xref: /qemu/tests/unit/test-bdrv-drain.c (revision 70ce076fa6dff60585c229a4b641b13e64bf03cf)
1 /*
2  * Block node draining tests
3  *
4  * Copyright (c) 2017 Kevin Wolf <kwolf@redhat.com>
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "block/block_int.h"
27 #include "block/blockjob_int.h"
28 #include "system/block-backend.h"
29 #include "qapi/error.h"
30 #include "qemu/main-loop.h"
31 #include "qemu/clang-tsa.h"
32 #include "iothread.h"
33 
34 static QemuEvent done_event;
35 
36 typedef struct BDRVTestState {
37     int drain_count;
38     AioContext *bh_indirection_ctx;
39     bool sleep_in_drain_begin;
40 } BDRVTestState;
41 
42 static void coroutine_fn sleep_in_drain_begin(void *opaque)
43 {
44     BlockDriverState *bs = opaque;
45 
46     qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
47     bdrv_dec_in_flight(bs);
48 }
49 
50 static void bdrv_test_drain_begin(BlockDriverState *bs)
51 {
52     BDRVTestState *s = bs->opaque;
53     s->drain_count++;
54     if (s->sleep_in_drain_begin) {
55         Coroutine *co = qemu_coroutine_create(sleep_in_drain_begin, bs);
56         bdrv_inc_in_flight(bs);
57         aio_co_enter(bdrv_get_aio_context(bs), co);
58     }
59 }
60 
61 static void bdrv_test_drain_end(BlockDriverState *bs)
62 {
63     BDRVTestState *s = bs->opaque;
64     s->drain_count--;
65 }
66 
67 static void bdrv_test_close(BlockDriverState *bs)
68 {
69     BDRVTestState *s = bs->opaque;
70     g_assert_cmpint(s->drain_count, >, 0);
71 }
72 
73 static void co_reenter_bh(void *opaque)
74 {
75     aio_co_wake(opaque);
76 }
77 
78 static int coroutine_fn bdrv_test_co_preadv(BlockDriverState *bs,
79                                             int64_t offset, int64_t bytes,
80                                             QEMUIOVector *qiov,
81                                             BdrvRequestFlags flags)
82 {
83     BDRVTestState *s = bs->opaque;
84 
85     /* We want this request to stay until the polling loop in drain waits for
86      * it to complete. We need to sleep a while as bdrv_drain_invoke() comes
87      * first and polls its result, too, but it shouldn't accidentally complete
88      * this request yet. */
89     qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
90 
91     if (s->bh_indirection_ctx) {
92         aio_bh_schedule_oneshot(s->bh_indirection_ctx, co_reenter_bh,
93                                 qemu_coroutine_self());
94         qemu_coroutine_yield();
95     }
96 
97     return 0;
98 }
99 
100 static int bdrv_test_co_change_backing_file(BlockDriverState *bs,
101                                             const char *backing_file,
102                                             const char *backing_fmt)
103 {
104     return 0;
105 }
106 
107 static BlockDriver bdrv_test = {
108     .format_name            = "test",
109     .instance_size          = sizeof(BDRVTestState),
110     .supports_backing       = true,
111 
112     .bdrv_close             = bdrv_test_close,
113     .bdrv_co_preadv         = bdrv_test_co_preadv,
114 
115     .bdrv_drain_begin       = bdrv_test_drain_begin,
116     .bdrv_drain_end         = bdrv_test_drain_end,
117 
118     .bdrv_child_perm        = bdrv_default_perms,
119 
120     .bdrv_co_change_backing_file = bdrv_test_co_change_backing_file,
121 };
122 
123 static void aio_ret_cb(void *opaque, int ret)
124 {
125     int *aio_ret = opaque;
126     *aio_ret = ret;
127 }
128 
129 typedef struct CallInCoroutineData {
130     void (*entry)(void);
131     bool done;
132 } CallInCoroutineData;
133 
134 static coroutine_fn void call_in_coroutine_entry(void *opaque)
135 {
136     CallInCoroutineData *data = opaque;
137 
138     data->entry();
139     data->done = true;
140 }
141 
142 static void call_in_coroutine(void (*entry)(void))
143 {
144     Coroutine *co;
145     CallInCoroutineData data = {
146         .entry  = entry,
147         .done   = false,
148     };
149 
150     co = qemu_coroutine_create(call_in_coroutine_entry, &data);
151     qemu_coroutine_enter(co);
152     while (!data.done) {
153         aio_poll(qemu_get_aio_context(), true);
154     }
155 }
156 
157 enum drain_type {
158     BDRV_DRAIN_ALL,
159     BDRV_DRAIN,
160     DRAIN_TYPE_MAX,
161 };
162 
163 static void do_drain_begin(enum drain_type drain_type, BlockDriverState *bs)
164 {
165     switch (drain_type) {
166     case BDRV_DRAIN_ALL:        bdrv_drain_all_begin(); break;
167     case BDRV_DRAIN:            bdrv_drained_begin(bs); break;
168     default:                    g_assert_not_reached();
169     }
170 }
171 
172 static void do_drain_end(enum drain_type drain_type, BlockDriverState *bs)
173 {
174     switch (drain_type) {
175     case BDRV_DRAIN_ALL:        bdrv_drain_all_end(); break;
176     case BDRV_DRAIN:            bdrv_drained_end(bs); break;
177     default:                    g_assert_not_reached();
178     }
179 }
180 
181 static void do_drain_begin_unlocked(enum drain_type drain_type, BlockDriverState *bs)
182 {
183     do_drain_begin(drain_type, bs);
184 }
185 
186 static BlockBackend * no_coroutine_fn test_setup(void)
187 {
188     BlockBackend *blk;
189     BlockDriverState *bs, *backing;
190 
191     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
192     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
193                               &error_abort);
194     blk_insert_bs(blk, bs, &error_abort);
195 
196     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
197     bdrv_set_backing_hd(bs, backing, &error_abort);
198 
199     bdrv_unref(backing);
200     bdrv_unref(bs);
201 
202     return blk;
203 }
204 
205 static void do_drain_end_unlocked(enum drain_type drain_type, BlockDriverState *bs)
206 {
207     do_drain_end(drain_type, bs);
208 }
209 
210 /*
211  * Locking the block graph would be a bit cumbersome here because this function
212  * is called both in coroutine and non-coroutine context. We know this is a test
213  * and nothing else is running, so don't bother with TSA.
214  */
215 static void coroutine_mixed_fn TSA_NO_TSA
216 test_drv_cb_common(BlockBackend *blk, enum drain_type drain_type,
217                    bool recursive)
218 {
219     BlockDriverState *bs = blk_bs(blk);
220     BlockDriverState *backing = bs->backing->bs;
221     BDRVTestState *s, *backing_s;
222     BlockAIOCB *acb;
223     int aio_ret;
224 
225     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
226 
227     s = bs->opaque;
228     backing_s = backing->opaque;
229 
230     /* Simple bdrv_drain_all_begin/end pair, check that CBs are called */
231     g_assert_cmpint(s->drain_count, ==, 0);
232     g_assert_cmpint(backing_s->drain_count, ==, 0);
233 
234     do_drain_begin(drain_type, bs);
235 
236     g_assert_cmpint(s->drain_count, ==, 1);
237     g_assert_cmpint(backing_s->drain_count, ==, !!recursive);
238 
239     do_drain_end(drain_type, bs);
240 
241     g_assert_cmpint(s->drain_count, ==, 0);
242     g_assert_cmpint(backing_s->drain_count, ==, 0);
243 
244     /* Now do the same while a request is pending */
245     aio_ret = -EINPROGRESS;
246     acb = blk_aio_preadv(blk, 0, &qiov, 0, aio_ret_cb, &aio_ret);
247     g_assert(acb != NULL);
248     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
249 
250     g_assert_cmpint(s->drain_count, ==, 0);
251     g_assert_cmpint(backing_s->drain_count, ==, 0);
252 
253     do_drain_begin(drain_type, bs);
254 
255     g_assert_cmpint(aio_ret, ==, 0);
256     g_assert_cmpint(s->drain_count, ==, 1);
257     g_assert_cmpint(backing_s->drain_count, ==, !!recursive);
258 
259     do_drain_end(drain_type, bs);
260 
261     g_assert_cmpint(s->drain_count, ==, 0);
262     g_assert_cmpint(backing_s->drain_count, ==, 0);
263 }
264 
265 static void test_drv_cb_drain_all(void)
266 {
267     BlockBackend *blk = test_setup();
268     test_drv_cb_common(blk, BDRV_DRAIN_ALL, true);
269     blk_unref(blk);
270 }
271 
272 static void test_drv_cb_drain(void)
273 {
274     BlockBackend *blk = test_setup();
275     test_drv_cb_common(blk, BDRV_DRAIN, false);
276     blk_unref(blk);
277 }
278 
279 static void coroutine_fn test_drv_cb_co_drain_all_entry(void)
280 {
281     BlockBackend *blk = blk_all_next(NULL);
282     test_drv_cb_common(blk, BDRV_DRAIN_ALL, true);
283 }
284 
285 static void test_drv_cb_co_drain_all(void)
286 {
287     BlockBackend *blk = test_setup();
288     call_in_coroutine(test_drv_cb_co_drain_all_entry);
289     blk_unref(blk);
290 }
291 
292 static void coroutine_fn test_drv_cb_co_drain_entry(void)
293 {
294     BlockBackend *blk = blk_all_next(NULL);
295     test_drv_cb_common(blk, BDRV_DRAIN, false);
296 }
297 
298 static void test_drv_cb_co_drain(void)
299 {
300     BlockBackend *blk = test_setup();
301     call_in_coroutine(test_drv_cb_co_drain_entry);
302     blk_unref(blk);
303 }
304 
305 /*
306  * Locking the block graph would be a bit cumbersome here because this function
307  * is called both in coroutine and non-coroutine context. We know this is a test
308  * and nothing else is running, so don't bother with TSA.
309  */
310 static void coroutine_mixed_fn TSA_NO_TSA
311 test_quiesce_common(BlockBackend *blk, enum drain_type drain_type,
312                     bool recursive)
313 {
314     BlockDriverState *bs = blk_bs(blk);
315     BlockDriverState *backing = bs->backing->bs;
316 
317     g_assert_cmpint(bs->quiesce_counter, ==, 0);
318     g_assert_cmpint(backing->quiesce_counter, ==, 0);
319 
320     do_drain_begin(drain_type, bs);
321 
322     if (drain_type == BDRV_DRAIN_ALL) {
323         g_assert_cmpint(bs->quiesce_counter, ==, 2);
324     } else {
325         g_assert_cmpint(bs->quiesce_counter, ==, 1);
326     }
327     g_assert_cmpint(backing->quiesce_counter, ==, !!recursive);
328 
329     do_drain_end(drain_type, bs);
330 
331     g_assert_cmpint(bs->quiesce_counter, ==, 0);
332     g_assert_cmpint(backing->quiesce_counter, ==, 0);
333 }
334 
335 static void test_quiesce_drain_all(void)
336 {
337     BlockBackend *blk = test_setup();
338     test_quiesce_common(blk, BDRV_DRAIN_ALL, true);
339     blk_unref(blk);
340 }
341 
342 static void test_quiesce_drain(void)
343 {
344     BlockBackend *blk = test_setup();
345     test_quiesce_common(blk, BDRV_DRAIN, false);
346     blk_unref(blk);
347 }
348 
349 static void coroutine_fn test_quiesce_co_drain_all_entry(void)
350 {
351     BlockBackend *blk = blk_all_next(NULL);
352     test_quiesce_common(blk, BDRV_DRAIN_ALL, true);
353 }
354 
355 static void test_quiesce_co_drain_all(void)
356 {
357     BlockBackend *blk = test_setup();
358     call_in_coroutine(test_quiesce_co_drain_all_entry);
359     blk_unref(blk);
360 }
361 
362 static void coroutine_fn test_quiesce_co_drain_entry(void)
363 {
364     BlockBackend *blk = blk_all_next(NULL);
365     test_quiesce_common(blk, BDRV_DRAIN, false);
366 }
367 
368 static void test_quiesce_co_drain(void)
369 {
370     BlockBackend *blk = test_setup();
371     call_in_coroutine(test_quiesce_co_drain_entry);
372     blk_unref(blk);
373 }
374 
375 static void test_nested(void)
376 {
377     BlockBackend *blk;
378     BlockDriverState *bs, *backing;
379     BDRVTestState *s, *backing_s;
380     enum drain_type outer, inner;
381 
382     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
383     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
384                               &error_abort);
385     s = bs->opaque;
386     blk_insert_bs(blk, bs, &error_abort);
387 
388     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
389     backing_s = backing->opaque;
390     bdrv_set_backing_hd(bs, backing, &error_abort);
391 
392     for (outer = 0; outer < DRAIN_TYPE_MAX; outer++) {
393         for (inner = 0; inner < DRAIN_TYPE_MAX; inner++) {
394             int backing_quiesce = (outer == BDRV_DRAIN_ALL) +
395                                   (inner == BDRV_DRAIN_ALL);
396 
397             g_assert_cmpint(bs->quiesce_counter, ==, 0);
398             g_assert_cmpint(backing->quiesce_counter, ==, 0);
399             g_assert_cmpint(s->drain_count, ==, 0);
400             g_assert_cmpint(backing_s->drain_count, ==, 0);
401 
402             do_drain_begin(outer, bs);
403             do_drain_begin(inner, bs);
404 
405             g_assert_cmpint(bs->quiesce_counter, ==, 2 + !!backing_quiesce);
406             g_assert_cmpint(backing->quiesce_counter, ==, backing_quiesce);
407             g_assert_cmpint(s->drain_count, ==, 1);
408             g_assert_cmpint(backing_s->drain_count, ==, !!backing_quiesce);
409 
410             do_drain_end(inner, bs);
411             do_drain_end(outer, bs);
412 
413             g_assert_cmpint(bs->quiesce_counter, ==, 0);
414             g_assert_cmpint(backing->quiesce_counter, ==, 0);
415             g_assert_cmpint(s->drain_count, ==, 0);
416             g_assert_cmpint(backing_s->drain_count, ==, 0);
417         }
418     }
419 
420     bdrv_unref(backing);
421     bdrv_unref(bs);
422     blk_unref(blk);
423 }
424 
425 static void test_graph_change_drain_all(void)
426 {
427     BlockBackend *blk_a, *blk_b;
428     BlockDriverState *bs_a, *bs_b;
429     BDRVTestState *a_s, *b_s;
430 
431     /* Create node A with a BlockBackend */
432     blk_a = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
433     bs_a = bdrv_new_open_driver(&bdrv_test, "test-node-a", BDRV_O_RDWR,
434                                 &error_abort);
435     a_s = bs_a->opaque;
436     blk_insert_bs(blk_a, bs_a, &error_abort);
437 
438     g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
439     g_assert_cmpint(a_s->drain_count, ==, 0);
440 
441     /* Call bdrv_drain_all_begin() */
442     bdrv_drain_all_begin();
443 
444     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
445     g_assert_cmpint(a_s->drain_count, ==, 1);
446 
447     /* Create node B with a BlockBackend */
448     blk_b = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
449     bs_b = bdrv_new_open_driver(&bdrv_test, "test-node-b", BDRV_O_RDWR,
450                                 &error_abort);
451     b_s = bs_b->opaque;
452     blk_insert_bs(blk_b, bs_b, &error_abort);
453 
454     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
455     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
456     g_assert_cmpint(a_s->drain_count, ==, 1);
457     g_assert_cmpint(b_s->drain_count, ==, 1);
458 
459     /* Unref and finally delete node A */
460     blk_unref(blk_a);
461 
462     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
463     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
464     g_assert_cmpint(a_s->drain_count, ==, 1);
465     g_assert_cmpint(b_s->drain_count, ==, 1);
466 
467     bdrv_unref(bs_a);
468 
469     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
470     g_assert_cmpint(b_s->drain_count, ==, 1);
471 
472     /* End the drained section */
473     bdrv_drain_all_end();
474 
475     g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
476     g_assert_cmpint(b_s->drain_count, ==, 0);
477 
478     bdrv_unref(bs_b);
479     blk_unref(blk_b);
480 }
481 
482 struct test_iothread_data {
483     BlockDriverState *bs;
484     enum drain_type drain_type;
485     int *aio_ret;
486     bool co_done;
487 };
488 
489 static void coroutine_fn test_iothread_drain_co_entry(void *opaque)
490 {
491     struct test_iothread_data *data = opaque;
492 
493     do_drain_begin(data->drain_type, data->bs);
494     g_assert_cmpint(*data->aio_ret, ==, 0);
495     do_drain_end(data->drain_type, data->bs);
496 
497     data->co_done = true;
498     aio_wait_kick();
499 }
500 
501 static void test_iothread_aio_cb(void *opaque, int ret)
502 {
503     int *aio_ret = opaque;
504     *aio_ret = ret;
505     qemu_event_set(&done_event);
506 }
507 
508 static void test_iothread_main_thread_bh(void *opaque)
509 {
510     struct test_iothread_data *data = opaque;
511 
512     bdrv_flush(data->bs);
513     bdrv_dec_in_flight(data->bs); /* incremented by test_iothread_common() */
514 }
515 
516 /*
517  * Starts an AIO request on a BDS that runs in the AioContext of iothread 1.
518  * The request involves a BH on iothread 2 before it can complete.
519  *
520  * @drain_thread = 0 means that do_drain_begin/end are called from the main
521  * thread, @drain_thread = 1 means that they are called from iothread 1. Drain
522  * for this BDS cannot be called from iothread 2 because only the main thread
523  * may do cross-AioContext polling.
524  */
525 static void test_iothread_common(enum drain_type drain_type, int drain_thread)
526 {
527     BlockBackend *blk;
528     BlockDriverState *bs;
529     BDRVTestState *s;
530     BlockAIOCB *acb;
531     Coroutine *co;
532     int aio_ret;
533     struct test_iothread_data data;
534 
535     IOThread *a = iothread_new();
536     IOThread *b = iothread_new();
537     AioContext *ctx_a = iothread_get_aio_context(a);
538     AioContext *ctx_b = iothread_get_aio_context(b);
539 
540     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
541 
542     /* bdrv_drain_all() may only be called from the main loop thread */
543     if (drain_type == BDRV_DRAIN_ALL && drain_thread != 0) {
544         goto out;
545     }
546 
547     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
548     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
549                               &error_abort);
550     s = bs->opaque;
551     blk_insert_bs(blk, bs, &error_abort);
552     blk_set_disable_request_queuing(blk, true);
553 
554     blk_set_aio_context(blk, ctx_a, &error_abort);
555 
556     s->bh_indirection_ctx = ctx_b;
557 
558     aio_ret = -EINPROGRESS;
559     qemu_event_reset(&done_event);
560 
561     if (drain_thread == 0) {
562         acb = blk_aio_preadv(blk, 0, &qiov, 0, test_iothread_aio_cb, &aio_ret);
563     } else {
564         acb = blk_aio_preadv(blk, 0, &qiov, 0, aio_ret_cb, &aio_ret);
565     }
566     g_assert(acb != NULL);
567     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
568 
569     data = (struct test_iothread_data) {
570         .bs         = bs,
571         .drain_type = drain_type,
572         .aio_ret    = &aio_ret,
573     };
574 
575     switch (drain_thread) {
576     case 0:
577         /*
578          * Increment in_flight so that do_drain_begin() waits for
579          * test_iothread_main_thread_bh(). This prevents the race between
580          * test_iothread_main_thread_bh() in IOThread a and do_drain_begin() in
581          * this thread. test_iothread_main_thread_bh() decrements in_flight.
582          */
583         bdrv_inc_in_flight(bs);
584         aio_bh_schedule_oneshot(ctx_a, test_iothread_main_thread_bh, &data);
585 
586         /* The request is running on the IOThread a. Draining its block device
587          * will make sure that it has completed as far as the BDS is concerned,
588          * but the drain in this thread can continue immediately after
589          * bdrv_dec_in_flight() and aio_ret might be assigned only slightly
590          * later. */
591         do_drain_begin(drain_type, bs);
592         g_assert_cmpint(bs->in_flight, ==, 0);
593 
594         qemu_event_wait(&done_event);
595 
596         g_assert_cmpint(aio_ret, ==, 0);
597         do_drain_end(drain_type, bs);
598         break;
599     case 1:
600         co = qemu_coroutine_create(test_iothread_drain_co_entry, &data);
601         aio_co_enter(ctx_a, co);
602         AIO_WAIT_WHILE_UNLOCKED(NULL, !data.co_done);
603         break;
604     default:
605         g_assert_not_reached();
606     }
607 
608     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
609 
610     bdrv_unref(bs);
611     blk_unref(blk);
612 
613 out:
614     iothread_join(a);
615     iothread_join(b);
616 }
617 
618 static void test_iothread_drain_all(void)
619 {
620     test_iothread_common(BDRV_DRAIN_ALL, 0);
621     test_iothread_common(BDRV_DRAIN_ALL, 1);
622 }
623 
624 static void test_iothread_drain(void)
625 {
626     test_iothread_common(BDRV_DRAIN, 0);
627     test_iothread_common(BDRV_DRAIN, 1);
628 }
629 
630 
631 typedef struct TestBlockJob {
632     BlockJob common;
633     BlockDriverState *bs;
634     int run_ret;
635     int prepare_ret;
636     bool running;
637     bool should_complete;
638 } TestBlockJob;
639 
640 static int test_job_prepare(Job *job)
641 {
642     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
643 
644     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
645     bdrv_flush(s->bs);
646     return s->prepare_ret;
647 }
648 
649 static void test_job_commit(Job *job)
650 {
651     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
652 
653     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
654     bdrv_flush(s->bs);
655 }
656 
657 static void test_job_abort(Job *job)
658 {
659     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
660 
661     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
662     bdrv_flush(s->bs);
663 }
664 
665 static int coroutine_fn test_job_run(Job *job, Error **errp)
666 {
667     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
668 
669     /* We are running the actual job code past the pause point in
670      * job_co_entry(). */
671     s->running = true;
672 
673     job_transition_to_ready(&s->common.job);
674     while (!s->should_complete) {
675         /* Avoid job_sleep_ns() because it marks the job as !busy. We want to
676          * emulate some actual activity (probably some I/O) here so that drain
677          * has to wait for this activity to stop. */
678         qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
679 
680         job_pause_point(&s->common.job);
681     }
682 
683     return s->run_ret;
684 }
685 
686 static void test_job_complete(Job *job, Error **errp)
687 {
688     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
689     s->should_complete = true;
690 }
691 
692 BlockJobDriver test_job_driver = {
693     .job_driver = {
694         .instance_size  = sizeof(TestBlockJob),
695         .free           = block_job_free,
696         .user_resume    = block_job_user_resume,
697         .run            = test_job_run,
698         .complete       = test_job_complete,
699         .prepare        = test_job_prepare,
700         .commit         = test_job_commit,
701         .abort          = test_job_abort,
702     },
703 };
704 
705 enum test_job_result {
706     TEST_JOB_SUCCESS,
707     TEST_JOB_FAIL_RUN,
708     TEST_JOB_FAIL_PREPARE,
709 };
710 
711 enum test_job_drain_node {
712     TEST_JOB_DRAIN_SRC,
713     TEST_JOB_DRAIN_SRC_CHILD,
714 };
715 
716 static void test_blockjob_common_drain_node(enum drain_type drain_type,
717                                             bool use_iothread,
718                                             enum test_job_result result,
719                                             enum test_job_drain_node drain_node)
720 {
721     BlockBackend *blk_src, *blk_target;
722     BlockDriverState *src, *src_backing, *src_overlay, *target, *drain_bs;
723     BlockJob *job;
724     TestBlockJob *tjob;
725     IOThread *iothread = NULL;
726     int ret = -1;
727 
728     src = bdrv_new_open_driver(&bdrv_test, "source", BDRV_O_RDWR,
729                                &error_abort);
730     src_backing = bdrv_new_open_driver(&bdrv_test, "source-backing",
731                                        BDRV_O_RDWR, &error_abort);
732     src_overlay = bdrv_new_open_driver(&bdrv_test, "source-overlay",
733                                        BDRV_O_RDWR, &error_abort);
734 
735     bdrv_set_backing_hd(src_overlay, src, &error_abort);
736     bdrv_unref(src);
737     bdrv_set_backing_hd(src, src_backing, &error_abort);
738     bdrv_unref(src_backing);
739 
740     blk_src = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
741     blk_insert_bs(blk_src, src_overlay, &error_abort);
742 
743     switch (drain_node) {
744     case TEST_JOB_DRAIN_SRC:
745         drain_bs = src;
746         break;
747     case TEST_JOB_DRAIN_SRC_CHILD:
748         drain_bs = src_backing;
749         break;
750     default:
751         g_assert_not_reached();
752     }
753 
754     if (use_iothread) {
755         AioContext *ctx;
756 
757         iothread = iothread_new();
758         ctx = iothread_get_aio_context(iothread);
759         blk_set_aio_context(blk_src, ctx, &error_abort);
760     }
761 
762     target = bdrv_new_open_driver(&bdrv_test, "target", BDRV_O_RDWR,
763                                   &error_abort);
764     blk_target = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
765     blk_insert_bs(blk_target, target, &error_abort);
766     blk_set_allow_aio_context_change(blk_target, true);
767 
768     tjob = block_job_create("job0", &test_job_driver, NULL, src,
769                             0, BLK_PERM_ALL,
770                             0, 0, NULL, NULL, &error_abort);
771     tjob->bs = src;
772     job = &tjob->common;
773 
774     bdrv_graph_wrlock();
775     block_job_add_bdrv(job, "target", target, 0, BLK_PERM_ALL, &error_abort);
776     bdrv_graph_wrunlock();
777 
778     switch (result) {
779     case TEST_JOB_SUCCESS:
780         break;
781     case TEST_JOB_FAIL_RUN:
782         tjob->run_ret = -EIO;
783         break;
784     case TEST_JOB_FAIL_PREPARE:
785         tjob->prepare_ret = -EIO;
786         break;
787     }
788 
789     job_start(&job->job);
790 
791     if (use_iothread) {
792         /* job_co_entry() is run in the I/O thread, wait for the actual job
793          * code to start (we don't want to catch the job in the pause point in
794          * job_co_entry(). */
795         while (!tjob->running) {
796             aio_poll(qemu_get_aio_context(), false);
797         }
798     }
799 
800     WITH_JOB_LOCK_GUARD() {
801         g_assert_cmpint(job->job.pause_count, ==, 0);
802         g_assert_false(job->job.paused);
803         g_assert_true(tjob->running);
804         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
805     }
806 
807     do_drain_begin_unlocked(drain_type, drain_bs);
808 
809     WITH_JOB_LOCK_GUARD() {
810         if (drain_type == BDRV_DRAIN_ALL) {
811             /* bdrv_drain_all() drains both src and target */
812             g_assert_cmpint(job->job.pause_count, ==, 2);
813         } else {
814             g_assert_cmpint(job->job.pause_count, ==, 1);
815         }
816         g_assert_true(job->job.paused);
817         g_assert_false(job->job.busy); /* The job is paused */
818     }
819 
820     do_drain_end_unlocked(drain_type, drain_bs);
821 
822     if (use_iothread) {
823         /*
824          * Here we are waiting for the paused status to change,
825          * so don't bother protecting the read every time.
826          *
827          * paused is reset in the I/O thread, wait for it
828          */
829         while (job->job.paused) {
830             aio_poll(qemu_get_aio_context(), false);
831         }
832     }
833 
834     WITH_JOB_LOCK_GUARD() {
835         g_assert_cmpint(job->job.pause_count, ==, 0);
836         g_assert_false(job->job.paused);
837         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
838     }
839 
840     do_drain_begin_unlocked(drain_type, target);
841 
842     WITH_JOB_LOCK_GUARD() {
843         if (drain_type == BDRV_DRAIN_ALL) {
844             /* bdrv_drain_all() drains both src and target */
845             g_assert_cmpint(job->job.pause_count, ==, 2);
846         } else {
847             g_assert_cmpint(job->job.pause_count, ==, 1);
848         }
849         g_assert_true(job->job.paused);
850         g_assert_false(job->job.busy); /* The job is paused */
851     }
852 
853     do_drain_end_unlocked(drain_type, target);
854 
855     if (use_iothread) {
856         /*
857          * Here we are waiting for the paused status to change,
858          * so don't bother protecting the read every time.
859          *
860          * paused is reset in the I/O thread, wait for it
861          */
862         while (job->job.paused) {
863             aio_poll(qemu_get_aio_context(), false);
864         }
865     }
866 
867     WITH_JOB_LOCK_GUARD() {
868         g_assert_cmpint(job->job.pause_count, ==, 0);
869         g_assert_false(job->job.paused);
870         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
871     }
872 
873     WITH_JOB_LOCK_GUARD() {
874         ret = job_complete_sync_locked(&job->job, &error_abort);
875     }
876     g_assert_cmpint(ret, ==, (result == TEST_JOB_SUCCESS ? 0 : -EIO));
877 
878     if (use_iothread) {
879         blk_set_aio_context(blk_src, qemu_get_aio_context(), &error_abort);
880         assert(blk_get_aio_context(blk_target) == qemu_get_aio_context());
881     }
882 
883     blk_unref(blk_src);
884     blk_unref(blk_target);
885     bdrv_unref(src_overlay);
886     bdrv_unref(target);
887 
888     if (iothread) {
889         iothread_join(iothread);
890     }
891 }
892 
893 static void test_blockjob_common(enum drain_type drain_type, bool use_iothread,
894                                  enum test_job_result result)
895 {
896     test_blockjob_common_drain_node(drain_type, use_iothread, result,
897                                     TEST_JOB_DRAIN_SRC);
898     test_blockjob_common_drain_node(drain_type, use_iothread, result,
899                                     TEST_JOB_DRAIN_SRC_CHILD);
900 }
901 
902 static void test_blockjob_drain_all(void)
903 {
904     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_SUCCESS);
905 }
906 
907 static void test_blockjob_drain(void)
908 {
909     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_SUCCESS);
910 }
911 
912 static void test_blockjob_error_drain_all(void)
913 {
914     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_RUN);
915     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_PREPARE);
916 }
917 
918 static void test_blockjob_error_drain(void)
919 {
920     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_RUN);
921     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_PREPARE);
922 }
923 
924 static void test_blockjob_iothread_drain_all(void)
925 {
926     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_SUCCESS);
927 }
928 
929 static void test_blockjob_iothread_drain(void)
930 {
931     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_SUCCESS);
932 }
933 
934 static void test_blockjob_iothread_error_drain_all(void)
935 {
936     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_RUN);
937     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_PREPARE);
938 }
939 
940 static void test_blockjob_iothread_error_drain(void)
941 {
942     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_RUN);
943     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_PREPARE);
944 }
945 
946 
947 typedef struct BDRVTestTopState {
948     BdrvChild *wait_child;
949 } BDRVTestTopState;
950 
951 static void bdrv_test_top_close(BlockDriverState *bs)
952 {
953     BdrvChild *c, *next_c;
954 
955     bdrv_graph_wrlock();
956     QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
957         bdrv_unref_child(bs, c);
958     }
959     bdrv_graph_wrunlock();
960 }
961 
962 static int coroutine_fn GRAPH_RDLOCK
963 bdrv_test_top_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
964                         QEMUIOVector *qiov, BdrvRequestFlags flags)
965 {
966     BDRVTestTopState *tts = bs->opaque;
967     return bdrv_co_preadv(tts->wait_child, offset, bytes, qiov, flags);
968 }
969 
970 static BlockDriver bdrv_test_top_driver = {
971     .format_name            = "test_top_driver",
972     .instance_size          = sizeof(BDRVTestTopState),
973 
974     .bdrv_close             = bdrv_test_top_close,
975     .bdrv_co_preadv         = bdrv_test_top_co_preadv,
976 
977     .bdrv_child_perm        = bdrv_default_perms,
978 };
979 
980 typedef struct TestCoDeleteByDrainData {
981     BlockBackend *blk;
982     bool detach_instead_of_delete;
983     bool done;
984 } TestCoDeleteByDrainData;
985 
986 static void coroutine_fn test_co_delete_by_drain(void *opaque)
987 {
988     TestCoDeleteByDrainData *dbdd = opaque;
989     BlockBackend *blk = dbdd->blk;
990     BlockDriverState *bs = blk_bs(blk);
991     BDRVTestTopState *tts = bs->opaque;
992     void *buffer = g_malloc(65536);
993     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buffer, 65536);
994 
995     /* Pretend some internal write operation from parent to child.
996      * Important: We have to read from the child, not from the parent!
997      * Draining works by first propagating it all up the tree to the
998      * root and then waiting for drainage from root to the leaves
999      * (protocol nodes).  If we have a request waiting on the root,
1000      * everything will be drained before we go back down the tree, but
1001      * we do not want that.  We want to be in the middle of draining
1002      * when this following requests returns. */
1003     bdrv_graph_co_rdlock();
1004     bdrv_co_preadv(tts->wait_child, 0, 65536, &qiov, 0);
1005     bdrv_graph_co_rdunlock();
1006 
1007     g_assert_cmpint(bs->refcnt, ==, 1);
1008 
1009     if (!dbdd->detach_instead_of_delete) {
1010         blk_co_unref(blk);
1011     } else {
1012         BdrvChild *c, *next_c;
1013         bdrv_graph_co_rdlock();
1014         QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
1015             bdrv_graph_co_rdunlock();
1016             bdrv_co_unref_child(bs, c);
1017             bdrv_graph_co_rdlock();
1018         }
1019         bdrv_graph_co_rdunlock();
1020     }
1021 
1022     dbdd->done = true;
1023     g_free(buffer);
1024 }
1025 
1026 /**
1027  * Test what happens when some BDS has some children, you drain one of
1028  * them and this results in the BDS being deleted.
1029  *
1030  * If @detach_instead_of_delete is set, the BDS is not going to be
1031  * deleted but will only detach all of its children.
1032  */
1033 static void do_test_delete_by_drain(bool detach_instead_of_delete,
1034                                     enum drain_type drain_type)
1035 {
1036     BlockBackend *blk;
1037     BlockDriverState *bs, *child_bs, *null_bs;
1038     BDRVTestTopState *tts;
1039     TestCoDeleteByDrainData dbdd;
1040     Coroutine *co;
1041 
1042     bs = bdrv_new_open_driver(&bdrv_test_top_driver, "top", BDRV_O_RDWR,
1043                               &error_abort);
1044     bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
1045     tts = bs->opaque;
1046 
1047     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
1048                         &error_abort);
1049     bdrv_graph_wrlock();
1050     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds,
1051                       BDRV_CHILD_DATA, &error_abort);
1052     bdrv_graph_wrunlock();
1053 
1054     /* This child will be the one to pass to requests through to, and
1055      * it will stall until a drain occurs */
1056     child_bs = bdrv_new_open_driver(&bdrv_test, "child", BDRV_O_RDWR,
1057                                     &error_abort);
1058     child_bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
1059     /* Takes our reference to child_bs */
1060     bdrv_graph_wrlock();
1061     tts->wait_child = bdrv_attach_child(bs, child_bs, "wait-child",
1062                                         &child_of_bds,
1063                                         BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
1064                                         &error_abort);
1065     bdrv_graph_wrunlock();
1066 
1067     /* This child is just there to be deleted
1068      * (for detach_instead_of_delete == true) */
1069     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
1070                         &error_abort);
1071     bdrv_graph_wrlock();
1072     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds, BDRV_CHILD_DATA,
1073                       &error_abort);
1074     bdrv_graph_wrunlock();
1075 
1076     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1077     blk_insert_bs(blk, bs, &error_abort);
1078 
1079     /* Referenced by blk now */
1080     bdrv_unref(bs);
1081 
1082     g_assert_cmpint(bs->refcnt, ==, 1);
1083     g_assert_cmpint(child_bs->refcnt, ==, 1);
1084     g_assert_cmpint(null_bs->refcnt, ==, 1);
1085 
1086 
1087     dbdd = (TestCoDeleteByDrainData){
1088         .blk = blk,
1089         .detach_instead_of_delete = detach_instead_of_delete,
1090         .done = false,
1091     };
1092     co = qemu_coroutine_create(test_co_delete_by_drain, &dbdd);
1093     qemu_coroutine_enter(co);
1094 
1095     /* Drain the child while the read operation is still pending.
1096      * This should result in the operation finishing and
1097      * test_co_delete_by_drain() resuming.  Thus, @bs will be deleted
1098      * and the coroutine will exit while this drain operation is still
1099      * in progress. */
1100     switch (drain_type) {
1101     case BDRV_DRAIN:
1102         bdrv_ref(child_bs);
1103         bdrv_drain(child_bs);
1104         bdrv_unref(child_bs);
1105         break;
1106     case BDRV_DRAIN_ALL:
1107         bdrv_drain_all_begin();
1108         bdrv_drain_all_end();
1109         break;
1110     default:
1111         g_assert_not_reached();
1112     }
1113 
1114     while (!dbdd.done) {
1115         aio_poll(qemu_get_aio_context(), true);
1116     }
1117 
1118     if (detach_instead_of_delete) {
1119         /* Here, the reference has not passed over to the coroutine,
1120          * so we have to delete the BB ourselves */
1121         blk_unref(blk);
1122     }
1123 }
1124 
1125 static void test_delete_by_drain(void)
1126 {
1127     do_test_delete_by_drain(false, BDRV_DRAIN);
1128 }
1129 
1130 static void test_detach_by_drain_all(void)
1131 {
1132     do_test_delete_by_drain(true, BDRV_DRAIN_ALL);
1133 }
1134 
1135 static void test_detach_by_drain(void)
1136 {
1137     do_test_delete_by_drain(true, BDRV_DRAIN);
1138 }
1139 
1140 
1141 struct detach_by_parent_data {
1142     BlockDriverState *parent_b;
1143     BdrvChild *child_b;
1144     BlockDriverState *c;
1145     BdrvChild *child_c;
1146     bool by_parent_cb;
1147     bool detach_on_drain;
1148 };
1149 static struct detach_by_parent_data detach_by_parent_data;
1150 
1151 static void no_coroutine_fn detach_indirect_bh(void *opaque)
1152 {
1153     struct detach_by_parent_data *data = opaque;
1154 
1155     bdrv_dec_in_flight(data->child_b->bs);
1156 
1157     bdrv_graph_wrlock();
1158     bdrv_unref_child(data->parent_b, data->child_b);
1159 
1160     bdrv_ref(data->c);
1161     data->child_c = bdrv_attach_child(data->parent_b, data->c, "PB-C",
1162                                       &child_of_bds, BDRV_CHILD_DATA,
1163                                       &error_abort);
1164     bdrv_graph_wrunlock();
1165 }
1166 
1167 static void coroutine_mixed_fn detach_by_parent_aio_cb(void *opaque, int ret)
1168 {
1169     struct detach_by_parent_data *data = &detach_by_parent_data;
1170 
1171     g_assert_cmpint(ret, ==, 0);
1172     if (data->by_parent_cb) {
1173         bdrv_inc_in_flight(data->child_b->bs);
1174         aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
1175                                 detach_indirect_bh, &detach_by_parent_data);
1176     }
1177 }
1178 
1179 static void GRAPH_RDLOCK detach_by_driver_cb_drained_begin(BdrvChild *child)
1180 {
1181     struct detach_by_parent_data *data = &detach_by_parent_data;
1182 
1183     if (!data->detach_on_drain) {
1184         return;
1185     }
1186     data->detach_on_drain = false;
1187 
1188     bdrv_inc_in_flight(data->child_b->bs);
1189     aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
1190                             detach_indirect_bh, &detach_by_parent_data);
1191     child_of_bds.drained_begin(child);
1192 }
1193 
1194 static BdrvChildClass detach_by_driver_cb_class;
1195 
1196 /*
1197  * Initial graph:
1198  *
1199  * PA     PB
1200  *    \ /   \
1201  *     A     B     C
1202  *
1203  * by_parent_cb == true:  Test that parent callbacks don't poll
1204  *
1205  *     PA has a pending write request whose callback changes the child nodes of
1206  *     PB: It removes B and adds C instead. The subtree of PB is drained, which
1207  *     will indirectly drain the write request, too.
1208  *
1209  * by_parent_cb == false: Test that bdrv_drain_invoke() doesn't poll
1210  *
1211  *     PA's BdrvChildClass has a .drained_begin callback that schedules a BH
1212  *     that does the same graph change. If bdrv_drain_invoke() calls it, the
1213  *     state is messed up, but if it is only polled in the single
1214  *     BDRV_POLL_WHILE() at the end of the drain, this should work fine.
1215  */
1216 static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
1217 {
1218     BlockBackend *blk;
1219     BlockDriverState *parent_a, *parent_b, *a, *b, *c;
1220     BdrvChild *child_a, *child_b;
1221     BlockAIOCB *acb;
1222 
1223     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
1224 
1225     if (!by_parent_cb) {
1226         detach_by_driver_cb_class = child_of_bds;
1227         detach_by_driver_cb_class.drained_begin =
1228             detach_by_driver_cb_drained_begin;
1229         detach_by_driver_cb_class.drained_end = NULL;
1230         detach_by_driver_cb_class.drained_poll = NULL;
1231     }
1232 
1233     detach_by_parent_data = (struct detach_by_parent_data) {
1234         .detach_on_drain = false,
1235     };
1236 
1237     /* Create all involved nodes */
1238     parent_a = bdrv_new_open_driver(&bdrv_test, "parent-a", BDRV_O_RDWR,
1239                                     &error_abort);
1240     parent_b = bdrv_new_open_driver(&bdrv_test, "parent-b", 0,
1241                                     &error_abort);
1242 
1243     a = bdrv_new_open_driver(&bdrv_test, "a", BDRV_O_RDWR, &error_abort);
1244     b = bdrv_new_open_driver(&bdrv_test, "b", BDRV_O_RDWR, &error_abort);
1245     c = bdrv_new_open_driver(&bdrv_test, "c", BDRV_O_RDWR, &error_abort);
1246 
1247     /* blk is a BB for parent-a */
1248     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1249     blk_insert_bs(blk, parent_a, &error_abort);
1250     bdrv_unref(parent_a);
1251 
1252     /* If we want to get bdrv_drain_invoke() to call aio_poll(), the driver
1253      * callback must not return immediately. */
1254     if (!by_parent_cb) {
1255         BDRVTestState *s = parent_a->opaque;
1256         s->sleep_in_drain_begin = true;
1257     }
1258 
1259     /* Set child relationships */
1260     bdrv_ref(b);
1261     bdrv_ref(a);
1262     bdrv_graph_wrlock();
1263     child_b = bdrv_attach_child(parent_b, b, "PB-B", &child_of_bds,
1264                                 BDRV_CHILD_DATA, &error_abort);
1265     child_a = bdrv_attach_child(parent_b, a, "PB-A", &child_of_bds,
1266                                 BDRV_CHILD_COW, &error_abort);
1267 
1268     bdrv_ref(a);
1269     bdrv_attach_child(parent_a, a, "PA-A",
1270                       by_parent_cb ? &child_of_bds : &detach_by_driver_cb_class,
1271                       BDRV_CHILD_DATA, &error_abort);
1272     bdrv_graph_wrunlock();
1273 
1274     g_assert_cmpint(parent_a->refcnt, ==, 1);
1275     g_assert_cmpint(parent_b->refcnt, ==, 1);
1276     g_assert_cmpint(a->refcnt, ==, 3);
1277     g_assert_cmpint(b->refcnt, ==, 2);
1278     g_assert_cmpint(c->refcnt, ==, 1);
1279 
1280     g_assert(QLIST_FIRST(&parent_b->children) == child_a);
1281     g_assert(QLIST_NEXT(child_a, next) == child_b);
1282     g_assert(QLIST_NEXT(child_b, next) == NULL);
1283 
1284     /* Start the evil write request */
1285     detach_by_parent_data = (struct detach_by_parent_data) {
1286         .parent_b = parent_b,
1287         .child_b = child_b,
1288         .c = c,
1289         .by_parent_cb = by_parent_cb,
1290         .detach_on_drain = true,
1291     };
1292     acb = blk_aio_preadv(blk, 0, &qiov, 0, detach_by_parent_aio_cb, NULL);
1293     g_assert(acb != NULL);
1294 
1295     /* Drain and check the expected result */
1296     bdrv_drained_begin(parent_b);
1297     bdrv_drained_begin(a);
1298     bdrv_drained_begin(b);
1299     bdrv_drained_begin(c);
1300 
1301     g_assert(detach_by_parent_data.child_c != NULL);
1302 
1303     g_assert_cmpint(parent_a->refcnt, ==, 1);
1304     g_assert_cmpint(parent_b->refcnt, ==, 1);
1305     g_assert_cmpint(a->refcnt, ==, 3);
1306     g_assert_cmpint(b->refcnt, ==, 1);
1307     g_assert_cmpint(c->refcnt, ==, 2);
1308 
1309     g_assert(QLIST_FIRST(&parent_b->children) == detach_by_parent_data.child_c);
1310     g_assert(QLIST_NEXT(detach_by_parent_data.child_c, next) == child_a);
1311     g_assert(QLIST_NEXT(child_a, next) == NULL);
1312 
1313     g_assert_cmpint(parent_a->quiesce_counter, ==, 1);
1314     g_assert_cmpint(parent_b->quiesce_counter, ==, 3);
1315     g_assert_cmpint(a->quiesce_counter, ==, 1);
1316     g_assert_cmpint(b->quiesce_counter, ==, 1);
1317     g_assert_cmpint(c->quiesce_counter, ==, 1);
1318 
1319     bdrv_drained_end(parent_b);
1320     bdrv_drained_end(a);
1321     bdrv_drained_end(b);
1322     bdrv_drained_end(c);
1323 
1324     bdrv_unref(parent_b);
1325     blk_unref(blk);
1326 
1327     g_assert_cmpint(a->refcnt, ==, 1);
1328     g_assert_cmpint(b->refcnt, ==, 1);
1329     g_assert_cmpint(c->refcnt, ==, 1);
1330     bdrv_unref(a);
1331     bdrv_unref(b);
1332     bdrv_unref(c);
1333 }
1334 
1335 static void test_detach_by_parent_cb(void)
1336 {
1337     test_detach_indirect(true);
1338 }
1339 
1340 static void test_detach_by_driver_cb(void)
1341 {
1342     test_detach_indirect(false);
1343 }
1344 
1345 static void test_append_to_drained(void)
1346 {
1347     BlockBackend *blk;
1348     BlockDriverState *base, *overlay;
1349     BDRVTestState *base_s, *overlay_s;
1350 
1351     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1352     base = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
1353     base_s = base->opaque;
1354     blk_insert_bs(blk, base, &error_abort);
1355 
1356     overlay = bdrv_new_open_driver(&bdrv_test, "overlay", BDRV_O_RDWR,
1357                                    &error_abort);
1358     overlay_s = overlay->opaque;
1359 
1360     do_drain_begin(BDRV_DRAIN, base);
1361     g_assert_cmpint(base->quiesce_counter, ==, 1);
1362     g_assert_cmpint(base_s->drain_count, ==, 1);
1363     g_assert_cmpint(base->in_flight, ==, 0);
1364 
1365     bdrv_append(overlay, base, &error_abort);
1366 
1367     g_assert_cmpint(base->in_flight, ==, 0);
1368     g_assert_cmpint(overlay->in_flight, ==, 0);
1369 
1370     g_assert_cmpint(base->quiesce_counter, ==, 1);
1371     g_assert_cmpint(base_s->drain_count, ==, 1);
1372     g_assert_cmpint(overlay->quiesce_counter, ==, 1);
1373     g_assert_cmpint(overlay_s->drain_count, ==, 1);
1374 
1375     do_drain_end(BDRV_DRAIN, base);
1376 
1377     g_assert_cmpint(base->quiesce_counter, ==, 0);
1378     g_assert_cmpint(base_s->drain_count, ==, 0);
1379     g_assert_cmpint(overlay->quiesce_counter, ==, 0);
1380     g_assert_cmpint(overlay_s->drain_count, ==, 0);
1381 
1382     bdrv_unref(overlay);
1383     bdrv_unref(base);
1384     blk_unref(blk);
1385 }
1386 
1387 static void test_set_aio_context(void)
1388 {
1389     BlockDriverState *bs;
1390     IOThread *a = iothread_new();
1391     IOThread *b = iothread_new();
1392     AioContext *ctx_a = iothread_get_aio_context(a);
1393     AioContext *ctx_b = iothread_get_aio_context(b);
1394 
1395     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
1396                               &error_abort);
1397 
1398     bdrv_drained_begin(bs);
1399     bdrv_try_change_aio_context(bs, ctx_a, NULL, &error_abort);
1400     bdrv_drained_end(bs);
1401 
1402     bdrv_drained_begin(bs);
1403     bdrv_try_change_aio_context(bs, ctx_b, NULL, &error_abort);
1404     bdrv_try_change_aio_context(bs, qemu_get_aio_context(), NULL, &error_abort);
1405     bdrv_drained_end(bs);
1406 
1407     bdrv_unref(bs);
1408     iothread_join(a);
1409     iothread_join(b);
1410 }
1411 
1412 
1413 typedef struct TestDropBackingBlockJob {
1414     BlockJob common;
1415     bool should_complete;
1416     bool *did_complete;
1417     BlockDriverState *detach_also;
1418     BlockDriverState *bs;
1419 } TestDropBackingBlockJob;
1420 
1421 static int coroutine_fn test_drop_backing_job_run(Job *job, Error **errp)
1422 {
1423     TestDropBackingBlockJob *s =
1424         container_of(job, TestDropBackingBlockJob, common.job);
1425 
1426     while (!s->should_complete) {
1427         job_sleep_ns(job, 0);
1428     }
1429 
1430     return 0;
1431 }
1432 
1433 static void test_drop_backing_job_commit(Job *job)
1434 {
1435     TestDropBackingBlockJob *s =
1436         container_of(job, TestDropBackingBlockJob, common.job);
1437 
1438     bdrv_set_backing_hd(s->bs, NULL, &error_abort);
1439     bdrv_set_backing_hd(s->detach_also, NULL, &error_abort);
1440 
1441     *s->did_complete = true;
1442 }
1443 
1444 static const BlockJobDriver test_drop_backing_job_driver = {
1445     .job_driver = {
1446         .instance_size  = sizeof(TestDropBackingBlockJob),
1447         .free           = block_job_free,
1448         .user_resume    = block_job_user_resume,
1449         .run            = test_drop_backing_job_run,
1450         .commit         = test_drop_backing_job_commit,
1451     }
1452 };
1453 
1454 /**
1455  * Creates a child node with three parent nodes on it, and then runs a
1456  * block job on the final one, parent-node-2.
1457  *
1458  * The job is then asked to complete before a section where the child
1459  * is drained.
1460  *
1461  * Ending this section will undrain the child's parents, first
1462  * parent-node-2, then parent-node-1, then parent-node-0 -- the parent
1463  * list is in reverse order of how they were added.  Ending the drain
1464  * on parent-node-2 will resume the job, thus completing it and
1465  * scheduling job_exit().
1466  *
1467  * Ending the drain on parent-node-1 will poll the AioContext, which
1468  * lets job_exit() and thus test_drop_backing_job_commit() run.  That
1469  * function first removes the child as parent-node-2's backing file.
1470  *
1471  * In old (and buggy) implementations, there are two problems with
1472  * that:
1473  * (A) bdrv_drain_invoke() polls for every node that leaves the
1474  *     drained section.  This means that job_exit() is scheduled
1475  *     before the child has left the drained section.  Its
1476  *     quiesce_counter is therefore still 1 when it is removed from
1477  *     parent-node-2.
1478  *
1479  * (B) bdrv_replace_child_noperm() calls drained_end() on the old
1480  *     child's parents as many times as the child is quiesced.  This
1481  *     means it will call drained_end() on parent-node-2 once.
1482  *     Because parent-node-2 is no longer quiesced at this point, this
1483  *     will fail.
1484  *
1485  * bdrv_replace_child_noperm() therefore must call drained_end() on
1486  * the parent only if it really is still drained because the child is
1487  * drained.
1488  *
1489  * If removing child from parent-node-2 was successful (as it should
1490  * be), test_drop_backing_job_commit() will then also remove the child
1491  * from parent-node-0.
1492  *
1493  * With an old version of our drain infrastructure ((A) above), that
1494  * resulted in the following flow:
1495  *
1496  * 1. child attempts to leave its drained section.  The call recurses
1497  *    to its parents.
1498  *
1499  * 2. parent-node-2 leaves the drained section.  Polling in
1500  *    bdrv_drain_invoke() will schedule job_exit().
1501  *
1502  * 3. parent-node-1 leaves the drained section.  Polling in
1503  *    bdrv_drain_invoke() will run job_exit(), thus disconnecting
1504  *    parent-node-0 from the child node.
1505  *
1506  * 4. bdrv_parent_drained_end() uses a QLIST_FOREACH_SAFE() loop to
1507  *    iterate over the parents.  Thus, it now accesses the BdrvChild
1508  *    object that used to connect parent-node-0 and the child node.
1509  *    However, that object no longer exists, so it accesses a dangling
1510  *    pointer.
1511  *
1512  * The solution is to only poll once when running a bdrv_drained_end()
1513  * operation, specifically at the end when all drained_end()
1514  * operations for all involved nodes have been scheduled.
1515  * Note that this also solves (A) above, thus hiding (B).
1516  */
1517 static void test_blockjob_commit_by_drained_end(void)
1518 {
1519     BlockDriverState *bs_child, *bs_parents[3];
1520     TestDropBackingBlockJob *job;
1521     bool job_has_completed = false;
1522     int i;
1523 
1524     bs_child = bdrv_new_open_driver(&bdrv_test, "child-node", BDRV_O_RDWR,
1525                                     &error_abort);
1526 
1527     for (i = 0; i < 3; i++) {
1528         char name[32];
1529         snprintf(name, sizeof(name), "parent-node-%i", i);
1530         bs_parents[i] = bdrv_new_open_driver(&bdrv_test, name, BDRV_O_RDWR,
1531                                              &error_abort);
1532         bdrv_set_backing_hd(bs_parents[i], bs_child, &error_abort);
1533     }
1534 
1535     job = block_job_create("job", &test_drop_backing_job_driver, NULL,
1536                            bs_parents[2], 0, BLK_PERM_ALL, 0, 0, NULL, NULL,
1537                            &error_abort);
1538     job->bs = bs_parents[2];
1539 
1540     job->detach_also = bs_parents[0];
1541     job->did_complete = &job_has_completed;
1542 
1543     job_start(&job->common.job);
1544 
1545     job->should_complete = true;
1546     bdrv_drained_begin(bs_child);
1547     g_assert(!job_has_completed);
1548     bdrv_drained_end(bs_child);
1549     aio_poll(qemu_get_aio_context(), false);
1550     g_assert(job_has_completed);
1551 
1552     bdrv_unref(bs_parents[0]);
1553     bdrv_unref(bs_parents[1]);
1554     bdrv_unref(bs_parents[2]);
1555     bdrv_unref(bs_child);
1556 }
1557 
1558 
1559 typedef struct TestSimpleBlockJob {
1560     BlockJob common;
1561     bool should_complete;
1562     bool *did_complete;
1563 } TestSimpleBlockJob;
1564 
1565 static int coroutine_fn test_simple_job_run(Job *job, Error **errp)
1566 {
1567     TestSimpleBlockJob *s = container_of(job, TestSimpleBlockJob, common.job);
1568 
1569     while (!s->should_complete) {
1570         job_sleep_ns(job, 0);
1571     }
1572 
1573     return 0;
1574 }
1575 
1576 static void test_simple_job_clean(Job *job)
1577 {
1578     TestSimpleBlockJob *s = container_of(job, TestSimpleBlockJob, common.job);
1579     *s->did_complete = true;
1580 }
1581 
1582 static const BlockJobDriver test_simple_job_driver = {
1583     .job_driver = {
1584         .instance_size  = sizeof(TestSimpleBlockJob),
1585         .free           = block_job_free,
1586         .user_resume    = block_job_user_resume,
1587         .run            = test_simple_job_run,
1588         .clean          = test_simple_job_clean,
1589     },
1590 };
1591 
1592 static int drop_intermediate_poll_update_filename(BdrvChild *child,
1593                                                   BlockDriverState *new_base,
1594                                                   const char *filename,
1595                                                   bool backing_mask_protocol,
1596                                                   Error **errp)
1597 {
1598     /*
1599      * We are free to poll here, which may change the block graph, if
1600      * it is not drained.
1601      */
1602 
1603     /* If the job is not drained: Complete it, schedule job_exit() */
1604     aio_poll(qemu_get_current_aio_context(), false);
1605     /* If the job is not drained: Run job_exit(), finish the job */
1606     aio_poll(qemu_get_current_aio_context(), false);
1607 
1608     return 0;
1609 }
1610 
1611 /**
1612  * Test a poll in the midst of bdrv_drop_intermediate().
1613  *
1614  * bdrv_drop_intermediate() calls BdrvChildClass.update_filename(),
1615  * which can yield or poll.  This may lead to graph changes, unless
1616  * the whole subtree in question is drained.
1617  *
1618  * We test this on the following graph:
1619  *
1620  *                    Job
1621  *
1622  *                     |
1623  *                  job-node
1624  *                     |
1625  *                     v
1626  *
1627  *                  job-node
1628  *
1629  *                     |
1630  *                  backing
1631  *                     |
1632  *                     v
1633  *
1634  * node-2 --chain--> node-1 --chain--> node-0
1635  *
1636  * We drop node-1 with bdrv_drop_intermediate(top=node-1, base=node-0).
1637  *
1638  * This first updates node-2's backing filename by invoking
1639  * drop_intermediate_poll_update_filename(), which polls twice.  This
1640  * causes the job to finish, which in turns causes the job-node to be
1641  * deleted.
1642  *
1643  * bdrv_drop_intermediate() uses a QLIST_FOREACH_SAFE() loop, so it
1644  * already has a pointer to the BdrvChild edge between job-node and
1645  * node-1.  When it tries to handle that edge, we probably get a
1646  * segmentation fault because the object no longer exists.
1647  *
1648  *
1649  * The solution is for bdrv_drop_intermediate() to drain top's
1650  * subtree.  This prevents graph changes from happening just because
1651  * BdrvChildClass.update_filename() yields or polls.  Thus, the block
1652  * job is paused during that drained section and must finish before or
1653  * after.
1654  *
1655  * (In addition, bdrv_replace_child() must keep the job paused.)
1656  */
1657 static void test_drop_intermediate_poll(void)
1658 {
1659     static BdrvChildClass chain_child_class;
1660     BlockDriverState *chain[3];
1661     TestSimpleBlockJob *job;
1662     BlockDriverState *job_node;
1663     bool job_has_completed = false;
1664     int i;
1665     int ret;
1666 
1667     chain_child_class = child_of_bds;
1668     chain_child_class.update_filename = drop_intermediate_poll_update_filename;
1669 
1670     for (i = 0; i < 3; i++) {
1671         char name[32];
1672         snprintf(name, 32, "node-%i", i);
1673 
1674         chain[i] = bdrv_new_open_driver(&bdrv_test, name, 0, &error_abort);
1675     }
1676 
1677     job_node = bdrv_new_open_driver(&bdrv_test, "job-node", BDRV_O_RDWR,
1678                                     &error_abort);
1679     bdrv_set_backing_hd(job_node, chain[1], &error_abort);
1680 
1681     /*
1682      * Establish the chain last, so the chain links are the first
1683      * elements in the BDS.parents lists
1684      */
1685     bdrv_graph_wrlock();
1686     for (i = 0; i < 3; i++) {
1687         if (i) {
1688             /* Takes the reference to chain[i - 1] */
1689             bdrv_attach_child(chain[i], chain[i - 1], "chain",
1690                               &chain_child_class, BDRV_CHILD_COW, &error_abort);
1691         }
1692     }
1693     bdrv_graph_wrunlock();
1694 
1695     job = block_job_create("job", &test_simple_job_driver, NULL, job_node,
1696                            0, BLK_PERM_ALL, 0, 0, NULL, NULL, &error_abort);
1697 
1698     /* The job has a reference now */
1699     bdrv_unref(job_node);
1700 
1701     job->did_complete = &job_has_completed;
1702 
1703     job_start(&job->common.job);
1704     job->should_complete = true;
1705 
1706     g_assert(!job_has_completed);
1707     ret = bdrv_drop_intermediate(chain[1], chain[0], NULL, false);
1708     aio_poll(qemu_get_aio_context(), false);
1709     g_assert(ret == 0);
1710     g_assert(job_has_completed);
1711 
1712     bdrv_unref(chain[2]);
1713 }
1714 
1715 
1716 typedef struct BDRVReplaceTestState {
1717     bool setup_completed;
1718     bool was_drained;
1719     bool was_undrained;
1720     bool has_read;
1721 
1722     int drain_count;
1723 
1724     bool yield_before_read;
1725     Coroutine *io_co;
1726     Coroutine *drain_co;
1727 } BDRVReplaceTestState;
1728 
1729 static void bdrv_replace_test_close(BlockDriverState *bs)
1730 {
1731 }
1732 
1733 /**
1734  * If @bs has a backing file:
1735  *   Yield if .yield_before_read is true (and wait for drain_begin to
1736  *   wake us up).
1737  *   Forward the read to bs->backing.  Set .has_read to true.
1738  *   If drain_begin has woken us, wake it in turn.
1739  *
1740  * Otherwise:
1741  *   Set .has_read to true and return success.
1742  */
1743 static int coroutine_fn GRAPH_RDLOCK
1744 bdrv_replace_test_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
1745                             QEMUIOVector *qiov, BdrvRequestFlags flags)
1746 {
1747     BDRVReplaceTestState *s = bs->opaque;
1748 
1749     if (bs->backing) {
1750         int ret;
1751 
1752         g_assert(!s->drain_count);
1753 
1754         s->io_co = qemu_coroutine_self();
1755         if (s->yield_before_read) {
1756             s->yield_before_read = false;
1757             qemu_coroutine_yield();
1758         }
1759         s->io_co = NULL;
1760 
1761         ret = bdrv_co_preadv(bs->backing, offset, bytes, qiov, 0);
1762         s->has_read = true;
1763 
1764         /* Wake up drain_co if it runs */
1765         if (s->drain_co) {
1766             aio_co_wake(s->drain_co);
1767         }
1768 
1769         return ret;
1770     }
1771 
1772     s->has_read = true;
1773     return 0;
1774 }
1775 
1776 static void coroutine_fn bdrv_replace_test_drain_co(void *opaque)
1777 {
1778     BlockDriverState *bs = opaque;
1779     BDRVReplaceTestState *s = bs->opaque;
1780 
1781     /* Keep waking io_co up until it is done */
1782     while (s->io_co) {
1783         aio_co_wake(s->io_co);
1784         s->io_co = NULL;
1785         qemu_coroutine_yield();
1786     }
1787     s->drain_co = NULL;
1788     bdrv_dec_in_flight(bs);
1789 }
1790 
1791 /**
1792  * If .drain_count is 0, wake up .io_co if there is one; and set
1793  * .was_drained.
1794  * Increment .drain_count.
1795  */
1796 static void bdrv_replace_test_drain_begin(BlockDriverState *bs)
1797 {
1798     BDRVReplaceTestState *s = bs->opaque;
1799 
1800     if (!s->setup_completed) {
1801         return;
1802     }
1803 
1804     if (!s->drain_count) {
1805         s->drain_co = qemu_coroutine_create(bdrv_replace_test_drain_co, bs);
1806         bdrv_inc_in_flight(bs);
1807         aio_co_enter(bdrv_get_aio_context(bs), s->drain_co);
1808         s->was_drained = true;
1809     }
1810     s->drain_count++;
1811 }
1812 
1813 static void coroutine_fn bdrv_replace_test_read_entry(void *opaque)
1814 {
1815     BlockDriverState *bs = opaque;
1816     char data;
1817     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, &data, 1);
1818     int ret;
1819 
1820     /* Queue a read request post-drain */
1821     bdrv_graph_co_rdlock();
1822     ret = bdrv_replace_test_co_preadv(bs, 0, 1, &qiov, 0);
1823     bdrv_graph_co_rdunlock();
1824 
1825     g_assert(ret >= 0);
1826     bdrv_dec_in_flight(bs);
1827 }
1828 
1829 /**
1830  * Reduce .drain_count, set .was_undrained once it reaches 0.
1831  * If .drain_count reaches 0 and the node has a backing file, issue a
1832  * read request.
1833  */
1834 static void bdrv_replace_test_drain_end(BlockDriverState *bs)
1835 {
1836     BDRVReplaceTestState *s = bs->opaque;
1837 
1838     GRAPH_RDLOCK_GUARD_MAINLOOP();
1839 
1840     if (!s->setup_completed) {
1841         return;
1842     }
1843 
1844     g_assert(s->drain_count > 0);
1845     if (!--s->drain_count) {
1846         s->was_undrained = true;
1847 
1848         if (bs->backing) {
1849             Coroutine *co = qemu_coroutine_create(bdrv_replace_test_read_entry,
1850                                                   bs);
1851             bdrv_inc_in_flight(bs);
1852             aio_co_enter(bdrv_get_aio_context(bs), co);
1853         }
1854     }
1855 }
1856 
1857 static BlockDriver bdrv_replace_test = {
1858     .format_name            = "replace_test",
1859     .instance_size          = sizeof(BDRVReplaceTestState),
1860     .supports_backing       = true,
1861 
1862     .bdrv_close             = bdrv_replace_test_close,
1863     .bdrv_co_preadv         = bdrv_replace_test_co_preadv,
1864 
1865     .bdrv_drain_begin       = bdrv_replace_test_drain_begin,
1866     .bdrv_drain_end         = bdrv_replace_test_drain_end,
1867 
1868     .bdrv_child_perm        = bdrv_default_perms,
1869 };
1870 
1871 static void coroutine_fn test_replace_child_mid_drain_read_co(void *opaque)
1872 {
1873     int ret;
1874     char data;
1875 
1876     ret = blk_co_pread(opaque, 0, 1, &data, 0);
1877     g_assert(ret >= 0);
1878 }
1879 
1880 /**
1881  * We test two things:
1882  * (1) bdrv_replace_child_noperm() must not undrain the parent if both
1883  *     children are drained.
1884  * (2) bdrv_replace_child_noperm() must never flush I/O requests to a
1885  *     drained child.  If the old child is drained, it must flush I/O
1886  *     requests after the new one has been attached.  If the new child
1887  *     is drained, it must flush I/O requests before the old one is
1888  *     detached.
1889  *
1890  * To do so, we create one parent node and two child nodes; then
1891  * attach one of the children (old_child_bs) to the parent, then
1892  * drain both old_child_bs and new_child_bs according to
1893  * old_drain_count and new_drain_count, respectively, and finally
1894  * we invoke bdrv_replace_node() to replace old_child_bs by
1895  * new_child_bs.
1896  *
1897  * The test block driver we use here (bdrv_replace_test) has a read
1898  * function that:
1899  * - For the parent node, can optionally yield, and then forwards the
1900  *   read to bdrv_preadv(),
1901  * - For the child node, just returns immediately.
1902  *
1903  * If the read yields, the drain_begin function will wake it up.
1904  *
1905  * The drain_end function issues a read on the parent once it is fully
1906  * undrained (which simulates requests starting to come in again).
1907  */
1908 static void do_test_replace_child_mid_drain(int old_drain_count,
1909                                             int new_drain_count)
1910 {
1911     BlockBackend *parent_blk;
1912     BlockDriverState *parent_bs;
1913     BlockDriverState *old_child_bs, *new_child_bs;
1914     BDRVReplaceTestState *parent_s;
1915     BDRVReplaceTestState *old_child_s, *new_child_s;
1916     Coroutine *io_co;
1917     int i;
1918 
1919     parent_bs = bdrv_new_open_driver(&bdrv_replace_test, "parent", 0,
1920                                      &error_abort);
1921     parent_s = parent_bs->opaque;
1922 
1923     parent_blk = blk_new(qemu_get_aio_context(),
1924                          BLK_PERM_CONSISTENT_READ, BLK_PERM_ALL);
1925     blk_insert_bs(parent_blk, parent_bs, &error_abort);
1926 
1927     old_child_bs = bdrv_new_open_driver(&bdrv_replace_test, "old-child", 0,
1928                                         &error_abort);
1929     new_child_bs = bdrv_new_open_driver(&bdrv_replace_test, "new-child", 0,
1930                                         &error_abort);
1931     old_child_s = old_child_bs->opaque;
1932     new_child_s = new_child_bs->opaque;
1933 
1934     /* So that we can read something */
1935     parent_bs->total_sectors = 1;
1936     old_child_bs->total_sectors = 1;
1937     new_child_bs->total_sectors = 1;
1938 
1939     bdrv_ref(old_child_bs);
1940     bdrv_graph_wrlock();
1941     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
1942                       BDRV_CHILD_COW, &error_abort);
1943     bdrv_graph_wrunlock();
1944     parent_s->setup_completed = true;
1945 
1946     for (i = 0; i < old_drain_count; i++) {
1947         bdrv_drained_begin(old_child_bs);
1948     }
1949     for (i = 0; i < new_drain_count; i++) {
1950         bdrv_drained_begin(new_child_bs);
1951     }
1952 
1953     if (!old_drain_count) {
1954         /*
1955          * Start a read operation that will yield, so it will not
1956          * complete before the node is drained.
1957          */
1958         parent_s->yield_before_read = true;
1959         io_co = qemu_coroutine_create(test_replace_child_mid_drain_read_co,
1960                                       parent_blk);
1961         qemu_coroutine_enter(io_co);
1962     }
1963 
1964     /* If we have started a read operation, it should have yielded */
1965     g_assert(!parent_s->has_read);
1966 
1967     /* Reset drained status so we can see what bdrv_replace_node() does */
1968     parent_s->was_drained = false;
1969     parent_s->was_undrained = false;
1970 
1971     g_assert(parent_bs->quiesce_counter == old_drain_count);
1972     bdrv_drained_begin(old_child_bs);
1973     bdrv_drained_begin(new_child_bs);
1974     bdrv_graph_wrlock();
1975     bdrv_replace_node(old_child_bs, new_child_bs, &error_abort);
1976     bdrv_graph_wrunlock();
1977     bdrv_drained_end(new_child_bs);
1978     bdrv_drained_end(old_child_bs);
1979     g_assert(parent_bs->quiesce_counter == new_drain_count);
1980 
1981     if (!old_drain_count && !new_drain_count) {
1982         /*
1983          * From undrained to undrained drains and undrains the parent,
1984          * because bdrv_replace_node() contains a drained section for
1985          * @old_child_bs.
1986          */
1987         g_assert(parent_s->was_drained && parent_s->was_undrained);
1988     } else if (!old_drain_count && new_drain_count) {
1989         /*
1990          * From undrained to drained should drain the parent and keep
1991          * it that way.
1992          */
1993         g_assert(parent_s->was_drained && !parent_s->was_undrained);
1994     } else if (old_drain_count && !new_drain_count) {
1995         /*
1996          * From drained to undrained should undrain the parent and
1997          * keep it that way.
1998          */
1999         g_assert(!parent_s->was_drained && parent_s->was_undrained);
2000     } else /* if (old_drain_count && new_drain_count) */ {
2001         /*
2002          * From drained to drained must not undrain the parent at any
2003          * point
2004          */
2005         g_assert(!parent_s->was_drained && !parent_s->was_undrained);
2006     }
2007 
2008     if (!old_drain_count || !new_drain_count) {
2009         /*
2010          * If !old_drain_count, we have started a read request before
2011          * bdrv_replace_node().  If !new_drain_count, the parent must
2012          * have been undrained at some point, and
2013          * bdrv_replace_test_co_drain_end() starts a read request
2014          * then.
2015          */
2016         g_assert(parent_s->has_read);
2017     } else {
2018         /*
2019          * If the parent was never undrained, there is no way to start
2020          * a read request.
2021          */
2022         g_assert(!parent_s->has_read);
2023     }
2024 
2025     /* A drained child must have not received any request */
2026     g_assert(!(old_drain_count && old_child_s->has_read));
2027     g_assert(!(new_drain_count && new_child_s->has_read));
2028 
2029     for (i = 0; i < new_drain_count; i++) {
2030         bdrv_drained_end(new_child_bs);
2031     }
2032     for (i = 0; i < old_drain_count; i++) {
2033         bdrv_drained_end(old_child_bs);
2034     }
2035 
2036     /*
2037      * By now, bdrv_replace_test_co_drain_end() must have been called
2038      * at some point while the new child was attached to the parent.
2039      */
2040     g_assert(parent_s->has_read);
2041     g_assert(new_child_s->has_read);
2042 
2043     blk_unref(parent_blk);
2044     bdrv_unref(parent_bs);
2045     bdrv_unref(old_child_bs);
2046     bdrv_unref(new_child_bs);
2047 }
2048 
2049 static void test_replace_child_mid_drain(void)
2050 {
2051     int old_drain_count, new_drain_count;
2052 
2053     for (old_drain_count = 0; old_drain_count < 2; old_drain_count++) {
2054         for (new_drain_count = 0; new_drain_count < 2; new_drain_count++) {
2055             do_test_replace_child_mid_drain(old_drain_count, new_drain_count);
2056         }
2057     }
2058 }
2059 
2060 int main(int argc, char **argv)
2061 {
2062     int ret;
2063 
2064     bdrv_init();
2065     qemu_init_main_loop(&error_abort);
2066 
2067     g_test_init(&argc, &argv, NULL);
2068     qemu_event_init(&done_event, false);
2069 
2070     g_test_add_func("/bdrv-drain/driver-cb/drain_all", test_drv_cb_drain_all);
2071     g_test_add_func("/bdrv-drain/driver-cb/drain", test_drv_cb_drain);
2072 
2073     g_test_add_func("/bdrv-drain/driver-cb/co/drain_all",
2074                     test_drv_cb_co_drain_all);
2075     g_test_add_func("/bdrv-drain/driver-cb/co/drain", test_drv_cb_co_drain);
2076 
2077     g_test_add_func("/bdrv-drain/quiesce/drain_all", test_quiesce_drain_all);
2078     g_test_add_func("/bdrv-drain/quiesce/drain", test_quiesce_drain);
2079 
2080     g_test_add_func("/bdrv-drain/quiesce/co/drain_all",
2081                     test_quiesce_co_drain_all);
2082     g_test_add_func("/bdrv-drain/quiesce/co/drain", test_quiesce_co_drain);
2083 
2084     g_test_add_func("/bdrv-drain/nested", test_nested);
2085 
2086     g_test_add_func("/bdrv-drain/graph-change/drain_all",
2087                     test_graph_change_drain_all);
2088 
2089     g_test_add_func("/bdrv-drain/iothread/drain_all", test_iothread_drain_all);
2090     g_test_add_func("/bdrv-drain/iothread/drain", test_iothread_drain);
2091 
2092     g_test_add_func("/bdrv-drain/blockjob/drain_all", test_blockjob_drain_all);
2093     g_test_add_func("/bdrv-drain/blockjob/drain", test_blockjob_drain);
2094 
2095     g_test_add_func("/bdrv-drain/blockjob/error/drain_all",
2096                     test_blockjob_error_drain_all);
2097     g_test_add_func("/bdrv-drain/blockjob/error/drain",
2098                     test_blockjob_error_drain);
2099 
2100     g_test_add_func("/bdrv-drain/blockjob/iothread/drain_all",
2101                     test_blockjob_iothread_drain_all);
2102     g_test_add_func("/bdrv-drain/blockjob/iothread/drain",
2103                     test_blockjob_iothread_drain);
2104 
2105     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain_all",
2106                     test_blockjob_iothread_error_drain_all);
2107     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain",
2108                     test_blockjob_iothread_error_drain);
2109 
2110     g_test_add_func("/bdrv-drain/deletion/drain", test_delete_by_drain);
2111     g_test_add_func("/bdrv-drain/detach/drain_all", test_detach_by_drain_all);
2112     g_test_add_func("/bdrv-drain/detach/drain", test_detach_by_drain);
2113     g_test_add_func("/bdrv-drain/detach/parent_cb", test_detach_by_parent_cb);
2114     g_test_add_func("/bdrv-drain/detach/driver_cb", test_detach_by_driver_cb);
2115 
2116     g_test_add_func("/bdrv-drain/attach/drain", test_append_to_drained);
2117 
2118     g_test_add_func("/bdrv-drain/set_aio_context", test_set_aio_context);
2119 
2120     g_test_add_func("/bdrv-drain/blockjob/commit_by_drained_end",
2121                     test_blockjob_commit_by_drained_end);
2122 
2123     g_test_add_func("/bdrv-drain/bdrv_drop_intermediate/poll",
2124                     test_drop_intermediate_poll);
2125 
2126     g_test_add_func("/bdrv-drain/replace_child/mid-drain",
2127                     test_replace_child_mid_drain);
2128 
2129     ret = g_test_run();
2130     qemu_event_destroy(&done_event);
2131     return ret;
2132 }
2133