xref: /qemu/tests/unit/test-bdrv-drain.c (revision 372b69f5)
1 /*
2  * Block node draining tests
3  *
4  * Copyright (c) 2017 Kevin Wolf <kwolf@redhat.com>
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "block/block_int.h"
27 #include "block/blockjob_int.h"
28 #include "sysemu/block-backend.h"
29 #include "qapi/error.h"
30 #include "qemu/main-loop.h"
31 #include "iothread.h"
32 
33 static QemuEvent done_event;
34 
35 typedef struct BDRVTestState {
36     int drain_count;
37     AioContext *bh_indirection_ctx;
38     bool sleep_in_drain_begin;
39 } BDRVTestState;
40 
41 static void coroutine_fn sleep_in_drain_begin(void *opaque)
42 {
43     BlockDriverState *bs = opaque;
44 
45     qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
46     bdrv_dec_in_flight(bs);
47 }
48 
49 static void bdrv_test_drain_begin(BlockDriverState *bs)
50 {
51     BDRVTestState *s = bs->opaque;
52     s->drain_count++;
53     if (s->sleep_in_drain_begin) {
54         Coroutine *co = qemu_coroutine_create(sleep_in_drain_begin, bs);
55         bdrv_inc_in_flight(bs);
56         aio_co_enter(bdrv_get_aio_context(bs), co);
57     }
58 }
59 
60 static void bdrv_test_drain_end(BlockDriverState *bs)
61 {
62     BDRVTestState *s = bs->opaque;
63     s->drain_count--;
64 }
65 
66 static void bdrv_test_close(BlockDriverState *bs)
67 {
68     BDRVTestState *s = bs->opaque;
69     g_assert_cmpint(s->drain_count, >, 0);
70 }
71 
72 static void co_reenter_bh(void *opaque)
73 {
74     aio_co_wake(opaque);
75 }
76 
77 static int coroutine_fn bdrv_test_co_preadv(BlockDriverState *bs,
78                                             int64_t offset, int64_t bytes,
79                                             QEMUIOVector *qiov,
80                                             BdrvRequestFlags flags)
81 {
82     BDRVTestState *s = bs->opaque;
83 
84     /* We want this request to stay until the polling loop in drain waits for
85      * it to complete. We need to sleep a while as bdrv_drain_invoke() comes
86      * first and polls its result, too, but it shouldn't accidentally complete
87      * this request yet. */
88     qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
89 
90     if (s->bh_indirection_ctx) {
91         aio_bh_schedule_oneshot(s->bh_indirection_ctx, co_reenter_bh,
92                                 qemu_coroutine_self());
93         qemu_coroutine_yield();
94     }
95 
96     return 0;
97 }
98 
99 static int bdrv_test_change_backing_file(BlockDriverState *bs,
100                                          const char *backing_file,
101                                          const char *backing_fmt)
102 {
103     return 0;
104 }
105 
106 static BlockDriver bdrv_test = {
107     .format_name            = "test",
108     .instance_size          = sizeof(BDRVTestState),
109     .supports_backing       = true,
110 
111     .bdrv_close             = bdrv_test_close,
112     .bdrv_co_preadv         = bdrv_test_co_preadv,
113 
114     .bdrv_drain_begin       = bdrv_test_drain_begin,
115     .bdrv_drain_end         = bdrv_test_drain_end,
116 
117     .bdrv_child_perm        = bdrv_default_perms,
118 
119     .bdrv_change_backing_file = bdrv_test_change_backing_file,
120 };
121 
122 static void aio_ret_cb(void *opaque, int ret)
123 {
124     int *aio_ret = opaque;
125     *aio_ret = ret;
126 }
127 
128 typedef struct CallInCoroutineData {
129     void (*entry)(void);
130     bool done;
131 } CallInCoroutineData;
132 
133 static coroutine_fn void call_in_coroutine_entry(void *opaque)
134 {
135     CallInCoroutineData *data = opaque;
136 
137     data->entry();
138     data->done = true;
139 }
140 
141 static void call_in_coroutine(void (*entry)(void))
142 {
143     Coroutine *co;
144     CallInCoroutineData data = {
145         .entry  = entry,
146         .done   = false,
147     };
148 
149     co = qemu_coroutine_create(call_in_coroutine_entry, &data);
150     qemu_coroutine_enter(co);
151     while (!data.done) {
152         aio_poll(qemu_get_aio_context(), true);
153     }
154 }
155 
156 enum drain_type {
157     BDRV_DRAIN_ALL,
158     BDRV_DRAIN,
159     DRAIN_TYPE_MAX,
160 };
161 
162 static void do_drain_begin(enum drain_type drain_type, BlockDriverState *bs)
163 {
164     switch (drain_type) {
165     case BDRV_DRAIN_ALL:        bdrv_drain_all_begin(); break;
166     case BDRV_DRAIN:            bdrv_drained_begin(bs); break;
167     default:                    g_assert_not_reached();
168     }
169 }
170 
171 static void do_drain_end(enum drain_type drain_type, BlockDriverState *bs)
172 {
173     switch (drain_type) {
174     case BDRV_DRAIN_ALL:        bdrv_drain_all_end(); break;
175     case BDRV_DRAIN:            bdrv_drained_end(bs); break;
176     default:                    g_assert_not_reached();
177     }
178 }
179 
180 static void do_drain_begin_unlocked(enum drain_type drain_type, BlockDriverState *bs)
181 {
182     if (drain_type != BDRV_DRAIN_ALL) {
183         aio_context_acquire(bdrv_get_aio_context(bs));
184     }
185     do_drain_begin(drain_type, bs);
186     if (drain_type != BDRV_DRAIN_ALL) {
187         aio_context_release(bdrv_get_aio_context(bs));
188     }
189 }
190 
191 static BlockBackend * no_coroutine_fn test_setup(void)
192 {
193     BlockBackend *blk;
194     BlockDriverState *bs, *backing;
195 
196     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
197     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
198                               &error_abort);
199     blk_insert_bs(blk, bs, &error_abort);
200 
201     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
202     bdrv_set_backing_hd(bs, backing, &error_abort);
203 
204     bdrv_unref(backing);
205     bdrv_unref(bs);
206 
207     return blk;
208 }
209 
210 static void do_drain_end_unlocked(enum drain_type drain_type, BlockDriverState *bs)
211 {
212     if (drain_type != BDRV_DRAIN_ALL) {
213         aio_context_acquire(bdrv_get_aio_context(bs));
214     }
215     do_drain_end(drain_type, bs);
216     if (drain_type != BDRV_DRAIN_ALL) {
217         aio_context_release(bdrv_get_aio_context(bs));
218     }
219 }
220 
221 static void test_drv_cb_common(BlockBackend *blk, enum drain_type drain_type,
222                                bool recursive)
223 {
224     BlockDriverState *bs = blk_bs(blk);
225     BlockDriverState *backing = bs->backing->bs;
226     BDRVTestState *s, *backing_s;
227     BlockAIOCB *acb;
228     int aio_ret;
229 
230     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
231 
232     s = bs->opaque;
233     backing_s = backing->opaque;
234 
235     /* Simple bdrv_drain_all_begin/end pair, check that CBs are called */
236     g_assert_cmpint(s->drain_count, ==, 0);
237     g_assert_cmpint(backing_s->drain_count, ==, 0);
238 
239     do_drain_begin(drain_type, bs);
240 
241     g_assert_cmpint(s->drain_count, ==, 1);
242     g_assert_cmpint(backing_s->drain_count, ==, !!recursive);
243 
244     do_drain_end(drain_type, bs);
245 
246     g_assert_cmpint(s->drain_count, ==, 0);
247     g_assert_cmpint(backing_s->drain_count, ==, 0);
248 
249     /* Now do the same while a request is pending */
250     aio_ret = -EINPROGRESS;
251     acb = blk_aio_preadv(blk, 0, &qiov, 0, aio_ret_cb, &aio_ret);
252     g_assert(acb != NULL);
253     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
254 
255     g_assert_cmpint(s->drain_count, ==, 0);
256     g_assert_cmpint(backing_s->drain_count, ==, 0);
257 
258     do_drain_begin(drain_type, bs);
259 
260     g_assert_cmpint(aio_ret, ==, 0);
261     g_assert_cmpint(s->drain_count, ==, 1);
262     g_assert_cmpint(backing_s->drain_count, ==, !!recursive);
263 
264     do_drain_end(drain_type, bs);
265 
266     g_assert_cmpint(s->drain_count, ==, 0);
267     g_assert_cmpint(backing_s->drain_count, ==, 0);
268 }
269 
270 static void test_drv_cb_drain_all(void)
271 {
272     BlockBackend *blk = test_setup();
273     test_drv_cb_common(blk, BDRV_DRAIN_ALL, true);
274     blk_unref(blk);
275 }
276 
277 static void test_drv_cb_drain(void)
278 {
279     BlockBackend *blk = test_setup();
280     test_drv_cb_common(blk, BDRV_DRAIN, false);
281     blk_unref(blk);
282 }
283 
284 static void coroutine_fn test_drv_cb_co_drain_all_entry(void)
285 {
286     BlockBackend *blk = blk_all_next(NULL);
287     test_drv_cb_common(blk, BDRV_DRAIN_ALL, true);
288 }
289 
290 static void test_drv_cb_co_drain_all(void)
291 {
292     BlockBackend *blk = test_setup();
293     call_in_coroutine(test_drv_cb_co_drain_all_entry);
294     blk_unref(blk);
295 }
296 
297 static void coroutine_fn test_drv_cb_co_drain_entry(void)
298 {
299     BlockBackend *blk = blk_all_next(NULL);
300     test_drv_cb_common(blk, BDRV_DRAIN, false);
301 }
302 
303 static void test_drv_cb_co_drain(void)
304 {
305     BlockBackend *blk = test_setup();
306     call_in_coroutine(test_drv_cb_co_drain_entry);
307     blk_unref(blk);
308 }
309 
310 static void test_quiesce_common(BlockBackend *blk, enum drain_type drain_type,
311                                 bool recursive)
312 {
313     BlockDriverState *bs = blk_bs(blk);
314     BlockDriverState *backing = bs->backing->bs;
315 
316     g_assert_cmpint(bs->quiesce_counter, ==, 0);
317     g_assert_cmpint(backing->quiesce_counter, ==, 0);
318 
319     do_drain_begin(drain_type, bs);
320 
321     if (drain_type == BDRV_DRAIN_ALL) {
322         g_assert_cmpint(bs->quiesce_counter, ==, 2);
323     } else {
324         g_assert_cmpint(bs->quiesce_counter, ==, 1);
325     }
326     g_assert_cmpint(backing->quiesce_counter, ==, !!recursive);
327 
328     do_drain_end(drain_type, bs);
329 
330     g_assert_cmpint(bs->quiesce_counter, ==, 0);
331     g_assert_cmpint(backing->quiesce_counter, ==, 0);
332 }
333 
334 static void test_quiesce_drain_all(void)
335 {
336     BlockBackend *blk = test_setup();
337     test_quiesce_common(blk, BDRV_DRAIN_ALL, true);
338     blk_unref(blk);
339 }
340 
341 static void test_quiesce_drain(void)
342 {
343     BlockBackend *blk = test_setup();
344     test_quiesce_common(blk, BDRV_DRAIN, false);
345     blk_unref(blk);
346 }
347 
348 static void coroutine_fn test_quiesce_co_drain_all_entry(void)
349 {
350     BlockBackend *blk = blk_all_next(NULL);
351     test_quiesce_common(blk, BDRV_DRAIN_ALL, true);
352 }
353 
354 static void test_quiesce_co_drain_all(void)
355 {
356     BlockBackend *blk = test_setup();
357     call_in_coroutine(test_quiesce_co_drain_all_entry);
358     blk_unref(blk);
359 }
360 
361 static void coroutine_fn test_quiesce_co_drain_entry(void)
362 {
363     BlockBackend *blk = blk_all_next(NULL);
364     test_quiesce_common(blk, BDRV_DRAIN, false);
365 }
366 
367 static void test_quiesce_co_drain(void)
368 {
369     BlockBackend *blk = test_setup();
370     call_in_coroutine(test_quiesce_co_drain_entry);
371     blk_unref(blk);
372 }
373 
374 static void test_nested(void)
375 {
376     BlockBackend *blk;
377     BlockDriverState *bs, *backing;
378     BDRVTestState *s, *backing_s;
379     enum drain_type outer, inner;
380 
381     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
382     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
383                               &error_abort);
384     s = bs->opaque;
385     blk_insert_bs(blk, bs, &error_abort);
386 
387     backing = bdrv_new_open_driver(&bdrv_test, "backing", 0, &error_abort);
388     backing_s = backing->opaque;
389     bdrv_set_backing_hd(bs, backing, &error_abort);
390 
391     for (outer = 0; outer < DRAIN_TYPE_MAX; outer++) {
392         for (inner = 0; inner < DRAIN_TYPE_MAX; inner++) {
393             int backing_quiesce = (outer == BDRV_DRAIN_ALL) +
394                                   (inner == BDRV_DRAIN_ALL);
395 
396             g_assert_cmpint(bs->quiesce_counter, ==, 0);
397             g_assert_cmpint(backing->quiesce_counter, ==, 0);
398             g_assert_cmpint(s->drain_count, ==, 0);
399             g_assert_cmpint(backing_s->drain_count, ==, 0);
400 
401             do_drain_begin(outer, bs);
402             do_drain_begin(inner, bs);
403 
404             g_assert_cmpint(bs->quiesce_counter, ==, 2 + !!backing_quiesce);
405             g_assert_cmpint(backing->quiesce_counter, ==, backing_quiesce);
406             g_assert_cmpint(s->drain_count, ==, 1);
407             g_assert_cmpint(backing_s->drain_count, ==, !!backing_quiesce);
408 
409             do_drain_end(inner, bs);
410             do_drain_end(outer, bs);
411 
412             g_assert_cmpint(bs->quiesce_counter, ==, 0);
413             g_assert_cmpint(backing->quiesce_counter, ==, 0);
414             g_assert_cmpint(s->drain_count, ==, 0);
415             g_assert_cmpint(backing_s->drain_count, ==, 0);
416         }
417     }
418 
419     bdrv_unref(backing);
420     bdrv_unref(bs);
421     blk_unref(blk);
422 }
423 
424 static void test_graph_change_drain_all(void)
425 {
426     BlockBackend *blk_a, *blk_b;
427     BlockDriverState *bs_a, *bs_b;
428     BDRVTestState *a_s, *b_s;
429 
430     /* Create node A with a BlockBackend */
431     blk_a = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
432     bs_a = bdrv_new_open_driver(&bdrv_test, "test-node-a", BDRV_O_RDWR,
433                                 &error_abort);
434     a_s = bs_a->opaque;
435     blk_insert_bs(blk_a, bs_a, &error_abort);
436 
437     g_assert_cmpint(bs_a->quiesce_counter, ==, 0);
438     g_assert_cmpint(a_s->drain_count, ==, 0);
439 
440     /* Call bdrv_drain_all_begin() */
441     bdrv_drain_all_begin();
442 
443     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
444     g_assert_cmpint(a_s->drain_count, ==, 1);
445 
446     /* Create node B with a BlockBackend */
447     blk_b = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
448     bs_b = bdrv_new_open_driver(&bdrv_test, "test-node-b", BDRV_O_RDWR,
449                                 &error_abort);
450     b_s = bs_b->opaque;
451     blk_insert_bs(blk_b, bs_b, &error_abort);
452 
453     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
454     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
455     g_assert_cmpint(a_s->drain_count, ==, 1);
456     g_assert_cmpint(b_s->drain_count, ==, 1);
457 
458     /* Unref and finally delete node A */
459     blk_unref(blk_a);
460 
461     g_assert_cmpint(bs_a->quiesce_counter, ==, 1);
462     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
463     g_assert_cmpint(a_s->drain_count, ==, 1);
464     g_assert_cmpint(b_s->drain_count, ==, 1);
465 
466     bdrv_unref(bs_a);
467 
468     g_assert_cmpint(bs_b->quiesce_counter, ==, 1);
469     g_assert_cmpint(b_s->drain_count, ==, 1);
470 
471     /* End the drained section */
472     bdrv_drain_all_end();
473 
474     g_assert_cmpint(bs_b->quiesce_counter, ==, 0);
475     g_assert_cmpint(b_s->drain_count, ==, 0);
476 
477     bdrv_unref(bs_b);
478     blk_unref(blk_b);
479 }
480 
481 struct test_iothread_data {
482     BlockDriverState *bs;
483     enum drain_type drain_type;
484     int *aio_ret;
485     bool co_done;
486 };
487 
488 static void coroutine_fn test_iothread_drain_co_entry(void *opaque)
489 {
490     struct test_iothread_data *data = opaque;
491 
492     do_drain_begin(data->drain_type, data->bs);
493     g_assert_cmpint(*data->aio_ret, ==, 0);
494     do_drain_end(data->drain_type, data->bs);
495 
496     data->co_done = true;
497     aio_wait_kick();
498 }
499 
500 static void test_iothread_aio_cb(void *opaque, int ret)
501 {
502     int *aio_ret = opaque;
503     *aio_ret = ret;
504     qemu_event_set(&done_event);
505 }
506 
507 static void test_iothread_main_thread_bh(void *opaque)
508 {
509     struct test_iothread_data *data = opaque;
510 
511     /* Test that the AioContext is not yet locked in a random BH that is
512      * executed during drain, otherwise this would deadlock. */
513     aio_context_acquire(bdrv_get_aio_context(data->bs));
514     bdrv_flush(data->bs);
515     bdrv_dec_in_flight(data->bs); /* incremented by test_iothread_common() */
516     aio_context_release(bdrv_get_aio_context(data->bs));
517 }
518 
519 /*
520  * Starts an AIO request on a BDS that runs in the AioContext of iothread 1.
521  * The request involves a BH on iothread 2 before it can complete.
522  *
523  * @drain_thread = 0 means that do_drain_begin/end are called from the main
524  * thread, @drain_thread = 1 means that they are called from iothread 1. Drain
525  * for this BDS cannot be called from iothread 2 because only the main thread
526  * may do cross-AioContext polling.
527  */
528 static void test_iothread_common(enum drain_type drain_type, int drain_thread)
529 {
530     BlockBackend *blk;
531     BlockDriverState *bs;
532     BDRVTestState *s;
533     BlockAIOCB *acb;
534     Coroutine *co;
535     int aio_ret;
536     struct test_iothread_data data;
537 
538     IOThread *a = iothread_new();
539     IOThread *b = iothread_new();
540     AioContext *ctx_a = iothread_get_aio_context(a);
541     AioContext *ctx_b = iothread_get_aio_context(b);
542 
543     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
544 
545     /* bdrv_drain_all() may only be called from the main loop thread */
546     if (drain_type == BDRV_DRAIN_ALL && drain_thread != 0) {
547         goto out;
548     }
549 
550     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
551     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
552                               &error_abort);
553     s = bs->opaque;
554     blk_insert_bs(blk, bs, &error_abort);
555     blk_set_disable_request_queuing(blk, true);
556 
557     blk_set_aio_context(blk, ctx_a, &error_abort);
558     aio_context_acquire(ctx_a);
559 
560     s->bh_indirection_ctx = ctx_b;
561 
562     aio_ret = -EINPROGRESS;
563     qemu_event_reset(&done_event);
564 
565     if (drain_thread == 0) {
566         acb = blk_aio_preadv(blk, 0, &qiov, 0, test_iothread_aio_cb, &aio_ret);
567     } else {
568         acb = blk_aio_preadv(blk, 0, &qiov, 0, aio_ret_cb, &aio_ret);
569     }
570     g_assert(acb != NULL);
571     g_assert_cmpint(aio_ret, ==, -EINPROGRESS);
572 
573     aio_context_release(ctx_a);
574 
575     data = (struct test_iothread_data) {
576         .bs         = bs,
577         .drain_type = drain_type,
578         .aio_ret    = &aio_ret,
579     };
580 
581     switch (drain_thread) {
582     case 0:
583         if (drain_type != BDRV_DRAIN_ALL) {
584             aio_context_acquire(ctx_a);
585         }
586 
587         /*
588          * Increment in_flight so that do_drain_begin() waits for
589          * test_iothread_main_thread_bh(). This prevents the race between
590          * test_iothread_main_thread_bh() in IOThread a and do_drain_begin() in
591          * this thread. test_iothread_main_thread_bh() decrements in_flight.
592          */
593         bdrv_inc_in_flight(bs);
594         aio_bh_schedule_oneshot(ctx_a, test_iothread_main_thread_bh, &data);
595 
596         /* The request is running on the IOThread a. Draining its block device
597          * will make sure that it has completed as far as the BDS is concerned,
598          * but the drain in this thread can continue immediately after
599          * bdrv_dec_in_flight() and aio_ret might be assigned only slightly
600          * later. */
601         do_drain_begin(drain_type, bs);
602         g_assert_cmpint(bs->in_flight, ==, 0);
603 
604         if (drain_type != BDRV_DRAIN_ALL) {
605             aio_context_release(ctx_a);
606         }
607         qemu_event_wait(&done_event);
608         if (drain_type != BDRV_DRAIN_ALL) {
609             aio_context_acquire(ctx_a);
610         }
611 
612         g_assert_cmpint(aio_ret, ==, 0);
613         do_drain_end(drain_type, bs);
614 
615         if (drain_type != BDRV_DRAIN_ALL) {
616             aio_context_release(ctx_a);
617         }
618         break;
619     case 1:
620         co = qemu_coroutine_create(test_iothread_drain_co_entry, &data);
621         aio_co_enter(ctx_a, co);
622         AIO_WAIT_WHILE_UNLOCKED(NULL, !data.co_done);
623         break;
624     default:
625         g_assert_not_reached();
626     }
627 
628     aio_context_acquire(ctx_a);
629     blk_set_aio_context(blk, qemu_get_aio_context(), &error_abort);
630     aio_context_release(ctx_a);
631 
632     bdrv_unref(bs);
633     blk_unref(blk);
634 
635 out:
636     iothread_join(a);
637     iothread_join(b);
638 }
639 
640 static void test_iothread_drain_all(void)
641 {
642     test_iothread_common(BDRV_DRAIN_ALL, 0);
643     test_iothread_common(BDRV_DRAIN_ALL, 1);
644 }
645 
646 static void test_iothread_drain(void)
647 {
648     test_iothread_common(BDRV_DRAIN, 0);
649     test_iothread_common(BDRV_DRAIN, 1);
650 }
651 
652 
653 typedef struct TestBlockJob {
654     BlockJob common;
655     BlockDriverState *bs;
656     int run_ret;
657     int prepare_ret;
658     bool running;
659     bool should_complete;
660 } TestBlockJob;
661 
662 static int test_job_prepare(Job *job)
663 {
664     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
665 
666     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
667     bdrv_flush(s->bs);
668     return s->prepare_ret;
669 }
670 
671 static void test_job_commit(Job *job)
672 {
673     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
674 
675     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
676     bdrv_flush(s->bs);
677 }
678 
679 static void test_job_abort(Job *job)
680 {
681     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
682 
683     /* Provoke an AIO_WAIT_WHILE() call to verify there is no deadlock */
684     bdrv_flush(s->bs);
685 }
686 
687 static int coroutine_fn test_job_run(Job *job, Error **errp)
688 {
689     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
690 
691     /* We are running the actual job code past the pause point in
692      * job_co_entry(). */
693     s->running = true;
694 
695     job_transition_to_ready(&s->common.job);
696     while (!s->should_complete) {
697         /* Avoid job_sleep_ns() because it marks the job as !busy. We want to
698          * emulate some actual activity (probably some I/O) here so that drain
699          * has to wait for this activity to stop. */
700         qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 1000000);
701 
702         job_pause_point(&s->common.job);
703     }
704 
705     return s->run_ret;
706 }
707 
708 static void test_job_complete(Job *job, Error **errp)
709 {
710     TestBlockJob *s = container_of(job, TestBlockJob, common.job);
711     s->should_complete = true;
712 }
713 
714 BlockJobDriver test_job_driver = {
715     .job_driver = {
716         .instance_size  = sizeof(TestBlockJob),
717         .free           = block_job_free,
718         .user_resume    = block_job_user_resume,
719         .run            = test_job_run,
720         .complete       = test_job_complete,
721         .prepare        = test_job_prepare,
722         .commit         = test_job_commit,
723         .abort          = test_job_abort,
724     },
725 };
726 
727 enum test_job_result {
728     TEST_JOB_SUCCESS,
729     TEST_JOB_FAIL_RUN,
730     TEST_JOB_FAIL_PREPARE,
731 };
732 
733 enum test_job_drain_node {
734     TEST_JOB_DRAIN_SRC,
735     TEST_JOB_DRAIN_SRC_CHILD,
736 };
737 
738 static void test_blockjob_common_drain_node(enum drain_type drain_type,
739                                             bool use_iothread,
740                                             enum test_job_result result,
741                                             enum test_job_drain_node drain_node)
742 {
743     BlockBackend *blk_src, *blk_target;
744     BlockDriverState *src, *src_backing, *src_overlay, *target, *drain_bs;
745     BlockJob *job;
746     TestBlockJob *tjob;
747     IOThread *iothread = NULL;
748     AioContext *ctx;
749     int ret;
750 
751     src = bdrv_new_open_driver(&bdrv_test, "source", BDRV_O_RDWR,
752                                &error_abort);
753     src_backing = bdrv_new_open_driver(&bdrv_test, "source-backing",
754                                        BDRV_O_RDWR, &error_abort);
755     src_overlay = bdrv_new_open_driver(&bdrv_test, "source-overlay",
756                                        BDRV_O_RDWR, &error_abort);
757 
758     bdrv_set_backing_hd(src_overlay, src, &error_abort);
759     bdrv_unref(src);
760     bdrv_set_backing_hd(src, src_backing, &error_abort);
761     bdrv_unref(src_backing);
762 
763     blk_src = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
764     blk_insert_bs(blk_src, src_overlay, &error_abort);
765 
766     switch (drain_node) {
767     case TEST_JOB_DRAIN_SRC:
768         drain_bs = src;
769         break;
770     case TEST_JOB_DRAIN_SRC_CHILD:
771         drain_bs = src_backing;
772         break;
773     default:
774         g_assert_not_reached();
775     }
776 
777     if (use_iothread) {
778         iothread = iothread_new();
779         ctx = iothread_get_aio_context(iothread);
780         blk_set_aio_context(blk_src, ctx, &error_abort);
781     } else {
782         ctx = qemu_get_aio_context();
783     }
784 
785     target = bdrv_new_open_driver(&bdrv_test, "target", BDRV_O_RDWR,
786                                   &error_abort);
787     blk_target = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
788     blk_insert_bs(blk_target, target, &error_abort);
789     blk_set_allow_aio_context_change(blk_target, true);
790 
791     aio_context_acquire(ctx);
792     tjob = block_job_create("job0", &test_job_driver, NULL, src,
793                             0, BLK_PERM_ALL,
794                             0, 0, NULL, NULL, &error_abort);
795     tjob->bs = src;
796     job = &tjob->common;
797 
798     bdrv_graph_wrlock(target);
799     block_job_add_bdrv(job, "target", target, 0, BLK_PERM_ALL, &error_abort);
800     bdrv_graph_wrunlock();
801 
802     switch (result) {
803     case TEST_JOB_SUCCESS:
804         break;
805     case TEST_JOB_FAIL_RUN:
806         tjob->run_ret = -EIO;
807         break;
808     case TEST_JOB_FAIL_PREPARE:
809         tjob->prepare_ret = -EIO;
810         break;
811     }
812     aio_context_release(ctx);
813 
814     job_start(&job->job);
815 
816     if (use_iothread) {
817         /* job_co_entry() is run in the I/O thread, wait for the actual job
818          * code to start (we don't want to catch the job in the pause point in
819          * job_co_entry(). */
820         while (!tjob->running) {
821             aio_poll(qemu_get_aio_context(), false);
822         }
823     }
824 
825     WITH_JOB_LOCK_GUARD() {
826         g_assert_cmpint(job->job.pause_count, ==, 0);
827         g_assert_false(job->job.paused);
828         g_assert_true(tjob->running);
829         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
830     }
831 
832     do_drain_begin_unlocked(drain_type, drain_bs);
833 
834     WITH_JOB_LOCK_GUARD() {
835         if (drain_type == BDRV_DRAIN_ALL) {
836             /* bdrv_drain_all() drains both src and target */
837             g_assert_cmpint(job->job.pause_count, ==, 2);
838         } else {
839             g_assert_cmpint(job->job.pause_count, ==, 1);
840         }
841         g_assert_true(job->job.paused);
842         g_assert_false(job->job.busy); /* The job is paused */
843     }
844 
845     do_drain_end_unlocked(drain_type, drain_bs);
846 
847     if (use_iothread) {
848         /*
849          * Here we are waiting for the paused status to change,
850          * so don't bother protecting the read every time.
851          *
852          * paused is reset in the I/O thread, wait for it
853          */
854         while (job->job.paused) {
855             aio_poll(qemu_get_aio_context(), false);
856         }
857     }
858 
859     WITH_JOB_LOCK_GUARD() {
860         g_assert_cmpint(job->job.pause_count, ==, 0);
861         g_assert_false(job->job.paused);
862         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
863     }
864 
865     do_drain_begin_unlocked(drain_type, target);
866 
867     WITH_JOB_LOCK_GUARD() {
868         if (drain_type == BDRV_DRAIN_ALL) {
869             /* bdrv_drain_all() drains both src and target */
870             g_assert_cmpint(job->job.pause_count, ==, 2);
871         } else {
872             g_assert_cmpint(job->job.pause_count, ==, 1);
873         }
874         g_assert_true(job->job.paused);
875         g_assert_false(job->job.busy); /* The job is paused */
876     }
877 
878     do_drain_end_unlocked(drain_type, target);
879 
880     if (use_iothread) {
881         /*
882          * Here we are waiting for the paused status to change,
883          * so don't bother protecting the read every time.
884          *
885          * paused is reset in the I/O thread, wait for it
886          */
887         while (job->job.paused) {
888             aio_poll(qemu_get_aio_context(), false);
889         }
890     }
891 
892     WITH_JOB_LOCK_GUARD() {
893         g_assert_cmpint(job->job.pause_count, ==, 0);
894         g_assert_false(job->job.paused);
895         g_assert_true(job->job.busy); /* We're in qemu_co_sleep_ns() */
896     }
897 
898     WITH_JOB_LOCK_GUARD() {
899         ret = job_complete_sync_locked(&job->job, &error_abort);
900     }
901     g_assert_cmpint(ret, ==, (result == TEST_JOB_SUCCESS ? 0 : -EIO));
902 
903     aio_context_acquire(ctx);
904     if (use_iothread) {
905         blk_set_aio_context(blk_src, qemu_get_aio_context(), &error_abort);
906         assert(blk_get_aio_context(blk_target) == qemu_get_aio_context());
907     }
908     aio_context_release(ctx);
909 
910     blk_unref(blk_src);
911     blk_unref(blk_target);
912     bdrv_unref(src_overlay);
913     bdrv_unref(target);
914 
915     if (iothread) {
916         iothread_join(iothread);
917     }
918 }
919 
920 static void test_blockjob_common(enum drain_type drain_type, bool use_iothread,
921                                  enum test_job_result result)
922 {
923     test_blockjob_common_drain_node(drain_type, use_iothread, result,
924                                     TEST_JOB_DRAIN_SRC);
925     test_blockjob_common_drain_node(drain_type, use_iothread, result,
926                                     TEST_JOB_DRAIN_SRC_CHILD);
927 }
928 
929 static void test_blockjob_drain_all(void)
930 {
931     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_SUCCESS);
932 }
933 
934 static void test_blockjob_drain(void)
935 {
936     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_SUCCESS);
937 }
938 
939 static void test_blockjob_error_drain_all(void)
940 {
941     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_RUN);
942     test_blockjob_common(BDRV_DRAIN_ALL, false, TEST_JOB_FAIL_PREPARE);
943 }
944 
945 static void test_blockjob_error_drain(void)
946 {
947     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_RUN);
948     test_blockjob_common(BDRV_DRAIN, false, TEST_JOB_FAIL_PREPARE);
949 }
950 
951 static void test_blockjob_iothread_drain_all(void)
952 {
953     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_SUCCESS);
954 }
955 
956 static void test_blockjob_iothread_drain(void)
957 {
958     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_SUCCESS);
959 }
960 
961 static void test_blockjob_iothread_error_drain_all(void)
962 {
963     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_RUN);
964     test_blockjob_common(BDRV_DRAIN_ALL, true, TEST_JOB_FAIL_PREPARE);
965 }
966 
967 static void test_blockjob_iothread_error_drain(void)
968 {
969     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_RUN);
970     test_blockjob_common(BDRV_DRAIN, true, TEST_JOB_FAIL_PREPARE);
971 }
972 
973 
974 typedef struct BDRVTestTopState {
975     BdrvChild *wait_child;
976 } BDRVTestTopState;
977 
978 static void bdrv_test_top_close(BlockDriverState *bs)
979 {
980     BdrvChild *c, *next_c;
981 
982     bdrv_graph_wrlock(NULL);
983     QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
984         bdrv_unref_child(bs, c);
985     }
986     bdrv_graph_wrunlock();
987 }
988 
989 static int coroutine_fn GRAPH_RDLOCK
990 bdrv_test_top_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
991                         QEMUIOVector *qiov, BdrvRequestFlags flags)
992 {
993     BDRVTestTopState *tts = bs->opaque;
994     return bdrv_co_preadv(tts->wait_child, offset, bytes, qiov, flags);
995 }
996 
997 static BlockDriver bdrv_test_top_driver = {
998     .format_name            = "test_top_driver",
999     .instance_size          = sizeof(BDRVTestTopState),
1000 
1001     .bdrv_close             = bdrv_test_top_close,
1002     .bdrv_co_preadv         = bdrv_test_top_co_preadv,
1003 
1004     .bdrv_child_perm        = bdrv_default_perms,
1005 };
1006 
1007 typedef struct TestCoDeleteByDrainData {
1008     BlockBackend *blk;
1009     bool detach_instead_of_delete;
1010     bool done;
1011 } TestCoDeleteByDrainData;
1012 
1013 static void coroutine_fn test_co_delete_by_drain(void *opaque)
1014 {
1015     TestCoDeleteByDrainData *dbdd = opaque;
1016     BlockBackend *blk = dbdd->blk;
1017     BlockDriverState *bs = blk_bs(blk);
1018     BDRVTestTopState *tts = bs->opaque;
1019     void *buffer = g_malloc(65536);
1020     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buffer, 65536);
1021 
1022     /* Pretend some internal write operation from parent to child.
1023      * Important: We have to read from the child, not from the parent!
1024      * Draining works by first propagating it all up the tree to the
1025      * root and then waiting for drainage from root to the leaves
1026      * (protocol nodes).  If we have a request waiting on the root,
1027      * everything will be drained before we go back down the tree, but
1028      * we do not want that.  We want to be in the middle of draining
1029      * when this following requests returns. */
1030     bdrv_graph_co_rdlock();
1031     bdrv_co_preadv(tts->wait_child, 0, 65536, &qiov, 0);
1032     bdrv_graph_co_rdunlock();
1033 
1034     g_assert_cmpint(bs->refcnt, ==, 1);
1035 
1036     if (!dbdd->detach_instead_of_delete) {
1037         blk_co_unref(blk);
1038     } else {
1039         BdrvChild *c, *next_c;
1040         bdrv_graph_co_rdlock();
1041         QLIST_FOREACH_SAFE(c, &bs->children, next, next_c) {
1042             bdrv_graph_co_rdunlock();
1043             bdrv_co_unref_child(bs, c);
1044             bdrv_graph_co_rdlock();
1045         }
1046         bdrv_graph_co_rdunlock();
1047     }
1048 
1049     dbdd->done = true;
1050     g_free(buffer);
1051 }
1052 
1053 /**
1054  * Test what happens when some BDS has some children, you drain one of
1055  * them and this results in the BDS being deleted.
1056  *
1057  * If @detach_instead_of_delete is set, the BDS is not going to be
1058  * deleted but will only detach all of its children.
1059  */
1060 static void do_test_delete_by_drain(bool detach_instead_of_delete,
1061                                     enum drain_type drain_type)
1062 {
1063     BlockBackend *blk;
1064     BlockDriverState *bs, *child_bs, *null_bs;
1065     BDRVTestTopState *tts;
1066     TestCoDeleteByDrainData dbdd;
1067     Coroutine *co;
1068 
1069     bs = bdrv_new_open_driver(&bdrv_test_top_driver, "top", BDRV_O_RDWR,
1070                               &error_abort);
1071     bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
1072     tts = bs->opaque;
1073 
1074     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
1075                         &error_abort);
1076     bdrv_graph_wrlock(NULL);
1077     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds,
1078                       BDRV_CHILD_DATA, &error_abort);
1079     bdrv_graph_wrunlock();
1080 
1081     /* This child will be the one to pass to requests through to, and
1082      * it will stall until a drain occurs */
1083     child_bs = bdrv_new_open_driver(&bdrv_test, "child", BDRV_O_RDWR,
1084                                     &error_abort);
1085     child_bs->total_sectors = 65536 >> BDRV_SECTOR_BITS;
1086     /* Takes our reference to child_bs */
1087     bdrv_graph_wrlock(NULL);
1088     tts->wait_child = bdrv_attach_child(bs, child_bs, "wait-child",
1089                                         &child_of_bds,
1090                                         BDRV_CHILD_DATA | BDRV_CHILD_PRIMARY,
1091                                         &error_abort);
1092     bdrv_graph_wrunlock();
1093 
1094     /* This child is just there to be deleted
1095      * (for detach_instead_of_delete == true) */
1096     null_bs = bdrv_open("null-co://", NULL, NULL, BDRV_O_RDWR | BDRV_O_PROTOCOL,
1097                         &error_abort);
1098     bdrv_graph_wrlock(NULL);
1099     bdrv_attach_child(bs, null_bs, "null-child", &child_of_bds, BDRV_CHILD_DATA,
1100                       &error_abort);
1101     bdrv_graph_wrunlock();
1102 
1103     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1104     blk_insert_bs(blk, bs, &error_abort);
1105 
1106     /* Referenced by blk now */
1107     bdrv_unref(bs);
1108 
1109     g_assert_cmpint(bs->refcnt, ==, 1);
1110     g_assert_cmpint(child_bs->refcnt, ==, 1);
1111     g_assert_cmpint(null_bs->refcnt, ==, 1);
1112 
1113 
1114     dbdd = (TestCoDeleteByDrainData){
1115         .blk = blk,
1116         .detach_instead_of_delete = detach_instead_of_delete,
1117         .done = false,
1118     };
1119     co = qemu_coroutine_create(test_co_delete_by_drain, &dbdd);
1120     qemu_coroutine_enter(co);
1121 
1122     /* Drain the child while the read operation is still pending.
1123      * This should result in the operation finishing and
1124      * test_co_delete_by_drain() resuming.  Thus, @bs will be deleted
1125      * and the coroutine will exit while this drain operation is still
1126      * in progress. */
1127     switch (drain_type) {
1128     case BDRV_DRAIN:
1129         bdrv_ref(child_bs);
1130         bdrv_drain(child_bs);
1131         bdrv_unref(child_bs);
1132         break;
1133     case BDRV_DRAIN_ALL:
1134         bdrv_drain_all_begin();
1135         bdrv_drain_all_end();
1136         break;
1137     default:
1138         g_assert_not_reached();
1139     }
1140 
1141     while (!dbdd.done) {
1142         aio_poll(qemu_get_aio_context(), true);
1143     }
1144 
1145     if (detach_instead_of_delete) {
1146         /* Here, the reference has not passed over to the coroutine,
1147          * so we have to delete the BB ourselves */
1148         blk_unref(blk);
1149     }
1150 }
1151 
1152 static void test_delete_by_drain(void)
1153 {
1154     do_test_delete_by_drain(false, BDRV_DRAIN);
1155 }
1156 
1157 static void test_detach_by_drain_all(void)
1158 {
1159     do_test_delete_by_drain(true, BDRV_DRAIN_ALL);
1160 }
1161 
1162 static void test_detach_by_drain(void)
1163 {
1164     do_test_delete_by_drain(true, BDRV_DRAIN);
1165 }
1166 
1167 
1168 struct detach_by_parent_data {
1169     BlockDriverState *parent_b;
1170     BdrvChild *child_b;
1171     BlockDriverState *c;
1172     BdrvChild *child_c;
1173     bool by_parent_cb;
1174     bool detach_on_drain;
1175 };
1176 static struct detach_by_parent_data detach_by_parent_data;
1177 
1178 static void no_coroutine_fn detach_indirect_bh(void *opaque)
1179 {
1180     struct detach_by_parent_data *data = opaque;
1181 
1182     bdrv_dec_in_flight(data->child_b->bs);
1183 
1184     bdrv_graph_wrlock(NULL);
1185     bdrv_unref_child(data->parent_b, data->child_b);
1186 
1187     bdrv_ref(data->c);
1188     data->child_c = bdrv_attach_child(data->parent_b, data->c, "PB-C",
1189                                       &child_of_bds, BDRV_CHILD_DATA,
1190                                       &error_abort);
1191     bdrv_graph_wrunlock();
1192 }
1193 
1194 static void coroutine_mixed_fn detach_by_parent_aio_cb(void *opaque, int ret)
1195 {
1196     struct detach_by_parent_data *data = &detach_by_parent_data;
1197 
1198     g_assert_cmpint(ret, ==, 0);
1199     if (data->by_parent_cb) {
1200         bdrv_inc_in_flight(data->child_b->bs);
1201         aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
1202                                 detach_indirect_bh, &detach_by_parent_data);
1203     }
1204 }
1205 
1206 static void GRAPH_RDLOCK detach_by_driver_cb_drained_begin(BdrvChild *child)
1207 {
1208     struct detach_by_parent_data *data = &detach_by_parent_data;
1209 
1210     if (!data->detach_on_drain) {
1211         return;
1212     }
1213     data->detach_on_drain = false;
1214 
1215     bdrv_inc_in_flight(data->child_b->bs);
1216     aio_bh_schedule_oneshot(qemu_get_current_aio_context(),
1217                             detach_indirect_bh, &detach_by_parent_data);
1218     child_of_bds.drained_begin(child);
1219 }
1220 
1221 static BdrvChildClass detach_by_driver_cb_class;
1222 
1223 /*
1224  * Initial graph:
1225  *
1226  * PA     PB
1227  *    \ /   \
1228  *     A     B     C
1229  *
1230  * by_parent_cb == true:  Test that parent callbacks don't poll
1231  *
1232  *     PA has a pending write request whose callback changes the child nodes of
1233  *     PB: It removes B and adds C instead. The subtree of PB is drained, which
1234  *     will indirectly drain the write request, too.
1235  *
1236  * by_parent_cb == false: Test that bdrv_drain_invoke() doesn't poll
1237  *
1238  *     PA's BdrvChildClass has a .drained_begin callback that schedules a BH
1239  *     that does the same graph change. If bdrv_drain_invoke() calls it, the
1240  *     state is messed up, but if it is only polled in the single
1241  *     BDRV_POLL_WHILE() at the end of the drain, this should work fine.
1242  */
1243 static void TSA_NO_TSA test_detach_indirect(bool by_parent_cb)
1244 {
1245     BlockBackend *blk;
1246     BlockDriverState *parent_a, *parent_b, *a, *b, *c;
1247     BdrvChild *child_a, *child_b;
1248     BlockAIOCB *acb;
1249 
1250     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, NULL, 0);
1251 
1252     if (!by_parent_cb) {
1253         detach_by_driver_cb_class = child_of_bds;
1254         detach_by_driver_cb_class.drained_begin =
1255             detach_by_driver_cb_drained_begin;
1256         detach_by_driver_cb_class.drained_end = NULL;
1257         detach_by_driver_cb_class.drained_poll = NULL;
1258     }
1259 
1260     detach_by_parent_data = (struct detach_by_parent_data) {
1261         .detach_on_drain = false,
1262     };
1263 
1264     /* Create all involved nodes */
1265     parent_a = bdrv_new_open_driver(&bdrv_test, "parent-a", BDRV_O_RDWR,
1266                                     &error_abort);
1267     parent_b = bdrv_new_open_driver(&bdrv_test, "parent-b", 0,
1268                                     &error_abort);
1269 
1270     a = bdrv_new_open_driver(&bdrv_test, "a", BDRV_O_RDWR, &error_abort);
1271     b = bdrv_new_open_driver(&bdrv_test, "b", BDRV_O_RDWR, &error_abort);
1272     c = bdrv_new_open_driver(&bdrv_test, "c", BDRV_O_RDWR, &error_abort);
1273 
1274     /* blk is a BB for parent-a */
1275     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1276     blk_insert_bs(blk, parent_a, &error_abort);
1277     bdrv_unref(parent_a);
1278 
1279     /* If we want to get bdrv_drain_invoke() to call aio_poll(), the driver
1280      * callback must not return immediately. */
1281     if (!by_parent_cb) {
1282         BDRVTestState *s = parent_a->opaque;
1283         s->sleep_in_drain_begin = true;
1284     }
1285 
1286     /* Set child relationships */
1287     bdrv_ref(b);
1288     bdrv_ref(a);
1289     bdrv_graph_wrlock(NULL);
1290     child_b = bdrv_attach_child(parent_b, b, "PB-B", &child_of_bds,
1291                                 BDRV_CHILD_DATA, &error_abort);
1292     child_a = bdrv_attach_child(parent_b, a, "PB-A", &child_of_bds,
1293                                 BDRV_CHILD_COW, &error_abort);
1294 
1295     bdrv_ref(a);
1296     bdrv_attach_child(parent_a, a, "PA-A",
1297                       by_parent_cb ? &child_of_bds : &detach_by_driver_cb_class,
1298                       BDRV_CHILD_DATA, &error_abort);
1299     bdrv_graph_wrunlock();
1300 
1301     g_assert_cmpint(parent_a->refcnt, ==, 1);
1302     g_assert_cmpint(parent_b->refcnt, ==, 1);
1303     g_assert_cmpint(a->refcnt, ==, 3);
1304     g_assert_cmpint(b->refcnt, ==, 2);
1305     g_assert_cmpint(c->refcnt, ==, 1);
1306 
1307     g_assert(QLIST_FIRST(&parent_b->children) == child_a);
1308     g_assert(QLIST_NEXT(child_a, next) == child_b);
1309     g_assert(QLIST_NEXT(child_b, next) == NULL);
1310 
1311     /* Start the evil write request */
1312     detach_by_parent_data = (struct detach_by_parent_data) {
1313         .parent_b = parent_b,
1314         .child_b = child_b,
1315         .c = c,
1316         .by_parent_cb = by_parent_cb,
1317         .detach_on_drain = true,
1318     };
1319     acb = blk_aio_preadv(blk, 0, &qiov, 0, detach_by_parent_aio_cb, NULL);
1320     g_assert(acb != NULL);
1321 
1322     /* Drain and check the expected result */
1323     bdrv_drained_begin(parent_b);
1324     bdrv_drained_begin(a);
1325     bdrv_drained_begin(b);
1326     bdrv_drained_begin(c);
1327 
1328     g_assert(detach_by_parent_data.child_c != NULL);
1329 
1330     g_assert_cmpint(parent_a->refcnt, ==, 1);
1331     g_assert_cmpint(parent_b->refcnt, ==, 1);
1332     g_assert_cmpint(a->refcnt, ==, 3);
1333     g_assert_cmpint(b->refcnt, ==, 1);
1334     g_assert_cmpint(c->refcnt, ==, 2);
1335 
1336     g_assert(QLIST_FIRST(&parent_b->children) == detach_by_parent_data.child_c);
1337     g_assert(QLIST_NEXT(detach_by_parent_data.child_c, next) == child_a);
1338     g_assert(QLIST_NEXT(child_a, next) == NULL);
1339 
1340     g_assert_cmpint(parent_a->quiesce_counter, ==, 1);
1341     g_assert_cmpint(parent_b->quiesce_counter, ==, 3);
1342     g_assert_cmpint(a->quiesce_counter, ==, 1);
1343     g_assert_cmpint(b->quiesce_counter, ==, 1);
1344     g_assert_cmpint(c->quiesce_counter, ==, 1);
1345 
1346     bdrv_drained_end(parent_b);
1347     bdrv_drained_end(a);
1348     bdrv_drained_end(b);
1349     bdrv_drained_end(c);
1350 
1351     bdrv_unref(parent_b);
1352     blk_unref(blk);
1353 
1354     g_assert_cmpint(a->refcnt, ==, 1);
1355     g_assert_cmpint(b->refcnt, ==, 1);
1356     g_assert_cmpint(c->refcnt, ==, 1);
1357     bdrv_unref(a);
1358     bdrv_unref(b);
1359     bdrv_unref(c);
1360 }
1361 
1362 static void test_detach_by_parent_cb(void)
1363 {
1364     test_detach_indirect(true);
1365 }
1366 
1367 static void test_detach_by_driver_cb(void)
1368 {
1369     test_detach_indirect(false);
1370 }
1371 
1372 static void test_append_to_drained(void)
1373 {
1374     BlockBackend *blk;
1375     BlockDriverState *base, *overlay;
1376     BDRVTestState *base_s, *overlay_s;
1377 
1378     blk = blk_new(qemu_get_aio_context(), BLK_PERM_ALL, BLK_PERM_ALL);
1379     base = bdrv_new_open_driver(&bdrv_test, "base", BDRV_O_RDWR, &error_abort);
1380     base_s = base->opaque;
1381     blk_insert_bs(blk, base, &error_abort);
1382 
1383     overlay = bdrv_new_open_driver(&bdrv_test, "overlay", BDRV_O_RDWR,
1384                                    &error_abort);
1385     overlay_s = overlay->opaque;
1386 
1387     do_drain_begin(BDRV_DRAIN, base);
1388     g_assert_cmpint(base->quiesce_counter, ==, 1);
1389     g_assert_cmpint(base_s->drain_count, ==, 1);
1390     g_assert_cmpint(base->in_flight, ==, 0);
1391 
1392     aio_context_acquire(qemu_get_aio_context());
1393     bdrv_append(overlay, base, &error_abort);
1394     aio_context_release(qemu_get_aio_context());
1395 
1396     g_assert_cmpint(base->in_flight, ==, 0);
1397     g_assert_cmpint(overlay->in_flight, ==, 0);
1398 
1399     g_assert_cmpint(base->quiesce_counter, ==, 1);
1400     g_assert_cmpint(base_s->drain_count, ==, 1);
1401     g_assert_cmpint(overlay->quiesce_counter, ==, 1);
1402     g_assert_cmpint(overlay_s->drain_count, ==, 1);
1403 
1404     do_drain_end(BDRV_DRAIN, base);
1405 
1406     g_assert_cmpint(base->quiesce_counter, ==, 0);
1407     g_assert_cmpint(base_s->drain_count, ==, 0);
1408     g_assert_cmpint(overlay->quiesce_counter, ==, 0);
1409     g_assert_cmpint(overlay_s->drain_count, ==, 0);
1410 
1411     bdrv_unref(overlay);
1412     bdrv_unref(base);
1413     blk_unref(blk);
1414 }
1415 
1416 static void test_set_aio_context(void)
1417 {
1418     BlockDriverState *bs;
1419     IOThread *a = iothread_new();
1420     IOThread *b = iothread_new();
1421     AioContext *ctx_a = iothread_get_aio_context(a);
1422     AioContext *ctx_b = iothread_get_aio_context(b);
1423 
1424     bs = bdrv_new_open_driver(&bdrv_test, "test-node", BDRV_O_RDWR,
1425                               &error_abort);
1426 
1427     bdrv_drained_begin(bs);
1428     bdrv_try_change_aio_context(bs, ctx_a, NULL, &error_abort);
1429 
1430     aio_context_acquire(ctx_a);
1431     bdrv_drained_end(bs);
1432 
1433     bdrv_drained_begin(bs);
1434     bdrv_try_change_aio_context(bs, ctx_b, NULL, &error_abort);
1435     aio_context_release(ctx_a);
1436     aio_context_acquire(ctx_b);
1437     bdrv_try_change_aio_context(bs, qemu_get_aio_context(), NULL, &error_abort);
1438     aio_context_release(ctx_b);
1439     bdrv_drained_end(bs);
1440 
1441     bdrv_unref(bs);
1442     iothread_join(a);
1443     iothread_join(b);
1444 }
1445 
1446 
1447 typedef struct TestDropBackingBlockJob {
1448     BlockJob common;
1449     bool should_complete;
1450     bool *did_complete;
1451     BlockDriverState *detach_also;
1452     BlockDriverState *bs;
1453 } TestDropBackingBlockJob;
1454 
1455 static int coroutine_fn test_drop_backing_job_run(Job *job, Error **errp)
1456 {
1457     TestDropBackingBlockJob *s =
1458         container_of(job, TestDropBackingBlockJob, common.job);
1459 
1460     while (!s->should_complete) {
1461         job_sleep_ns(job, 0);
1462     }
1463 
1464     return 0;
1465 }
1466 
1467 static void test_drop_backing_job_commit(Job *job)
1468 {
1469     TestDropBackingBlockJob *s =
1470         container_of(job, TestDropBackingBlockJob, common.job);
1471 
1472     bdrv_set_backing_hd(s->bs, NULL, &error_abort);
1473     bdrv_set_backing_hd(s->detach_also, NULL, &error_abort);
1474 
1475     *s->did_complete = true;
1476 }
1477 
1478 static const BlockJobDriver test_drop_backing_job_driver = {
1479     .job_driver = {
1480         .instance_size  = sizeof(TestDropBackingBlockJob),
1481         .free           = block_job_free,
1482         .user_resume    = block_job_user_resume,
1483         .run            = test_drop_backing_job_run,
1484         .commit         = test_drop_backing_job_commit,
1485     }
1486 };
1487 
1488 /**
1489  * Creates a child node with three parent nodes on it, and then runs a
1490  * block job on the final one, parent-node-2.
1491  *
1492  * The job is then asked to complete before a section where the child
1493  * is drained.
1494  *
1495  * Ending this section will undrain the child's parents, first
1496  * parent-node-2, then parent-node-1, then parent-node-0 -- the parent
1497  * list is in reverse order of how they were added.  Ending the drain
1498  * on parent-node-2 will resume the job, thus completing it and
1499  * scheduling job_exit().
1500  *
1501  * Ending the drain on parent-node-1 will poll the AioContext, which
1502  * lets job_exit() and thus test_drop_backing_job_commit() run.  That
1503  * function first removes the child as parent-node-2's backing file.
1504  *
1505  * In old (and buggy) implementations, there are two problems with
1506  * that:
1507  * (A) bdrv_drain_invoke() polls for every node that leaves the
1508  *     drained section.  This means that job_exit() is scheduled
1509  *     before the child has left the drained section.  Its
1510  *     quiesce_counter is therefore still 1 when it is removed from
1511  *     parent-node-2.
1512  *
1513  * (B) bdrv_replace_child_noperm() calls drained_end() on the old
1514  *     child's parents as many times as the child is quiesced.  This
1515  *     means it will call drained_end() on parent-node-2 once.
1516  *     Because parent-node-2 is no longer quiesced at this point, this
1517  *     will fail.
1518  *
1519  * bdrv_replace_child_noperm() therefore must call drained_end() on
1520  * the parent only if it really is still drained because the child is
1521  * drained.
1522  *
1523  * If removing child from parent-node-2 was successful (as it should
1524  * be), test_drop_backing_job_commit() will then also remove the child
1525  * from parent-node-0.
1526  *
1527  * With an old version of our drain infrastructure ((A) above), that
1528  * resulted in the following flow:
1529  *
1530  * 1. child attempts to leave its drained section.  The call recurses
1531  *    to its parents.
1532  *
1533  * 2. parent-node-2 leaves the drained section.  Polling in
1534  *    bdrv_drain_invoke() will schedule job_exit().
1535  *
1536  * 3. parent-node-1 leaves the drained section.  Polling in
1537  *    bdrv_drain_invoke() will run job_exit(), thus disconnecting
1538  *    parent-node-0 from the child node.
1539  *
1540  * 4. bdrv_parent_drained_end() uses a QLIST_FOREACH_SAFE() loop to
1541  *    iterate over the parents.  Thus, it now accesses the BdrvChild
1542  *    object that used to connect parent-node-0 and the child node.
1543  *    However, that object no longer exists, so it accesses a dangling
1544  *    pointer.
1545  *
1546  * The solution is to only poll once when running a bdrv_drained_end()
1547  * operation, specifically at the end when all drained_end()
1548  * operations for all involved nodes have been scheduled.
1549  * Note that this also solves (A) above, thus hiding (B).
1550  */
1551 static void test_blockjob_commit_by_drained_end(void)
1552 {
1553     BlockDriverState *bs_child, *bs_parents[3];
1554     TestDropBackingBlockJob *job;
1555     bool job_has_completed = false;
1556     int i;
1557 
1558     bs_child = bdrv_new_open_driver(&bdrv_test, "child-node", BDRV_O_RDWR,
1559                                     &error_abort);
1560 
1561     for (i = 0; i < 3; i++) {
1562         char name[32];
1563         snprintf(name, sizeof(name), "parent-node-%i", i);
1564         bs_parents[i] = bdrv_new_open_driver(&bdrv_test, name, BDRV_O_RDWR,
1565                                              &error_abort);
1566         bdrv_set_backing_hd(bs_parents[i], bs_child, &error_abort);
1567     }
1568 
1569     job = block_job_create("job", &test_drop_backing_job_driver, NULL,
1570                            bs_parents[2], 0, BLK_PERM_ALL, 0, 0, NULL, NULL,
1571                            &error_abort);
1572     job->bs = bs_parents[2];
1573 
1574     job->detach_also = bs_parents[0];
1575     job->did_complete = &job_has_completed;
1576 
1577     job_start(&job->common.job);
1578 
1579     job->should_complete = true;
1580     bdrv_drained_begin(bs_child);
1581     g_assert(!job_has_completed);
1582     bdrv_drained_end(bs_child);
1583     aio_poll(qemu_get_aio_context(), false);
1584     g_assert(job_has_completed);
1585 
1586     bdrv_unref(bs_parents[0]);
1587     bdrv_unref(bs_parents[1]);
1588     bdrv_unref(bs_parents[2]);
1589     bdrv_unref(bs_child);
1590 }
1591 
1592 
1593 typedef struct TestSimpleBlockJob {
1594     BlockJob common;
1595     bool should_complete;
1596     bool *did_complete;
1597 } TestSimpleBlockJob;
1598 
1599 static int coroutine_fn test_simple_job_run(Job *job, Error **errp)
1600 {
1601     TestSimpleBlockJob *s = container_of(job, TestSimpleBlockJob, common.job);
1602 
1603     while (!s->should_complete) {
1604         job_sleep_ns(job, 0);
1605     }
1606 
1607     return 0;
1608 }
1609 
1610 static void test_simple_job_clean(Job *job)
1611 {
1612     TestSimpleBlockJob *s = container_of(job, TestSimpleBlockJob, common.job);
1613     *s->did_complete = true;
1614 }
1615 
1616 static const BlockJobDriver test_simple_job_driver = {
1617     .job_driver = {
1618         .instance_size  = sizeof(TestSimpleBlockJob),
1619         .free           = block_job_free,
1620         .user_resume    = block_job_user_resume,
1621         .run            = test_simple_job_run,
1622         .clean          = test_simple_job_clean,
1623     },
1624 };
1625 
1626 static int drop_intermediate_poll_update_filename(BdrvChild *child,
1627                                                   BlockDriverState *new_base,
1628                                                   const char *filename,
1629                                                   Error **errp)
1630 {
1631     /*
1632      * We are free to poll here, which may change the block graph, if
1633      * it is not drained.
1634      */
1635 
1636     /* If the job is not drained: Complete it, schedule job_exit() */
1637     aio_poll(qemu_get_current_aio_context(), false);
1638     /* If the job is not drained: Run job_exit(), finish the job */
1639     aio_poll(qemu_get_current_aio_context(), false);
1640 
1641     return 0;
1642 }
1643 
1644 /**
1645  * Test a poll in the midst of bdrv_drop_intermediate().
1646  *
1647  * bdrv_drop_intermediate() calls BdrvChildClass.update_filename(),
1648  * which can yield or poll.  This may lead to graph changes, unless
1649  * the whole subtree in question is drained.
1650  *
1651  * We test this on the following graph:
1652  *
1653  *                    Job
1654  *
1655  *                     |
1656  *                  job-node
1657  *                     |
1658  *                     v
1659  *
1660  *                  job-node
1661  *
1662  *                     |
1663  *                  backing
1664  *                     |
1665  *                     v
1666  *
1667  * node-2 --chain--> node-1 --chain--> node-0
1668  *
1669  * We drop node-1 with bdrv_drop_intermediate(top=node-1, base=node-0).
1670  *
1671  * This first updates node-2's backing filename by invoking
1672  * drop_intermediate_poll_update_filename(), which polls twice.  This
1673  * causes the job to finish, which in turns causes the job-node to be
1674  * deleted.
1675  *
1676  * bdrv_drop_intermediate() uses a QLIST_FOREACH_SAFE() loop, so it
1677  * already has a pointer to the BdrvChild edge between job-node and
1678  * node-1.  When it tries to handle that edge, we probably get a
1679  * segmentation fault because the object no longer exists.
1680  *
1681  *
1682  * The solution is for bdrv_drop_intermediate() to drain top's
1683  * subtree.  This prevents graph changes from happening just because
1684  * BdrvChildClass.update_filename() yields or polls.  Thus, the block
1685  * job is paused during that drained section and must finish before or
1686  * after.
1687  *
1688  * (In addition, bdrv_replace_child() must keep the job paused.)
1689  */
1690 static void test_drop_intermediate_poll(void)
1691 {
1692     static BdrvChildClass chain_child_class;
1693     BlockDriverState *chain[3];
1694     TestSimpleBlockJob *job;
1695     BlockDriverState *job_node;
1696     bool job_has_completed = false;
1697     int i;
1698     int ret;
1699 
1700     chain_child_class = child_of_bds;
1701     chain_child_class.update_filename = drop_intermediate_poll_update_filename;
1702 
1703     for (i = 0; i < 3; i++) {
1704         char name[32];
1705         snprintf(name, 32, "node-%i", i);
1706 
1707         chain[i] = bdrv_new_open_driver(&bdrv_test, name, 0, &error_abort);
1708     }
1709 
1710     job_node = bdrv_new_open_driver(&bdrv_test, "job-node", BDRV_O_RDWR,
1711                                     &error_abort);
1712     bdrv_set_backing_hd(job_node, chain[1], &error_abort);
1713 
1714     /*
1715      * Establish the chain last, so the chain links are the first
1716      * elements in the BDS.parents lists
1717      */
1718     bdrv_graph_wrlock(NULL);
1719     for (i = 0; i < 3; i++) {
1720         if (i) {
1721             /* Takes the reference to chain[i - 1] */
1722             bdrv_attach_child(chain[i], chain[i - 1], "chain",
1723                               &chain_child_class, BDRV_CHILD_COW, &error_abort);
1724         }
1725     }
1726     bdrv_graph_wrunlock();
1727 
1728     job = block_job_create("job", &test_simple_job_driver, NULL, job_node,
1729                            0, BLK_PERM_ALL, 0, 0, NULL, NULL, &error_abort);
1730 
1731     /* The job has a reference now */
1732     bdrv_unref(job_node);
1733 
1734     job->did_complete = &job_has_completed;
1735 
1736     job_start(&job->common.job);
1737     job->should_complete = true;
1738 
1739     g_assert(!job_has_completed);
1740     ret = bdrv_drop_intermediate(chain[1], chain[0], NULL);
1741     aio_poll(qemu_get_aio_context(), false);
1742     g_assert(ret == 0);
1743     g_assert(job_has_completed);
1744 
1745     bdrv_unref(chain[2]);
1746 }
1747 
1748 
1749 typedef struct BDRVReplaceTestState {
1750     bool setup_completed;
1751     bool was_drained;
1752     bool was_undrained;
1753     bool has_read;
1754 
1755     int drain_count;
1756 
1757     bool yield_before_read;
1758     Coroutine *io_co;
1759     Coroutine *drain_co;
1760 } BDRVReplaceTestState;
1761 
1762 static void bdrv_replace_test_close(BlockDriverState *bs)
1763 {
1764 }
1765 
1766 /**
1767  * If @bs has a backing file:
1768  *   Yield if .yield_before_read is true (and wait for drain_begin to
1769  *   wake us up).
1770  *   Forward the read to bs->backing.  Set .has_read to true.
1771  *   If drain_begin has woken us, wake it in turn.
1772  *
1773  * Otherwise:
1774  *   Set .has_read to true and return success.
1775  */
1776 static int coroutine_fn GRAPH_RDLOCK
1777 bdrv_replace_test_co_preadv(BlockDriverState *bs, int64_t offset, int64_t bytes,
1778                             QEMUIOVector *qiov, BdrvRequestFlags flags)
1779 {
1780     BDRVReplaceTestState *s = bs->opaque;
1781 
1782     if (bs->backing) {
1783         int ret;
1784 
1785         g_assert(!s->drain_count);
1786 
1787         s->io_co = qemu_coroutine_self();
1788         if (s->yield_before_read) {
1789             s->yield_before_read = false;
1790             qemu_coroutine_yield();
1791         }
1792         s->io_co = NULL;
1793 
1794         ret = bdrv_co_preadv(bs->backing, offset, bytes, qiov, 0);
1795         s->has_read = true;
1796 
1797         /* Wake up drain_co if it runs */
1798         if (s->drain_co) {
1799             aio_co_wake(s->drain_co);
1800         }
1801 
1802         return ret;
1803     }
1804 
1805     s->has_read = true;
1806     return 0;
1807 }
1808 
1809 static void coroutine_fn bdrv_replace_test_drain_co(void *opaque)
1810 {
1811     BlockDriverState *bs = opaque;
1812     BDRVReplaceTestState *s = bs->opaque;
1813 
1814     /* Keep waking io_co up until it is done */
1815     while (s->io_co) {
1816         aio_co_wake(s->io_co);
1817         s->io_co = NULL;
1818         qemu_coroutine_yield();
1819     }
1820     s->drain_co = NULL;
1821     bdrv_dec_in_flight(bs);
1822 }
1823 
1824 /**
1825  * If .drain_count is 0, wake up .io_co if there is one; and set
1826  * .was_drained.
1827  * Increment .drain_count.
1828  */
1829 static void bdrv_replace_test_drain_begin(BlockDriverState *bs)
1830 {
1831     BDRVReplaceTestState *s = bs->opaque;
1832 
1833     if (!s->setup_completed) {
1834         return;
1835     }
1836 
1837     if (!s->drain_count) {
1838         s->drain_co = qemu_coroutine_create(bdrv_replace_test_drain_co, bs);
1839         bdrv_inc_in_flight(bs);
1840         aio_co_enter(bdrv_get_aio_context(bs), s->drain_co);
1841         s->was_drained = true;
1842     }
1843     s->drain_count++;
1844 }
1845 
1846 static void coroutine_fn bdrv_replace_test_read_entry(void *opaque)
1847 {
1848     BlockDriverState *bs = opaque;
1849     char data;
1850     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, &data, 1);
1851     int ret;
1852 
1853     /* Queue a read request post-drain */
1854     bdrv_graph_co_rdlock();
1855     ret = bdrv_replace_test_co_preadv(bs, 0, 1, &qiov, 0);
1856     bdrv_graph_co_rdunlock();
1857 
1858     g_assert(ret >= 0);
1859     bdrv_dec_in_flight(bs);
1860 }
1861 
1862 /**
1863  * Reduce .drain_count, set .was_undrained once it reaches 0.
1864  * If .drain_count reaches 0 and the node has a backing file, issue a
1865  * read request.
1866  */
1867 static void bdrv_replace_test_drain_end(BlockDriverState *bs)
1868 {
1869     BDRVReplaceTestState *s = bs->opaque;
1870 
1871     if (!s->setup_completed) {
1872         return;
1873     }
1874 
1875     g_assert(s->drain_count > 0);
1876     if (!--s->drain_count) {
1877         s->was_undrained = true;
1878 
1879         if (bs->backing) {
1880             Coroutine *co = qemu_coroutine_create(bdrv_replace_test_read_entry,
1881                                                   bs);
1882             bdrv_inc_in_flight(bs);
1883             aio_co_enter(bdrv_get_aio_context(bs), co);
1884         }
1885     }
1886 }
1887 
1888 static BlockDriver bdrv_replace_test = {
1889     .format_name            = "replace_test",
1890     .instance_size          = sizeof(BDRVReplaceTestState),
1891     .supports_backing       = true,
1892 
1893     .bdrv_close             = bdrv_replace_test_close,
1894     .bdrv_co_preadv         = bdrv_replace_test_co_preadv,
1895 
1896     .bdrv_drain_begin       = bdrv_replace_test_drain_begin,
1897     .bdrv_drain_end         = bdrv_replace_test_drain_end,
1898 
1899     .bdrv_child_perm        = bdrv_default_perms,
1900 };
1901 
1902 static void coroutine_fn test_replace_child_mid_drain_read_co(void *opaque)
1903 {
1904     int ret;
1905     char data;
1906 
1907     ret = blk_co_pread(opaque, 0, 1, &data, 0);
1908     g_assert(ret >= 0);
1909 }
1910 
1911 /**
1912  * We test two things:
1913  * (1) bdrv_replace_child_noperm() must not undrain the parent if both
1914  *     children are drained.
1915  * (2) bdrv_replace_child_noperm() must never flush I/O requests to a
1916  *     drained child.  If the old child is drained, it must flush I/O
1917  *     requests after the new one has been attached.  If the new child
1918  *     is drained, it must flush I/O requests before the old one is
1919  *     detached.
1920  *
1921  * To do so, we create one parent node and two child nodes; then
1922  * attach one of the children (old_child_bs) to the parent, then
1923  * drain both old_child_bs and new_child_bs according to
1924  * old_drain_count and new_drain_count, respectively, and finally
1925  * we invoke bdrv_replace_node() to replace old_child_bs by
1926  * new_child_bs.
1927  *
1928  * The test block driver we use here (bdrv_replace_test) has a read
1929  * function that:
1930  * - For the parent node, can optionally yield, and then forwards the
1931  *   read to bdrv_preadv(),
1932  * - For the child node, just returns immediately.
1933  *
1934  * If the read yields, the drain_begin function will wake it up.
1935  *
1936  * The drain_end function issues a read on the parent once it is fully
1937  * undrained (which simulates requests starting to come in again).
1938  */
1939 static void do_test_replace_child_mid_drain(int old_drain_count,
1940                                             int new_drain_count)
1941 {
1942     BlockBackend *parent_blk;
1943     BlockDriverState *parent_bs;
1944     BlockDriverState *old_child_bs, *new_child_bs;
1945     BDRVReplaceTestState *parent_s;
1946     BDRVReplaceTestState *old_child_s, *new_child_s;
1947     Coroutine *io_co;
1948     int i;
1949 
1950     parent_bs = bdrv_new_open_driver(&bdrv_replace_test, "parent", 0,
1951                                      &error_abort);
1952     parent_s = parent_bs->opaque;
1953 
1954     parent_blk = blk_new(qemu_get_aio_context(),
1955                          BLK_PERM_CONSISTENT_READ, BLK_PERM_ALL);
1956     blk_insert_bs(parent_blk, parent_bs, &error_abort);
1957 
1958     old_child_bs = bdrv_new_open_driver(&bdrv_replace_test, "old-child", 0,
1959                                         &error_abort);
1960     new_child_bs = bdrv_new_open_driver(&bdrv_replace_test, "new-child", 0,
1961                                         &error_abort);
1962     old_child_s = old_child_bs->opaque;
1963     new_child_s = new_child_bs->opaque;
1964 
1965     /* So that we can read something */
1966     parent_bs->total_sectors = 1;
1967     old_child_bs->total_sectors = 1;
1968     new_child_bs->total_sectors = 1;
1969 
1970     bdrv_ref(old_child_bs);
1971     bdrv_graph_wrlock(NULL);
1972     bdrv_attach_child(parent_bs, old_child_bs, "child", &child_of_bds,
1973                       BDRV_CHILD_COW, &error_abort);
1974     bdrv_graph_wrunlock();
1975     parent_s->setup_completed = true;
1976 
1977     for (i = 0; i < old_drain_count; i++) {
1978         bdrv_drained_begin(old_child_bs);
1979     }
1980     for (i = 0; i < new_drain_count; i++) {
1981         bdrv_drained_begin(new_child_bs);
1982     }
1983 
1984     if (!old_drain_count) {
1985         /*
1986          * Start a read operation that will yield, so it will not
1987          * complete before the node is drained.
1988          */
1989         parent_s->yield_before_read = true;
1990         io_co = qemu_coroutine_create(test_replace_child_mid_drain_read_co,
1991                                       parent_blk);
1992         qemu_coroutine_enter(io_co);
1993     }
1994 
1995     /* If we have started a read operation, it should have yielded */
1996     g_assert(!parent_s->has_read);
1997 
1998     /* Reset drained status so we can see what bdrv_replace_node() does */
1999     parent_s->was_drained = false;
2000     parent_s->was_undrained = false;
2001 
2002     g_assert(parent_bs->quiesce_counter == old_drain_count);
2003     bdrv_replace_node(old_child_bs, new_child_bs, &error_abort);
2004     g_assert(parent_bs->quiesce_counter == new_drain_count);
2005 
2006     if (!old_drain_count && !new_drain_count) {
2007         /*
2008          * From undrained to undrained drains and undrains the parent,
2009          * because bdrv_replace_node() contains a drained section for
2010          * @old_child_bs.
2011          */
2012         g_assert(parent_s->was_drained && parent_s->was_undrained);
2013     } else if (!old_drain_count && new_drain_count) {
2014         /*
2015          * From undrained to drained should drain the parent and keep
2016          * it that way.
2017          */
2018         g_assert(parent_s->was_drained && !parent_s->was_undrained);
2019     } else if (old_drain_count && !new_drain_count) {
2020         /*
2021          * From drained to undrained should undrain the parent and
2022          * keep it that way.
2023          */
2024         g_assert(!parent_s->was_drained && parent_s->was_undrained);
2025     } else /* if (old_drain_count && new_drain_count) */ {
2026         /*
2027          * From drained to drained must not undrain the parent at any
2028          * point
2029          */
2030         g_assert(!parent_s->was_drained && !parent_s->was_undrained);
2031     }
2032 
2033     if (!old_drain_count || !new_drain_count) {
2034         /*
2035          * If !old_drain_count, we have started a read request before
2036          * bdrv_replace_node().  If !new_drain_count, the parent must
2037          * have been undrained at some point, and
2038          * bdrv_replace_test_co_drain_end() starts a read request
2039          * then.
2040          */
2041         g_assert(parent_s->has_read);
2042     } else {
2043         /*
2044          * If the parent was never undrained, there is no way to start
2045          * a read request.
2046          */
2047         g_assert(!parent_s->has_read);
2048     }
2049 
2050     /* A drained child must have not received any request */
2051     g_assert(!(old_drain_count && old_child_s->has_read));
2052     g_assert(!(new_drain_count && new_child_s->has_read));
2053 
2054     for (i = 0; i < new_drain_count; i++) {
2055         bdrv_drained_end(new_child_bs);
2056     }
2057     for (i = 0; i < old_drain_count; i++) {
2058         bdrv_drained_end(old_child_bs);
2059     }
2060 
2061     /*
2062      * By now, bdrv_replace_test_co_drain_end() must have been called
2063      * at some point while the new child was attached to the parent.
2064      */
2065     g_assert(parent_s->has_read);
2066     g_assert(new_child_s->has_read);
2067 
2068     blk_unref(parent_blk);
2069     bdrv_unref(parent_bs);
2070     bdrv_unref(old_child_bs);
2071     bdrv_unref(new_child_bs);
2072 }
2073 
2074 static void test_replace_child_mid_drain(void)
2075 {
2076     int old_drain_count, new_drain_count;
2077 
2078     for (old_drain_count = 0; old_drain_count < 2; old_drain_count++) {
2079         for (new_drain_count = 0; new_drain_count < 2; new_drain_count++) {
2080             do_test_replace_child_mid_drain(old_drain_count, new_drain_count);
2081         }
2082     }
2083 }
2084 
2085 int main(int argc, char **argv)
2086 {
2087     int ret;
2088 
2089     bdrv_init();
2090     qemu_init_main_loop(&error_abort);
2091 
2092     g_test_init(&argc, &argv, NULL);
2093     qemu_event_init(&done_event, false);
2094 
2095     g_test_add_func("/bdrv-drain/driver-cb/drain_all", test_drv_cb_drain_all);
2096     g_test_add_func("/bdrv-drain/driver-cb/drain", test_drv_cb_drain);
2097 
2098     g_test_add_func("/bdrv-drain/driver-cb/co/drain_all",
2099                     test_drv_cb_co_drain_all);
2100     g_test_add_func("/bdrv-drain/driver-cb/co/drain", test_drv_cb_co_drain);
2101 
2102     g_test_add_func("/bdrv-drain/quiesce/drain_all", test_quiesce_drain_all);
2103     g_test_add_func("/bdrv-drain/quiesce/drain", test_quiesce_drain);
2104 
2105     g_test_add_func("/bdrv-drain/quiesce/co/drain_all",
2106                     test_quiesce_co_drain_all);
2107     g_test_add_func("/bdrv-drain/quiesce/co/drain", test_quiesce_co_drain);
2108 
2109     g_test_add_func("/bdrv-drain/nested", test_nested);
2110 
2111     g_test_add_func("/bdrv-drain/graph-change/drain_all",
2112                     test_graph_change_drain_all);
2113 
2114     g_test_add_func("/bdrv-drain/iothread/drain_all", test_iothread_drain_all);
2115     g_test_add_func("/bdrv-drain/iothread/drain", test_iothread_drain);
2116 
2117     g_test_add_func("/bdrv-drain/blockjob/drain_all", test_blockjob_drain_all);
2118     g_test_add_func("/bdrv-drain/blockjob/drain", test_blockjob_drain);
2119 
2120     g_test_add_func("/bdrv-drain/blockjob/error/drain_all",
2121                     test_blockjob_error_drain_all);
2122     g_test_add_func("/bdrv-drain/blockjob/error/drain",
2123                     test_blockjob_error_drain);
2124 
2125     g_test_add_func("/bdrv-drain/blockjob/iothread/drain_all",
2126                     test_blockjob_iothread_drain_all);
2127     g_test_add_func("/bdrv-drain/blockjob/iothread/drain",
2128                     test_blockjob_iothread_drain);
2129 
2130     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain_all",
2131                     test_blockjob_iothread_error_drain_all);
2132     g_test_add_func("/bdrv-drain/blockjob/iothread/error/drain",
2133                     test_blockjob_iothread_error_drain);
2134 
2135     g_test_add_func("/bdrv-drain/deletion/drain", test_delete_by_drain);
2136     g_test_add_func("/bdrv-drain/detach/drain_all", test_detach_by_drain_all);
2137     g_test_add_func("/bdrv-drain/detach/drain", test_detach_by_drain);
2138     g_test_add_func("/bdrv-drain/detach/parent_cb", test_detach_by_parent_cb);
2139     g_test_add_func("/bdrv-drain/detach/driver_cb", test_detach_by_driver_cb);
2140 
2141     g_test_add_func("/bdrv-drain/attach/drain", test_append_to_drained);
2142 
2143     g_test_add_func("/bdrv-drain/set_aio_context", test_set_aio_context);
2144 
2145     g_test_add_func("/bdrv-drain/blockjob/commit_by_drained_end",
2146                     test_blockjob_commit_by_drained_end);
2147 
2148     g_test_add_func("/bdrv-drain/bdrv_drop_intermediate/poll",
2149                     test_drop_intermediate_poll);
2150 
2151     g_test_add_func("/bdrv-drain/replace_child/mid-drain",
2152                     test_replace_child_mid_drain);
2153 
2154     ret = g_test_run();
2155     qemu_event_destroy(&done_event);
2156     return ret;
2157 }
2158