 16 24 28 after; do
+-	check_disconnect "neg-classic" "$when" --classic-negotiation
++		# Also inject short replies from the NBD server
++		case "$event" in
++		neg1)
++			for when in 8 16; do
++				check_disconnect "--$proto" "$event" "$when"
++			done
++			;;
++		"export")
++			for when in 4 12 16; do
++				check_disconnect "--$proto" "$event" "$when"
++			done
++			;;
++		neg2)
++			for when in 8 10; do
++				check_disconnect "--$proto" "$event" "$when"
++			done
++			;;
++		reply)
++			for when in 4 8; do
++				check_disconnect "--$proto" "$event" "$when"
++			done
++			;;
++		esac
++	done
++
++	# Also check classic negotiation without export information
++	for when in before 8 16 24 28 after; do
++		check_disconnect "--$proto" --classic-negotiation "neg-classic" "$when"
++	done
+ done
+ 
+ # success, all done
+diff --git a/tests/qemu-iotests/083.out b/tests/qemu-iotests/083.out
+index 0c13888..7419722 100644
+--- a/tests/qemu-iotests/083.out
++++ b/tests/qemu-iotests/083.out
+@@ -1,43 +1,43 @@
+ QA output created by 083
+ === Check disconnect before neg1 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect after neg1 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect 8 neg1 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect 16 neg1 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect before export ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect after export ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect 4 export ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect 12 export ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect 16 export ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect before neg2 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect after neg2 ===
+ 
+@@ -45,11 +45,11 @@ read failed: Input/output error
+ 
+ === Check disconnect 8 neg2 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect 10 neg2 ===
+ 
+-can't open device nbd:127.0.0.1:PORT:exportname=foo
++can't open device nbd+tcp://127.0.0.1:PORT/foo
+ 
+ === Check disconnect before request ===
+ 
+@@ -86,23 +86,132 @@ read 512/512 bytes at offset 0
+ 
+ === Check disconnect before neg-classic ===
+ 
+-can't open device nbd:127.0.0.1:PORT
++can't open device nbd+tcp://127.0.0.1:PORT/
+ 
+ === Check disconnect 8 neg-classic ===
+ 
+-can't open device nbd:127.0.0.1:PORT
++can't open device nbd+tcp://127.0.0.1:PORT/
+ 
+ === Check disconnect 16 neg-classic ===
+ 
+-can't open device nbd:127.0.0.1:PORT
++can't open device nbd+tcp://127.0.0.1:PORT/
+ 
+ === Check disconnect 24 neg-classic ===
+ 
+-can't open device nbd:127.0.0.1:PORT
++can't open device nbd+tcp://127.0.0.1:PORT/
+ 
+ === Check disconnect 28 neg-classic ===
+ 
+-can't open device nbd:127.0.0.1:PORT
++can't open device nbd+tcp://127.0.0.1:PORT/
++
++=== Check disconnect after neg-classic ===
++
++read failed: Input/output error
++
++=== Check disconnect before neg1 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect after neg1 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 8 neg1 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 16 neg1 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect before export ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect after export ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 4 export ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 12 export ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 16 export ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect before neg2 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect after neg2 ===
++
++read failed: Input/output error
++
++=== Check disconnect 8 neg2 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 10 neg2 ===
++
++can't open device nbd+unix:///foo?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect before request ===
++
++read failed: Input/output error
++
++=== Check disconnect after request ===
++
++read failed: Input/output error
++
++=== Check disconnect before reply ===
++
++read failed: Input/output error
++
++=== Check disconnect after reply ===
++
++read failed: Input/output error
++
++=== Check disconnect 4 reply ===
++
++read failed: Input/output error
++
++=== Check disconnect 8 reply ===
++
++read failed: Input/output error
++
++=== Check disconnect before data ===
++
++read failed: Input/output error
++
++=== Check disconnect after data ===
++
++read 512/512 bytes at offset 0
++512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
++
++=== Check disconnect before neg-classic ===
++
++can't open device nbd+unix:///?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 8 neg-classic ===
++
++can't open device nbd+unix:///?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 16 neg-classic ===
++
++can't open device nbd+unix:///?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 24 neg-classic ===
++
++can't open device nbd+unix:///?socket=TEST_DIR/nbd.sock
++
++=== Check disconnect 28 neg-classic ===
++
++can't open device nbd+unix:///?socket=TEST_DIR/nbd.sock
+ 
+ === Check disconnect after neg-classic ===
+ 
+diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
+index c9a2d5c..f06d4dc 100644
+--- a/tests/qemu-iotests/common.filter
++++ b/tests/qemu-iotests/common.filter
+@@ -154,9 +154,9 @@ _filter_nbd()
+     #
+     # Filter out the TCP port number since this changes between runs.
+     sed -e '/nbd\/.*\.c:/d' \
+-        -e 's#nbd:\(//\)\?127\.0\.0\.1:[0-9]*#nbd:\1127.0.0.1:PORT#g' \
++        -e 's#127\.0\.0\.1:[0-9]*#127.0.0.1:PORT#g' \
+         -e "s#?socket=$TEST_DIR#?socket=TEST_DIR#g" \
+-        -e 's#\(exportname=foo\|PORT\): Failed to .*$#\1#'
++        -e 's#\(foo\|PORT/\?\|.sock\): Failed to .*$#\1#'
+ }
+ 
+ # make sure this script returns success
+-- 
+1.8.3.1
+
diff --git a/debian/patches/extra/0046-kvm-block-nbd-client-nbd_co_send_request-fix-return-code.patch b/debian/patches/extra/0046-kvm-block-nbd-client-nbd_co_send_request-fix-return-code.patch
new file mode 100644
index 0000000..6f6c27c
--- /dev/null
+++ b/debian/patches/extra/0046-kvm-block-nbd-client-nbd_co_send_request-fix-return-code.patch
@@ -0,0 +1,45 @@
+From 7e938f6990b74b24dbc4f5d77b670b686220a1df Mon Sep 17 00:00:00 2001
+From: Eric Blake <eblake at redhat.com>
+Date: Wed, 27 Sep 2017 17:57:25 +0200
+Subject: [PATCH 7/7] block/nbd-client: nbd_co_send_request: fix return code
+
+RH-Author: Eric Blake <eblake at redhat.com>
+Message-id: <20170927175725.20023-8-eblake at redhat.com>
+Patchwork-id: 76673
+O-Subject: [RHEV-7.4.z qemu-kvm-rhev PATCH 7/7] block/nbd-client: nbd_co_send_request: fix return code
+Bugzilla: 1495474
+RH-Acked-by: Max Reitz <mreitz at redhat.com>
+RH-Acked-by: Jeffrey Cody <jcody at redhat.com>
+RH-Acked-by: Stefan Hajnoczi <stefanha at redhat.com>
+
+From: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+
+It's incorrect to return success rc >= 0 if we skip qio_channel_writev_all()
+call due to s->quit.
+
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov at virtuozzo.com>
+Reviewed-by: Eric Blake <eblake at redhat.com>
+Message-Id: <20170920124507.18841-4-vsementsov at virtuozzo.com>
+Signed-off-by: Eric Blake <eblake at redhat.com>
+(cherry picked from commit a693437037328a95d815ad5aec37ac2f8e130e58)
+Signed-off-by: Miroslav Rezanina <mrezanin at redhat.com>
+---
+ block/nbd-client.c | 2 ++
+ 1 file changed, 2 insertions(+)
+
+diff --git a/block/nbd-client.c b/block/nbd-client.c
+index 434acf6..76789c1 100644
+--- a/block/nbd-client.c
++++ b/block/nbd-client.c
+@@ -156,6 +156,8 @@ static int nbd_co_send_request(BlockDriverState *bs,
+             if (ret != request->len) {
+                 rc = -EIO;
+             }
++        } else if (rc >= 0) {
++            rc = -EIO;
+         }
+         qio_channel_set_cork(s->ioc, false);
+     } else {
+-- 
+1.8.3.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 167bd80..d452ead 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -61,3 +61,16 @@ extra/0031-i386-Add-support-for-SPEC_CTRL-MSR.patch
 extra/0032-i386-Add-spec-ctrl-CPUID-bit.patch
 extra/0033-i386-Add-FEAT_8000_0008_EBX-CPUID-feature-word.patch
 extra/0034-i386-Add-new-IBRS-versions-of-Intel-CPU-models.patch
+extra/0035-kvm-nbd-make-it-thread-safe-fix-qcow2-over-nbd.patch
+extra/0036-kvm-nbd-strict-nbd_wr_syncv.patch
+extra/0037-kvm-nbd-read_sync-and-friends-return-0-on-success.patch
+extra/0038-kvm-nbd-make-nbd_drop-public.patch
+extra/0039-kvm-nbd-server-get-rid-of-nbd_negotiate_read-and-friends.patch
+extra/0040-kvm-nbd-client-Fix-regression-when-server-sends-garbage.patch
+extra/0041-kvm-fix-build-failure-in-nbd_read_reply_entry.patch
+extra/0042-kvm-nbd-client-avoid-spurious-qio_channel_yield-re-entry.patch
+extra/0043-kvm-nbd-client-avoid-read_reply_co-entry-if-send-failed.patch
+extra/0044-kvm-qemu-iotests-improve-nbd-fault-injector.py-startup-p.patch
+extra/0045-kvm-qemu-iotests-test-NBD-over-UNIX-domain-sockets-in-08.patch
+extra/0046-kvm-block-nbd-client-nbd_co_send_request-fix-return-code.patch
+
-- 
2.11.0




More information about the pve-devel mailing list