qemu/qemu.git, branch v10.0.10

Update version for 10.0.10 release

2026-05-25T17:13:03+00:00

Signed-off-by: Michael Tokarev

block/graph-lock: fix missed wakeup in bdrv_graph_co_rdunlock()

2026-05-25T17:10:28+00:00

tests/qemu-iotests/tests/iothreads-create reproduces the hang on master under `stress-ng --cpu $(nproc) --timeout 0`. The iotest's vm.run_job() times out and qemu stays permanently stuck in ppoll(timeout=-1) inside bdrv_graph_wrlock_drained -> blk_remove_bs during qemu_cleanup(). The timing window is narrow on modern bare-metal hardware and much wider in a VM guest; downstream trees that still use plain bdrv_graph_wrlock() in blk_remove_bs() hit it on the first iteration under the same stress. bdrv_graph_wrlock() zeroes has_writer around its AIO_WAIT_WHILE loop so that callbacks dispatched by aio_poll() can still take the read lock on the fast path. The rdunlock side, however, only kicks a waiting writer when has_writer is observed set; a reader that drops its lock inside the polling window silently returns and nothing ever wakes the writer: main thread iothread0 coroutine ----------- ------------------- bdrv_graph_wrlock: rdlock held, reader_count=1 bdrv_drain_all_begin_nopoll has_writer = 0 AIO_WAIT_WHILE_UNLOCKED( NULL, reader_count >= 1): num_waiters++ smp_mb aio_poll(main_ctx, true) --> bdrv_graph_co_rdunlock: (ppoll, blocked) reader_count-- -> 0 smp_mb read has_writer = 0 skip aio_wait_kick() return reader_count is now 0 and num_waiters is still 1, but no BH, fd or timer on the main AioContext will fire -- the only entity that could kick just decided it did not have to. Main stays in ppoll() holding BQL, so RCU, VCPUs and any iothread path that needs BQL stall behind it. The hang is final; no timeout, no forward progress, no recovery as there is no other source of wake up inside qemu_cleanup(). bdrv_drain_all_begin() does not close the race on its own: it quiesces in-flight I/O, but graph readers also include non-I/O coroutines (block-job cleanup, virtio-scsi polling) that drain does not evict. The bdrv_graph_wrlock_drained() wrapper narrows the window but does not eliminate it; every plain bdrv_graph_wrlock() site is exposed on the same basis. Drop the has_writer check in bdrv_graph_co_rdunlock() and call aio_wait_kick() unconditionally. The helper itself loads num_waiters atomically and only schedules a dummy BH when a waiter exists, so the change is a no-op on the no-writer path and closes the missed-wakeup on the writer path. Signed-off-by: Denis V. Lunev Cc: Kevin Wolf Cc: Hanna Reitz Cc: Stefan Hajnoczi Cc: Fiona Ebner Message-ID: <20260424103917.248668-2-den@openvz.org> Reviewed-by: Kevin Wolf Signed-off-by: Kevin Wolf (cherry picked from commit e3082ab3b38538ebdbc5cd62b4c476b673c5e515) Signed-off-by: Michael Tokarev

block: Add more defaults to DEFAULT_BLOCK_CONF

2026-05-20T08:23:08+00:00

discard_granularity was missing from this, which means that SCSI disks created with -drive if=scsi would default to 0 (i.e. disabling discards) instead of -1, which makes scsi-hd automatically pick a granularity and is the default of the corresponding qdev property for -device scsi-hd. This was broken in QEMU 9.0 with commit 3089637. Also set other fields whose default isn't an obvious 0. These are not actual bug fixes because ON_OFF_AUTO_AUTO in fact happens to be 0, but it's better not to rely on the order of enums. Cc: qemu-stable@nongnu.org Fixes: 308963746169 ('scsi: Don't ignore most usb-storage properties') Reported-by: Lexi Winter Signed-off-by: Kevin Wolf Message-ID: <20260410152314.86412-3-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit f27aea1896338f4dd085a0e2cb2ab3797c5fe3e9) Signed-off-by: Michael Tokarev

block: Create DEFAULT_BLOCK_CONF macro

2026-05-20T08:23:08+00:00

The property default values from include/hw/block/block.h were duplicated in scsi_bus_legacy_handle_cmdline(), allowing them to go out of sync easily. There doesn't seem a good way to avoid the duplication, but moving them next to each other in the header file should help to avoid this problem in the future. Signed-off-by: Kevin Wolf Message-ID: <20260410152314.86412-2-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit a1310cc6281d22ac948f4aa198dcc55d58fc039d) Signed-off-by: Michael Tokarev

ide-test: Test reset during TRIM

2026-05-20T08:23:05+00:00

This is a regression test for the bug fixed in the previous commits, a deadlock between the drain issued by an IDE reset and the TRIM state machine. Signed-off-by: Kevin Wolf Message-ID: <20260421161132.99878-8-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 2fa24e9755994f76f08ea2452215eb50f26f4c21) Signed-off-by: Michael Tokarev

ide-test: Factor out wait_dma_completion()

2026-05-20T08:23:05+00:00

Signed-off-by: Kevin Wolf Message-ID: <20260421161132.99878-7-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 92854c9c7539bdbf4f9c1abb33dd3ba59ff91e58) Signed-off-by: Michael Tokarev

ide: Clean up ide_trim_co_entry() to be idiomatic coroutine code

2026-05-20T08:23:05+00:00

The previous commit did a minimal conversion of the callback based state machine for TRIM to a coroutine in order to fix a bug. Refactor it to actually look like normal coroutine based code, which improves its readability. Signed-off-by: Kevin Wolf Message-ID: <20260421161132.99878-6-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit c1c71a7e167fdabaa9827d00c0be3aeafebdd921) Signed-off-by: Michael Tokarev

ide: Minimal fix for deadlock between TRIM and drain

2026-05-20T08:23:01+00:00

The implementation of TRIM in IDE can chain multiple discard requests and uses blk_inc/dec_in_flight() to make sure that the whole TRIM operation has completed when the device needs to be quiescent (e.g. for the drain when performing an IDE reset, it would be bad if an IDE request like TRIM were still in flight). The problem is that each drain request calls blk_wait_while_drained() and when draining, it waits until the drained section ends. At the same time, drain_begin can only return if the whole TRIM operation has completed. This is a classic deadlock. Use blk_co_start/end_request() and BDRV_REQ_NO_QUEUE to avoid the problem. This requires moving the TRIM state machine to a coroutine. This commit does the minimal conversion so that we do have a coroutine that works for the fix, but it still looks much like a callback-based implementation. This will be cleaned up in the next patch. Cc: qemu-stable@nongnu.org Fixes: 7e5cdb345f77 ('ide: Increment BB in-flight counter for TRIM BH') Buglink: https://redhat.atlassian.net/browse/RHEL-121686 Signed-off-by: Kevin Wolf Message-ID: <20260421161132.99878-5-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 095c08a7ba68cabaa6e0ce7a8a0804a949542c4c) Signed-off-by: Michael Tokarev

block: Add flags parameter to blk_*_pdiscard()

2026-05-20T08:22:56+00:00

All existing callers pass 0, but we need a way to pass BDRV_REQ_NO_QUEUE for discard requests. Signed-off-by: Kevin Wolf Message-ID: <20260421161132.99878-4-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 53074ba0330ae8831abbae2521c012e1d9072ed3) Signed-off-by: Michael Tokarev

block: Add blk_co_start/end_request() and BDRV_REQ_NO_QUEUE

2026-05-20T08:22:56+00:00

If a device uses blk_inc/dec_in_flight() in order to build macro operations that involve multiple requests for the block layer and that need to be completed as a unit before the BlockBackend can be considered drained, it sets the stage for a deadlock: When a drain is requested, the inner request at the BlockBackend level will be queued in blk_wait_while_drained() and wait until the drained section ends, but at the same time, drain_begin can only return if the whole macro operation at the device level has completed. Introduce a new interface to allow implementing the logic correctly: Instead of queueing individual requests, blk_co_start_request() calls blk_wait_while_drained() once at the beginning. The individual requests must then set BDRV_REQ_NO_QUEUE to avoid being queued and running into the deadlock; being wrapped in blk_co_start/end_request() makes sure that drain_begin waits for them and they don't sneak in when the BlockBackend is supposed to already be quiescent. Signed-off-by: Kevin Wolf Message-ID: <20260421161132.99878-3-kwolf@redhat.com> Signed-off-by: Kevin Wolf (cherry picked from commit 34a67637767d3ed1ac813c44effe827bbfba5996) Signed-off-by: Michael Tokarev