@samitouri / QOSamiQemu / commits / 095c08a7ba

ide: Minimal fix for deadlock between TRIM and drain

The implementation of TRIM in IDE can chain multiple discard requests and uses blk_inc/dec_in_flight() to make sure that the whole TRIM operation has completed when the device needs to be quiescent (e.g. for the drain when performing an IDE reset, it would be bad if an IDE request like TRIM were still in flight). The problem is that each drain request calls blk_wait_while_drained() and when draining, it waits until the drained section ends. At the same time, drain_begin can only return if the whole TRIM operation has completed. This is a classic deadlock. Use blk_co_start/end_request() and BDRV_REQ_NO_QUEUE to avoid the problem. This requires moving the TRIM state machine to a coroutine. This commit does the minimal conversion so that we do have a coroutine that works for the fix, but it still looks much like a callback-based implementation. This will be cleaned up in the next patch. Cc: qemu-stable@nongnu.org Fixes: 7e5cdb345f77 ('ide: Increment BB in-flight counter for TRIM BH') Buglink: https://redhat.atlassian.net/browse/RHEL-121686 Signed-off-by: Kevin Wolf <kwolf@redhat.com> Message-ID: <20260421161132.99878-5-kwolf@redhat.com> Signed-off-by: Kevin Wolf <kwolf@redhat.com>

Kevin Wolf committed Apr 21, 2026 at 18:11 UTC 095c08a7ba68cabaa6e0ce7a8a0804a949542c4c
1 file changed +18 -19
hw/ide/core.c
+18 -19
@@ -420,7 +420,6 @@ typedef struct TrimAIOCB {
420 QEMUBH *bh;
421 int ret;
422 QEMUIOVector *qiov;
423 - BlockAIOCB *aiocb;
423 int i, j;
424 } TrimAIOCB;
425
@@ -433,11 +432,6 @@ static void trim_aio_cancel(BlockAIOCB *acb)
432 iocb->i = (iocb->qiov->iov[iocb->j].iov_len / 8) - 1;
433
434 iocb->ret = -ECANCELED;
436 -
437 - if (iocb->aiocb) {
438 - blk_aio_cancel_async(iocb->aiocb);
439 - iocb->aiocb = NULL;
440 - }
435 }
436
437 static const AIOCBInfo trim_aiocb_info = {
@@ -456,15 +450,20 @@ static void ide_trim_bh_cb(void *opaque)
450 iocb->bh = NULL;
451 qemu_aio_unref(iocb);
452
459 - /* Paired with an increment in ide_issue_trim() */
460 - blk_dec_in_flight(blk);
453 + /* Paired with blk_co_start_request in ide_trim_co_entry() */
454 + blk_end_request(blk);
455 }
456
463 -static void ide_issue_trim_cb(void *opaque, int ret)
457 +static void coroutine_fn ide_trim_co_entry(void *opaque)
458 {
459 TrimAIOCB *iocb = opaque;
460 IDEState *s = iocb->s;
461 + int ret = 0;
462 +
463 + /* Paired with blk_end_request in ide_trim_bh_cb() */
464 + blk_co_start_request(s->blk);
465
466 +loop:
467 if (iocb->i >= 0) {
468 if (ret >= 0) {
469 block_acct_done(blk_get_stats(s->blk), &s->acct);
@@ -499,11 +498,11 @@ static void ide_issue_trim_cb(void *opaque, int ret)
498 count << BDRV_SECTOR_BITS, BLOCK_ACCT_UNMAP);
499
500 /* Got an entry! Submit and exit. */
502 - iocb->aiocb = blk_aio_pdiscard(s->blk,
503 - sector << BDRV_SECTOR_BITS,
504 - count << BDRV_SECTOR_BITS,
505 - ide_issue_trim_cb, opaque);
506 - return;
501 + ret = blk_co_pdiscard(s->blk,
502 + sector << BDRV_SECTOR_BITS,
503 + count << BDRV_SECTOR_BITS,
504 + BDRV_REQ_NO_QUEUE);
505 + goto loop;
506 }
507
508 iocb->j++;
@@ -514,7 +513,6 @@ static void ide_issue_trim_cb(void *opaque, int ret)
513 }
514
515 done:
517 - iocb->aiocb = NULL;
516 if (iocb->bh) {
517 replay_bh_schedule_event(iocb->bh);
518 }
@@ -527,9 +525,7 @@ BlockAIOCB *ide_issue_trim(
525 IDEState *s = opaque;
526 IDEDevice *dev = s->unit ? s->bus->slave : s->bus->master;
527 TrimAIOCB *iocb;
530 -
531 - /* Paired with a decrement in ide_trim_bh_cb() */
532 - blk_inc_in_flight(s->blk);
528 + Coroutine *co;
529
530 iocb = blk_aio_get(&trim_aiocb_info, s->blk, cb, cb_opaque);
531 iocb->s = s;
@@ -539,7 +535,10 @@ BlockAIOCB *ide_issue_trim(
535 iocb->qiov = qiov;
536 iocb->i = -1;
537 iocb->j = 0;
542 - ide_issue_trim_cb(iocb, 0);
538 +
539 + co = qemu_coroutine_create(ide_trim_co_entry, iocb);
540 + aio_co_enter(qemu_get_current_aio_context(), co);
541 +
542 return &iocb->common;
543 }
544