xref: /qemu/tests/unit/test-bdrv-drain.c (revision 08b462dd9970a88d7f0e7c61ca48502463b0b78d)
1 /*
2  * Block node draining tests
3  *
4  * Copyright (c) 2017 Kevin Wolf <kwolf@redhat.com>
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "block/block_int.h"
27 #include "block/blockjob_int.h"
28 #include "system/block-backend.h"
29 #include "qapi/error.h"
30 #include "qemu/main-loop.h"
31 #include "iothread.h"
32 
33 static QemuEvent done_event;
34 
35 typedef struct BDRVTestState {
36     int drain_count;
37     AioContext *bh_indirection_ctx;
38     bool sleep_in_drain_begin;
39 } BDRVTestState;
40 
41 static void coroutine_fn sleep_in_drain_begin(void *opaque)
42 {
43     BlockDriverState *bs = opaque;
44 
45     qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
46     bdrv_dec_in_flight(bs);
47 }
48 
49 static void bdrv_test_drain_begin(BlockDriverState *bs)
50 {
51     BDRVTestState *s = bs->opaque;
52     s->drain_count++;
53     if (s->sleep_in_drain_begin) {
54         Coroutine *co = qemu_coroutine_create(sleep_in_drain_begin, bs);
55         bdrv_inc_in_flight(bs);
56         aio_co_enter(bdrv_get_aio_context(bs), co);
57     }
58 }
59 
60 static void bdrv_test_drain_end(BlockDriverState *bs)
61 {
62     BDRVTestState *s = bs->opaque;
63     s->drain_count--;
64 }
65 
66 static void bdrv_test_close(BlockDriverState *bs)
67 {
68     BDRVTestState *s = bs->opaque;
69     g_assert_cmpint(s->drain_count, >, 0);
70 }
71 
72 static void co_reenter_bh(void *opaque)
73 {
74     aio_co_wake(opaque);
75 }
76 
77 static int coroutine_fn bdrv_test_co_preadv(BlockDriverState *bs,
78                                             int64_t offset, int64_t bytes,
79                                             QEMUIOVector *qiov,
80                                             BdrvRequestFlags flags)
81 {
82     BDRVTestState *s = bs->opaque;
83 
84     /* We want this request to stay until the polling loop in drain waits for
85      * it to complete. We need to sleep a while as bdrv_drain_invoke() comes
86      * first and polls its result, too, but it shouldn't accidentally complete
87      * this request yet. */
88     qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
89 
90     if (s->bh_indirection_ctx) {
91         aio_bh_schedule_oneshot(s->bh_indirection_ctx, co_reenter_bh,
92                                 qemu_coroutine_self());
93         qemu_coroutine_yield();
94     }
95 
96     return 0;
97 }
98 
99 static int bdrv_test_co_change_backing_file(BlockDriverState *bs,
100                                             const char *backing_file,
101                                             const char *backing_fmt)
102 {
103     return 0;
104 }
105 
106 static BlockDriver bdrv_test = {
107     .format_name            = "test",
108     .instance_size          = sizeof(BDRVTestState),
109     .supports_backing       = true,
110 
111     .bdrv_close             = bdrv_test_close,
112     .bdrv_co_preadv         = bdrv_test_co_preadv,
113 
114     .bdrv_drain_begin       = bdrv_test_drain_begin,
115     .bdrv_drain_end         = bdrv_test_drain_end,
116 
117     .bdrv_child_perm        = bdrv_default_perms,
118 
119     .bdrv_co_change_backing_file = bdrv_test_co_change_backing_file,
120 };
121 
122 static void aio_ret_cb(void *opaque, int ret)
123 {
124     int *aio_ret = opaque;
125     *aio_ret = ret;
126 }
127 
128 typedef struct CallInCoroutineData {
129     void (*entry)(void);
130     bool done;
131 } CallInCoroutineData;
132 
133 static coroutine_fn void call_in_coroutine_entry(void *opaque)
134 {
135     CallInCoroutineData *data = opaque;
136 
137     data->entry();
138     data->done = true;
139 }
140 
141 static void call_in_coroutine(void (*entry)(void))
142 {
143     Coroutine *co;
144     CallInCoroutineData data = {
145         .entry  = entry,
146         .done   = false,
147     };
148 
149     co = qemu_coroutine_create(call_in_coroutine_entry, &data);
150     qemu_coroutine_enter(co);
151     while (!data.done) {
152         aio_poll(qemu_get_aio_context(), true);
153     }
154 }
155 
156 enum drain_type {
157     BDRV_DRAIN_ALL,
158     BDRV_DRAIN,
159     DRAIN_TYPE_MAX,
160 };
161 
162 static void do_drain_begin(enum drain_type drain_type, BlockDriverState *bs)
163 {
164     switch (drain_type) {
165     case BDRV_DRAIN_ALL:        bdrv_drain_all_begin(); break;
166     case BDRV_DRAIN:            bdrv_drained_begin(bs); break;
167     default:                    g_assert_not_reached();
168     }
169 }
170 
171 static void do_drain_end(enum drain_type drain_type, BlockDriverState *bs)
172 {
173     switch (drain_type) {
174     case BDRV_DRAIN_ALL:        bdrv_drain_all_end(); break;
175     case BDRV_DRAIN:            bdrv_drained_end(bs); break;
176     default:                    g_assert_not_reached();
177     }
178 }
179 
180 static void do_drain_begin_unlocked(enum drain_type drain_type, BlockDriverState *bs)
181 {
182     do_drain_begin(drain_type, bs);
183 }
184 
185 static BlockBackend * no_coroutine_fn test_setup(void)
186 {
187     BlockBackend *blk;
188     BlockDriverState *bs, *backing;
189 
190     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
191     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
192                               &error_abort);
193     blk_insert_bs(blk, bs, &error_abort);
194 
195     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
196     bdrv_set_backing_hd(bs, backing, &error_abort);
197 
198     bdrv_unref(backing);
199     bdrv_unref(bs);
200 
201     return blk;
202 }
203 
204 static void do_drain_end_unlocked(enum drain_type drain_type, BlockDriverState *bs)
205 {
206     do_drain_end(drain_type, bs);
207 }
208 
209 /*
210  * Locking the block graph would be a bit cumbersome here because this function
211  * is called both in coroutine and non-coroutine context. We know this is a test
212  * and nothing else is running, so don't bother with TSA.
213  */
214 static void coroutine_mixed_fn TSA_NO_TSA
215 test_drv_cb_common(BlockBackend *blk, enum drain_type drain_type,
216                    bool recursive)
217 {
218     BlockDriverState *bs = blk_bs(blk);
219     BlockDriverState *backing = bs->backing->bs;
220     BDRVTestState *s, *backing_s;
221     BlockAIOCB *acb;
222     int aio_ret;
223 
224     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
225 
226     s = bs->opaque;
227     backing_s = backing->opaque;
228 
229     /* Simple bdrv_drain_all_begin/end pair, check that CBs are called */
230     g_assert_cmpint(s->drain_count, ==, 0);
231     g_assert_cmpint(backing_s->drain_count, ==, 0);
232 
233     do_drain_begin(drain_type, bs);
234 
235     g_assert_cmpint(s->drain_count, ==, 1);
236     g_assert_cmpint(backing_s->drain_count, ==, !!recursive);
237 
238     do_drain_end(drain_type, bs);
239 
240     g_assert_cmpint(s->drain_count, ==, 0);
241     g_assert_cmpint(backing_s->drain_count, ==, 0);
242 
243     /* Now do the same while a request is pending */
244     aio_ret = -EINPROGRESS;
245     acb = blk_aio_preadv(blk, 0, &qiov, 0, aio_ret_cb, &aio_ret);
246     g_assert(acb != NULL);
247     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
248 
249     g_assert_cmpint(s->drain_count, ==, 0);
250     g_assert_cmpint(backing_s->drain_count, ==, 0);
251 
252     do_drain_begin(drain_type, bs);
253 
254     g_assert_cmpint(aio_ret, ==, 0);
255     g_assert_cmpint(s->drain_count, ==, 1);
256     g_assert_cmpint(backing_s->drain_count, ==, !!recursive);
257 
258     do_drain_end(drain_type, bs);
259 
260     g_assert_cmpint(s->drain_count, ==, 0);
261     g_assert_cmpint(backing_s->drain_count, ==, 0);
262 }
263 
264 static void test_drv_cb_drain_all(void)
265 {
266     BlockBackend *blk = test_setup();
267     test_drv_cb_common(blk, BDRV_DRAIN_ALL, true);
268     blk_unref(blk);
269 }
270 
271 static void test_drv_cb_drain(void)
272 {
273     BlockBackend *blk = test_setup();
274     test_drv_cb_common(blk, BDRV_DRAIN, false);
275     blk_unref(blk);
276 }
277 
278 static void coroutine_fn test_drv_cb_co_drain_all_entry(void)
279 {
280     BlockBackend *blk = blk_all_next(NULL);
281     test_drv_cb_common(blk, BDRV_DRAIN_ALL, true);
282 }
283 
284 static void test_drv_cb_co_drain_all(void)
285 {
286     BlockBackend *blk = test_setup();
287     call_in_coroutine(test_drv_cb_co_drain_all_entry);
288     blk_unref(blk);
289 }
290 
291 static void coroutine_fn test_drv_cb_co_drain_entry(void)
292 {
293     BlockBackend *blk = blk_all_next(NULL);
294     test_drv_cb_common(blk, BDRV_DRAIN, false);
295 }
296 
297 static void test_drv_cb_co_drain(void)
298 {
299     BlockBackend *blk = test_setup();
300     call_in_coroutine(test_drv_cb_co_drain_entry);
301     blk_unref(blk);
302 }
303 
304 /*
305  * Locking the block graph would be a bit cumbersome here because this function
306  * is called both in coroutine and non-coroutine context. We know this is a test
307  * and nothing else is running, so don't bother with TSA.
308  */
309 static void coroutine_mixed_fn TSA_NO_TSA
310 test_quiesce_common(BlockBackend *blk, enum drain_type drain_type,
311                     bool recursive)
312 {
313     BlockDriverState *bs = blk_bs(blk);
314     BlockDriverState *backing = bs->backing->bs;
315 
316     g_assert_cmpint(bs->quiesce_counter, ==, 0);
317     g_assert_cmpint(backing->quiesce_counter, ==, 0);
318 
319     do_drain_begin(drain_type, bs);
320 
321     if (drain_type == BDRV_DRAIN_ALL) {
322         g_assert_cmpint(bs->quiesce_counter, ==, 2);
323     } else {
324         g_assert_cmpint(bs->quiesce_counter, ==, 1);
325     }
326     g_assert_cmpint(backing->quiesce_counter, ==, !!recursive);
327 
328     do_drain_end(drain_type, bs);
329 
330     g_assert_cmpint(bs->quiesce_counter, ==, 0);
331     g_assert_cmpint(backing->quiesce_counter, ==, 0);
332 }
333 
334 static void test_quiesce_drain_all(void)
335 {
336     BlockBackend *blk = test_setup();
337     test_quiesce_common(blk, BDRV_DRAIN_ALL, true);
338     blk_unref(blk);
339 }
340 
341 static void test_quiesce_drain(void)
342 {
343     BlockBackend *blk = test_setup();
344     test_quiesce_common(blk, BDRV_DRAIN, false);
345     blk_unref(blk);
346 }
347 
348 static void coroutine_fn test_quiesce_co_drain_all_entry(void)
349 {
350     BlockBackend *blk = blk_all_next(NULL);
351     test_quiesce_common(blk, BDRV_DRAIN_ALL, true);
352 }
353 
354 static void test_quiesce_co_drain_all(void)
355 {
356     BlockBackend *blk = test_setup();
357     call_in_coroutine(test_quiesce_co_drain_all_entry);
358     blk_unref(blk);
359 }
360 
361 static void coroutine_fn test_quiesce_co_drain_entry(void)
362 {
363     BlockBackend *blk = blk_all_next(NULL);
364     test_quiesce_common(blk, BDRV_DRAIN, false);
365 }
366 
367 static void test_quiesce_co_drain(void)
368 {
369     BlockBackend *blk = test_setup();
370     call_in_coroutine(test_quiesce_co_drain_entry);
371     blk_unref(blk);
372 }
373 
374 static void test_nested(void)
375 {
376     BlockBackend *blk;
377     BlockDriverState *bs, *backing;
378     BDRVTestState *s, *backing_s;
379     enum drain_type outer, inner;
380 
381     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
382     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
383                               &error_abort);
384     s = bs->opaque;
385     blk_insert_bs(blk, bs, &error_abort);
386 
387     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
388     backing_s = backing->opaque;
389     bdrv_set_backing_hd(bs, backing, &error_abort);
390 
391     for (outer = 0; outer < DRAIN_TYPE_MAX; outer++) {
392         for (inner = 0; inner < DRAIN_TYPE_MAX; inner++) {
393             int backing_quiesce = (outer == BDRV_DRAIN_ALL) +
394                                   (inner == BDRV_DRAIN_ALL);
395 
396             g_assert_cmpint(bs->quiesce_counter, ==, 0);
397             g_assert_cmpint(backing->quiesce_counter, ==, 0);
398             g_assert_cmpint(s->drain_count, ==, 0);
399             g_assert_cmpint(backing_s->drain_count, ==, 0);
400 
401             do_drain_begin(outer, bs);
402             do_drain_begin(inner, bs);
403 
404             g_assert_cmpint(bs->quiesce_counter, ==, 2 + !!backing_quiesce);
405             g_assert_cmpint(backing->quiesce_counter, ==, backing_quiesce);
406             g_assert_cmpint(s->drain_count, ==, 1);
407             g_assert_cmpint(backing_s->drain_count, ==, !!backing_quiesce);
408 
409             do_drain_end(inner, bs);
410             do_drain_end(outer, bs);
411 
412             g_assert_cmpint(bs->quiesce_counter, ==, 0);
413             g_assert_cmpint(backing->quiesce_counter, ==, 0);
414             g_assert_cmpint(s->drain_count, ==, 0);
415             g_assert_cmpint(backing_s->drain_count, ==, 0);
416         }
417     }
418 
419     bdrv_unref(backing);
420     bdrv_unref(bs);
421     blk_unref(blk);
422 }
423 
424 static void test_graph_change_drain_all(void)
425 {
426     BlockBackend *blk_a, *blk_b;
427     BlockDriverState *bs_a, *bs_b;
428     BDRVTestState *a_s, *b_s;
429 
430     /* Create node A with a BlockBackend */
431     blk_a = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
432     bs_a = bdrv_new_open_driver(&bdrv_test, "test-node-a", BDRV_O_RDWR,
433                                 &error_abort);
434     a_s = bs_a->opaque;
435     blk_insert_bs(blk_a, bs_a, &error_abort);
436 
437     g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
438     g_assert_cmpint(a_s->drain_count, ==, 0);
439 
440     /* Call bdrv_drain_all_begin() */
441     bdrv_drain_all_begin();
442 
443     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
444     g_assert_cmpint(a_s->drain_count, ==, 1);
445 
446     /* Create node B with a BlockBackend */
447     blk_b = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
448     bs_b = bdrv_new_open_driver(&bdrv_test, "test-node-b", BDRV_O_RDWR,
449                                 &error_abort);
450     b_s = bs_b->opaque;
451     blk_insert_bs(blk_b, bs_b, &error_abort);
452 
453     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
454     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
455     g_assert_cmpint(a_s->drain_count, ==, 1);
456     g_assert_cmpint(b_s->drain_count, ==, 1);
457 
458     /* Unref and finally delete node A */
459     blk_unref(blk_a);
460 
461     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
462     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
463     g_assert_cmpint(a_s->drain_count, ==, 1);
464     g_assert_cmpint(b_s->drain_count, ==, 1);
465 
466     bdrv_unref(bs_a);
467 
468     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
469     g_assert_cmpint(b_s->drain_count, ==, 1);
470 
471     /* End the drained section */
472     bdrv_drain_all_end();
473 
474     g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
475     g_assert_cmpint(b_s->drain_count, ==, 0);
476 
477     bdrv_unref(bs_b);
478     blk_unref(blk_b);
479 }
480 
481 struct test_iothread_data {
482     BlockDriverState *bs;
483     enum drain_type drain_type;
484     int *aio_ret;
485     bool co_done;
486 };
487 
488 static void coroutine_fn test_iothread_drain_co_entry(void *opaque)
489 {
490     struct test_iothread_data *data = opaque;
491 
492     do_drain_begin(data->drain_type, data->bs);
493     g_assert_cmpint(*data->aio_ret, ==, 0);
494     do_drain_end(data->drain_type, data->bs);
495 
496     data->co_done = true;
497     aio_wait_kick();
498 }
499 
500 static void test_iothread_aio_cb(void *opaque, int ret)
501 {
502     int *aio_ret = opaque;
503     *aio_ret = ret;
504     qemu_event_set(&done_event);
505 }
506 
507 static void test_iothread_main_thread_bh(void *opaque)
508 {
509     struct test_iothread_data *data = opaque;
510 
511     bdrv_flush(data->bs);
512     bdrv_dec_in_flight(data->bs); /* incremented by test_iothread_common() */
513 }
514 
515 /*
516  * Starts an AIO request on a BDS that runs in the AioContext of iothread 1.
517  * The request involves a BH on iothread 2 before it can complete.
518  *
519  * @drain_thread = 0 means that do_drain_begin/end are called from the main
520  * thread, @drain_thread = 1 means that they are called from iothread 1. Drain
521  * for this BDS cannot be called from iothread 2 because only the main thread
522  * may do cross-AioContext polling.
523  */
524 static void test_iothread_common(enum drain_type drain_type, int drain_thread)
525 {
526     BlockBackend *blk;
527     BlockDriverState *bs;
528     BDRVTestState *s;
529     BlockAIOCB *acb;
530     Coroutine *co;
531     int aio_ret;
532     struct test_iothread_data data;
533 
534     IOThread *a = iothread_new();
535     IOThread *b = iothread_new();
536     AioContext *ctx_a = iothread_get_aio_context(a);
537     AioContext *ctx_b = iothread_get_aio_context(b);
538 
539     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
540 
541     /* bdrv_drain_all() may only be called from the main loop thread */
542     if (drain_type == BDRV_DRAIN_ALL && drain_thread != 0) {
543         goto out;
544     }
545 
546     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
547     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
548                               &error_abort);
549     s = bs->opaque;
550     blk_insert_bs(blk, bs, &error_abort);
551     blk_set_disable_request_queuing(blk, true);
552 
553     blk_set_aio_context(blk, ctx_a, &error_abort);
554 
555     s->bh_indirection_ctx = ctx_b;
556 
557     aio_ret = -EINPROGRESS;
558     qemu_event_reset(&done_event);
559 
560     if (drain_thread == 0) {
561         acb = blk_aio_preadv(blk, 0, &qiov, 0, test_iothread_aio_cb, &aio_ret);
562     } else {
563         acb = blk_aio_preadv(blk, 0, &qiov, 0, aio_ret_cb, &aio_ret);
564     }
565     g_assert(acb != NULL);
566     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
567 
568     data = (struct test_iothread_data) {
569         .bs         = bs,
570         .drain_type = drain_type,
571         .aio_ret    = &aio_ret,
572     };
573 
574     switch (drain_thread) {
575     case 0:
576         /*
577          * Increment in_flight so that do_drain_begin() waits for
578          * test_iothread_main_thread_bh(). This prevents the race between
579          * test_iothread_main_thread_bh() in IOThread a and do_drain_begin() in
580          * this thread. test_iothread_main_thread_bh() decrements in_flight.
581          */
582         bdrv_inc_in_flight(bs);
583         aio_bh_schedule_oneshot(ctx_a, test_iothread_main_thread_bh, &data);
584 
585         /* The request is running on the IOThread a. Draining its block device
586          * will make sure that it has completed as far as the BDS is concerned,
587          * but the drain in this thread can continue immediately after
588          * bdrv_dec_in_flight() and aio_ret might be assigned only slightly
589          * later. */
590         do_drain_begin(drain_type, bs);
591         g_assert_cmpint(bs->in_flight, ==, 0);
592 
593         qemu_event_wait(&done_event);
594 
595         g_assert_cmpint(aio_ret, ==, 0);
596         do_drain_end(drain_type, bs);
597         break;
598     case 1:
599         co = qemu_coroutine_create(test_iothread_drain_co_entry, &data);
600         aio_co_enter(ctx_a, co);
601         AIO_WAIT_WHILE_UNLOCKED(NULL, !data.co_done);
602         break;
603     default:
604         g_assert_not_reached();
605     }
606 
607     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
608 
609     bdrv_unref(bs);
610     blk_unref(blk);
611 
612 out:
613     iothread_join(a);
614     iothread_join(b);
615 }
616 
617 static void test_iothread_drain_all(void)
618 {
619     test_iothread_common(BDRV_DRAIN_ALL, 0);
620     test_iothread_common(BDRV_DRAIN_ALL, 1);
621 }
622 
623 static void test_iothread_drain(void)
624 {
625     test_iothread_common(BDRV_DRAIN, 0);
626     test_iothread_common(BDRV_DRAIN, 1);
627 }
628 
629 
630 typedef struct TestBlockJob {
631     BlockJob common;
632     BlockDriverState *bs;
633     int run_ret;
634     int prepare_ret;
635 
636     /* Accessed with atomics */
637     bool running;
638     bool should_complete;
639 } TestBlockJob;
640 
641 static int test_job_prepare(Job *job)
642 {
643     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
644 
645     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
646     bdrv_flush(s->bs);
647     return s->prepare_ret;
648 }
649 
650 static void test_job_commit(Job *job)
651 {
652     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
653 
654     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
655     bdrv_flush(s->bs);
656 }
657 
658 static void test_job_abort(Job *job)
659 {
660     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
661 
662     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
663     bdrv_flush(s->bs);
664 }
665 
666 static int coroutine_fn test_job_run(Job *job, Error **errp)
667 {
668     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
669 
670     /* We are running the actual job code past the pause point in
671      * job_co_entry(). */
672     qatomic_set(&s->running, true);
673 
674     job_transition_to_ready(&s->common.job);
675     while (!qatomic_read(&s->should_complete)) {
676         /* Avoid job_sleep_ns() because it marks the job as !busy. We want to
677          * emulate some actual activity (probably some I/O) here so that drain
678          * has to wait for this activity to stop. */
679         qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
680 
681         job_pause_point(&s->common.job);
682     }
683 
684     return s->run_ret;
685 }
686 
687 static void test_job_complete(Job *job, Error **errp)
688 {
689     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
690     qatomic_set(&s->should_complete, true);
691 }
692 
693 BlockJobDriver test_job_driver = {
694     .job_driver = {
695         .instance_size  = sizeof(TestBlockJob),
696         .free           = block_job_free,
697         .user_resume    = block_job_user_resume,
698         .run            = test_job_run,
699         .complete       = test_job_complete,
700         .prepare        = test_job_prepare,
701         .commit         = test_job_commit,
702         .abort          = test_job_abort,
703     },
704 };
705 
706 enum test_job_result {
707     TEST_JOB_SUCCESS,
708     TEST_JOB_FAIL_RUN,
709     TEST_JOB_FAIL_PREPARE,
710 };
711 
712 enum test_job_drain_node {
713     TEST_JOB_DRAIN_SRC,
714     TEST_JOB_DRAIN_SRC_CHILD,
715 };
716 
717 static void test_blockjob_common_drain_node(enum drain_type drain_type,
718                                             bool use_iothread,
719                                             enum test_job_result result,
720                                             enum test_job_drain_node drain_node)
721 {
722     BlockBackend *blk_src, *blk_target;
723     BlockDriverState *src, *src_backing, *src_overlay, *target, *drain_bs;
724     BlockJob *job;
725     TestBlockJob *tjob;
726     IOThread *iothread = NULL;
727     int ret = -1;
728 
729     src = bdrv_new_open_driver(&bdrv_test, "source", BDRV_O_RDWR,
730                                &error_abort);
731     src_backing = bdrv_new_open_driver(&bdrv_test, "source-backing",
732                                        BDRV_O_RDWR, &error_abort);
733     src_overlay = bdrv_new_open_driver(&bdrv_test, "source-overlay",
734                                        BDRV_O_RDWR, &error_abort);
735 
736     bdrv_set_backing_hd(src_overlay, src, &error_abort);
737     bdrv_unref(src);
738     bdrv_set_backing_hd(src, src_backing, &error_abort);
739     bdrv_unref(src_backing);
740 
741     blk_src = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
742     blk_insert_bs(blk_src, src_overlay, &error_abort);
743 
744     switch (drain_node) {
745     case TEST_JOB_DRAIN_SRC:
746         drain_bs = src;
747         break;
748     case TEST_JOB_DRAIN_SRC_CHILD:
749         drain_bs = src_backing;
750         break;
751     default:
752         g_assert_not_reached();
753     }
754 
755     if (use_iothread) {
756         AioContext *ctx;
757 
758         iothread = iothread_new();
759         ctx = iothread_get_aio_context(iothread);
760         blk_set_aio_context(blk_src, ctx, &error_abort);
761     }
762 
763     target = bdrv_new_open_driver(&bdrv_test, "target", BDRV_O_RDWR,
764                                   &error_abort);
765     blk_target = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
766     blk_insert_bs(blk_target, target, &error_abort);
767     blk_set_allow_aio_context_change(blk_target, true);
768 
769     tjob = block_job_create("job0", &test_job_driver, NULL, src,
770                             0, BLK_PERM_ALL,
771                             0, 0, NULL, NULL, &error_abort);
772     tjob->bs = src;
773     job = &tjob->common;
774 
775     bdrv_graph_wrlock();
776     block_job_add_bdrv(job, "target", target, 0, BLK_PERM_ALL, &error_abort);
777     bdrv_graph_wrunlock();
778 
779     switch (result) {
780     case TEST_JOB_SUCCESS:
781         break;
782     case TEST_JOB_FAIL_RUN:
783         tjob->run_ret = -EIO;
784         break;
785     case TEST_JOB_FAIL_PREPARE:
786         tjob->prepare_ret = -EIO;
787         break;
788     }
789 
790     job_start(&job->job);
791 
792     if (use_iothread) {
793         /* job_co_entry() is run in the I/O thread, wait for the actual job
794          * code to start (we don't want to catch the job in the pause point in
795          * job_co_entry(). */
796         while (!qatomic_read(&tjob->running)) {
797             aio_poll(qemu_get_aio_context(), false);
798         }
799     }
800 
801     WITH_JOB_LOCK_GUARD() {
802         g_assert_cmpint(job->job.pause_count, ==, 0);
803         g_assert_false(job->job.paused);
804         g_assert_true(qatomic_read(&tjob->running));
805         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
806     }
807 
808     do_drain_begin_unlocked(drain_type, drain_bs);
809 
810     WITH_JOB_LOCK_GUARD() {
811         if (drain_type == BDRV_DRAIN_ALL) {
812             /* bdrv_drain_all() drains both src and target */
813             g_assert_cmpint(job->job.pause_count, ==, 2);
814         } else {
815             g_assert_cmpint(job->job.pause_count, ==, 1);
816         }
817         g_assert_true(job->job.paused);
818         g_assert_false(job->job.busy); /* The job is paused */
819     }
820 
821     do_drain_end_unlocked(drain_type, drain_bs);
822 
823     if (use_iothread) {
824         /*
825          * Here we are waiting for the paused status to change,
826          * so don't bother protecting the read every time.
827          *
828          * paused is reset in the I/O thread, wait for it
829          */
830         while (job_is_paused(&job->job)) {
831             aio_poll(qemu_get_aio_context(), false);
832         }
833     }
834 
835     WITH_JOB_LOCK_GUARD() {
836         g_assert_cmpint(job->job.pause_count, ==, 0);
837         g_assert_false(job->job.paused);
838         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
839     }
840 
841     do_drain_begin_unlocked(drain_type, target);
842 
843     WITH_JOB_LOCK_GUARD() {
844         if (drain_type == BDRV_DRAIN_ALL) {
845             /* bdrv_drain_all() drains both src and target */
846             g_assert_cmpint(job->job.pause_count, ==, 2);
847         } else {
848             g_assert_cmpint(job->job.pause_count, ==, 1);
849         }
850         g_assert_true(job->job.paused);
851         g_assert_false(job->job.busy); /* The job is paused */
852     }
853 
854     do_drain_end_unlocked(drain_type, target);
855 
856     if (use_iothread) {
857         /*
858          * Here we are waiting for the paused status to change,
859          * so don't bother protecting the read every time.
860          *
861          * paused is reset in the I/O thread, wait for it
862          */
863         while (job_is_paused(&job->job)) {
864             aio_poll(qemu_get_aio_context(), false);
865         }
866     }
867 
868     WITH_JOB_LOCK_GUARD() {
869         g_assert_cmpint(job->job.pause_count, ==, 0);
870         g_assert_false(job->job.paused);
871         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
872     }
873 
874     WITH_JOB_LOCK_GUARD() {
875         ret = job_complete_sync_locked(&job->job, &error_abort);
876     }
877     g_assert_cmpint(ret, ==, (result == TEST_JOB_SUCCESS ? 0 : -EIO));
878 
879     if (use_iothread) {
880         blk_set_aio_context(blk_src, qemu_get_aio_context(), &error_abort);
881         assert(blk_get_aio_context(blk_target) == qemu_get_aio_context());
882     }
883 
884     blk_unref(blk_src);
885     blk_unref(blk_target);
886     bdrv_unref(src_overlay);
887     bdrv_unref(target);
888 
889     if (iothread) {
890         iothread_join(iothread);
891     }
892 }
893 
894 static void test_blockjob_common(enum drain_type drain_type, bool use_iothread,
895                                  enum test_job_result result)
896 {
897     test_blockjob_common_drain_node(drain_type, use_iothread, result,
898                                     TEST_JOB_DRAIN_SRC);
899     test_blockjob_common_drain_node(drain_type, use_iothread, result,
900                                     TEST_JOB_DRAIN_SRC_CHILD);
901 }
902 
903 static void test_blockjob_drain_all(void)
904 {
905     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_SUCCESS);
906 }
907 
908 static void test_blockjob_drain(void)
909 {
910     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_SUCCESS);
911 }
912 
913 static void test_blockjob_error_drain_all(void)
914 {
915     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_RUN);
916     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_PREPARE);
917 }
918 
919 static void test_blockjob_error_drain(void)
920 {
921     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_RUN);
922     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_PREPARE);
923 }
924 
925 static void test_blockjob_iothread_drain_all(void)
926 {
927     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_SUCCESS);
928 }
929 
930 static void test_blockjob_iothread_drain(void)
931 {
932     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_SUCCESS);
933 }
934 
935 static void test_blockjob_iothread_error_drain_all(void)
936 {
937     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_RUN);
938     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_PREPARE);
939 }
940 
941 static void test_blockjob_iothread_error_drain(void)
942 {
943     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_RUN);
944     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_PREPARE);
945 }
946 
947 
948 typedef struct BDRVTestTopState {
949     BdrvChild *wait_child;
950 } BDRVTestTopState;
951 
952 static void bdrv_test_top_close(BlockDriverState *bs)
953 {
954     BdrvChild *c, *next_c;
955 
956     bdrv_graph_wrlock();
957     QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
958         bdrv_unref_child(bs, c);
959     }
960     bdrv_graph_wrunlock();
961 }
962 
963 static int coroutine_fn GRAPH_RDLOCK
964 bdrv_test_top_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
965                         QEMUIOVector *qiov, BdrvRequestFlags flags)
966 {
967     BDRVTestTopState *tts = bs->opaque;
968     return bdrv_co_preadv(tts->wait_child, offset, bytes, qiov, flags);
969 }
970 
971 static BlockDriver bdrv_test_top_driver = {
972     .format_name            = "test_top_driver",
973     .instance_size          = sizeof(BDRVTestTopState),
974 
975     .bdrv_close             = bdrv_test_top_close,
976     .bdrv_co_preadv         = bdrv_test_top_co_preadv,
977 
978     .bdrv_child_perm        = bdrv_default_perms,
979 };
980 
981 typedef struct TestCoDeleteByDrainData {
982     BlockBackend *blk;
983     bool detach_instead_of_delete;
984     bool done;
985 } TestCoDeleteByDrainData;
986 
987 static void coroutine_fn test_co_delete_by_drain(void *opaque)
988 {
989     TestCoDeleteByDrainData *dbdd = opaque;
990     BlockBackend *blk = dbdd->blk;
991     BlockDriverState *bs = blk_bs(blk);
992     BDRVTestTopState *tts = bs->opaque;
993     void *buffer = g_malloc(65536);
994     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buffer, 65536);
995 
996     /* Pretend some internal write operation from parent to child.
997      * Important: We have to read from the child, not from the parent!
998      * Draining works by first propagating it all up the tree to the
999      * root and then waiting for drainage from root to the leaves
1000      * (protocol nodes).  If we have a request waiting on the root,
1001      * everything will be drained before we go back down the tree, but
1002      * we do not want that.  We want to be in the middle of draining
1003      * when this following requests returns. */
1004     bdrv_graph_co_rdlock();
1005     bdrv_co_preadv(tts->wait_child, 0, 65536, &qiov, 0);
1006     bdrv_graph_co_rdunlock();
1007 
1008     g_assert_cmpint(bs->refcnt, ==, 1);
1009 
1010     if (!dbdd->detach_instead_of_delete) {
1011         blk_co_unref(blk);
1012     } else {
1013         BdrvChild *c, *next_c;
1014         bdrv_graph_co_rdlock();
1015         QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
1016             bdrv_graph_co_rdunlock();
1017             bdrv_co_unref_child(bs, c);
1018             bdrv_graph_co_rdlock();
1019         }
1020         bdrv_graph_co_rdunlock();
1021     }
1022 
1023     dbdd->done = true;
1024     g_free(buffer);
1025 }
1026 
1027 /**
1028  * Test what happens when some BDS has some children, you drain one of
1029  * them and this results in the BDS being deleted.
1030  *
1031  * If @detach_instead_of_delete is set, the BDS is not going to be
1032  * deleted but will only detach all of its children.
1033  */
1034 static void do_test_delete_by_drain(bool detach_instead_of_delete,
1035                                     enum drain_type drain_type)
1036 {
1037     BlockBackend *blk;
1038     BlockDriverState *bs, *child_bs, *null_bs;
1039     BDRVTestTopState *tts;
1040     TestCoDeleteByDrainData dbdd;
1041     Coroutine *co;
1042 
1043     bs = bdrv_new_open_driver(&bdrv_test_top_driver, "top", BDRV_O_RDWR,
1044                               &error_abort);
1045     bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
1046     tts = bs->opaque;
1047 
1048     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
1049                         &error_abort);
1050     bdrv_graph_wrlock();
1051     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds,
1052                       BDRV_CHILD_DATA, &error_abort);
1053     bdrv_graph_wrunlock();
1054 
1055     /* This child will be the one to pass to requests through to, and
1056      * it will stall until a drain occurs */
1057     child_bs = bdrv_new_open_driver(&bdrv_test, "child", BDRV_O_RDWR,
1058                                     &error_abort);
1059     child_bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
1060     /* Takes our reference to child_bs */
1061     bdrv_graph_wrlock();
1062     tts->wait_child = bdrv_attach_child(bs, child_bs, "wait-child",
1063                                         &child_of_bds,
1064                                         BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
1065                                         &error_abort);
1066     bdrv_graph_wrunlock();
1067 
1068     /* This child is just there to be deleted
1069      * (for detach_instead_of_delete == true) */
1070     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
1071                         &error_abort);
1072     bdrv_graph_wrlock();
1073     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds, BDRV_CHILD_DATA,
1074                       &error_abort);
1075     bdrv_graph_wrunlock();
1076 
1077     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1078     blk_insert_bs(blk, bs, &error_abort);
1079 
1080     /* Referenced by blk now */
1081     bdrv_unref(bs);
1082 
1083     g_assert_cmpint(bs->refcnt, ==, 1);
1084     g_assert_cmpint(child_bs->refcnt, ==, 1);
1085     g_assert_cmpint(null_bs->refcnt, ==, 1);
1086 
1087 
1088     dbdd = (TestCoDeleteByDrainData){
1089         .blk = blk,
1090         .detach_instead_of_delete = detach_instead_of_delete,
1091         .done = false,
1092     };
1093     co = qemu_coroutine_create(test_co_delete_by_drain, &dbdd);
1094     qemu_coroutine_enter(co);
1095 
1096     /* Drain the child while the read operation is still pending.
1097      * This should result in the operation finishing and
1098      * test_co_delete_by_drain() resuming.  Thus, @bs will be deleted
1099      * and the coroutine will exit while this drain operation is still
1100      * in progress. */
1101     switch (drain_type) {
1102     case BDRV_DRAIN:
1103         bdrv_ref(child_bs);
1104         bdrv_drain(child_bs);
1105         bdrv_unref(child_bs);
1106         break;
1107     case BDRV_DRAIN_ALL:
1108         bdrv_drain_all_begin();
1109         bdrv_drain_all_end();
1110         break;
1111     default:
1112         g_assert_not_reached();
1113     }
1114 
1115     while (!dbdd.done) {
1116         aio_poll(qemu_get_aio_context(), true);
1117     }
1118 
1119     if (detach_instead_of_delete) {
1120         /* Here, the reference has not passed over to the coroutine,
1121          * so we have to delete the BB ourselves */
1122         blk_unref(blk);
1123     }
1124 }
1125 
1126 static void test_delete_by_drain(void)
1127 {
1128     do_test_delete_by_drain(false, BDRV_DRAIN);
1129 }
1130 
1131 static void test_detach_by_drain_all(void)
1132 {
1133     do_test_delete_by_drain(true, BDRV_DRAIN_ALL);
1134 }
1135 
1136 static void test_detach_by_drain(void)
1137 {
1138     do_test_delete_by_drain(true, BDRV_DRAIN);
1139 }
1140 
1141 
1142 struct detach_by_parent_data {
1143     BlockDriverState *parent_b;
1144     BdrvChild *child_b;
1145     BlockDriverState *c;
1146     BdrvChild *child_c;
1147     bool by_parent_cb;
1148     bool detach_on_drain;
1149 };
1150 static struct detach_by_parent_data detach_by_parent_data;
1151 
1152 static void no_coroutine_fn detach_indirect_bh(void *opaque)
1153 {
1154     struct detach_by_parent_data *data = opaque;
1155 
1156     bdrv_dec_in_flight(data->child_b->bs);
1157 
1158     bdrv_graph_wrlock();
1159     bdrv_unref_child(data->parent_b, data->child_b);
1160 
1161     bdrv_ref(data->c);
1162     data->child_c = bdrv_attach_child(data->parent_b, data->c, "PB-C",
1163                                       &child_of_bds, BDRV_CHILD_DATA,
1164                                       &error_abort);
1165     bdrv_graph_wrunlock();
1166 }
1167 
1168 static void coroutine_mixed_fn detach_by_parent_aio_cb(void *opaque, int ret)
1169 {
1170     struct detach_by_parent_data *data = &detach_by_parent_data;
1171 
1172     g_assert_cmpint(ret, ==, 0);
1173     if (data->by_parent_cb) {
1174         bdrv_inc_in_flight(data->child_b->bs);
1175         aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
1176                                 detach_indirect_bh, &detach_by_parent_data);
1177     }
1178 }
1179 
1180 static void GRAPH_RDLOCK detach_by_driver_cb_drained_begin(BdrvChild *child)
1181 {
1182     struct detach_by_parent_data *data = &detach_by_parent_data;
1183 
1184     if (!data->detach_on_drain) {
1185         return;
1186     }
1187     data->detach_on_drain = false;
1188 
1189     bdrv_inc_in_flight(data->child_b->bs);
1190     aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
1191                             detach_indirect_bh, &detach_by_parent_data);
1192     child_of_bds.drained_begin(child);
1193 }
1194 
1195 static BdrvChildClass detach_by_driver_cb_class;
1196 
1197 /*
1198  * Initial graph:
1199  *
1200  * PA     PB
1201  *    \ /   \
1202  *     A     B     C
1203  *
1204  * by_parent_cb == true:  Test that parent callbacks don't poll
1205  *
1206  *     PA has a pending write request whose callback changes the child nodes of
1207  *     PB: It removes B and adds C instead. The subtree of PB is drained, which
1208  *     will indirectly drain the write request, too.
1209  *
1210  * by_parent_cb == false: Test that bdrv_drain_invoke() doesn't poll
1211  *
1212  *     PA's BdrvChildClass has a .drained_begin callback that schedules a BH
1213  *     that does the same graph change. If bdrv_drain_invoke() calls it, the
1214  *     state is messed up, but if it is only polled in the single
1215  *     BDRV_POLL_WHILE() at the end of the drain, this should work fine.
1216  */
1217 static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
1218 {
1219     BlockBackend *blk;
1220     BlockDriverState *parent_a, *parent_b, *a, *b, *c;
1221     BdrvChild *child_a, *child_b;
1222     BlockAIOCB *acb;
1223 
1224     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
1225 
1226     if (!by_parent_cb) {
1227         detach_by_driver_cb_class = child_of_bds;
1228         detach_by_driver_cb_class.drained_begin =
1229             detach_by_driver_cb_drained_begin;
1230         detach_by_driver_cb_class.drained_end = NULL;
1231         detach_by_driver_cb_class.drained_poll = NULL;
1232     }
1233 
1234     detach_by_parent_data = (struct detach_by_parent_data) {
1235         .detach_on_drain = false,
1236     };
1237 
1238     /* Create all involved nodes */
1239     parent_a = bdrv_new_open_driver(&bdrv_test, "parent-a", BDRV_O_RDWR,
1240                                     &error_abort);
1241     parent_b = bdrv_new_open_driver(&bdrv_test, "parent-b", 0,
1242                                     &error_abort);
1243 
1244     a = bdrv_new_open_driver(&bdrv_test, "a", BDRV_O_RDWR, &error_abort);
1245     b = bdrv_new_open_driver(&bdrv_test, "b", BDRV_O_RDWR, &error_abort);
1246     c = bdrv_new_open_driver(&bdrv_test, "c", BDRV_O_RDWR, &error_abort);
1247 
1248     /* blk is a BB for parent-a */
1249     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1250     blk_insert_bs(blk, parent_a, &error_abort);
1251     bdrv_unref(parent_a);
1252 
1253     /* If we want to get bdrv_drain_invoke() to call aio_poll(), the driver
1254      * callback must not return immediately. */
1255     if (!by_parent_cb) {
1256         BDRVTestState *s = parent_a->opaque;
1257         s->sleep_in_drain_begin = true;
1258     }
1259 
1260     /* Set child relationships */
1261     bdrv_ref(b);
1262     bdrv_ref(a);
1263     bdrv_graph_wrlock();
1264     child_b = bdrv_attach_child(parent_b, b, "PB-B", &child_of_bds,
1265                                 BDRV_CHILD_DATA, &error_abort);
1266     child_a = bdrv_attach_child(parent_b, a, "PB-A", &child_of_bds,
1267                                 BDRV_CHILD_COW, &error_abort);
1268 
1269     bdrv_ref(a);
1270     bdrv_attach_child(parent_a, a, "PA-A",
1271                       by_parent_cb ? &child_of_bds : &detach_by_driver_cb_class,
1272                       BDRV_CHILD_DATA, &error_abort);
1273     bdrv_graph_wrunlock();
1274 
1275     g_assert_cmpint(parent_a->refcnt, ==, 1);
1276     g_assert_cmpint(parent_b->refcnt, ==, 1);
1277     g_assert_cmpint(a->refcnt, ==, 3);
1278     g_assert_cmpint(b->refcnt, ==, 2);
1279     g_assert_cmpint(c->refcnt, ==, 1);
1280 
1281     g_assert(QLIST_FIRST(&parent_b->children) == child_a);
1282     g_assert(QLIST_NEXT(child_a, next) == child_b);
1283     g_assert(QLIST_NEXT(child_b, next) == NULL);
1284 
1285     /* Start the evil write request */
1286     detach_by_parent_data = (struct detach_by_parent_data) {
1287         .parent_b = parent_b,
1288         .child_b = child_b,
1289         .c = c,
1290         .by_parent_cb = by_parent_cb,
1291         .detach_on_drain = true,
1292     };
1293     acb = blk_aio_preadv(blk, 0, &qiov, 0, detach_by_parent_aio_cb, NULL);
1294     g_assert(acb != NULL);
1295 
1296     /* Drain and check the expected result */
1297     bdrv_drained_begin(parent_b);
1298     bdrv_drained_begin(a);
1299     bdrv_drained_begin(b);
1300     bdrv_drained_begin(c);
1301 
1302     g_assert(detach_by_parent_data.child_c != NULL);
1303 
1304     g_assert_cmpint(parent_a->refcnt, ==, 1);
1305     g_assert_cmpint(parent_b->refcnt, ==, 1);
1306     g_assert_cmpint(a->refcnt, ==, 3);
1307     g_assert_cmpint(b->refcnt, ==, 1);
1308     g_assert_cmpint(c->refcnt, ==, 2);
1309 
1310     g_assert(QLIST_FIRST(&parent_b->children) == detach_by_parent_data.child_c);
1311     g_assert(QLIST_NEXT(detach_by_parent_data.child_c, next) == child_a);
1312     g_assert(QLIST_NEXT(child_a, next) == NULL);
1313 
1314     g_assert_cmpint(parent_a->quiesce_counter, ==, 1);
1315     g_assert_cmpint(parent_b->quiesce_counter, ==, 3);
1316     g_assert_cmpint(a->quiesce_counter, ==, 1);
1317     g_assert_cmpint(b->quiesce_counter, ==, 1);
1318     g_assert_cmpint(c->quiesce_counter, ==, 1);
1319 
1320     bdrv_drained_end(parent_b);
1321     bdrv_drained_end(a);
1322     bdrv_drained_end(b);
1323     bdrv_drained_end(c);
1324 
1325     bdrv_unref(parent_b);
1326     blk_unref(blk);
1327 
1328     g_assert_cmpint(a->refcnt, ==, 1);
1329     g_assert_cmpint(b->refcnt, ==, 1);
1330     g_assert_cmpint(c->refcnt, ==, 1);
1331     bdrv_unref(a);
1332     bdrv_unref(b);
1333     bdrv_unref(c);
1334 }
1335 
1336 static void test_detach_by_parent_cb(void)
1337 {
1338     test_detach_indirect(true);
1339 }
1340 
1341 static void test_detach_by_driver_cb(void)
1342 {
1343     test_detach_indirect(false);
1344 }
1345 
1346 static void test_append_to_drained(void)
1347 {
1348     BlockBackend *blk;
1349     BlockDriverState *base, *overlay;
1350     BDRVTestState *base_s, *overlay_s;
1351 
1352     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1353     base = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
1354     base_s = base->opaque;
1355     blk_insert_bs(blk, base, &error_abort);
1356 
1357     overlay = bdrv_new_open_driver(&bdrv_test, "overlay", BDRV_O_RDWR,
1358                                    &error_abort);
1359     overlay_s = overlay->opaque;
1360 
1361     do_drain_begin(BDRV_DRAIN, base);
1362     g_assert_cmpint(base->quiesce_counter, ==, 1);
1363     g_assert_cmpint(base_s->drain_count, ==, 1);
1364     g_assert_cmpint(base->in_flight, ==, 0);
1365 
1366     bdrv_append(overlay, base, &error_abort);
1367 
1368     g_assert_cmpint(base->in_flight, ==, 0);
1369     g_assert_cmpint(overlay->in_flight, ==, 0);
1370 
1371     g_assert_cmpint(base->quiesce_counter, ==, 1);
1372     g_assert_cmpint(base_s->drain_count, ==, 1);
1373     g_assert_cmpint(overlay->quiesce_counter, ==, 1);
1374     g_assert_cmpint(overlay_s->drain_count, ==, 1);
1375 
1376     do_drain_end(BDRV_DRAIN, base);
1377 
1378     g_assert_cmpint(base->quiesce_counter, ==, 0);
1379     g_assert_cmpint(base_s->drain_count, ==, 0);
1380     g_assert_cmpint(overlay->quiesce_counter, ==, 0);
1381     g_assert_cmpint(overlay_s->drain_count, ==, 0);
1382 
1383     bdrv_unref(overlay);
1384     bdrv_unref(base);
1385     blk_unref(blk);
1386 }
1387 
1388 static void test_set_aio_context(void)
1389 {
1390     BlockDriverState *bs;
1391     IOThread *a = iothread_new();
1392     IOThread *b = iothread_new();
1393     AioContext *ctx_a = iothread_get_aio_context(a);
1394     AioContext *ctx_b = iothread_get_aio_context(b);
1395 
1396     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
1397                               &error_abort);
1398 
1399     bdrv_drained_begin(bs);
1400     bdrv_try_change_aio_context(bs, ctx_a, NULL, &error_abort);
1401     bdrv_drained_end(bs);
1402 
1403     bdrv_drained_begin(bs);
1404     bdrv_try_change_aio_context(bs, ctx_b, NULL, &error_abort);
1405     bdrv_try_change_aio_context(bs, qemu_get_aio_context(), NULL, &error_abort);
1406     bdrv_drained_end(bs);
1407 
1408     bdrv_unref(bs);
1409     iothread_join(a);
1410     iothread_join(b);
1411 }
1412 
1413 
1414 typedef struct TestDropBackingBlockJob {
1415     BlockJob common;
1416     bool *did_complete;
1417     BlockDriverState *detach_also;
1418     BlockDriverState *bs;
1419 
1420     /* Accessed with atomics */
1421     bool should_complete;
1422 } TestDropBackingBlockJob;
1423 
1424 static int coroutine_fn test_drop_backing_job_run(Job *job, Error **errp)
1425 {
1426     TestDropBackingBlockJob *s =
1427         container_of(job, TestDropBackingBlockJob, common.job);
1428 
1429     while (!qatomic_read(&s->should_complete)) {
1430         job_sleep_ns(job, 0);
1431     }
1432 
1433     return 0;
1434 }
1435 
1436 static void test_drop_backing_job_commit(Job *job)
1437 {
1438     TestDropBackingBlockJob *s =
1439         container_of(job, TestDropBackingBlockJob, common.job);
1440 
1441     bdrv_set_backing_hd(s->bs, NULL, &error_abort);
1442     bdrv_set_backing_hd(s->detach_also, NULL, &error_abort);
1443 
1444     *s->did_complete = true;
1445 }
1446 
1447 static const BlockJobDriver test_drop_backing_job_driver = {
1448     .job_driver = {
1449         .instance_size  = sizeof(TestDropBackingBlockJob),
1450         .free           = block_job_free,
1451         .user_resume    = block_job_user_resume,
1452         .run            = test_drop_backing_job_run,
1453         .commit         = test_drop_backing_job_commit,
1454     }
1455 };
1456 
1457 /**
1458  * Creates a child node with three parent nodes on it, and then runs a
1459  * block job on the final one, parent-node-2.
1460  *
1461  * The job is then asked to complete before a section where the child
1462  * is drained.
1463  *
1464  * Ending this section will undrain the child's parents, first
1465  * parent-node-2, then parent-node-1, then parent-node-0 -- the parent
1466  * list is in reverse order of how they were added.  Ending the drain
1467  * on parent-node-2 will resume the job, thus completing it and
1468  * scheduling job_exit().
1469  *
1470  * Ending the drain on parent-node-1 will poll the AioContext, which
1471  * lets job_exit() and thus test_drop_backing_job_commit() run.  That
1472  * function first removes the child as parent-node-2's backing file.
1473  *
1474  * In old (and buggy) implementations, there are two problems with
1475  * that:
1476  * (A) bdrv_drain_invoke() polls for every node that leaves the
1477  *     drained section.  This means that job_exit() is scheduled
1478  *     before the child has left the drained section.  Its
1479  *     quiesce_counter is therefore still 1 when it is removed from
1480  *     parent-node-2.
1481  *
1482  * (B) bdrv_replace_child_noperm() calls drained_end() on the old
1483  *     child's parents as many times as the child is quiesced.  This
1484  *     means it will call drained_end() on parent-node-2 once.
1485  *     Because parent-node-2 is no longer quiesced at this point, this
1486  *     will fail.
1487  *
1488  * bdrv_replace_child_noperm() therefore must call drained_end() on
1489  * the parent only if it really is still drained because the child is
1490  * drained.
1491  *
1492  * If removing child from parent-node-2 was successful (as it should
1493  * be), test_drop_backing_job_commit() will then also remove the child
1494  * from parent-node-0.
1495  *
1496  * With an old version of our drain infrastructure ((A) above), that
1497  * resulted in the following flow:
1498  *
1499  * 1. child attempts to leave its drained section.  The call recurses
1500  *    to its parents.
1501  *
1502  * 2. parent-node-2 leaves the drained section.  Polling in
1503  *    bdrv_drain_invoke() will schedule job_exit().
1504  *
1505  * 3. parent-node-1 leaves the drained section.  Polling in
1506  *    bdrv_drain_invoke() will run job_exit(), thus disconnecting
1507  *    parent-node-0 from the child node.
1508  *
1509  * 4. bdrv_parent_drained_end() uses a QLIST_FOREACH_SAFE() loop to
1510  *    iterate over the parents.  Thus, it now accesses the BdrvChild
1511  *    object that used to connect parent-node-0 and the child node.
1512  *    However, that object no longer exists, so it accesses a dangling
1513  *    pointer.
1514  *
1515  * The solution is to only poll once when running a bdrv_drained_end()
1516  * operation, specifically at the end when all drained_end()
1517  * operations for all involved nodes have been scheduled.
1518  * Note that this also solves (A) above, thus hiding (B).
1519  */
1520 static void test_blockjob_commit_by_drained_end(void)
1521 {
1522     BlockDriverState *bs_child, *bs_parents[3];
1523     TestDropBackingBlockJob *job;
1524     bool job_has_completed = false;
1525     int i;
1526 
1527     bs_child = bdrv_new_open_driver(&bdrv_test, "child-node", BDRV_O_RDWR,
1528                                     &error_abort);
1529 
1530     for (i = 0; i < 3; i++) {
1531         char name[32];
1532         snprintf(name, sizeof(name), "parent-node-%i", i);
1533         bs_parents[i] = bdrv_new_open_driver(&bdrv_test, name, BDRV_O_RDWR,
1534                                              &error_abort);
1535         bdrv_set_backing_hd(bs_parents[i], bs_child, &error_abort);
1536     }
1537 
1538     job = block_job_create("job", &test_drop_backing_job_driver, NULL,
1539                            bs_parents[2], 0, BLK_PERM_ALL, 0, 0, NULL, NULL,
1540                            &error_abort);
1541     job->bs = bs_parents[2];
1542 
1543     job->detach_also = bs_parents[0];
1544     job->did_complete = &job_has_completed;
1545 
1546     job_start(&job->common.job);
1547 
1548     qatomic_set(&job->should_complete, true);
1549     bdrv_drained_begin(bs_child);
1550     g_assert(!job_has_completed);
1551     bdrv_drained_end(bs_child);
1552     aio_poll(qemu_get_aio_context(), false);
1553     g_assert(job_has_completed);
1554 
1555     bdrv_unref(bs_parents[0]);
1556     bdrv_unref(bs_parents[1]);
1557     bdrv_unref(bs_parents[2]);
1558     bdrv_unref(bs_child);
1559 }
1560 
1561 
1562 typedef struct TestSimpleBlockJob {
1563     BlockJob common;
1564     bool *did_complete;
1565 
1566     /* Accessed with atomics */
1567     bool should_complete;
1568 } TestSimpleBlockJob;
1569 
1570 static int coroutine_fn test_simple_job_run(Job *job, Error **errp)
1571 {
1572     TestSimpleBlockJob *s = container_of(job, TestSimpleBlockJob, common.job);
1573 
1574     while (!qatomic_read(&s->should_complete)) {
1575         job_sleep_ns(job, 0);
1576     }
1577 
1578     return 0;
1579 }
1580 
1581 static void test_simple_job_clean(Job *job)
1582 {
1583     TestSimpleBlockJob *s = container_of(job, TestSimpleBlockJob, common.job);
1584     *s->did_complete = true;
1585 }
1586 
1587 static const BlockJobDriver test_simple_job_driver = {
1588     .job_driver = {
1589         .instance_size  = sizeof(TestSimpleBlockJob),
1590         .free           = block_job_free,
1591         .user_resume    = block_job_user_resume,
1592         .run            = test_simple_job_run,
1593         .clean          = test_simple_job_clean,
1594     },
1595 };
1596 
1597 static int drop_intermediate_poll_update_filename(BdrvChild *child,
1598                                                   BlockDriverState *new_base,
1599                                                   const char *filename,
1600                                                   bool backing_mask_protocol,
1601                                                   Error **errp)
1602 {
1603     /*
1604      * We are free to poll here, which may change the block graph, if
1605      * it is not drained.
1606      */
1607 
1608     /* If the job is not drained: Complete it, schedule job_exit() */
1609     aio_poll(qemu_get_current_aio_context(), false);
1610     /* If the job is not drained: Run job_exit(), finish the job */
1611     aio_poll(qemu_get_current_aio_context(), false);
1612 
1613     return 0;
1614 }
1615 
1616 /**
1617  * Test a poll in the midst of bdrv_drop_intermediate().
1618  *
1619  * bdrv_drop_intermediate() calls BdrvChildClass.update_filename(),
1620  * which can yield or poll.  This may lead to graph changes, unless
1621  * the whole subtree in question is drained.
1622  *
1623  * We test this on the following graph:
1624  *
1625  *                    Job
1626  *
1627  *                     |
1628  *                  job-node
1629  *                     |
1630  *                     v
1631  *
1632  *                  job-node
1633  *
1634  *                     |
1635  *                  backing
1636  *                     |
1637  *                     v
1638  *
1639  * node-2 --chain--> node-1 --chain--> node-0
1640  *
1641  * We drop node-1 with bdrv_drop_intermediate(top=node-1, base=node-0).
1642  *
1643  * This first updates node-2's backing filename by invoking
1644  * drop_intermediate_poll_update_filename(), which polls twice.  This
1645  * causes the job to finish, which in turns causes the job-node to be
1646  * deleted.
1647  *
1648  * bdrv_drop_intermediate() uses a QLIST_FOREACH_SAFE() loop, so it
1649  * already has a pointer to the BdrvChild edge between job-node and
1650  * node-1.  When it tries to handle that edge, we probably get a
1651  * segmentation fault because the object no longer exists.
1652  *
1653  *
1654  * The solution is for bdrv_drop_intermediate() to drain top's
1655  * subtree.  This prevents graph changes from happening just because
1656  * BdrvChildClass.update_filename() yields or polls.  Thus, the block
1657  * job is paused during that drained section and must finish before or
1658  * after.
1659  *
1660  * (In addition, bdrv_replace_child() must keep the job paused.)
1661  */
1662 static void test_drop_intermediate_poll(void)
1663 {
1664     static BdrvChildClass chain_child_class;
1665     BlockDriverState *chain[3];
1666     TestSimpleBlockJob *job;
1667     BlockDriverState *job_node;
1668     bool job_has_completed = false;
1669     int i;
1670     int ret;
1671 
1672     chain_child_class = child_of_bds;
1673     chain_child_class.update_filename = drop_intermediate_poll_update_filename;
1674 
1675     for (i = 0; i < 3; i++) {
1676         char name[32];
1677         snprintf(name, 32, "node-%i", i);
1678 
1679         chain[i] = bdrv_new_open_driver(&bdrv_test, name, 0, &error_abort);
1680     }
1681 
1682     job_node = bdrv_new_open_driver(&bdrv_test, "job-node", BDRV_O_RDWR,
1683                                     &error_abort);
1684     bdrv_set_backing_hd(job_node, chain[1], &error_abort);
1685 
1686     /*
1687      * Establish the chain last, so the chain links are the first
1688      * elements in the BDS.parents lists
1689      */
1690     bdrv_graph_wrlock();
1691     for (i = 0; i < 3; i++) {
1692         if (i) {
1693             /* Takes the reference to chain[i - 1] */
1694             bdrv_attach_child(chain[i], chain[i - 1], "chain",
1695                               &chain_child_class, BDRV_CHILD_COW, &error_abort);
1696         }
1697     }
1698     bdrv_graph_wrunlock();
1699 
1700     job = block_job_create("job", &test_simple_job_driver, NULL, job_node,
1701                            0, BLK_PERM_ALL, 0, 0, NULL, NULL, &error_abort);
1702 
1703     /* The job has a reference now */
1704     bdrv_unref(job_node);
1705 
1706     job->did_complete = &job_has_completed;
1707 
1708     job_start(&job->common.job);
1709     qatomic_set(&job->should_complete, true);
1710 
1711     g_assert(!job_has_completed);
1712     ret = bdrv_drop_intermediate(chain[1], chain[0], NULL, false);
1713     aio_poll(qemu_get_aio_context(), false);
1714     g_assert(ret == 0);
1715     g_assert(job_has_completed);
1716 
1717     bdrv_unref(chain[2]);
1718 }
1719 
1720 
1721 typedef struct BDRVReplaceTestState {
1722     bool setup_completed;
1723     bool was_drained;
1724     bool was_undrained;
1725     bool has_read;
1726 
1727     int drain_count;
1728 
1729     bool yield_before_read;
1730     Coroutine *io_co;
1731     Coroutine *drain_co;
1732 } BDRVReplaceTestState;
1733 
1734 static void bdrv_replace_test_close(BlockDriverState *bs)
1735 {
1736 }
1737 
1738 /**
1739  * If @bs has a backing file:
1740  *   Yield if .yield_before_read is true (and wait for drain_begin to
1741  *   wake us up).
1742  *   Forward the read to bs->backing.  Set .has_read to true.
1743  *   If drain_begin has woken us, wake it in turn.
1744  *
1745  * Otherwise:
1746  *   Set .has_read to true and return success.
1747  */
1748 static int coroutine_fn GRAPH_RDLOCK
1749 bdrv_replace_test_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
1750                             QEMUIOVector *qiov, BdrvRequestFlags flags)
1751 {
1752     BDRVReplaceTestState *s = bs->opaque;
1753 
1754     if (bs->backing) {
1755         int ret;
1756 
1757         g_assert(!s->drain_count);
1758 
1759         s->io_co = qemu_coroutine_self();
1760         if (s->yield_before_read) {
1761             s->yield_before_read = false;
1762             qemu_coroutine_yield();
1763         }
1764         s->io_co = NULL;
1765 
1766         ret = bdrv_co_preadv(bs->backing, offset, bytes, qiov, 0);
1767         s->has_read = true;
1768 
1769         /* Wake up drain_co if it runs */
1770         if (s->drain_co) {
1771             aio_co_wake(s->drain_co);
1772         }
1773 
1774         return ret;
1775     }
1776 
1777     s->has_read = true;
1778     return 0;
1779 }
1780 
1781 static void coroutine_fn bdrv_replace_test_drain_co(void *opaque)
1782 {
1783     BlockDriverState *bs = opaque;
1784     BDRVReplaceTestState *s = bs->opaque;
1785 
1786     /* Keep waking io_co up until it is done */
1787     while (s->io_co) {
1788         aio_co_wake(s->io_co);
1789         s->io_co = NULL;
1790         qemu_coroutine_yield();
1791     }
1792     s->drain_co = NULL;
1793     bdrv_dec_in_flight(bs);
1794 }
1795 
1796 /**
1797  * If .drain_count is 0, wake up .io_co if there is one; and set
1798  * .was_drained.
1799  * Increment .drain_count.
1800  */
1801 static void bdrv_replace_test_drain_begin(BlockDriverState *bs)
1802 {
1803     BDRVReplaceTestState *s = bs->opaque;
1804 
1805     if (!s->setup_completed) {
1806         return;
1807     }
1808 
1809     if (!s->drain_count) {
1810         s->drain_co = qemu_coroutine_create(bdrv_replace_test_drain_co, bs);
1811         bdrv_inc_in_flight(bs);
1812         aio_co_enter(bdrv_get_aio_context(bs), s->drain_co);
1813         s->was_drained = true;
1814     }
1815     s->drain_count++;
1816 }
1817 
1818 static void coroutine_fn bdrv_replace_test_read_entry(void *opaque)
1819 {
1820     BlockDriverState *bs = opaque;
1821     char data;
1822     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, &data, 1);
1823     int ret;
1824 
1825     /* Queue a read request post-drain */
1826     bdrv_graph_co_rdlock();
1827     ret = bdrv_replace_test_co_preadv(bs, 0, 1, &qiov, 0);
1828     bdrv_graph_co_rdunlock();
1829 
1830     g_assert(ret >= 0);
1831     bdrv_dec_in_flight(bs);
1832 }
1833 
1834 /**
1835  * Reduce .drain_count, set .was_undrained once it reaches 0.
1836  * If .drain_count reaches 0 and the node has a backing file, issue a
1837  * read request.
1838  */
1839 static void bdrv_replace_test_drain_end(BlockDriverState *bs)
1840 {
1841     BDRVReplaceTestState *s = bs->opaque;
1842 
1843     GRAPH_RDLOCK_GUARD_MAINLOOP();
1844 
1845     if (!s->setup_completed) {
1846         return;
1847     }
1848 
1849     g_assert(s->drain_count > 0);
1850     if (!--s->drain_count) {
1851         s->was_undrained = true;
1852 
1853         if (bs->backing) {
1854             Coroutine *co = qemu_coroutine_create(bdrv_replace_test_read_entry,
1855                                                   bs);
1856             bdrv_inc_in_flight(bs);
1857             aio_co_enter(bdrv_get_aio_context(bs), co);
1858         }
1859     }
1860 }
1861 
1862 static BlockDriver bdrv_replace_test = {
1863     .format_name            = "replace_test",
1864     .instance_size          = sizeof(BDRVReplaceTestState),
1865     .supports_backing       = true,
1866 
1867     .bdrv_close             = bdrv_replace_test_close,
1868     .bdrv_co_preadv         = bdrv_replace_test_co_preadv,
1869 
1870     .bdrv_drain_begin       = bdrv_replace_test_drain_begin,
1871     .bdrv_drain_end         = bdrv_replace_test_drain_end,
1872 
1873     .bdrv_child_perm        = bdrv_default_perms,
1874 };
1875 
1876 static void coroutine_fn test_replace_child_mid_drain_read_co(void *opaque)
1877 {
1878     int ret;
1879     char data;
1880 
1881     ret = blk_co_pread(opaque, 0, 1, &data, 0);
1882     g_assert(ret >= 0);
1883 }
1884 
1885 /**
1886  * We test two things:
1887  * (1) bdrv_replace_child_noperm() must not undrain the parent if both
1888  *     children are drained.
1889  * (2) bdrv_replace_child_noperm() must never flush I/O requests to a
1890  *     drained child.  If the old child is drained, it must flush I/O
1891  *     requests after the new one has been attached.  If the new child
1892  *     is drained, it must flush I/O requests before the old one is
1893  *     detached.
1894  *
1895  * To do so, we create one parent node and two child nodes; then
1896  * attach one of the children (old_child_bs) to the parent, then
1897  * drain both old_child_bs and new_child_bs according to
1898  * old_drain_count and new_drain_count, respectively, and finally
1899  * we invoke bdrv_replace_node() to replace old_child_bs by
1900  * new_child_bs.
1901  *
1902  * The test block driver we use here (bdrv_replace_test) has a read
1903  * function that:
1904  * - For the parent node, can optionally yield, and then forwards the
1905  *   read to bdrv_preadv(),
1906  * - For the child node, just returns immediately.
1907  *
1908  * If the read yields, the drain_begin function will wake it up.
1909  *
1910  * The drain_end function issues a read on the parent once it is fully
1911  * undrained (which simulates requests starting to come in again).
1912  */
1913 static void do_test_replace_child_mid_drain(int old_drain_count,
1914                                             int new_drain_count)
1915 {
1916     BlockBackend *parent_blk;
1917     BlockDriverState *parent_bs;
1918     BlockDriverState *old_child_bs, *new_child_bs;
1919     BDRVReplaceTestState *parent_s;
1920     BDRVReplaceTestState *old_child_s, *new_child_s;
1921     Coroutine *io_co;
1922     int i;
1923 
1924     parent_bs = bdrv_new_open_driver(&bdrv_replace_test, "parent", 0,
1925                                      &error_abort);
1926     parent_s = parent_bs->opaque;
1927 
1928     parent_blk = blk_new(qemu_get_aio_context(),
1929                          BLK_PERM_CONSISTENT_READ, BLK_PERM_ALL);
1930     blk_insert_bs(parent_blk, parent_bs, &error_abort);
1931 
1932     old_child_bs = bdrv_new_open_driver(&bdrv_replace_test, "old-child", 0,
1933                                         &error_abort);
1934     new_child_bs = bdrv_new_open_driver(&bdrv_replace_test, "new-child", 0,
1935                                         &error_abort);
1936     old_child_s = old_child_bs->opaque;
1937     new_child_s = new_child_bs->opaque;
1938 
1939     /* So that we can read something */
1940     parent_bs->total_sectors = 1;
1941     old_child_bs->total_sectors = 1;
1942     new_child_bs->total_sectors = 1;
1943 
1944     bdrv_ref(old_child_bs);
1945     bdrv_graph_wrlock();
1946     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
1947                       BDRV_CHILD_COW, &error_abort);
1948     bdrv_graph_wrunlock();
1949     parent_s->setup_completed = true;
1950 
1951     for (i = 0; i < old_drain_count; i++) {
1952         bdrv_drained_begin(old_child_bs);
1953     }
1954     for (i = 0; i < new_drain_count; i++) {
1955         bdrv_drained_begin(new_child_bs);
1956     }
1957 
1958     if (!old_drain_count) {
1959         /*
1960          * Start a read operation that will yield, so it will not
1961          * complete before the node is drained.
1962          */
1963         parent_s->yield_before_read = true;
1964         io_co = qemu_coroutine_create(test_replace_child_mid_drain_read_co,
1965                                       parent_blk);
1966         qemu_coroutine_enter(io_co);
1967     }
1968 
1969     /* If we have started a read operation, it should have yielded */
1970     g_assert(!parent_s->has_read);
1971 
1972     /* Reset drained status so we can see what bdrv_replace_node() does */
1973     parent_s->was_drained = false;
1974     parent_s->was_undrained = false;
1975 
1976     g_assert(parent_bs->quiesce_counter == old_drain_count);
1977     bdrv_drained_begin(old_child_bs);
1978     bdrv_drained_begin(new_child_bs);
1979     bdrv_graph_wrlock();
1980     bdrv_replace_node(old_child_bs, new_child_bs, &error_abort);
1981     bdrv_graph_wrunlock();
1982     bdrv_drained_end(new_child_bs);
1983     bdrv_drained_end(old_child_bs);
1984     g_assert(parent_bs->quiesce_counter == new_drain_count);
1985 
1986     if (!old_drain_count && !new_drain_count) {
1987         /*
1988          * From undrained to undrained drains and undrains the parent,
1989          * because bdrv_replace_node() contains a drained section for
1990          * @old_child_bs.
1991          */
1992         g_assert(parent_s->was_drained && parent_s->was_undrained);
1993     } else if (!old_drain_count && new_drain_count) {
1994         /*
1995          * From undrained to drained should drain the parent and keep
1996          * it that way.
1997          */
1998         g_assert(parent_s->was_drained && !parent_s->was_undrained);
1999     } else if (old_drain_count && !new_drain_count) {
2000         /*
2001          * From drained to undrained should undrain the parent and
2002          * keep it that way.
2003          */
2004         g_assert(!parent_s->was_drained && parent_s->was_undrained);
2005     } else /* if (old_drain_count && new_drain_count) */ {
2006         /*
2007          * From drained to drained must not undrain the parent at any
2008          * point
2009          */
2010         g_assert(!parent_s->was_drained && !parent_s->was_undrained);
2011     }
2012 
2013     if (!old_drain_count || !new_drain_count) {
2014         /*
2015          * If !old_drain_count, we have started a read request before
2016          * bdrv_replace_node().  If !new_drain_count, the parent must
2017          * have been undrained at some point, and
2018          * bdrv_replace_test_co_drain_end() starts a read request
2019          * then.
2020          */
2021         g_assert(parent_s->has_read);
2022     } else {
2023         /*
2024          * If the parent was never undrained, there is no way to start
2025          * a read request.
2026          */
2027         g_assert(!parent_s->has_read);
2028     }
2029 
2030     /* A drained child must have not received any request */
2031     g_assert(!(old_drain_count && old_child_s->has_read));
2032     g_assert(!(new_drain_count && new_child_s->has_read));
2033 
2034     for (i = 0; i < new_drain_count; i++) {
2035         bdrv_drained_end(new_child_bs);
2036     }
2037     for (i = 0; i < old_drain_count; i++) {
2038         bdrv_drained_end(old_child_bs);
2039     }
2040 
2041     /*
2042      * By now, bdrv_replace_test_co_drain_end() must have been called
2043      * at some point while the new child was attached to the parent.
2044      */
2045     g_assert(parent_s->has_read);
2046     g_assert(new_child_s->has_read);
2047 
2048     blk_unref(parent_blk);
2049     bdrv_unref(parent_bs);
2050     bdrv_unref(old_child_bs);
2051     bdrv_unref(new_child_bs);
2052 }
2053 
2054 static void test_replace_child_mid_drain(void)
2055 {
2056     int old_drain_count, new_drain_count;
2057 
2058     for (old_drain_count = 0; old_drain_count < 2; old_drain_count++) {
2059         for (new_drain_count = 0; new_drain_count < 2; new_drain_count++) {
2060             do_test_replace_child_mid_drain(old_drain_count, new_drain_count);
2061         }
2062     }
2063 }
2064 
2065 int main(int argc, char **argv)
2066 {
2067     int ret;
2068 
2069     bdrv_init();
2070     qemu_init_main_loop(&error_abort);
2071 
2072     g_test_init(&argc, &argv, NULL);
2073     qemu_event_init(&done_event, false);
2074 
2075     g_test_add_func("/bdrv-drain/driver-cb/drain_all", test_drv_cb_drain_all);
2076     g_test_add_func("/bdrv-drain/driver-cb/drain", test_drv_cb_drain);
2077 
2078     g_test_add_func("/bdrv-drain/driver-cb/co/drain_all",
2079                     test_drv_cb_co_drain_all);
2080     g_test_add_func("/bdrv-drain/driver-cb/co/drain", test_drv_cb_co_drain);
2081 
2082     g_test_add_func("/bdrv-drain/quiesce/drain_all", test_quiesce_drain_all);
2083     g_test_add_func("/bdrv-drain/quiesce/drain", test_quiesce_drain);
2084 
2085     g_test_add_func("/bdrv-drain/quiesce/co/drain_all",
2086                     test_quiesce_co_drain_all);
2087     g_test_add_func("/bdrv-drain/quiesce/co/drain", test_quiesce_co_drain);
2088 
2089     g_test_add_func("/bdrv-drain/nested", test_nested);
2090 
2091     g_test_add_func("/bdrv-drain/graph-change/drain_all",
2092                     test_graph_change_drain_all);
2093 
2094     g_test_add_func("/bdrv-drain/iothread/drain_all", test_iothread_drain_all);
2095     g_test_add_func("/bdrv-drain/iothread/drain", test_iothread_drain);
2096 
2097     g_test_add_func("/bdrv-drain/blockjob/drain_all", test_blockjob_drain_all);
2098     g_test_add_func("/bdrv-drain/blockjob/drain", test_blockjob_drain);
2099 
2100     g_test_add_func("/bdrv-drain/blockjob/error/drain_all",
2101                     test_blockjob_error_drain_all);
2102     g_test_add_func("/bdrv-drain/blockjob/error/drain",
2103                     test_blockjob_error_drain);
2104 
2105     g_test_add_func("/bdrv-drain/blockjob/iothread/drain_all",
2106                     test_blockjob_iothread_drain_all);
2107     g_test_add_func("/bdrv-drain/blockjob/iothread/drain",
2108                     test_blockjob_iothread_drain);
2109 
2110     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain_all",
2111                     test_blockjob_iothread_error_drain_all);
2112     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain",
2113                     test_blockjob_iothread_error_drain);
2114 
2115     g_test_add_func("/bdrv-drain/deletion/drain", test_delete_by_drain);
2116     g_test_add_func("/bdrv-drain/detach/drain_all", test_detach_by_drain_all);
2117     g_test_add_func("/bdrv-drain/detach/drain", test_detach_by_drain);
2118     g_test_add_func("/bdrv-drain/detach/parent_cb", test_detach_by_parent_cb);
2119     g_test_add_func("/bdrv-drain/detach/driver_cb", test_detach_by_driver_cb);
2120 
2121     g_test_add_func("/bdrv-drain/attach/drain", test_append_to_drained);
2122 
2123     g_test_add_func("/bdrv-drain/set_aio_context", test_set_aio_context);
2124 
2125     g_test_add_func("/bdrv-drain/blockjob/commit_by_drained_end",
2126                     test_blockjob_commit_by_drained_end);
2127 
2128     g_test_add_func("/bdrv-drain/bdrv_drop_intermediate/poll",
2129                     test_drop_intermediate_poll);
2130 
2131     g_test_add_func("/bdrv-drain/replace_child/mid-drain",
2132                     test_replace_child_mid_drain);
2133 
2134     ret = g_test_run();
2135     qemu_event_destroy(&done_event);
2136     return ret;
2137 }
2138