block/io.c

   1 /*
   2  * Block layer I/O functions
   3  *
   4  * Copyright (c) 2003 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26 #include "trace.h"
  27 #include "sysemu/block-backend.h"
  28 #include "block/aio-wait.h"
  29 #include "block/blockjob.h"
  30 #include "block/blockjob_int.h"
  31 #include "block/block_int.h"
  32 #include "block/coroutines.h"
  33 #include "block/write-threshold.h"
  34 #include "qemu/cutils.h"
  35 #include "qemu/memalign.h"
  36 #include "qapi/error.h"
  37 #include "qemu/error-report.h"
  38 #include "qemu/main-loop.h"
  39 #include "sysemu/replay.h"
  40
  41 /* Maximum bounce buffer for copy-on-read and write zeroes, in bytes */
  42 #define MAX_BOUNCE_BUFFER (32768 << BDRV_SECTOR_BITS)
  43
  44 static void bdrv_parent_cb_resize(BlockDriverState *bs);
  45 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
  46     int64_t offset, int64_t bytes, BdrvRequestFlags flags);
  47
  48 static void bdrv_parent_drained_begin(BlockDriverState *bs, BdrvChild *ignore)
  49 {
  50     BdrvChild *c, *next;
  51
  52     QLIST_FOREACH_SAFE(c, &bs->parents, next_parent, next) {
  53         if (c == ignore) {
  54             continue;
  55         }
  56         bdrv_parent_drained_begin_single(c, false);
  57     }
  58 }
  59
  60 void bdrv_parent_drained_end_single(BdrvChild *c)
  61 {
  62     IO_OR_GS_CODE();
  63
  64     assert(c->quiesced_parent);
  65     c->quiesced_parent = false;
  66
  67     if (c->klass->drained_end) {
  68         c->klass->drained_end(c);
  69     }
  70 }
  71
  72 static void bdrv_parent_drained_end(BlockDriverState *bs, BdrvChild *ignore)
  73 {
  74     BdrvChild *c;
  75
  76     QLIST_FOREACH(c, &bs->parents, next_parent) {
  77         if (c == ignore) {
  78             continue;
  79         }
  80         bdrv_parent_drained_end_single(c);
  81     }
  82 }
  83
  84 bool bdrv_parent_drained_poll_single(BdrvChild *c)
  85 {
  86     if (c->klass->drained_poll) {
  87         return c->klass->drained_poll(c);
  88     }
  89     return false;
  90 }
  91
  92 static bool bdrv_parent_drained_poll(BlockDriverState *bs, BdrvChild *ignore,
  93                                      bool ignore_bds_parents)
  94 {
  95     BdrvChild *c, *next;
  96     bool busy = false;
  97
  98     QLIST_FOREACH_SAFE(c, &bs->parents, next_parent, next) {
  99         if (c == ignore || (ignore_bds_parents && c->klass->parent_is_bds)) {
 100             continue;
 101         }
 102         busy |= bdrv_parent_drained_poll_single(c);
 103     }
 104
 105     return busy;
 106 }
 107
 108 void bdrv_parent_drained_begin_single(BdrvChild *c, bool poll)
 109 {
 110     AioContext *ctx = bdrv_child_get_parent_aio_context(c);
 111     IO_OR_GS_CODE();
 112
 113     assert(!c->quiesced_parent);
 114     c->quiesced_parent = true;
 115
 116     if (c->klass->drained_begin) {
 117         c->klass->drained_begin(c);
 118     }
 119     if (poll) {
 120         AIO_WAIT_WHILE(ctx, bdrv_parent_drained_poll_single(c));
 121     }
 122 }
 123
 124 static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
 125 {
 126     dst->pdiscard_alignment = MAX(dst->pdiscard_alignment,
 127                                   src->pdiscard_alignment);
 128     dst->opt_transfer = MAX(dst->opt_transfer, src->opt_transfer);
 129     dst->max_transfer = MIN_NON_ZERO(dst->max_transfer, src->max_transfer);
 130     dst->max_hw_transfer = MIN_NON_ZERO(dst->max_hw_transfer,
 131                                         src->max_hw_transfer);
 132     dst->opt_mem_alignment = MAX(dst->opt_mem_alignment,
 133                                  src->opt_mem_alignment);
 134     dst->min_mem_alignment = MAX(dst->min_mem_alignment,
 135                                  src->min_mem_alignment);
 136     dst->max_iov = MIN_NON_ZERO(dst->max_iov, src->max_iov);
 137     dst->max_hw_iov = MIN_NON_ZERO(dst->max_hw_iov, src->max_hw_iov);
 138 }
 139
 140 typedef struct BdrvRefreshLimitsState {
 141     BlockDriverState *bs;
 142     BlockLimits old_bl;
 143 } BdrvRefreshLimitsState;
 144
 145 static void bdrv_refresh_limits_abort(void *opaque)
 146 {
 147     BdrvRefreshLimitsState *s = opaque;
 148
 149     s->bs->bl = s->old_bl;
 150 }
 151
 152 static TransactionActionDrv bdrv_refresh_limits_drv = {
 153     .abort = bdrv_refresh_limits_abort,
 154     .clean = g_free,
 155 };
 156
 157 /* @tran is allowed to be NULL, in this case no rollback is possible. */
 158 void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
 159 {
 160     ERRP_GUARD();
 161     BlockDriver *drv = bs->drv;
 162     BdrvChild *c;
 163     bool have_limits;
 164
 165     GLOBAL_STATE_CODE();
 166
 167     if (tran) {
 168         BdrvRefreshLimitsState *s = g_new(BdrvRefreshLimitsState, 1);
 169         *s = (BdrvRefreshLimitsState) {
 170             .bs = bs,
 171             .old_bl = bs->bl,
 172         };
 173         tran_add(tran, &bdrv_refresh_limits_drv, s);
 174     }
 175
 176     memset(&bs->bl, 0, sizeof(bs->bl));
 177
 178     if (!drv) {
 179         return;
 180     }
 181
 182     /* Default alignment based on whether driver has byte interface */
 183     bs->bl.request_alignment = (drv->bdrv_co_preadv ||
 184                                 drv->bdrv_aio_preadv ||
 185                                 drv->bdrv_co_preadv_part) ? 1 : 512;
 186
 187     /* Take some limits from the children as a default */
 188     have_limits = false;
 189     QLIST_FOREACH(c, &bs->children, next) {
 190         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
 191         {
 192             bdrv_merge_limits(&bs->bl, &c->bs->bl);
 193             have_limits = true;
 194         }
 195     }
 196
 197     if (!have_limits) {
 198         bs->bl.min_mem_alignment = 512;
 199         bs->bl.opt_mem_alignment = qemu_real_host_page_size();
 200
 201         /* Safe default since most protocols use readv()/writev()/etc */
 202         bs->bl.max_iov = IOV_MAX;
 203     }
 204
 205     /* Then let the driver override it */
 206     if (drv->bdrv_refresh_limits) {
 207         drv->bdrv_refresh_limits(bs, errp);
 208         if (*errp) {
 209             return;
 210         }
 211     }
 212
 213     if (bs->bl.request_alignment > BDRV_MAX_ALIGNMENT) {
 214         error_setg(errp, "Driver requires too large request alignment");
 215     }
 216 }
 217
 218 /**
 219  * The copy-on-read flag is actually a reference count so multiple users may
 220  * use the feature without worrying about clobbering its previous state.
 221  * Copy-on-read stays enabled until all users have called to disable it.
 222  */
 223 void bdrv_enable_copy_on_read(BlockDriverState *bs)
 224 {
 225     IO_CODE();
 226     qatomic_inc(&bs->copy_on_read);
 227 }
 228
 229 void bdrv_disable_copy_on_read(BlockDriverState *bs)
 230 {
 231     int old = qatomic_fetch_dec(&bs->copy_on_read);
 232     IO_CODE();
 233     assert(old >= 1);
 234 }
 235
 236 typedef struct {
 237     Coroutine *co;
 238     BlockDriverState *bs;
 239     bool done;
 240     bool begin;
 241     bool poll;
 242     BdrvChild *parent;
 243 } BdrvCoDrainData;
 244
 245 /* Returns true if BDRV_POLL_WHILE() should go into a blocking aio_poll() */
 246 bool bdrv_drain_poll(BlockDriverState *bs, BdrvChild *ignore_parent,
 247                      bool ignore_bds_parents)
 248 {
 249     IO_OR_GS_CODE();
 250
 251     if (bdrv_parent_drained_poll(bs, ignore_parent, ignore_bds_parents)) {
 252         return true;
 253     }
 254
 255     if (qatomic_read(&bs->in_flight)) {
 256         return true;
 257     }
 258
 259     return false;
 260 }
 261
 262 static bool bdrv_drain_poll_top_level(BlockDriverState *bs,
 263                                       BdrvChild *ignore_parent)
 264 {
 265     return bdrv_drain_poll(bs, ignore_parent, false);
 266 }
 267
 268 static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
 269                                   bool poll);
 270 static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent);
 271
 272 static void bdrv_co_drain_bh_cb(void *opaque)
 273 {
 274     BdrvCoDrainData *data = opaque;
 275     Coroutine *co = data->co;
 276     BlockDriverState *bs = data->bs;
 277
 278     if (bs) {
 279         AioContext *ctx = bdrv_get_aio_context(bs);
 280         aio_context_acquire(ctx);
 281         bdrv_dec_in_flight(bs);
 282         if (data->begin) {
 283             bdrv_do_drained_begin(bs, data->parent, data->poll);
 284         } else {
 285             assert(!data->poll);
 286             bdrv_do_drained_end(bs, data->parent);
 287         }
 288         aio_context_release(ctx);
 289     } else {
 290         assert(data->begin);
 291         bdrv_drain_all_begin();
 292     }
 293
 294     data->done = true;
 295     aio_co_wake(co);
 296 }
 297
 298 static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs,
 299                                                 bool begin,
 300                                                 BdrvChild *parent,
 301                                                 bool poll)
 302 {
 303     BdrvCoDrainData data;
 304     Coroutine *self = qemu_coroutine_self();
 305     AioContext *ctx = bdrv_get_aio_context(bs);
 306     AioContext *co_ctx = qemu_coroutine_get_aio_context(self);
 307
 308     /* Calling bdrv_drain() from a BH ensures the current coroutine yields and
 309      * other coroutines run if they were queued by aio_co_enter(). */
 310
 311     assert(qemu_in_coroutine());
 312     data = (BdrvCoDrainData) {
 313         .co = self,
 314         .bs = bs,
 315         .done = false,
 316         .begin = begin,
 317         .parent = parent,
 318         .poll = poll,
 319     };
 320
 321     if (bs) {
 322         bdrv_inc_in_flight(bs);
 323     }
 324
 325     /*
 326      * Temporarily drop the lock across yield or we would get deadlocks.
 327      * bdrv_co_drain_bh_cb() reaquires the lock as needed.
 328      *
 329      * When we yield below, the lock for the current context will be
 330      * released, so if this is actually the lock that protects bs, don't drop
 331      * it a second time.
 332      */
 333     if (ctx != co_ctx) {
 334         aio_context_release(ctx);
 335     }
 336     replay_bh_schedule_oneshot_event(ctx, bdrv_co_drain_bh_cb, &data);
 337
 338     qemu_coroutine_yield();
 339     /* If we are resumed from some other event (such as an aio completion or a
 340      * timer callback), it is a bug in the caller that should be fixed. */
 341     assert(data.done);
 342
 343     /* Reaquire the AioContext of bs if we dropped it */
 344     if (ctx != co_ctx) {
 345         aio_context_acquire(ctx);
 346     }
 347 }
 348
 349 static void bdrv_do_drained_begin(BlockDriverState *bs, BdrvChild *parent,
 350                                   bool poll)
 351 {
 352     IO_OR_GS_CODE();
 353
 354     if (qemu_in_coroutine()) {
 355         bdrv_co_yield_to_drain(bs, true, parent, poll);
 356         return;
 357     }
 358
 359     /* Stop things in parent-to-child order */
 360     if (qatomic_fetch_inc(&bs->quiesce_counter) == 0) {
 361         aio_disable_external(bdrv_get_aio_context(bs));
 362         bdrv_parent_drained_begin(bs, parent);
 363         if (bs->drv && bs->drv->bdrv_drain_begin) {
 364             bs->drv->bdrv_drain_begin(bs);
 365         }
 366     }
 367
 368     /*
 369      * Wait for drained requests to finish.
 370      *
 371      * Calling BDRV_POLL_WHILE() only once for the top-level node is okay: The
 372      * call is needed so things in this AioContext can make progress even
 373      * though we don't return to the main AioContext loop - this automatically
 374      * includes other nodes in the same AioContext and therefore all child
 375      * nodes.
 376      */
 377     if (poll) {
 378         BDRV_POLL_WHILE(bs, bdrv_drain_poll_top_level(bs, parent));
 379     }
 380 }
 381
 382 void bdrv_do_drained_begin_quiesce(BlockDriverState *bs, BdrvChild *parent)
 383 {
 384     bdrv_do_drained_begin(bs, parent, false);
 385 }
 386
 387 void bdrv_drained_begin(BlockDriverState *bs)
 388 {
 389     IO_OR_GS_CODE();
 390     bdrv_do_drained_begin(bs, NULL, true);
 391 }
 392
 393 /**
 394  * This function does not poll, nor must any of its recursively called
 395  * functions.
 396  */
 397 static void bdrv_do_drained_end(BlockDriverState *bs, BdrvChild *parent)
 398 {
 399     int old_quiesce_counter;
 400
 401     if (qemu_in_coroutine()) {
 402         bdrv_co_yield_to_drain(bs, false, parent, false);
 403         return;
 404     }
 405     assert(bs->quiesce_counter > 0);
 406
 407     /* Re-enable things in child-to-parent order */
 408     old_quiesce_counter = qatomic_fetch_dec(&bs->quiesce_counter);
 409     if (old_quiesce_counter == 1) {
 410         if (bs->drv && bs->drv->bdrv_drain_end) {
 411             bs->drv->bdrv_drain_end(bs);
 412         }
 413         bdrv_parent_drained_end(bs, parent);
 414         aio_enable_external(bdrv_get_aio_context(bs));
 415     }
 416 }
 417
 418 void bdrv_drained_end(BlockDriverState *bs)
 419 {
 420     IO_OR_GS_CODE();
 421     bdrv_do_drained_end(bs, NULL);
 422 }
 423
 424 void bdrv_drain(BlockDriverState *bs)
 425 {
 426     IO_OR_GS_CODE();
 427     bdrv_drained_begin(bs);
 428     bdrv_drained_end(bs);
 429 }
 430
 431 static void bdrv_drain_assert_idle(BlockDriverState *bs)
 432 {
 433     BdrvChild *child, *next;
 434
 435     assert(qatomic_read(&bs->in_flight) == 0);
 436     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
 437         bdrv_drain_assert_idle(child->bs);
 438     }
 439 }
 440
 441 unsigned int bdrv_drain_all_count = 0;
 442
 443 static bool bdrv_drain_all_poll(void)
 444 {
 445     BlockDriverState *bs = NULL;
 446     bool result = false;
 447     GLOBAL_STATE_CODE();
 448
 449     /* bdrv_drain_poll() can't make changes to the graph and we are holding the
 450      * main AioContext lock, so iterating bdrv_next_all_states() is safe. */
 451     while ((bs = bdrv_next_all_states(bs))) {
 452         AioContext *aio_context = bdrv_get_aio_context(bs);
 453         aio_context_acquire(aio_context);
 454         result |= bdrv_drain_poll(bs, NULL, true);
 455         aio_context_release(aio_context);
 456     }
 457
 458     return result;
 459 }
 460
 461 /*
 462  * Wait for pending requests to complete across all BlockDriverStates
 463  *
 464  * This function does not flush data to disk, use bdrv_flush_all() for that
 465  * after calling this function.
 466  *
 467  * This pauses all block jobs and disables external clients. It must
 468  * be paired with bdrv_drain_all_end().
 469  *
 470  * NOTE: no new block jobs or BlockDriverStates can be created between
 471  * the bdrv_drain_all_begin() and bdrv_drain_all_end() calls.
 472  */
 473 void bdrv_drain_all_begin(void)
 474 {
 475     BlockDriverState *bs = NULL;
 476     GLOBAL_STATE_CODE();
 477
 478     if (qemu_in_coroutine()) {
 479         bdrv_co_yield_to_drain(NULL, true, NULL, true);
 480         return;
 481     }
 482
 483     /*
 484      * bdrv queue is managed by record/replay,
 485      * waiting for finishing the I/O requests may
 486      * be infinite
 487      */
 488     if (replay_events_enabled()) {
 489         return;
 490     }
 491
 492     /* AIO_WAIT_WHILE() with a NULL context can only be called from the main
 493      * loop AioContext, so make sure we're in the main context. */
 494     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
 495     assert(bdrv_drain_all_count < INT_MAX);
 496     bdrv_drain_all_count++;
 497
 498     /* Quiesce all nodes, without polling in-flight requests yet. The graph
 499      * cannot change during this loop. */
 500     while ((bs = bdrv_next_all_states(bs))) {
 501         AioContext *aio_context = bdrv_get_aio_context(bs);
 502
 503         aio_context_acquire(aio_context);
 504         bdrv_do_drained_begin(bs, NULL, false);
 505         aio_context_release(aio_context);
 506     }
 507
 508     /* Now poll the in-flight requests */
 509     AIO_WAIT_WHILE(NULL, bdrv_drain_all_poll());
 510
 511     while ((bs = bdrv_next_all_states(bs))) {
 512         bdrv_drain_assert_idle(bs);
 513     }
 514 }
 515
 516 void bdrv_drain_all_end_quiesce(BlockDriverState *bs)
 517 {
 518     GLOBAL_STATE_CODE();
 519
 520     g_assert(bs->quiesce_counter > 0);
 521     g_assert(!bs->refcnt);
 522
 523     while (bs->quiesce_counter) {
 524         bdrv_do_drained_end(bs, NULL);
 525     }
 526 }
 527
 528 void bdrv_drain_all_end(void)
 529 {
 530     BlockDriverState *bs = NULL;
 531     GLOBAL_STATE_CODE();
 532
 533     /*
 534      * bdrv queue is managed by record/replay,
 535      * waiting for finishing the I/O requests may
 536      * be endless
 537      */
 538     if (replay_events_enabled()) {
 539         return;
 540     }
 541
 542     while ((bs = bdrv_next_all_states(bs))) {
 543         AioContext *aio_context = bdrv_get_aio_context(bs);
 544
 545         aio_context_acquire(aio_context);
 546         bdrv_do_drained_end(bs, NULL);
 547         aio_context_release(aio_context);
 548     }
 549
 550     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
 551     assert(bdrv_drain_all_count > 0);
 552     bdrv_drain_all_count--;
 553 }
 554
 555 void bdrv_drain_all(void)
 556 {
 557     GLOBAL_STATE_CODE();
 558     bdrv_drain_all_begin();
 559     bdrv_drain_all_end();
 560 }
 561
 562 /**
 563  * Remove an active request from the tracked requests list
 564  *
 565  * This function should be called when a tracked request is completing.
 566  */
 567 static void coroutine_fn tracked_request_end(BdrvTrackedRequest *req)
 568 {
 569     if (req->serialising) {
 570         qatomic_dec(&req->bs->serialising_in_flight);
 571     }
 572
 573     qemu_co_mutex_lock(&req->bs->reqs_lock);
 574     QLIST_REMOVE(req, list);
 575     qemu_co_queue_restart_all(&req->wait_queue);
 576     qemu_co_mutex_unlock(&req->bs->reqs_lock);
 577 }
 578
 579 /**
 580  * Add an active request to the tracked requests list
 581  */
 582 static void coroutine_fn tracked_request_begin(BdrvTrackedRequest *req,
 583                                                BlockDriverState *bs,
 584                                                int64_t offset,
 585                                                int64_t bytes,
 586                                                enum BdrvTrackedRequestType type)
 587 {
 588     bdrv_check_request(offset, bytes, &error_abort);
 589
 590     *req = (BdrvTrackedRequest){
 591         .bs = bs,
 592         .offset         = offset,
 593         .bytes          = bytes,
 594         .type           = type,
 595         .co             = qemu_coroutine_self(),
 596         .serialising    = false,
 597         .overlap_offset = offset,
 598         .overlap_bytes  = bytes,
 599     };
 600
 601     qemu_co_queue_init(&req->wait_queue);
 602
 603     qemu_co_mutex_lock(&bs->reqs_lock);
 604     QLIST_INSERT_HEAD(&bs->tracked_requests, req, list);
 605     qemu_co_mutex_unlock(&bs->reqs_lock);
 606 }
 607
 608 static bool tracked_request_overlaps(BdrvTrackedRequest *req,
 609                                      int64_t offset, int64_t bytes)
 610 {
 611     bdrv_check_request(offset, bytes, &error_abort);
 612
 613     /*        aaaa   bbbb */
 614     if (offset >= req->overlap_offset + req->overlap_bytes) {
 615         return false;
 616     }
 617     /* bbbb   aaaa        */
 618     if (req->overlap_offset >= offset + bytes) {
 619         return false;
 620     }
 621     return true;
 622 }
 623
 624 /* Called with self->bs->reqs_lock held */
 625 static coroutine_fn BdrvTrackedRequest *
 626 bdrv_find_conflicting_request(BdrvTrackedRequest *self)
 627 {
 628     BdrvTrackedRequest *req;
 629
 630     QLIST_FOREACH(req, &self->bs->tracked_requests, list) {
 631         if (req == self || (!req->serialising && !self->serialising)) {
 632             continue;
 633         }
 634         if (tracked_request_overlaps(req, self->overlap_offset,
 635                                      self->overlap_bytes))
 636         {
 637             /*
 638              * Hitting this means there was a reentrant request, for
 639              * example, a block driver issuing nested requests.  This must
 640              * never happen since it means deadlock.
 641              */
 642             assert(qemu_coroutine_self() != req->co);
 643
 644             /*
 645              * If the request is already (indirectly) waiting for us, or
 646              * will wait for us as soon as it wakes up, then just go on
 647              * (instead of producing a deadlock in the former case).
 648              */
 649             if (!req->waiting_for) {
 650                 return req;
 651             }
 652         }
 653     }
 654
 655     return NULL;
 656 }
 657
 658 /* Called with self->bs->reqs_lock held */
 659 static void coroutine_fn
 660 bdrv_wait_serialising_requests_locked(BdrvTrackedRequest *self)
 661 {
 662     BdrvTrackedRequest *req;
 663
 664     while ((req = bdrv_find_conflicting_request(self))) {
 665         self->waiting_for = req;
 666         qemu_co_queue_wait(&req->wait_queue, &self->bs->reqs_lock);
 667         self->waiting_for = NULL;
 668     }
 669 }
 670
 671 /* Called with req->bs->reqs_lock held */
 672 static void tracked_request_set_serialising(BdrvTrackedRequest *req,
 673                                             uint64_t align)
 674 {
 675     int64_t overlap_offset = req->offset & ~(align - 1);
 676     int64_t overlap_bytes =
 677         ROUND_UP(req->offset + req->bytes, align) - overlap_offset;
 678
 679     bdrv_check_request(req->offset, req->bytes, &error_abort);
 680
 681     if (!req->serialising) {
 682         qatomic_inc(&req->bs->serialising_in_flight);
 683         req->serialising = true;
 684     }
 685
 686     req->overlap_offset = MIN(req->overlap_offset, overlap_offset);
 687     req->overlap_bytes = MAX(req->overlap_bytes, overlap_bytes);
 688 }
 689
 690 /**
 691  * Return the tracked request on @bs for the current coroutine, or
 692  * NULL if there is none.
 693  */
 694 BdrvTrackedRequest *coroutine_fn bdrv_co_get_self_request(BlockDriverState *bs)
 695 {
 696     BdrvTrackedRequest *req;
 697     Coroutine *self = qemu_coroutine_self();
 698     IO_CODE();
 699
 700     QLIST_FOREACH(req, &bs->tracked_requests, list) {
 701         if (req->co == self) {
 702             return req;
 703         }
 704     }
 705
 706     return NULL;
 707 }
 708
 709 /**
 710  * Round a region to cluster boundaries
 711  */
 712 void bdrv_round_to_clusters(BlockDriverState *bs,
 713                             int64_t offset, int64_t bytes,
 714                             int64_t *cluster_offset,
 715                             int64_t *cluster_bytes)
 716 {
 717     BlockDriverInfo bdi;
 718     IO_CODE();
 719     if (bdrv_get_info(bs, &bdi) < 0 || bdi.cluster_size == 0) {
 720         *cluster_offset = offset;
 721         *cluster_bytes = bytes;
 722     } else {
 723         int64_t c = bdi.cluster_size;
 724         *cluster_offset = QEMU_ALIGN_DOWN(offset, c);
 725         *cluster_bytes = QEMU_ALIGN_UP(offset - *cluster_offset + bytes, c);
 726     }
 727 }
 728
 729 static int bdrv_get_cluster_size(BlockDriverState *bs)
 730 {
 731     BlockDriverInfo bdi;
 732     int ret;
 733
 734     ret = bdrv_get_info(bs, &bdi);
 735     if (ret < 0 || bdi.cluster_size == 0) {
 736         return bs->bl.request_alignment;
 737     } else {
 738         return bdi.cluster_size;
 739     }
 740 }
 741
 742 void bdrv_inc_in_flight(BlockDriverState *bs)
 743 {
 744     IO_CODE();
 745     qatomic_inc(&bs->in_flight);
 746 }
 747
 748 void bdrv_wakeup(BlockDriverState *bs)
 749 {
 750     IO_CODE();
 751     aio_wait_kick();
 752 }
 753
 754 void bdrv_dec_in_flight(BlockDriverState *bs)
 755 {
 756     IO_CODE();
 757     qatomic_dec(&bs->in_flight);
 758     bdrv_wakeup(bs);
 759 }
 760
 761 static void coroutine_fn
 762 bdrv_wait_serialising_requests(BdrvTrackedRequest *self)
 763 {
 764     BlockDriverState *bs = self->bs;
 765
 766     if (!qatomic_read(&bs->serialising_in_flight)) {
 767         return;
 768     }
 769
 770     qemu_co_mutex_lock(&bs->reqs_lock);
 771     bdrv_wait_serialising_requests_locked(self);
 772     qemu_co_mutex_unlock(&bs->reqs_lock);
 773 }
 774
 775 void coroutine_fn bdrv_make_request_serialising(BdrvTrackedRequest *req,
 776                                                 uint64_t align)
 777 {
 778     IO_CODE();
 779
 780     qemu_co_mutex_lock(&req->bs->reqs_lock);
 781
 782     tracked_request_set_serialising(req, align);
 783     bdrv_wait_serialising_requests_locked(req);
 784
 785     qemu_co_mutex_unlock(&req->bs->reqs_lock);
 786 }
 787
 788 int bdrv_check_qiov_request(int64_t offset, int64_t bytes,
 789                             QEMUIOVector *qiov, size_t qiov_offset,
 790                             Error **errp)
 791 {
 792     /*
 793      * Check generic offset/bytes correctness
 794      */
 795
 796     if (offset < 0) {
 797         error_setg(errp, "offset is negative: %" PRIi64, offset);
 798         return -EIO;
 799     }
 800
 801     if (bytes < 0) {
 802         error_setg(errp, "bytes is negative: %" PRIi64, bytes);
 803         return -EIO;
 804     }
 805
 806     if (bytes > BDRV_MAX_LENGTH) {
 807         error_setg(errp, "bytes(%" PRIi64 ") exceeds maximum(%" PRIi64 ")",
 808                    bytes, BDRV_MAX_LENGTH);
 809         return -EIO;
 810     }
 811
 812     if (offset > BDRV_MAX_LENGTH) {
 813         error_setg(errp, "offset(%" PRIi64 ") exceeds maximum(%" PRIi64 ")",
 814                    offset, BDRV_MAX_LENGTH);
 815         return -EIO;
 816     }
 817
 818     if (offset > BDRV_MAX_LENGTH - bytes) {
 819         error_setg(errp, "sum of offset(%" PRIi64 ") and bytes(%" PRIi64 ") "
 820                    "exceeds maximum(%" PRIi64 ")", offset, bytes,
 821                    BDRV_MAX_LENGTH);
 822         return -EIO;
 823     }
 824
 825     if (!qiov) {
 826         return 0;
 827     }
 828
 829     /*
 830      * Check qiov and qiov_offset
 831      */
 832
 833     if (qiov_offset > qiov->size) {
 834         error_setg(errp, "qiov_offset(%zu) overflow io vector size(%zu)",
 835                    qiov_offset, qiov->size);
 836         return -EIO;
 837     }
 838
 839     if (bytes > qiov->size - qiov_offset) {
 840         error_setg(errp, "bytes(%" PRIi64 ") + qiov_offset(%zu) overflow io "
 841                    "vector size(%zu)", bytes, qiov_offset, qiov->size);
 842         return -EIO;
 843     }
 844
 845     return 0;
 846 }
 847
 848 int bdrv_check_request(int64_t offset, int64_t bytes, Error **errp)
 849 {
 850     return bdrv_check_qiov_request(offset, bytes, NULL, 0, errp);
 851 }
 852
 853 static int bdrv_check_request32(int64_t offset, int64_t bytes,
 854                                 QEMUIOVector *qiov, size_t qiov_offset)
 855 {
 856     int ret = bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, NULL);
 857     if (ret < 0) {
 858         return ret;
 859     }
 860
 861     if (bytes > BDRV_REQUEST_MAX_BYTES) {
 862         return -EIO;
 863     }
 864
 865     return 0;
 866 }
 867
 868 /*
 869  * Completely zero out a block device with the help of bdrv_pwrite_zeroes.
 870  * The operation is sped up by checking the block status and only writing
 871  * zeroes to the device if they currently do not return zeroes. Optional
 872  * flags are passed through to bdrv_pwrite_zeroes (e.g. BDRV_REQ_MAY_UNMAP,
 873  * BDRV_REQ_FUA).
 874  *
 875  * Returns < 0 on error, 0 on success. For error codes see bdrv_pwrite().
 876  */
 877 int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
 878 {
 879     int ret;
 880     int64_t target_size, bytes, offset = 0;
 881     BlockDriverState *bs = child->bs;
 882     IO_CODE();
 883
 884     target_size = bdrv_getlength(bs);
 885     if (target_size < 0) {
 886         return target_size;
 887     }
 888
 889     for (;;) {
 890         bytes = MIN(target_size - offset, BDRV_REQUEST_MAX_BYTES);
 891         if (bytes <= 0) {
 892             return 0;
 893         }
 894         ret = bdrv_block_status(bs, offset, bytes, &bytes, NULL, NULL);
 895         if (ret < 0) {
 896             return ret;
 897         }
 898         if (ret & BDRV_BLOCK_ZERO) {
 899             offset += bytes;
 900             continue;
 901         }
 902         ret = bdrv_pwrite_zeroes(child, offset, bytes, flags);
 903         if (ret < 0) {
 904             return ret;
 905         }
 906         offset += bytes;
 907     }
 908 }
 909
 910 /*
 911  * Writes to the file and ensures that no writes are reordered across this
 912  * request (acts as a barrier)
 913  *
 914  * Returns 0 on success, -errno in error cases.
 915  */
 916 int coroutine_fn bdrv_co_pwrite_sync(BdrvChild *child, int64_t offset,
 917                                      int64_t bytes, const void *buf,
 918                                      BdrvRequestFlags flags)
 919 {
 920     int ret;
 921     IO_CODE();
 922
 923     ret = bdrv_co_pwrite(child, offset, bytes, buf, flags);
 924     if (ret < 0) {
 925         return ret;
 926     }
 927
 928     ret = bdrv_co_flush(child->bs);
 929     if (ret < 0) {
 930         return ret;
 931     }
 932
 933     return 0;
 934 }
 935
 936 typedef struct CoroutineIOCompletion {
 937     Coroutine *coroutine;
 938     int ret;
 939 } CoroutineIOCompletion;
 940
 941 static void bdrv_co_io_em_complete(void *opaque, int ret)
 942 {
 943     CoroutineIOCompletion *co = opaque;
 944
 945     co->ret = ret;
 946     aio_co_wake(co->coroutine);
 947 }
 948
 949 static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
 950                                            int64_t offset, int64_t bytes,
 951                                            QEMUIOVector *qiov,
 952                                            size_t qiov_offset, int flags)
 953 {
 954     BlockDriver *drv = bs->drv;
 955     int64_t sector_num;
 956     unsigned int nb_sectors;
 957     QEMUIOVector local_qiov;
 958     int ret;
 959
 960     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
 961     assert(!(flags & ~bs->supported_read_flags));
 962
 963     if (!drv) {
 964         return -ENOMEDIUM;
 965     }
 966
 967     if (drv->bdrv_co_preadv_part) {
 968         return drv->bdrv_co_preadv_part(bs, offset, bytes, qiov, qiov_offset,
 969                                         flags);
 970     }
 971
 972     if (qiov_offset > 0 || bytes != qiov->size) {
 973         qemu_iovec_init_slice(&local_qiov, qiov, qiov_offset, bytes);
 974         qiov = &local_qiov;
 975     }
 976
 977     if (drv->bdrv_co_preadv) {
 978         ret = drv->bdrv_co_preadv(bs, offset, bytes, qiov, flags);
 979         goto out;
 980     }
 981
 982     if (drv->bdrv_aio_preadv) {
 983         BlockAIOCB *acb;
 984         CoroutineIOCompletion co = {
 985             .coroutine = qemu_coroutine_self(),
 986         };
 987
 988         acb = drv->bdrv_aio_preadv(bs, offset, bytes, qiov, flags,
 989                                    bdrv_co_io_em_complete, &co);
 990         if (acb == NULL) {
 991             ret = -EIO;
 992             goto out;
 993         } else {
 994             qemu_coroutine_yield();
 995             ret = co.ret;
 996             goto out;
 997         }
 998     }
 999
1000     sector_num = offset >> BDRV_SECTOR_BITS;
1001     nb_sectors = bytes >> BDRV_SECTOR_BITS;
1002
1003     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
1004     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
1005     assert(bytes <= BDRV_REQUEST_MAX_BYTES);
1006     assert(drv->bdrv_co_readv);
1007
1008     ret = drv->bdrv_co_readv(bs, sector_num, nb_sectors, qiov);
1009
1010 out:
1011     if (qiov == &local_qiov) {
1012         qemu_iovec_destroy(&local_qiov);
1013     }
1014
1015     return ret;
1016 }
1017
1018 static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
1019                                             int64_t offset, int64_t bytes,
1020                                             QEMUIOVector *qiov,
1021                                             size_t qiov_offset,
1022                                             BdrvRequestFlags flags)
1023 {
1024     BlockDriver *drv = bs->drv;
1025     bool emulate_fua = false;
1026     int64_t sector_num;
1027     unsigned int nb_sectors;
1028     QEMUIOVector local_qiov;
1029     int ret;
1030
1031     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
1032
1033     if (!drv) {
1034         return -ENOMEDIUM;
1035     }
1036
1037     if ((flags & BDRV_REQ_FUA) &&
1038         (~bs->supported_write_flags & BDRV_REQ_FUA)) {
1039         flags &= ~BDRV_REQ_FUA;
1040         emulate_fua = true;
1041     }
1042
1043     flags &= bs->supported_write_flags;
1044
1045     if (drv->bdrv_co_pwritev_part) {
1046         ret = drv->bdrv_co_pwritev_part(bs, offset, bytes, qiov, qiov_offset,
1047                                         flags);
1048         goto emulate_flags;
1049     }
1050
1051     if (qiov_offset > 0 || bytes != qiov->size) {
1052         qemu_iovec_init_slice(&local_qiov, qiov, qiov_offset, bytes);
1053         qiov = &local_qiov;
1054     }
1055
1056     if (drv->bdrv_co_pwritev) {
1057         ret = drv->bdrv_co_pwritev(bs, offset, bytes, qiov, flags);
1058         goto emulate_flags;
1059     }
1060
1061     if (drv->bdrv_aio_pwritev) {
1062         BlockAIOCB *acb;
1063         CoroutineIOCompletion co = {
1064             .coroutine = qemu_coroutine_self(),
1065         };
1066
1067         acb = drv->bdrv_aio_pwritev(bs, offset, bytes, qiov, flags,
1068                                     bdrv_co_io_em_complete, &co);
1069         if (acb == NULL) {
1070             ret = -EIO;
1071         } else {
1072             qemu_coroutine_yield();
1073             ret = co.ret;
1074         }
1075         goto emulate_flags;
1076     }
1077
1078     sector_num = offset >> BDRV_SECTOR_BITS;
1079     nb_sectors = bytes >> BDRV_SECTOR_BITS;
1080
1081     assert(QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE));
1082     assert(QEMU_IS_ALIGNED(bytes, BDRV_SECTOR_SIZE));
1083     assert(bytes <= BDRV_REQUEST_MAX_BYTES);
1084
1085     assert(drv->bdrv_co_writev);
1086     ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov, flags);
1087
1088 emulate_flags:
1089     if (ret == 0 && emulate_fua) {
1090         ret = bdrv_co_flush(bs);
1091     }
1092
1093     if (qiov == &local_qiov) {
1094         qemu_iovec_destroy(&local_qiov);
1095     }
1096
1097     return ret;
1098 }
1099
1100 static int coroutine_fn
1101 bdrv_driver_pwritev_compressed(BlockDriverState *bs, int64_t offset,
1102                                int64_t bytes, QEMUIOVector *qiov,
1103                                size_t qiov_offset)
1104 {
1105     BlockDriver *drv = bs->drv;
1106     QEMUIOVector local_qiov;
1107     int ret;
1108
1109     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
1110
1111     if (!drv) {
1112         return -ENOMEDIUM;
1113     }
1114
1115     if (!block_driver_can_compress(drv)) {
1116         return -ENOTSUP;
1117     }
1118
1119     if (drv->bdrv_co_pwritev_compressed_part) {
1120         return drv->bdrv_co_pwritev_compressed_part(bs, offset, bytes,
1121                                                     qiov, qiov_offset);
1122     }
1123
1124     if (qiov_offset == 0) {
1125         return drv->bdrv_co_pwritev_compressed(bs, offset, bytes, qiov);
1126     }
1127
1128     qemu_iovec_init_slice(&local_qiov, qiov, qiov_offset, bytes);
1129     ret = drv->bdrv_co_pwritev_compressed(bs, offset, bytes, &local_qiov);
1130     qemu_iovec_destroy(&local_qiov);
1131
1132     return ret;
1133 }
1134
1135 static int coroutine_fn bdrv_co_do_copy_on_readv(BdrvChild *child,
1136         int64_t offset, int64_t bytes, QEMUIOVector *qiov,
1137         size_t qiov_offset, int flags)
1138 {
1139     BlockDriverState *bs = child->bs;
1140
1141     /* Perform I/O through a temporary buffer so that users who scribble over
1142      * their read buffer while the operation is in progress do not end up
1143      * modifying the image file.  This is critical for zero-copy guest I/O
1144      * where anything might happen inside guest memory.
1145      */
1146     void *bounce_buffer = NULL;
1147
1148     BlockDriver *drv = bs->drv;
1149     int64_t cluster_offset;
1150     int64_t cluster_bytes;
1151     int64_t skip_bytes;
1152     int ret;
1153     int max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
1154                                     BDRV_REQUEST_MAX_BYTES);
1155     int64_t progress = 0;
1156     bool skip_write;
1157
1158     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
1159
1160     if (!drv) {
1161         return -ENOMEDIUM;
1162     }
1163
1164     /*
1165      * Do not write anything when the BDS is inactive.  That is not
1166      * allowed, and it would not help.
1167      */
1168     skip_write = (bs->open_flags & BDRV_O_INACTIVE);
1169
1170     /* FIXME We cannot require callers to have write permissions when all they
1171      * are doing is a read request. If we did things right, write permissions
1172      * would be obtained anyway, but internally by the copy-on-read code. As
1173      * long as it is implemented here rather than in a separate filter driver,
1174      * the copy-on-read code doesn't have its own BdrvChild, however, for which
1175      * it could request permissions. Therefore we have to bypass the permission
1176      * system for the moment. */
1177     // assert(child->perm & (BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE));
1178
1179     /* Cover entire cluster so no additional backing file I/O is required when
1180      * allocating cluster in the image file.  Note that this value may exceed
1181      * BDRV_REQUEST_MAX_BYTES (even when the original read did not), which
1182      * is one reason we loop rather than doing it all at once.
1183      */
1184     bdrv_round_to_clusters(bs, offset, bytes, &cluster_offset, &cluster_bytes);
1185     skip_bytes = offset - cluster_offset;
1186
1187     trace_bdrv_co_do_copy_on_readv(bs, offset, bytes,
1188                                    cluster_offset, cluster_bytes);
1189
1190     while (cluster_bytes) {
1191         int64_t pnum;
1192
1193         if (skip_write) {
1194             ret = 1; /* "already allocated", so nothing will be copied */
1195             pnum = MIN(cluster_bytes, max_transfer);
1196         } else {
1197             ret = bdrv_is_allocated(bs, cluster_offset,
1198                                     MIN(cluster_bytes, max_transfer), &pnum);
1199             if (ret < 0) {
1200                 /*
1201                  * Safe to treat errors in querying allocation as if
1202                  * unallocated; we'll probably fail again soon on the
1203                  * read, but at least that will set a decent errno.
1204                  */
1205                 pnum = MIN(cluster_bytes, max_transfer);
1206             }
1207
1208             /* Stop at EOF if the image ends in the middle of the cluster */
1209             if (ret == 0 && pnum == 0) {
1210                 assert(progress >= bytes);
1211                 break;
1212             }
1213
1214             assert(skip_bytes < pnum);
1215         }
1216
1217         if (ret <= 0) {
1218             QEMUIOVector local_qiov;
1219
1220             /* Must copy-on-read; use the bounce buffer */
1221             pnum = MIN(pnum, MAX_BOUNCE_BUFFER);
1222             if (!bounce_buffer) {
1223                 int64_t max_we_need = MAX(pnum, cluster_bytes - pnum);
1224                 int64_t max_allowed = MIN(max_transfer, MAX_BOUNCE_BUFFER);
1225                 int64_t bounce_buffer_len = MIN(max_we_need, max_allowed);
1226
1227                 bounce_buffer = qemu_try_blockalign(bs, bounce_buffer_len);
1228                 if (!bounce_buffer) {
1229                     ret = -ENOMEM;
1230                     goto err;
1231                 }
1232             }
1233             qemu_iovec_init_buf(&local_qiov, bounce_buffer, pnum);
1234
1235             ret = bdrv_driver_preadv(bs, cluster_offset, pnum,
1236                                      &local_qiov, 0, 0);
1237             if (ret < 0) {
1238                 goto err;
1239             }
1240
1241             bdrv_debug_event(bs, BLKDBG_COR_WRITE);
1242             if (drv->bdrv_co_pwrite_zeroes &&
1243                 buffer_is_zero(bounce_buffer, pnum)) {
1244                 /* FIXME: Should we (perhaps conditionally) be setting
1245                  * BDRV_REQ_MAY_UNMAP, if it will allow for a sparser copy
1246                  * that still correctly reads as zero? */
1247                 ret = bdrv_co_do_pwrite_zeroes(bs, cluster_offset, pnum,
1248                                                BDRV_REQ_WRITE_UNCHANGED);
1249             } else {
1250                 /* This does not change the data on the disk, it is not
1251                  * necessary to flush even in cache=writethrough mode.
1252                  */
1253                 ret = bdrv_driver_pwritev(bs, cluster_offset, pnum,
1254                                           &local_qiov, 0,
1255                                           BDRV_REQ_WRITE_UNCHANGED);
1256             }
1257
1258             if (ret < 0) {
1259                 /* It might be okay to ignore write errors for guest
1260                  * requests.  If this is a deliberate copy-on-read
1261                  * then we don't want to ignore the error.  Simply
1262                  * report it in all cases.
1263                  */
1264                 goto err;
1265             }
1266
1267             if (!(flags & BDRV_REQ_PREFETCH)) {
1268                 qemu_iovec_from_buf(qiov, qiov_offset + progress,
1269                                     bounce_buffer + skip_bytes,
1270                                     MIN(pnum - skip_bytes, bytes - progress));
1271             }
1272         } else if (!(flags & BDRV_REQ_PREFETCH)) {
1273             /* Read directly into the destination */
1274             ret = bdrv_driver_preadv(bs, offset + progress,
1275                                      MIN(pnum - skip_bytes, bytes - progress),
1276                                      qiov, qiov_offset + progress, 0);
1277             if (ret < 0) {
1278                 goto err;
1279             }
1280         }
1281
1282         cluster_offset += pnum;
1283         cluster_bytes -= pnum;
1284         progress += pnum - skip_bytes;
1285         skip_bytes = 0;
1286     }
1287     ret = 0;
1288
1289 err:
1290     qemu_vfree(bounce_buffer);
1291     return ret;
1292 }
1293
1294 /*
1295  * Forwards an already correctly aligned request to the BlockDriver. This
1296  * handles copy on read, zeroing after EOF, and fragmentation of large
1297  * reads; any other features must be implemented by the caller.
1298  */
1299 static int coroutine_fn bdrv_aligned_preadv(BdrvChild *child,
1300     BdrvTrackedRequest *req, int64_t offset, int64_t bytes,
1301     int64_t align, QEMUIOVector *qiov, size_t qiov_offset, int flags)
1302 {
1303     BlockDriverState *bs = child->bs;
1304     int64_t total_bytes, max_bytes;
1305     int ret = 0;
1306     int64_t bytes_remaining = bytes;
1307     int max_transfer;
1308
1309     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
1310     assert(is_power_of_2(align));
1311     assert((offset & (align - 1)) == 0);
1312     assert((bytes & (align - 1)) == 0);
1313     assert((bs->open_flags & BDRV_O_NO_IO) == 0);
1314     max_transfer = QEMU_ALIGN_DOWN(MIN_NON_ZERO(bs->bl.max_transfer, INT_MAX),
1315                                    align);
1316
1317     /*
1318      * TODO: We would need a per-BDS .supported_read_flags and
1319      * potential fallback support, if we ever implement any read flags
1320      * to pass through to drivers.  For now, there aren't any
1321      * passthrough flags except the BDRV_REQ_REGISTERED_BUF optimization hint.
1322      */
1323     assert(!(flags & ~(BDRV_REQ_COPY_ON_READ | BDRV_REQ_PREFETCH |
1324                        BDRV_REQ_REGISTERED_BUF)));
1325
1326     /* Handle Copy on Read and associated serialisation */
1327     if (flags & BDRV_REQ_COPY_ON_READ) {
1328         /* If we touch the same cluster it counts as an overlap.  This
1329          * guarantees that allocating writes will be serialized and not race
1330          * with each other for the same cluster.  For example, in copy-on-read
1331          * it ensures that the CoR read and write operations are atomic and
1332          * guest writes cannot interleave between them. */
1333         bdrv_make_request_serialising(req, bdrv_get_cluster_size(bs));
1334     } else {
1335         bdrv_wait_serialising_requests(req);
1336     }
1337
1338     if (flags & BDRV_REQ_COPY_ON_READ) {
1339         int64_t pnum;
1340
1341         /* The flag BDRV_REQ_COPY_ON_READ has reached its addressee */
1342         flags &= ~BDRV_REQ_COPY_ON_READ;
1343
1344         ret = bdrv_is_allocated(bs, offset, bytes, &pnum);
1345         if (ret < 0) {
1346             goto out;
1347         }
1348
1349         if (!ret || pnum != bytes) {
1350             ret = bdrv_co_do_copy_on_readv(child, offset, bytes,
1351                                            qiov, qiov_offset, flags);
1352             goto out;
1353         } else if (flags & BDRV_REQ_PREFETCH) {
1354             goto out;
1355         }
1356     }
1357
1358     /* Forward the request to the BlockDriver, possibly fragmenting it */
1359     total_bytes = bdrv_getlength(bs);
1360     if (total_bytes < 0) {
1361         ret = total_bytes;
1362         goto out;
1363     }
1364
1365     assert(!(flags & ~(bs->supported_read_flags | BDRV_REQ_REGISTERED_BUF)));
1366
1367     max_bytes = ROUND_UP(MAX(0, total_bytes - offset), align);
1368     if (bytes <= max_bytes && bytes <= max_transfer) {
1369         ret = bdrv_driver_preadv(bs, offset, bytes, qiov, qiov_offset, flags);
1370         goto out;
1371     }
1372
1373     while (bytes_remaining) {
1374         int64_t num;
1375
1376         if (max_bytes) {
1377             num = MIN(bytes_remaining, MIN(max_bytes, max_transfer));
1378             assert(num);
1379
1380             ret = bdrv_driver_preadv(bs, offset + bytes - bytes_remaining,
1381                                      num, qiov,
1382                                      qiov_offset + bytes - bytes_remaining,
1383                                      flags);
1384             max_bytes -= num;
1385         } else {
1386             num = bytes_remaining;
1387             ret = qemu_iovec_memset(qiov, qiov_offset + bytes - bytes_remaining,
1388                                     0, bytes_remaining);
1389         }
1390         if (ret < 0) {
1391             goto out;
1392         }
1393         bytes_remaining -= num;
1394     }
1395
1396 out:
1397     return ret < 0 ? ret : 0;
1398 }
1399
1400 /*
1401  * Request padding
1402  *
1403  *  |<---- align ----->|                     |<----- align ---->|
1404  *  |<- head ->|<------------- bytes ------------->|<-- tail -->|
1405  *  |          |       |                     |     |            |
1406  * -*----------$-------*-------- ... --------*-----$------------*---
1407  *  |          |       |                     |     |            |
1408  *  |          offset  |                     |     end          |
1409  *  ALIGN_DOWN(offset) ALIGN_UP(offset)      ALIGN_DOWN(end)   ALIGN_UP(end)
1410  *  [buf   ... )                             [tail_buf          )
1411  *
1412  * @buf is an aligned allocation needed to store @head and @tail paddings. @head
1413  * is placed at the beginning of @buf and @tail at the @end.
1414  *
1415  * @tail_buf is a pointer to sub-buffer, corresponding to align-sized chunk
1416  * around tail, if tail exists.
1417  *
1418  * @merge_reads is true for small requests,
1419  * if @buf_len == @head + bytes + @tail. In this case it is possible that both
1420  * head and tail exist but @buf_len == align and @tail_buf == @buf.
1421  */
1422 typedef struct BdrvRequestPadding {
1423     uint8_t *buf;
1424     size_t buf_len;
1425     uint8_t *tail_buf;
1426     size_t head;
1427     size_t tail;
1428     bool merge_reads;
1429     QEMUIOVector local_qiov;
1430 } BdrvRequestPadding;
1431
1432 static bool bdrv_init_padding(BlockDriverState *bs,
1433                               int64_t offset, int64_t bytes,
1434                               BdrvRequestPadding *pad)
1435 {
1436     int64_t align = bs->bl.request_alignment;
1437     int64_t sum;
1438
1439     bdrv_check_request(offset, bytes, &error_abort);
1440     assert(align <= INT_MAX); /* documented in block/block_int.h */
1441     assert(align <= SIZE_MAX / 2); /* so we can allocate the buffer */
1442
1443     memset(pad, 0, sizeof(*pad));
1444
1445     pad->head = offset & (align - 1);
1446     pad->tail = ((offset + bytes) & (align - 1));
1447     if (pad->tail) {
1448         pad->tail = align - pad->tail;
1449     }
1450
1451     if (!pad->head && !pad->tail) {
1452         return false;
1453     }
1454
1455     assert(bytes); /* Nothing good in aligning zero-length requests */
1456
1457     sum = pad->head + bytes + pad->tail;
1458     pad->buf_len = (sum > align && pad->head && pad->tail) ? 2 * align : align;
1459     pad->buf = qemu_blockalign(bs, pad->buf_len);
1460     pad->merge_reads = sum == pad->buf_len;
1461     if (pad->tail) {
1462         pad->tail_buf = pad->buf + pad->buf_len - align;
1463     }
1464
1465     return true;
1466 }
1467
1468 static coroutine_fn int bdrv_padding_rmw_read(BdrvChild *child,
1469                                               BdrvTrackedRequest *req,
1470                                               BdrvRequestPadding *pad,
1471                                               bool zero_middle)
1472 {
1473     QEMUIOVector local_qiov;
1474     BlockDriverState *bs = child->bs;
1475     uint64_t align = bs->bl.request_alignment;
1476     int ret;
1477
1478     assert(req->serialising && pad->buf);
1479
1480     if (pad->head || pad->merge_reads) {
1481         int64_t bytes = pad->merge_reads ? pad->buf_len : align;
1482
1483         qemu_iovec_init_buf(&local_qiov, pad->buf, bytes);
1484
1485         if (pad->head) {
1486             bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
1487         }
1488         if (pad->merge_reads && pad->tail) {
1489             bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
1490         }
1491         ret = bdrv_aligned_preadv(child, req, req->overlap_offset, bytes,
1492                                   align, &local_qiov, 0, 0);
1493         if (ret < 0) {
1494             return ret;
1495         }
1496         if (pad->head) {
1497             bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
1498         }
1499         if (pad->merge_reads && pad->tail) {
1500             bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
1501         }
1502
1503         if (pad->merge_reads) {
1504             goto zero_mem;
1505         }
1506     }
1507
1508     if (pad->tail) {
1509         qemu_iovec_init_buf(&local_qiov, pad->tail_buf, align);
1510
1511         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
1512         ret = bdrv_aligned_preadv(
1513                 child, req,
1514                 req->overlap_offset + req->overlap_bytes - align,
1515                 align, align, &local_qiov, 0, 0);
1516         if (ret < 0) {
1517             return ret;
1518         }
1519         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
1520     }
1521
1522 zero_mem:
1523     if (zero_middle) {
1524         memset(pad->buf + pad->head, 0, pad->buf_len - pad->head - pad->tail);
1525     }
1526
1527     return 0;
1528 }
1529
1530 static void bdrv_padding_destroy(BdrvRequestPadding *pad)
1531 {
1532     if (pad->buf) {
1533         qemu_vfree(pad->buf);
1534         qemu_iovec_destroy(&pad->local_qiov);
1535     }
1536     memset(pad, 0, sizeof(*pad));
1537 }
1538
1539 /*
1540  * bdrv_pad_request
1541  *
1542  * Exchange request parameters with padded request if needed. Don't include RMW
1543  * read of padding, bdrv_padding_rmw_read() should be called separately if
1544  * needed.
1545  *
1546  * Request parameters (@qiov, &qiov_offset, &offset, &bytes) are in-out:
1547  *  - on function start they represent original request
1548  *  - on failure or when padding is not needed they are unchanged
1549  *  - on success when padding is needed they represent padded request
1550  */
1551 static int bdrv_pad_request(BlockDriverState *bs,
1552                             QEMUIOVector **qiov, size_t *qiov_offset,
1553                             int64_t *offset, int64_t *bytes,
1554                             BdrvRequestPadding *pad, bool *padded,
1555                             BdrvRequestFlags *flags)
1556 {
1557     int ret;
1558
1559     bdrv_check_qiov_request(*offset, *bytes, *qiov, *qiov_offset, &error_abort);
1560
1561     if (!bdrv_init_padding(bs, *offset, *bytes, pad)) {
1562         if (padded) {
1563             *padded = false;
1564         }
1565         return 0;
1566     }
1567
1568     ret = qemu_iovec_init_extended(&pad->local_qiov, pad->buf, pad->head,
1569                                    *qiov, *qiov_offset, *bytes,
1570                                    pad->buf + pad->buf_len - pad->tail,
1571                                    pad->tail);
1572     if (ret < 0) {
1573         bdrv_padding_destroy(pad);
1574         return ret;
1575     }
1576     *bytes += pad->head + pad->tail;
1577     *offset -= pad->head;
1578     *qiov = &pad->local_qiov;
1579     *qiov_offset = 0;
1580     if (padded) {
1581         *padded = true;
1582     }
1583     if (flags) {
1584         /* Can't use optimization hint with bounce buffer */
1585         *flags &= ~BDRV_REQ_REGISTERED_BUF;
1586     }
1587
1588     return 0;
1589 }
1590
1591 int coroutine_fn bdrv_co_preadv(BdrvChild *child,
1592     int64_t offset, int64_t bytes, QEMUIOVector *qiov,
1593     BdrvRequestFlags flags)
1594 {
1595     IO_CODE();
1596     return bdrv_co_preadv_part(child, offset, bytes, qiov, 0, flags);
1597 }
1598
1599 int coroutine_fn bdrv_co_preadv_part(BdrvChild *child,
1600     int64_t offset, int64_t bytes,
1601     QEMUIOVector *qiov, size_t qiov_offset,
1602     BdrvRequestFlags flags)
1603 {
1604     BlockDriverState *bs = child->bs;
1605     BdrvTrackedRequest req;
1606     BdrvRequestPadding pad;
1607     int ret;
1608     IO_CODE();
1609
1610     trace_bdrv_co_preadv_part(bs, offset, bytes, flags);
1611
1612     if (!bdrv_is_inserted(bs)) {
1613         return -ENOMEDIUM;
1614     }
1615
1616     ret = bdrv_check_request32(offset, bytes, qiov, qiov_offset);
1617     if (ret < 0) {
1618         return ret;
1619     }
1620
1621     if (bytes == 0 && !QEMU_IS_ALIGNED(offset, bs->bl.request_alignment)) {
1622         /*
1623          * Aligning zero request is nonsense. Even if driver has special meaning
1624          * of zero-length (like qcow2_co_pwritev_compressed_part), we can't pass
1625          * it to driver due to request_alignment.
1626          *
1627          * Still, no reason to return an error if someone do unaligned
1628          * zero-length read occasionally.
1629          */
1630         return 0;
1631     }
1632
1633     bdrv_inc_in_flight(bs);
1634
1635     /* Don't do copy-on-read if we read data before write operation */
1636     if (qatomic_read(&bs->copy_on_read)) {
1637         flags |= BDRV_REQ_COPY_ON_READ;
1638     }
1639
1640     ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
1641                            NULL, &flags);
1642     if (ret < 0) {
1643         goto fail;
1644     }
1645
1646     tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_READ);
1647     ret = bdrv_aligned_preadv(child, &req, offset, bytes,
1648                               bs->bl.request_alignment,
1649                               qiov, qiov_offset, flags);
1650     tracked_request_end(&req);
1651     bdrv_padding_destroy(&pad);
1652
1653 fail:
1654     bdrv_dec_in_flight(bs);
1655
1656     return ret;
1657 }
1658
1659 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
1660     int64_t offset, int64_t bytes, BdrvRequestFlags flags)
1661 {
1662     BlockDriver *drv = bs->drv;
1663     QEMUIOVector qiov;
1664     void *buf = NULL;
1665     int ret = 0;
1666     bool need_flush = false;
1667     int head = 0;
1668     int tail = 0;
1669
1670     int64_t max_write_zeroes = MIN_NON_ZERO(bs->bl.max_pwrite_zeroes,
1671                                             INT64_MAX);
1672     int alignment = MAX(bs->bl.pwrite_zeroes_alignment,
1673                         bs->bl.request_alignment);
1674     int max_transfer = MIN_NON_ZERO(bs->bl.max_transfer, MAX_BOUNCE_BUFFER);
1675
1676     bdrv_check_request(offset, bytes, &error_abort);
1677
1678     if (!drv) {
1679         return -ENOMEDIUM;
1680     }
1681
1682     if ((flags & ~bs->supported_zero_flags) & BDRV_REQ_NO_FALLBACK) {
1683         return -ENOTSUP;
1684     }
1685
1686     /* By definition there is no user buffer so this flag doesn't make sense */
1687     if (flags & BDRV_REQ_REGISTERED_BUF) {
1688         return -EINVAL;
1689     }
1690
1691     /* Invalidate the cached block-status data range if this write overlaps */
1692     bdrv_bsc_invalidate_range(bs, offset, bytes);
1693
1694     assert(alignment % bs->bl.request_alignment == 0);
1695     head = offset % alignment;
1696     tail = (offset + bytes) % alignment;
1697     max_write_zeroes = QEMU_ALIGN_DOWN(max_write_zeroes, alignment);
1698     assert(max_write_zeroes >= bs->bl.request_alignment);
1699
1700     while (bytes > 0 && !ret) {
1701         int64_t num = bytes;
1702
1703         /* Align request.  Block drivers can expect the "bulk" of the request
1704          * to be aligned, and that unaligned requests do not cross cluster
1705          * boundaries.
1706          */
1707         if (head) {
1708             /* Make a small request up to the first aligned sector. For
1709              * convenience, limit this request to max_transfer even if
1710              * we don't need to fall back to writes.  */
1711             num = MIN(MIN(bytes, max_transfer), alignment - head);
1712             head = (head + num) % alignment;
1713             assert(num < max_write_zeroes);
1714         } else if (tail && num > alignment) {
1715             /* Shorten the request to the last aligned sector.  */
1716             num -= tail;
1717         }
1718
1719         /* limit request size */
1720         if (num > max_write_zeroes) {
1721             num = max_write_zeroes;
1722         }
1723
1724         ret = -ENOTSUP;
1725         /* First try the efficient write zeroes operation */
1726         if (drv->bdrv_co_pwrite_zeroes) {
1727             ret = drv->bdrv_co_pwrite_zeroes(bs, offset, num,
1728                                              flags & bs->supported_zero_flags);
1729             if (ret != -ENOTSUP && (flags & BDRV_REQ_FUA) &&
1730                 !(bs->supported_zero_flags & BDRV_REQ_FUA)) {
1731                 need_flush = true;
1732             }
1733         } else {
1734             assert(!bs->supported_zero_flags);
1735         }
1736
1737         if (ret == -ENOTSUP && !(flags & BDRV_REQ_NO_FALLBACK)) {
1738             /* Fall back to bounce buffer if write zeroes is unsupported */
1739             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
1740
1741             if ((flags & BDRV_REQ_FUA) &&
1742                 !(bs->supported_write_flags & BDRV_REQ_FUA)) {
1743                 /* No need for bdrv_driver_pwrite() to do a fallback
1744                  * flush on each chunk; use just one at the end */
1745                 write_flags &= ~BDRV_REQ_FUA;
1746                 need_flush = true;
1747             }
1748             num = MIN(num, max_transfer);
1749             if (buf == NULL) {
1750                 buf = qemu_try_blockalign0(bs, num);
1751                 if (buf == NULL) {
1752                     ret = -ENOMEM;
1753                     goto fail;
1754                 }
1755             }
1756             qemu_iovec_init_buf(&qiov, buf, num);
1757
1758             ret = bdrv_driver_pwritev(bs, offset, num, &qiov, 0, write_flags);
1759
1760             /* Keep bounce buffer around if it is big enough for all
1761              * all future requests.
1762              */
1763             if (num < max_transfer) {
1764                 qemu_vfree(buf);
1765                 buf = NULL;
1766             }
1767         }
1768
1769         offset += num;
1770         bytes -= num;
1771     }
1772
1773 fail:
1774     if (ret == 0 && need_flush) {
1775         ret = bdrv_co_flush(bs);
1776     }
1777     qemu_vfree(buf);
1778     return ret;
1779 }
1780
1781 static inline int coroutine_fn
1782 bdrv_co_write_req_prepare(BdrvChild *child, int64_t offset, int64_t bytes,
1783                           BdrvTrackedRequest *req, int flags)
1784 {
1785     BlockDriverState *bs = child->bs;
1786
1787     bdrv_check_request(offset, bytes, &error_abort);
1788
1789     if (bdrv_is_read_only(bs)) {
1790         return -EPERM;
1791     }
1792
1793     assert(!(bs->open_flags & BDRV_O_INACTIVE));
1794     assert((bs->open_flags & BDRV_O_NO_IO) == 0);
1795     assert(!(flags & ~BDRV_REQ_MASK));
1796     assert(!((flags & BDRV_REQ_NO_WAIT) && !(flags & BDRV_REQ_SERIALISING)));
1797
1798     if (flags & BDRV_REQ_SERIALISING) {
1799         QEMU_LOCK_GUARD(&bs->reqs_lock);
1800
1801         tracked_request_set_serialising(req, bdrv_get_cluster_size(bs));
1802
1803         if ((flags & BDRV_REQ_NO_WAIT) && bdrv_find_conflicting_request(req)) {
1804             return -EBUSY;
1805         }
1806
1807         bdrv_wait_serialising_requests_locked(req);
1808     } else {
1809         bdrv_wait_serialising_requests(req);
1810     }
1811
1812     assert(req->overlap_offset <= offset);
1813     assert(offset + bytes <= req->overlap_offset + req->overlap_bytes);
1814     assert(offset + bytes <= bs->total_sectors * BDRV_SECTOR_SIZE ||
1815            child->perm & BLK_PERM_RESIZE);
1816
1817     switch (req->type) {
1818     case BDRV_TRACKED_WRITE:
1819     case BDRV_TRACKED_DISCARD:
1820         if (flags & BDRV_REQ_WRITE_UNCHANGED) {
1821             assert(child->perm & (BLK_PERM_WRITE_UNCHANGED | BLK_PERM_WRITE));
1822         } else {
1823             assert(child->perm & BLK_PERM_WRITE);
1824         }
1825         bdrv_write_threshold_check_write(bs, offset, bytes);
1826         return 0;
1827     case BDRV_TRACKED_TRUNCATE:
1828         assert(child->perm & BLK_PERM_RESIZE);
1829         return 0;
1830     default:
1831         abort();
1832     }
1833 }
1834
1835 static inline void coroutine_fn
1836 bdrv_co_write_req_finish(BdrvChild *child, int64_t offset, int64_t bytes,
1837                          BdrvTrackedRequest *req, int ret)
1838 {
1839     int64_t end_sector = DIV_ROUND_UP(offset + bytes, BDRV_SECTOR_SIZE);
1840     BlockDriverState *bs = child->bs;
1841
1842     bdrv_check_request(offset, bytes, &error_abort);
1843
1844     qatomic_inc(&bs->write_gen);
1845
1846     /*
1847      * Discard cannot extend the image, but in error handling cases, such as
1848      * when reverting a qcow2 cluster allocation, the discarded range can pass
1849      * the end of image file, so we cannot assert about BDRV_TRACKED_DISCARD
1850      * here. Instead, just skip it, since semantically a discard request
1851      * beyond EOF cannot expand the image anyway.
1852      */
1853     if (ret == 0 &&
1854         (req->type == BDRV_TRACKED_TRUNCATE ||
1855          end_sector > bs->total_sectors) &&
1856         req->type != BDRV_TRACKED_DISCARD) {
1857         bs->total_sectors = end_sector;
1858         bdrv_parent_cb_resize(bs);
1859         bdrv_dirty_bitmap_truncate(bs, end_sector << BDRV_SECTOR_BITS);
1860     }
1861     if (req->bytes) {
1862         switch (req->type) {
1863         case BDRV_TRACKED_WRITE:
1864             stat64_max(&bs->wr_highest_offset, offset + bytes);
1865             /* fall through, to set dirty bits */
1866         case BDRV_TRACKED_DISCARD:
1867             bdrv_set_dirty(bs, offset, bytes);
1868             break;
1869         default:
1870             break;
1871         }
1872     }
1873 }
1874
1875 /*
1876  * Forwards an already correctly aligned write request to the BlockDriver,
1877  * after possibly fragmenting it.
1878  */
1879 static int coroutine_fn bdrv_aligned_pwritev(BdrvChild *child,
1880     BdrvTrackedRequest *req, int64_t offset, int64_t bytes,
1881     int64_t align, QEMUIOVector *qiov, size_t qiov_offset,
1882     BdrvRequestFlags flags)
1883 {
1884     BlockDriverState *bs = child->bs;
1885     BlockDriver *drv = bs->drv;
1886     int ret;
1887
1888     int64_t bytes_remaining = bytes;
1889     int max_transfer;
1890
1891     bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, &error_abort);
1892
1893     if (!drv) {
1894         return -ENOMEDIUM;
1895     }
1896
1897     if (bdrv_has_readonly_bitmaps(bs)) {
1898         return -EPERM;
1899     }
1900
1901     assert(is_power_of_2(align));
1902     assert((offset & (align - 1)) == 0);
1903     assert((bytes & (align - 1)) == 0);
1904     max_transfer = QEMU_ALIGN_DOWN(MIN_NON_ZERO(bs->bl.max_transfer, INT_MAX),
1905                                    align);
1906
1907     ret = bdrv_co_write_req_prepare(child, offset, bytes, req, flags);
1908
1909     if (!ret && bs->detect_zeroes != BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF &&
1910         !(flags & BDRV_REQ_ZERO_WRITE) && drv->bdrv_co_pwrite_zeroes &&
1911         qemu_iovec_is_zero(qiov, qiov_offset, bytes)) {
1912         flags |= BDRV_REQ_ZERO_WRITE;
1913         if (bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP) {
1914             flags |= BDRV_REQ_MAY_UNMAP;
1915         }
1916     }
1917
1918     if (ret < 0) {
1919         /* Do nothing, write notifier decided to fail this request */
1920     } else if (flags & BDRV_REQ_ZERO_WRITE) {
1921         bdrv_debug_event(bs, BLKDBG_PWRITEV_ZERO);
1922         ret = bdrv_co_do_pwrite_zeroes(bs, offset, bytes, flags);
1923     } else if (flags & BDRV_REQ_WRITE_COMPRESSED) {
1924         ret = bdrv_driver_pwritev_compressed(bs, offset, bytes,
1925                                              qiov, qiov_offset);
1926     } else if (bytes <= max_transfer) {
1927         bdrv_debug_event(bs, BLKDBG_PWRITEV);
1928         ret = bdrv_driver_pwritev(bs, offset, bytes, qiov, qiov_offset, flags);
1929     } else {
1930         bdrv_debug_event(bs, BLKDBG_PWRITEV);
1931         while (bytes_remaining) {
1932             int num = MIN(bytes_remaining, max_transfer);
1933             int local_flags = flags;
1934
1935             assert(num);
1936             if (num < bytes_remaining && (flags & BDRV_REQ_FUA) &&
1937                 !(bs->supported_write_flags & BDRV_REQ_FUA)) {
1938                 /* If FUA is going to be emulated by flush, we only
1939                  * need to flush on the last iteration */
1940                 local_flags &= ~BDRV_REQ_FUA;
1941             }
1942
1943             ret = bdrv_driver_pwritev(bs, offset + bytes - bytes_remaining,
1944                                       num, qiov,
1945                                       qiov_offset + bytes - bytes_remaining,
1946                                       local_flags);
1947             if (ret < 0) {
1948                 break;
1949             }
1950             bytes_remaining -= num;
1951         }
1952     }
1953     bdrv_debug_event(bs, BLKDBG_PWRITEV_DONE);
1954
1955     if (ret >= 0) {
1956         ret = 0;
1957     }
1958     bdrv_co_write_req_finish(child, offset, bytes, req, ret);
1959
1960     return ret;
1961 }
1962
1963 static int coroutine_fn bdrv_co_do_zero_pwritev(BdrvChild *child,
1964                                                 int64_t offset,
1965                                                 int64_t bytes,
1966                                                 BdrvRequestFlags flags,
1967                                                 BdrvTrackedRequest *req)
1968 {
1969     BlockDriverState *bs = child->bs;
1970     QEMUIOVector local_qiov;
1971     uint64_t align = bs->bl.request_alignment;
1972     int ret = 0;
1973     bool padding;
1974     BdrvRequestPadding pad;
1975
1976     /* This flag doesn't make sense for padding or zero writes */
1977     flags &= ~BDRV_REQ_REGISTERED_BUF;
1978
1979     padding = bdrv_init_padding(bs, offset, bytes, &pad);
1980     if (padding) {
1981         assert(!(flags & BDRV_REQ_NO_WAIT));
1982         bdrv_make_request_serialising(req, align);
1983
1984         bdrv_padding_rmw_read(child, req, &pad, true);
1985
1986         if (pad.head || pad.merge_reads) {
1987             int64_t aligned_offset = offset & ~(align - 1);
1988             int64_t write_bytes = pad.merge_reads ? pad.buf_len : align;
1989
1990             qemu_iovec_init_buf(&local_qiov, pad.buf, write_bytes);
1991             ret = bdrv_aligned_pwritev(child, req, aligned_offset, write_bytes,
1992                                        align, &local_qiov, 0,
1993                                        flags & ~BDRV_REQ_ZERO_WRITE);
1994             if (ret < 0 || pad.merge_reads) {
1995                 /* Error or all work is done */
1996                 goto out;
1997             }
1998             offset += write_bytes - pad.head;
1999             bytes -= write_bytes - pad.head;
2000         }
2001     }
2002
2003     assert(!bytes || (offset & (align - 1)) == 0);
2004     if (bytes >= align) {
2005         /* Write the aligned part in the middle. */
2006         int64_t aligned_bytes = bytes & ~(align - 1);
2007         ret = bdrv_aligned_pwritev(child, req, offset, aligned_bytes, align,
2008                                    NULL, 0, flags);
2009         if (ret < 0) {
2010             goto out;
2011         }
2012         bytes -= aligned_bytes;
2013         offset += aligned_bytes;
2014     }
2015
2016     assert(!bytes || (offset & (align - 1)) == 0);
2017     if (bytes) {
2018         assert(align == pad.tail + bytes);
2019
2020         qemu_iovec_init_buf(&local_qiov, pad.tail_buf, align);
2021         ret = bdrv_aligned_pwritev(child, req, offset, align, align,
2022                                    &local_qiov, 0,
2023                                    flags & ~BDRV_REQ_ZERO_WRITE);
2024     }
2025
2026 out:
2027     bdrv_padding_destroy(&pad);
2028
2029     return ret;
2030 }
2031
2032 /*
2033  * Handle a write request in coroutine context
2034  */
2035 int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
2036     int64_t offset, int64_t bytes, QEMUIOVector *qiov,
2037     BdrvRequestFlags flags)
2038 {
2039     IO_CODE();
2040     return bdrv_co_pwritev_part(child, offset, bytes, qiov, 0, flags);
2041 }
2042
2043 int coroutine_fn bdrv_co_pwritev_part(BdrvChild *child,
2044     int64_t offset, int64_t bytes, QEMUIOVector *qiov, size_t qiov_offset,
2045     BdrvRequestFlags flags)
2046 {
2047     BlockDriverState *bs = child->bs;
2048     BdrvTrackedRequest req;
2049     uint64_t align = bs->bl.request_alignment;
2050     BdrvRequestPadding pad;
2051     int ret;
2052     bool padded = false;
2053     IO_CODE();
2054
2055     trace_bdrv_co_pwritev_part(child->bs, offset, bytes, flags);
2056
2057     if (!bdrv_is_inserted(bs)) {
2058         return -ENOMEDIUM;
2059     }
2060
2061     if (flags & BDRV_REQ_ZERO_WRITE) {
2062         ret = bdrv_check_qiov_request(offset, bytes, qiov, qiov_offset, NULL);
2063     } else {
2064         ret = bdrv_check_request32(offset, bytes, qiov, qiov_offset);
2065     }
2066     if (ret < 0) {
2067         return ret;
2068     }
2069
2070     /* If the request is misaligned then we can't make it efficient */
2071     if ((flags & BDRV_REQ_NO_FALLBACK) &&
2072         !QEMU_IS_ALIGNED(offset | bytes, align))
2073     {
2074         return -ENOTSUP;
2075     }
2076
2077     if (bytes == 0 && !QEMU_IS_ALIGNED(offset, bs->bl.request_alignment)) {
2078         /*
2079          * Aligning zero request is nonsense. Even if driver has special meaning
2080          * of zero-length (like qcow2_co_pwritev_compressed_part), we can't pass
2081          * it to driver due to request_alignment.
2082          *
2083          * Still, no reason to return an error if someone do unaligned
2084          * zero-length write occasionally.
2085          */
2086         return 0;
2087     }
2088
2089     if (!(flags & BDRV_REQ_ZERO_WRITE)) {
2090         /*
2091          * Pad request for following read-modify-write cycle.
2092          * bdrv_co_do_zero_pwritev() does aligning by itself, so, we do
2093          * alignment only if there is no ZERO flag.
2094          */
2095         ret = bdrv_pad_request(bs, &qiov, &qiov_offset, &offset, &bytes, &pad,
2096                                &padded, &flags);
2097         if (ret < 0) {
2098             return ret;
2099         }
2100     }
2101
2102     bdrv_inc_in_flight(bs);
2103     tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_WRITE);
2104
2105     if (flags & BDRV_REQ_ZERO_WRITE) {
2106         assert(!padded);
2107         ret = bdrv_co_do_zero_pwritev(child, offset, bytes, flags, &req);
2108         goto out;
2109     }
2110
2111     if (padded) {
2112         /*
2113          * Request was unaligned to request_alignment and therefore
2114          * padded.  We are going to do read-modify-write, and must
2115          * serialize the request to prevent interactions of the
2116          * widened region with other transactions.
2117          */
2118         assert(!(flags & BDRV_REQ_NO_WAIT));
2119         bdrv_make_request_serialising(&req, align);
2120         bdrv_padding_rmw_read(child, &req, &pad, false);
2121     }
2122
2123     ret = bdrv_aligned_pwritev(child, &req, offset, bytes, align,
2124                                qiov, qiov_offset, flags);
2125
2126     bdrv_padding_destroy(&pad);
2127
2128 out:
2129     tracked_request_end(&req);
2130     bdrv_dec_in_flight(bs);
2131
2132     return ret;
2133 }
2134
2135 int coroutine_fn bdrv_co_pwrite_zeroes(BdrvChild *child, int64_t offset,
2136                                        int64_t bytes, BdrvRequestFlags flags)
2137 {
2138     IO_CODE();
2139     trace_bdrv_co_pwrite_zeroes(child->bs, offset, bytes, flags);
2140
2141     if (!(child->bs->open_flags & BDRV_O_UNMAP)) {
2142         flags &= ~BDRV_REQ_MAY_UNMAP;
2143     }
2144
2145     return bdrv_co_pwritev(child, offset, bytes, NULL,
2146                            BDRV_REQ_ZERO_WRITE | flags);
2147 }
2148
2149 /*
2150  * Flush ALL BDSes regardless of if they are reachable via a BlkBackend or not.
2151  */
2152 int bdrv_flush_all(void)
2153 {
2154     BdrvNextIterator it;
2155     BlockDriverState *bs = NULL;
2156     int result = 0;
2157
2158     GLOBAL_STATE_CODE();
2159
2160     /*
2161      * bdrv queue is managed by record/replay,
2162      * creating new flush request for stopping
2163      * the VM may break the determinism
2164      */
2165     if (replay_events_enabled()) {
2166         return result;
2167     }
2168
2169     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
2170         AioContext *aio_context = bdrv_get_aio_context(bs);
2171         int ret;
2172
2173         aio_context_acquire(aio_context);
2174         ret = bdrv_flush(bs);
2175         if (ret < 0 && !result) {
2176             result = ret;
2177         }
2178         aio_context_release(aio_context);
2179     }
2180
2181     return result;
2182 }
2183
2184 /*
2185  * Returns the allocation status of the specified sectors.
2186  * Drivers not implementing the functionality are assumed to not support
2187  * backing files, hence all their sectors are reported as allocated.
2188  *
2189  * If 'want_zero' is true, the caller is querying for mapping
2190  * purposes, with a focus on valid BDRV_BLOCK_OFFSET_VALID, _DATA, and
2191  * _ZERO where possible; otherwise, the result favors larger 'pnum',
2192  * with a focus on accurate BDRV_BLOCK_ALLOCATED.
2193  *
2194  * If 'offset' is beyond the end of the disk image the return value is
2195  * BDRV_BLOCK_EOF and 'pnum' is set to 0.
2196  *
2197  * 'bytes' is the max value 'pnum' should be set to.  If bytes goes
2198  * beyond the end of the disk image it will be clamped; if 'pnum' is set to
2199  * the end of the image, then the returned value will include BDRV_BLOCK_EOF.
2200  *
2201  * 'pnum' is set to the number of bytes (including and immediately
2202  * following the specified offset) that are easily known to be in the
2203  * same allocated/unallocated state.  Note that a second call starting
2204  * at the original offset plus returned pnum may have the same status.
2205  * The returned value is non-zero on success except at end-of-file.
2206  *
2207  * Returns negative errno on failure.  Otherwise, if the
2208  * BDRV_BLOCK_OFFSET_VALID bit is set, 'map' and 'file' (if non-NULL) are
2209  * set to the host mapping and BDS corresponding to the guest offset.
2210  */
2211 static int coroutine_fn bdrv_co_block_status(BlockDriverState *bs,
2212                                              bool want_zero,
2213                                              int64_t offset, int64_t bytes,
2214                                              int64_t *pnum, int64_t *map,
2215                                              BlockDriverState **file)
2216 {
2217     int64_t total_size;
2218     int64_t n; /* bytes */
2219     int ret;
2220     int64_t local_map = 0;
2221     BlockDriverState *local_file = NULL;
2222     int64_t aligned_offset, aligned_bytes;
2223     uint32_t align;
2224     bool has_filtered_child;
2225
2226     assert(pnum);
2227     *pnum = 0;
2228     total_size = bdrv_getlength(bs);
2229     if (total_size < 0) {
2230         ret = total_size;
2231         goto early_out;
2232     }
2233
2234     if (offset >= total_size) {
2235         ret = BDRV_BLOCK_EOF;
2236         goto early_out;
2237     }
2238     if (!bytes) {
2239         ret = 0;
2240         goto early_out;
2241     }
2242
2243     n = total_size - offset;
2244     if (n < bytes) {
2245         bytes = n;
2246     }
2247
2248     /* Must be non-NULL or bdrv_getlength() would have failed */
2249     assert(bs->drv);
2250     has_filtered_child = bdrv_filter_child(bs);
2251     if (!bs->drv->bdrv_co_block_status && !has_filtered_child) {
2252         *pnum = bytes;
2253         ret = BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED;
2254         if (offset + bytes == total_size) {
2255             ret |= BDRV_BLOCK_EOF;
2256         }
2257         if (bs->drv->protocol_name) {
2258             ret |= BDRV_BLOCK_OFFSET_VALID;
2259             local_map = offset;
2260             local_file = bs;
2261         }
2262         goto early_out;
2263     }
2264
2265     bdrv_inc_in_flight(bs);
2266
2267     /* Round out to request_alignment boundaries */
2268     align = bs->bl.request_alignment;
2269     aligned_offset = QEMU_ALIGN_DOWN(offset, align);
2270     aligned_bytes = ROUND_UP(offset + bytes, align) - aligned_offset;
2271
2272     if (bs->drv->bdrv_co_block_status) {
2273         /*
2274          * Use the block-status cache only for protocol nodes: Format
2275          * drivers are generally quick to inquire the status, but protocol
2276          * drivers often need to get information from outside of qemu, so
2277          * we do not have control over the actual implementation.  There
2278          * have been cases where inquiring the status took an unreasonably
2279          * long time, and we can do nothing in qemu to fix it.
2280          * This is especially problematic for images with large data areas,
2281          * because finding the few holes in them and giving them special
2282          * treatment does not gain much performance.  Therefore, we try to
2283          * cache the last-identified data region.
2284          *
2285          * Second, limiting ourselves to protocol nodes allows us to assume
2286          * the block status for data regions to be DATA | OFFSET_VALID, and
2287          * that the host offset is the same as the guest offset.
2288          *
2289          * Note that it is possible that external writers zero parts of
2290          * the cached regions without the cache being invalidated, and so
2291          * we may report zeroes as data.  This is not catastrophic,
2292          * however, because reporting zeroes as data is fine.
2293          */
2294         if (QLIST_EMPTY(&bs->children) &&
2295             bdrv_bsc_is_data(bs, aligned_offset, pnum))
2296         {
2297             ret = BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID;
2298             local_file = bs;
2299             local_map = aligned_offset;
2300         } else {
2301             ret = bs->drv->bdrv_co_block_status(bs, want_zero, aligned_offset,
2302                                                 aligned_bytes, pnum, &local_map,
2303                                                 &local_file);
2304
2305             /*
2306              * Note that checking QLIST_EMPTY(&bs->children) is also done when
2307              * the cache is queried above.  Technically, we do not need to check
2308              * it here; the worst that can happen is that we fill the cache for
2309              * non-protocol nodes, and then it is never used.  However, filling
2310              * the cache requires an RCU update, so double check here to avoid
2311              * such an update if possible.
2312              *
2313              * Check want_zero, because we only want to update the cache when we
2314              * have accurate information about what is zero and what is data.
2315              */
2316             if (want_zero &&
2317                 ret == (BDRV_BLOCK_DATA | BDRV_BLOCK_OFFSET_VALID) &&
2318                 QLIST_EMPTY(&bs->children))
2319             {
2320                 /*
2321                  * When a protocol driver reports BLOCK_OFFSET_VALID, the
2322                  * returned local_map value must be the same as the offset we
2323                  * have passed (aligned_offset), and local_bs must be the node
2324                  * itself.
2325                  * Assert this, because we follow this rule when reading from
2326                  * the cache (see the `local_file = bs` and
2327                  * `local_map = aligned_offset` assignments above), and the
2328                  * result the cache delivers must be the same as the driver
2329                  * would deliver.
2330                  */
2331                 assert(local_file == bs);
2332                 assert(local_map == aligned_offset);
2333                 bdrv_bsc_fill(bs, aligned_offset, *pnum);
2334             }
2335         }
2336     } else {
2337         /* Default code for filters */
2338
2339         local_file = bdrv_filter_bs(bs);
2340         assert(local_file);
2341
2342         *pnum = aligned_bytes;
2343         local_map = aligned_offset;
2344         ret = BDRV_BLOCK_RAW | BDRV_BLOCK_OFFSET_VALID;
2345     }
2346     if (ret < 0) {
2347         *pnum = 0;
2348         goto out;
2349     }
2350
2351     /*
2352      * The driver's result must be a non-zero multiple of request_alignment.
2353      * Clamp pnum and adjust map to original request.
2354      */
2355     assert(*pnum && QEMU_IS_ALIGNED(*pnum, align) &&
2356            align > offset - aligned_offset);
2357     if (ret & BDRV_BLOCK_RECURSE) {
2358         assert(ret & BDRV_BLOCK_DATA);
2359         assert(ret & BDRV_BLOCK_OFFSET_VALID);
2360         assert(!(ret & BDRV_BLOCK_ZERO));
2361     }
2362
2363     *pnum -= offset - aligned_offset;
2364     if (*pnum > bytes) {
2365         *pnum = bytes;
2366     }
2367     if (ret & BDRV_BLOCK_OFFSET_VALID) {
2368         local_map += offset - aligned_offset;
2369     }
2370
2371     if (ret & BDRV_BLOCK_RAW) {
2372         assert(ret & BDRV_BLOCK_OFFSET_VALID && local_file);
2373         ret = bdrv_co_block_status(local_file, want_zero, local_map,
2374                                    *pnum, pnum, &local_map, &local_file);
2375         goto out;
2376     }
2377
2378     if (ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ZERO)) {
2379         ret |= BDRV_BLOCK_ALLOCATED;
2380     } else if (bs->drv->supports_backing) {
2381         BlockDriverState *cow_bs = bdrv_cow_bs(bs);
2382
2383         if (!cow_bs) {
2384             ret |= BDRV_BLOCK_ZERO;
2385         } else if (want_zero) {
2386             int64_t size2 = bdrv_getlength(cow_bs);
2387
2388             if (size2 >= 0 && offset >= size2) {
2389                 ret |= BDRV_BLOCK_ZERO;
2390             }
2391         }
2392     }
2393
2394     if (want_zero && ret & BDRV_BLOCK_RECURSE &&
2395         local_file && local_file != bs &&
2396         (ret & BDRV_BLOCK_DATA) && !(ret & BDRV_BLOCK_ZERO) &&
2397         (ret & BDRV_BLOCK_OFFSET_VALID)) {
2398         int64_t file_pnum;
2399         int ret2;
2400
2401         ret2 = bdrv_co_block_status(local_file, want_zero, local_map,
2402                                     *pnum, &file_pnum, NULL, NULL);
2403         if (ret2 >= 0) {
2404             /* Ignore errors.  This is just providing extra information, it
2405              * is useful but not necessary.
2406              */
2407             if (ret2 & BDRV_BLOCK_EOF &&
2408                 (!file_pnum || ret2 & BDRV_BLOCK_ZERO)) {
2409                 /*
2410                  * It is valid for the format block driver to read
2411                  * beyond the end of the underlying file's current
2412                  * size; such areas read as zero.
2413                  */
2414                 ret |= BDRV_BLOCK_ZERO;
2415             } else {
2416                 /* Limit request to the range reported by the protocol driver */
2417                 *pnum = file_pnum;
2418                 ret |= (ret2 & BDRV_BLOCK_ZERO);
2419             }
2420         }
2421     }
2422
2423 out:
2424     bdrv_dec_in_flight(bs);
2425     if (ret >= 0 && offset + *pnum == total_size) {
2426         ret |= BDRV_BLOCK_EOF;
2427     }
2428 early_out:
2429     if (file) {
2430         *file = local_file;
2431     }
2432     if (map) {
2433         *map = local_map;
2434     }
2435     return ret;
2436 }
2437
2438 int coroutine_fn
2439 bdrv_co_common_block_status_above(BlockDriverState *bs,
2440                                   BlockDriverState *base,
2441                                   bool include_base,
2442                                   bool want_zero,
2443                                   int64_t offset,
2444                                   int64_t bytes,
2445                                   int64_t *pnum,
2446                                   int64_t *map,
2447                                   BlockDriverState **file,
2448                                   int *depth)
2449 {
2450     int ret;
2451     BlockDriverState *p;
2452     int64_t eof = 0;
2453     int dummy;
2454     IO_CODE();
2455
2456     assert(!include_base || base); /* Can't include NULL base */
2457
2458     if (!depth) {
2459         depth = &dummy;
2460     }
2461     *depth = 0;
2462
2463     if (!include_base && bs == base) {
2464         *pnum = bytes;
2465         return 0;
2466     }
2467
2468     ret = bdrv_co_block_status(bs, want_zero, offset, bytes, pnum, map, file);
2469     ++*depth;
2470     if (ret < 0 || *pnum == 0 || ret & BDRV_BLOCK_ALLOCATED || bs == base) {
2471         return ret;
2472     }
2473
2474     if (ret & BDRV_BLOCK_EOF) {
2475         eof = offset + *pnum;
2476     }
2477
2478     assert(*pnum <= bytes);
2479     bytes = *pnum;
2480
2481     for (p = bdrv_filter_or_cow_bs(bs); include_base || p != base;
2482          p = bdrv_filter_or_cow_bs(p))
2483     {
2484         ret = bdrv_co_block_status(p, want_zero, offset, bytes, pnum, map,
2485                                    file);
2486         ++*depth;
2487         if (ret < 0) {
2488             return ret;
2489         }
2490         if (*pnum == 0) {
2491             /*
2492              * The top layer deferred to this layer, and because this layer is
2493              * short, any zeroes that we synthesize beyond EOF behave as if they
2494              * were allocated at this layer.
2495              *
2496              * We don't include BDRV_BLOCK_EOF into ret, as upper layer may be
2497              * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see
2498              * below.
2499              */
2500             assert(ret & BDRV_BLOCK_EOF);
2501             *pnum = bytes;
2502             if (file) {
2503                 *file = p;
2504             }
2505             ret = BDRV_BLOCK_ZERO | BDRV_BLOCK_ALLOCATED;
2506             break;
2507         }
2508         if (ret & BDRV_BLOCK_ALLOCATED) {
2509             /*
2510              * We've found the node and the status, we must break.
2511              *
2512              * Drop BDRV_BLOCK_EOF, as it's not for upper layer, which may be
2513              * larger. We'll add BDRV_BLOCK_EOF if needed at function end, see
2514              * below.
2515              */
2516             ret &= ~BDRV_BLOCK_EOF;
2517             break;
2518         }
2519
2520         if (p == base) {
2521             assert(include_base);
2522             break;
2523         }
2524
2525         /*
2526          * OK, [offset, offset + *pnum) region is unallocated on this layer,
2527          * let's continue the diving.
2528          */
2529         assert(*pnum <= bytes);
2530         bytes = *pnum;
2531     }
2532
2533     if (offset + *pnum == eof) {
2534         ret |= BDRV_BLOCK_EOF;
2535     }
2536
2537     return ret;
2538 }
2539
2540 int bdrv_block_status_above(BlockDriverState *bs, BlockDriverState *base,
2541                             int64_t offset, int64_t bytes, int64_t *pnum,
2542                             int64_t *map, BlockDriverState **file)
2543 {
2544     IO_CODE();
2545     return bdrv_common_block_status_above(bs, base, false, true, offset, bytes,
2546                                           pnum, map, file, NULL);
2547 }
2548
2549 int bdrv_block_status(BlockDriverState *bs, int64_t offset, int64_t bytes,
2550                       int64_t *pnum, int64_t *map, BlockDriverState **file)
2551 {
2552     IO_CODE();
2553     return bdrv_block_status_above(bs, bdrv_filter_or_cow_bs(bs),
2554                                    offset, bytes, pnum, map, file);
2555 }
2556
2557 /*
2558  * Check @bs (and its backing chain) to see if the range defined
2559  * by @offset and @bytes is known to read as zeroes.
2560  * Return 1 if that is the case, 0 otherwise and -errno on error.
2561  * This test is meant to be fast rather than accurate so returning 0
2562  * does not guarantee non-zero data.
2563  */
2564 int coroutine_fn bdrv_co_is_zero_fast(BlockDriverState *bs, int64_t offset,
2565                                       int64_t bytes)
2566 {
2567     int ret;
2568     int64_t pnum = bytes;
2569     IO_CODE();
2570
2571     if (!bytes) {
2572         return 1;
2573     }
2574
2575     ret = bdrv_co_common_block_status_above(bs, NULL, false, false, offset,
2576                                             bytes, &pnum, NULL, NULL, NULL);
2577
2578     if (ret < 0) {
2579         return ret;
2580     }
2581
2582     return (pnum == bytes) && (ret & BDRV_BLOCK_ZERO);
2583 }
2584
2585 int bdrv_is_allocated(BlockDriverState *bs, int64_t offset, int64_t bytes,
2586                       int64_t *pnum)
2587 {
2588     int ret;
2589     int64_t dummy;
2590     IO_CODE();
2591
2592     ret = bdrv_common_block_status_above(bs, bs, true, false, offset,
2593                                          bytes, pnum ? pnum : &dummy, NULL,
2594                                          NULL, NULL);
2595     if (ret < 0) {
2596         return ret;
2597     }
2598     return !!(ret & BDRV_BLOCK_ALLOCATED);
2599 }
2600
2601 /*
2602  * Given an image chain: ... -> [BASE] -> [INTER1] -> [INTER2] -> [TOP]
2603  *
2604  * Return a positive depth if (a prefix of) the given range is allocated
2605  * in any image between BASE and TOP (BASE is only included if include_base
2606  * is set).  Depth 1 is TOP, 2 is the first backing layer, and so forth.
2607  * BASE can be NULL to check if the given offset is allocated in any
2608  * image of the chain.  Return 0 otherwise, or negative errno on
2609  * failure.
2610  *
2611  * 'pnum' is set to the number of bytes (including and immediately
2612  * following the specified offset) that are known to be in the same
2613  * allocated/unallocated state.  Note that a subsequent call starting
2614  * at 'offset + *pnum' may return the same allocation status (in other
2615  * words, the result is not necessarily the maximum possible range);
2616  * but 'pnum' will only be 0 when end of file is reached.
2617  */
2618 int bdrv_is_allocated_above(BlockDriverState *top,
2619                             BlockDriverState *base,
2620                             bool include_base, int64_t offset,
2621                             int64_t bytes, int64_t *pnum)
2622 {
2623     int depth;
2624     int ret = bdrv_common_block_status_above(top, base, include_base, false,
2625                                              offset, bytes, pnum, NULL, NULL,
2626                                              &depth);
2627     IO_CODE();
2628     if (ret < 0) {
2629         return ret;
2630     }
2631
2632     if (ret & BDRV_BLOCK_ALLOCATED) {
2633         return depth;
2634     }
2635     return 0;
2636 }
2637
2638 int coroutine_fn
2639 bdrv_co_readv_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
2640 {
2641     BlockDriver *drv = bs->drv;
2642     BlockDriverState *child_bs = bdrv_primary_bs(bs);
2643     int ret;
2644     IO_CODE();
2645
2646     ret = bdrv_check_qiov_request(pos, qiov->size, qiov, 0, NULL);
2647     if (ret < 0) {
2648         return ret;
2649     }
2650
2651     if (!drv) {
2652         return -ENOMEDIUM;
2653     }
2654
2655     bdrv_inc_in_flight(bs);
2656
2657     if (drv->bdrv_load_vmstate) {
2658         ret = drv->bdrv_load_vmstate(bs, qiov, pos);
2659     } else if (child_bs) {
2660         ret = bdrv_co_readv_vmstate(child_bs, qiov, pos);
2661     } else {
2662         ret = -ENOTSUP;
2663     }
2664
2665     bdrv_dec_in_flight(bs);
2666
2667     return ret;
2668 }
2669
2670 int coroutine_fn
2671 bdrv_co_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
2672 {
2673     BlockDriver *drv = bs->drv;
2674     BlockDriverState *child_bs = bdrv_primary_bs(bs);
2675     int ret;
2676     IO_CODE();
2677
2678     ret = bdrv_check_qiov_request(pos, qiov->size, qiov, 0, NULL);
2679     if (ret < 0) {
2680         return ret;
2681     }
2682
2683     if (!drv) {
2684         return -ENOMEDIUM;
2685     }
2686
2687     bdrv_inc_in_flight(bs);
2688
2689     if (drv->bdrv_save_vmstate) {
2690         ret = drv->bdrv_save_vmstate(bs, qiov, pos);
2691     } else if (child_bs) {
2692         ret = bdrv_co_writev_vmstate(child_bs, qiov, pos);
2693     } else {
2694         ret = -ENOTSUP;
2695     }
2696
2697     bdrv_dec_in_flight(bs);
2698
2699     return ret;
2700 }
2701
2702 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
2703                       int64_t pos, int size)
2704 {
2705     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
2706     int ret = bdrv_writev_vmstate(bs, &qiov, pos);
2707     IO_CODE();
2708
2709     return ret < 0 ? ret : size;
2710 }
2711
2712 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
2713                       int64_t pos, int size)
2714 {
2715     QEMUIOVector qiov = QEMU_IOVEC_INIT_BUF(qiov, buf, size);
2716     int ret = bdrv_readv_vmstate(bs, &qiov, pos);
2717     IO_CODE();
2718
2719     return ret < 0 ? ret : size;
2720 }
2721
2722 /**************************************************************/
2723 /* async I/Os */
2724
2725 void bdrv_aio_cancel(BlockAIOCB *acb)
2726 {
2727     IO_CODE();
2728     qemu_aio_ref(acb);
2729     bdrv_aio_cancel_async(acb);
2730     while (acb->refcnt > 1) {
2731         if (acb->aiocb_info->get_aio_context) {
2732             aio_poll(acb->aiocb_info->get_aio_context(acb), true);
2733         } else if (acb->bs) {
2734             /* qemu_aio_ref and qemu_aio_unref are not thread-safe, so
2735              * assert that we're not using an I/O thread.  Thread-safe
2736              * code should use bdrv_aio_cancel_async exclusively.
2737              */
2738             assert(bdrv_get_aio_context(acb->bs) == qemu_get_aio_context());
2739             aio_poll(bdrv_get_aio_context(acb->bs), true);
2740         } else {
2741             abort();
2742         }
2743     }
2744     qemu_aio_unref(acb);
2745 }
2746
2747 /* Async version of aio cancel. The caller is not blocked if the acb implements
2748  * cancel_async, otherwise we do nothing and let the request normally complete.
2749  * In either case the completion callback must be called. */
2750 void bdrv_aio_cancel_async(BlockAIOCB *acb)
2751 {
2752     IO_CODE();
2753     if (acb->aiocb_info->cancel_async) {
2754         acb->aiocb_info->cancel_async(acb);
2755     }
2756 }
2757
2758 /**************************************************************/
2759 /* Coroutine block device emulation */
2760
2761 int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
2762 {
2763     BdrvChild *primary_child = bdrv_primary_child(bs);
2764     BdrvChild *child;
2765     int current_gen;
2766     int ret = 0;
2767     IO_CODE();
2768
2769     bdrv_inc_in_flight(bs);
2770
2771     if (!bdrv_is_inserted(bs) || bdrv_is_read_only(bs) ||
2772         bdrv_is_sg(bs)) {
2773         goto early_exit;
2774     }
2775
2776     qemu_co_mutex_lock(&bs->reqs_lock);
2777     current_gen = qatomic_read(&bs->write_gen);
2778
2779     /* Wait until any previous flushes are completed */
2780     while (bs->active_flush_req) {
2781         qemu_co_queue_wait(&bs->flush_queue, &bs->reqs_lock);
2782     }
2783
2784     /* Flushes reach this point in nondecreasing current_gen order.  */
2785     bs->active_flush_req = true;
2786     qemu_co_mutex_unlock(&bs->reqs_lock);
2787
2788     /* Write back all layers by calling one driver function */
2789     if (bs->drv->bdrv_co_flush) {
2790         ret = bs->drv->bdrv_co_flush(bs);
2791         goto out;
2792     }
2793
2794     /* Write back cached data to the OS even with cache=unsafe */
2795     BLKDBG_EVENT(primary_child, BLKDBG_FLUSH_TO_OS);
2796     if (bs->drv->bdrv_co_flush_to_os) {
2797         ret = bs->drv->bdrv_co_flush_to_os(bs);
2798         if (ret < 0) {
2799             goto out;
2800         }
2801     }
2802
2803     /* But don't actually force it to the disk with cache=unsafe */
2804     if (bs->open_flags & BDRV_O_NO_FLUSH) {
2805         goto flush_children;
2806     }
2807
2808     /* Check if we really need to flush anything */
2809     if (bs->flushed_gen == current_gen) {
2810         goto flush_children;
2811     }
2812
2813     BLKDBG_EVENT(primary_child, BLKDBG_FLUSH_TO_DISK);
2814     if (!bs->drv) {
2815         /* bs->drv->bdrv_co_flush() might have ejected the BDS
2816          * (even in case of apparent success) */
2817         ret = -ENOMEDIUM;
2818         goto out;
2819     }
2820     if (bs->drv->bdrv_co_flush_to_disk) {
2821         ret = bs->drv->bdrv_co_flush_to_disk(bs);
2822     } else if (bs->drv->bdrv_aio_flush) {
2823         BlockAIOCB *acb;
2824         CoroutineIOCompletion co = {
2825             .coroutine = qemu_coroutine_self(),
2826         };
2827
2828         acb = bs->drv->bdrv_aio_flush(bs, bdrv_co_io_em_complete, &co);
2829         if (acb == NULL) {
2830             ret = -EIO;
2831         } else {
2832             qemu_coroutine_yield();
2833             ret = co.ret;
2834         }
2835     } else {
2836         /*
2837          * Some block drivers always operate in either writethrough or unsafe
2838          * mode and don't support bdrv_flush therefore. Usually qemu doesn't
2839          * know how the server works (because the behaviour is hardcoded or
2840          * depends on server-side configuration), so we can't ensure that
2841          * everything is safe on disk. Returning an error doesn't work because
2842          * that would break guests even if the server operates in writethrough
2843          * mode.
2844          *
2845          * Let's hope the user knows what he's doing.
2846          */
2847         ret = 0;
2848     }
2849
2850     if (ret < 0) {
2851         goto out;
2852     }
2853
2854     /* Now flush the underlying protocol.  It will also have BDRV_O_NO_FLUSH
2855      * in the case of cache=unsafe, so there are no useless flushes.
2856      */
2857 flush_children:
2858     ret = 0;
2859     QLIST_FOREACH(child, &bs->children, next) {
2860         if (child->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
2861             int this_child_ret = bdrv_co_flush(child->bs);
2862             if (!ret) {
2863                 ret = this_child_ret;
2864             }
2865         }
2866     }
2867
2868 out:
2869     /* Notify any pending flushes that we have completed */
2870     if (ret == 0) {
2871         bs->flushed_gen = current_gen;
2872     }
2873
2874     qemu_co_mutex_lock(&bs->reqs_lock);
2875     bs->active_flush_req = false;
2876     /* Return value is ignored - it's ok if wait queue is empty */
2877     qemu_co_queue_next(&bs->flush_queue);
2878     qemu_co_mutex_unlock(&bs->reqs_lock);
2879
2880 early_exit:
2881     bdrv_dec_in_flight(bs);
2882     return ret;
2883 }
2884
2885 int coroutine_fn bdrv_co_pdiscard(BdrvChild *child, int64_t offset,
2886                                   int64_t bytes)
2887 {
2888     BdrvTrackedRequest req;
2889     int ret;
2890     int64_t max_pdiscard;
2891     int head, tail, align;
2892     BlockDriverState *bs = child->bs;
2893     IO_CODE();
2894
2895     if (!bs || !bs->drv || !bdrv_is_inserted(bs)) {
2896         return -ENOMEDIUM;
2897     }
2898
2899     if (bdrv_has_readonly_bitmaps(bs)) {
2900         return -EPERM;
2901     }
2902
2903     ret = bdrv_check_request(offset, bytes, NULL);
2904     if (ret < 0) {
2905         return ret;
2906     }
2907
2908     /* Do nothing if disabled.  */
2909     if (!(bs->open_flags & BDRV_O_UNMAP)) {
2910         return 0;
2911     }
2912
2913     if (!bs->drv->bdrv_co_pdiscard && !bs->drv->bdrv_aio_pdiscard) {
2914         return 0;
2915     }
2916
2917     /* Invalidate the cached block-status data range if this discard overlaps */
2918     bdrv_bsc_invalidate_range(bs, offset, bytes);
2919
2920     /* Discard is advisory, but some devices track and coalesce
2921      * unaligned requests, so we must pass everything down rather than
2922      * round here.  Still, most devices will just silently ignore
2923      * unaligned requests (by returning -ENOTSUP), so we must fragment
2924      * the request accordingly.  */
2925     align = MAX(bs->bl.pdiscard_alignment, bs->bl.request_alignment);
2926     assert(align % bs->bl.request_alignment == 0);
2927     head = offset % align;
2928     tail = (offset + bytes) % align;
2929
2930     bdrv_inc_in_flight(bs);
2931     tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_DISCARD);
2932
2933     ret = bdrv_co_write_req_prepare(child, offset, bytes, &req, 0);
2934     if (ret < 0) {
2935         goto out;
2936     }
2937
2938     max_pdiscard = QEMU_ALIGN_DOWN(MIN_NON_ZERO(bs->bl.max_pdiscard, INT64_MAX),
2939                                    align);
2940     assert(max_pdiscard >= bs->bl.request_alignment);
2941
2942     while (bytes > 0) {
2943         int64_t num = bytes;
2944
2945         if (head) {
2946             /* Make small requests to get to alignment boundaries. */
2947             num = MIN(bytes, align - head);
2948             if (!QEMU_IS_ALIGNED(num, bs->bl.request_alignment)) {
2949                 num %= bs->bl.request_alignment;
2950             }
2951             head = (head + num) % align;
2952             assert(num < max_pdiscard);
2953         } else if (tail) {
2954             if (num > align) {
2955                 /* Shorten the request to the last aligned cluster.  */
2956                 num -= tail;
2957             } else if (!QEMU_IS_ALIGNED(tail, bs->bl.request_alignment) &&
2958                        tail > bs->bl.request_alignment) {
2959                 tail %= bs->bl.request_alignment;
2960                 num -= tail;
2961             }
2962         }
2963         /* limit request size */
2964         if (num > max_pdiscard) {
2965             num = max_pdiscard;
2966         }
2967
2968         if (!bs->drv) {
2969             ret = -ENOMEDIUM;
2970             goto out;
2971         }
2972         if (bs->drv->bdrv_co_pdiscard) {
2973             ret = bs->drv->bdrv_co_pdiscard(bs, offset, num);
2974         } else {
2975             BlockAIOCB *acb;
2976             CoroutineIOCompletion co = {
2977                 .coroutine = qemu_coroutine_self(),
2978             };
2979
2980             acb = bs->drv->bdrv_aio_pdiscard(bs, offset, num,
2981                                              bdrv_co_io_em_complete, &co);
2982             if (acb == NULL) {
2983                 ret = -EIO;
2984                 goto out;
2985             } else {
2986                 qemu_coroutine_yield();
2987                 ret = co.ret;
2988             }
2989         }
2990         if (ret && ret != -ENOTSUP) {
2991             goto out;
2992         }
2993
2994         offset += num;
2995         bytes -= num;
2996     }
2997     ret = 0;
2998 out:
2999     bdrv_co_write_req_finish(child, req.offset, req.bytes, &req, ret);
3000     tracked_request_end(&req);
3001     bdrv_dec_in_flight(bs);
3002     return ret;
3003 }
3004
3005 int coroutine_fn bdrv_co_ioctl(BlockDriverState *bs, int req, void *buf)
3006 {
3007     BlockDriver *drv = bs->drv;
3008     CoroutineIOCompletion co = {
3009         .coroutine = qemu_coroutine_self(),
3010     };
3011     BlockAIOCB *acb;
3012     IO_CODE();
3013
3014     bdrv_inc_in_flight(bs);
3015     if (!drv || (!drv->bdrv_aio_ioctl && !drv->bdrv_co_ioctl)) {
3016         co.ret = -ENOTSUP;
3017         goto out;
3018     }
3019
3020     if (drv->bdrv_co_ioctl) {
3021         co.ret = drv->bdrv_co_ioctl(bs, req, buf);
3022     } else {
3023         acb = drv->bdrv_aio_ioctl(bs, req, buf, bdrv_co_io_em_complete, &co);
3024         if (!acb) {
3025             co.ret = -ENOTSUP;
3026             goto out;
3027         }
3028         qemu_coroutine_yield();
3029     }
3030 out:
3031     bdrv_dec_in_flight(bs);
3032     return co.ret;
3033 }
3034
3035 void *qemu_blockalign(BlockDriverState *bs, size_t size)
3036 {
3037     IO_CODE();
3038     return qemu_memalign(bdrv_opt_mem_align(bs), size);
3039 }
3040
3041 void *qemu_blockalign0(BlockDriverState *bs, size_t size)
3042 {
3043     IO_CODE();
3044     return memset(qemu_blockalign(bs, size), 0, size);
3045 }
3046
3047 void *qemu_try_blockalign(BlockDriverState *bs, size_t size)
3048 {
3049     size_t align = bdrv_opt_mem_align(bs);
3050     IO_CODE();
3051
3052     /* Ensure that NULL is never returned on success */
3053     assert(align > 0);
3054     if (size == 0) {
3055         size = align;
3056     }
3057
3058     return qemu_try_memalign(align, size);
3059 }
3060
3061 void *qemu_try_blockalign0(BlockDriverState *bs, size_t size)
3062 {
3063     void *mem = qemu_try_blockalign(bs, size);
3064     IO_CODE();
3065
3066     if (mem) {
3067         memset(mem, 0, size);
3068     }
3069
3070     return mem;
3071 }
3072
3073 void bdrv_io_plug(BlockDriverState *bs)
3074 {
3075     BdrvChild *child;
3076     IO_CODE();
3077
3078     QLIST_FOREACH(child, &bs->children, next) {
3079         bdrv_io_plug(child->bs);
3080     }
3081
3082     if (qatomic_fetch_inc(&bs->io_plugged) == 0) {
3083         BlockDriver *drv = bs->drv;
3084         if (drv && drv->bdrv_io_plug) {
3085             drv->bdrv_io_plug(bs);
3086         }
3087     }
3088 }
3089
3090 void bdrv_io_unplug(BlockDriverState *bs)
3091 {
3092     BdrvChild *child;
3093     IO_CODE();
3094
3095     assert(bs->io_plugged);
3096     if (qatomic_fetch_dec(&bs->io_plugged) == 1) {
3097         BlockDriver *drv = bs->drv;
3098         if (drv && drv->bdrv_io_unplug) {
3099             drv->bdrv_io_unplug(bs);
3100         }
3101     }
3102
3103     QLIST_FOREACH(child, &bs->children, next) {
3104         bdrv_io_unplug(child->bs);
3105     }
3106 }
3107
3108 /* Helper that undoes bdrv_register_buf() when it fails partway through */
3109 static void bdrv_register_buf_rollback(BlockDriverState *bs,
3110                                        void *host,
3111                                        size_t size,
3112                                        BdrvChild *final_child)
3113 {
3114     BdrvChild *child;
3115
3116     QLIST_FOREACH(child, &bs->children, next) {
3117         if (child == final_child) {
3118             break;
3119         }
3120
3121         bdrv_unregister_buf(child->bs, host, size);
3122     }
3123
3124     if (bs->drv && bs->drv->bdrv_unregister_buf) {
3125         bs->drv->bdrv_unregister_buf(bs, host, size);
3126     }
3127 }
3128
3129 bool bdrv_register_buf(BlockDriverState *bs, void *host, size_t size,
3130                        Error **errp)
3131 {
3132     BdrvChild *child;
3133
3134     GLOBAL_STATE_CODE();
3135     if (bs->drv && bs->drv->bdrv_register_buf) {
3136         if (!bs->drv->bdrv_register_buf(bs, host, size, errp)) {
3137             return false;
3138         }
3139     }
3140     QLIST_FOREACH(child, &bs->children, next) {
3141         if (!bdrv_register_buf(child->bs, host, size, errp)) {
3142             bdrv_register_buf_rollback(bs, host, size, child);
3143             return false;
3144         }
3145     }
3146     return true;
3147 }
3148
3149 void bdrv_unregister_buf(BlockDriverState *bs, void *host, size_t size)
3150 {
3151     BdrvChild *child;
3152
3153     GLOBAL_STATE_CODE();
3154     if (bs->drv && bs->drv->bdrv_unregister_buf) {
3155         bs->drv->bdrv_unregister_buf(bs, host, size);
3156     }
3157     QLIST_FOREACH(child, &bs->children, next) {
3158         bdrv_unregister_buf(child->bs, host, size);
3159     }
3160 }
3161
3162 static int coroutine_fn bdrv_co_copy_range_internal(
3163         BdrvChild *src, int64_t src_offset, BdrvChild *dst,
3164         int64_t dst_offset, int64_t bytes,
3165         BdrvRequestFlags read_flags, BdrvRequestFlags write_flags,
3166         bool recurse_src)
3167 {
3168     BdrvTrackedRequest req;
3169     int ret;
3170
3171     /* TODO We can support BDRV_REQ_NO_FALLBACK here */
3172     assert(!(read_flags & BDRV_REQ_NO_FALLBACK));
3173     assert(!(write_flags & BDRV_REQ_NO_FALLBACK));
3174     assert(!(read_flags & BDRV_REQ_NO_WAIT));
3175     assert(!(write_flags & BDRV_REQ_NO_WAIT));
3176
3177     if (!dst || !dst->bs || !bdrv_is_inserted(dst->bs)) {
3178         return -ENOMEDIUM;
3179     }
3180     ret = bdrv_check_request32(dst_offset, bytes, NULL, 0);
3181     if (ret) {
3182         return ret;
3183     }
3184     if (write_flags & BDRV_REQ_ZERO_WRITE) {
3185         return bdrv_co_pwrite_zeroes(dst, dst_offset, bytes, write_flags);
3186     }
3187
3188     if (!src || !src->bs || !bdrv_is_inserted(src->bs)) {
3189         return -ENOMEDIUM;
3190     }
3191     ret = bdrv_check_request32(src_offset, bytes, NULL, 0);
3192     if (ret) {
3193         return ret;
3194     }
3195
3196     if (!src->bs->drv->bdrv_co_copy_range_from
3197         || !dst->bs->drv->bdrv_co_copy_range_to
3198         || src->bs->encrypted || dst->bs->encrypted) {
3199         return -ENOTSUP;
3200     }
3201
3202     if (recurse_src) {
3203         bdrv_inc_in_flight(src->bs);
3204         tracked_request_begin(&req, src->bs, src_offset, bytes,
3205                               BDRV_TRACKED_READ);
3206
3207         /* BDRV_REQ_SERIALISING is only for write operation */
3208         assert(!(read_flags & BDRV_REQ_SERIALISING));
3209         bdrv_wait_serialising_requests(&req);
3210
3211         ret = src->bs->drv->bdrv_co_copy_range_from(src->bs,
3212                                                     src, src_offset,
3213                                                     dst, dst_offset,
3214                                                     bytes,
3215                                                     read_flags, write_flags);
3216
3217         tracked_request_end(&req);
3218         bdrv_dec_in_flight(src->bs);
3219     } else {
3220         bdrv_inc_in_flight(dst->bs);
3221         tracked_request_begin(&req, dst->bs, dst_offset, bytes,
3222                               BDRV_TRACKED_WRITE);
3223         ret = bdrv_co_write_req_prepare(dst, dst_offset, bytes, &req,
3224                                         write_flags);
3225         if (!ret) {
3226             ret = dst->bs->drv->bdrv_co_copy_range_to(dst->bs,
3227                                                       src, src_offset,
3228                                                       dst, dst_offset,
3229                                                       bytes,
3230                                                       read_flags, write_flags);
3231         }
3232         bdrv_co_write_req_finish(dst, dst_offset, bytes, &req, ret);
3233         tracked_request_end(&req);
3234         bdrv_dec_in_flight(dst->bs);
3235     }
3236
3237     return ret;
3238 }
3239
3240 /* Copy range from @src to @dst.
3241  *
3242  * See the comment of bdrv_co_copy_range for the parameter and return value
3243  * semantics. */
3244 int coroutine_fn bdrv_co_copy_range_from(BdrvChild *src, int64_t src_offset,
3245                                          BdrvChild *dst, int64_t dst_offset,
3246                                          int64_t bytes,
3247                                          BdrvRequestFlags read_flags,
3248                                          BdrvRequestFlags write_flags)
3249 {
3250     IO_CODE();
3251     trace_bdrv_co_copy_range_from(src, src_offset, dst, dst_offset, bytes,
3252                                   read_flags, write_flags);
3253     return bdrv_co_copy_range_internal(src, src_offset, dst, dst_offset,
3254                                        bytes, read_flags, write_flags, true);
3255 }
3256
3257 /* Copy range from @src to @dst.
3258  *
3259  * See the comment of bdrv_co_copy_range for the parameter and return value
3260  * semantics. */
3261 int coroutine_fn bdrv_co_copy_range_to(BdrvChild *src, int64_t src_offset,
3262                                        BdrvChild *dst, int64_t dst_offset,
3263                                        int64_t bytes,
3264                                        BdrvRequestFlags read_flags,
3265                                        BdrvRequestFlags write_flags)
3266 {
3267     IO_CODE();
3268     trace_bdrv_co_copy_range_to(src, src_offset, dst, dst_offset, bytes,
3269                                 read_flags, write_flags);
3270     return bdrv_co_copy_range_internal(src, src_offset, dst, dst_offset,
3271                                        bytes, read_flags, write_flags, false);
3272 }
3273
3274 int coroutine_fn bdrv_co_copy_range(BdrvChild *src, int64_t src_offset,
3275                                     BdrvChild *dst, int64_t dst_offset,
3276                                     int64_t bytes, BdrvRequestFlags read_flags,
3277                                     BdrvRequestFlags write_flags)
3278 {
3279     IO_CODE();
3280     return bdrv_co_copy_range_from(src, src_offset,
3281                                    dst, dst_offset,
3282                                    bytes, read_flags, write_flags);
3283 }
3284
3285 static void bdrv_parent_cb_resize(BlockDriverState *bs)
3286 {
3287     BdrvChild *c;
3288     QLIST_FOREACH(c, &bs->parents, next_parent) {
3289         if (c->klass->resize) {
3290             c->klass->resize(c);
3291         }
3292     }
3293 }
3294
3295 /**
3296  * Truncate file to 'offset' bytes (needed only for file protocols)
3297  *
3298  * If 'exact' is true, the file must be resized to exactly the given
3299  * 'offset'.  Otherwise, it is sufficient for the node to be at least
3300  * 'offset' bytes in length.
3301  */
3302 int coroutine_fn bdrv_co_truncate(BdrvChild *child, int64_t offset, bool exact,
3303                                   PreallocMode prealloc, BdrvRequestFlags flags,
3304                                   Error **errp)
3305 {
3306     BlockDriverState *bs = child->bs;
3307     BdrvChild *filtered, *backing;
3308     BlockDriver *drv = bs->drv;
3309     BdrvTrackedRequest req;
3310     int64_t old_size, new_bytes;
3311     int ret;
3312     IO_CODE();
3313
3314     /* if bs->drv == NULL, bs is closed, so there's nothing to do here */
3315     if (!drv) {
3316         error_setg(errp, "No medium inserted");
3317         return -ENOMEDIUM;
3318     }
3319     if (offset < 0) {
3320         error_setg(errp, "Image size cannot be negative");
3321         return -EINVAL;
3322     }
3323
3324     ret = bdrv_check_request(offset, 0, errp);
3325     if (ret < 0) {
3326         return ret;
3327     }
3328
3329     old_size = bdrv_getlength(bs);
3330     if (old_size < 0) {
3331         error_setg_errno(errp, -old_size, "Failed to get old image size");
3332         return old_size;
3333     }
3334
3335     if (bdrv_is_read_only(bs)) {
3336         error_setg(errp, "Image is read-only");
3337         return -EACCES;
3338     }
3339
3340     if (offset > old_size) {
3341         new_bytes = offset - old_size;
3342     } else {
3343         new_bytes = 0;
3344     }
3345
3346     bdrv_inc_in_flight(bs);
3347     tracked_request_begin(&req, bs, offset - new_bytes, new_bytes,
3348                           BDRV_TRACKED_TRUNCATE);
3349
3350     /* If we are growing the image and potentially using preallocation for the
3351      * new area, we need to make sure that no write requests are made to it
3352      * concurrently or they might be overwritten by preallocation. */
3353     if (new_bytes) {
3354         bdrv_make_request_serialising(&req, 1);
3355     }
3356     ret = bdrv_co_write_req_prepare(child, offset - new_bytes, new_bytes, &req,
3357                                     0);
3358     if (ret < 0) {
3359         error_setg_errno(errp, -ret,
3360                          "Failed to prepare request for truncation");
3361         goto out;
3362     }
3363
3364     filtered = bdrv_filter_child(bs);
3365     backing = bdrv_cow_child(bs);
3366
3367     /*
3368      * If the image has a backing file that is large enough that it would
3369      * provide data for the new area, we cannot leave it unallocated because
3370      * then the backing file content would become visible. Instead, zero-fill
3371      * the new area.
3372      *
3373      * Note that if the image has a backing file, but was opened without the
3374      * backing file, taking care of keeping things consistent with that backing
3375      * file is the user's responsibility.
3376      */
3377     if (new_bytes && backing) {
3378         int64_t backing_len;
3379
3380         backing_len = bdrv_getlength(backing->bs);
3381         if (backing_len < 0) {
3382             ret = backing_len;
3383             error_setg_errno(errp, -ret, "Could not get backing file size");
3384             goto out;
3385         }
3386
3387         if (backing_len > old_size) {
3388             flags |= BDRV_REQ_ZERO_WRITE;
3389         }
3390     }
3391
3392     if (drv->bdrv_co_truncate) {
3393         if (flags & ~bs->supported_truncate_flags) {
3394             error_setg(errp, "Block driver does not support requested flags");
3395             ret = -ENOTSUP;
3396             goto out;
3397         }
3398         ret = drv->bdrv_co_truncate(bs, offset, exact, prealloc, flags, errp);
3399     } else if (filtered) {
3400         ret = bdrv_co_truncate(filtered, offset, exact, prealloc, flags, errp);
3401     } else {
3402         error_setg(errp, "Image format driver does not support resize");
3403         ret = -ENOTSUP;
3404         goto out;
3405     }
3406     if (ret < 0) {
3407         goto out;
3408     }
3409
3410     ret = refresh_total_sectors(bs, offset >> BDRV_SECTOR_BITS);
3411     if (ret < 0) {
3412         error_setg_errno(errp, -ret, "Could not refresh total sector count");
3413     } else {
3414         offset = bs->total_sectors * BDRV_SECTOR_SIZE;
3415     }
3416     /* It's possible that truncation succeeded but refresh_total_sectors
3417      * failed, but the latter doesn't affect how we should finish the request.
3418      * Pass 0 as the last parameter so that dirty bitmaps etc. are handled. */
3419     bdrv_co_write_req_finish(child, offset - new_bytes, new_bytes, &req, 0);
3420
3421 out:
3422     tracked_request_end(&req);
3423     bdrv_dec_in_flight(bs);
3424
3425     return ret;
3426 }
3427
3428 void bdrv_cancel_in_flight(BlockDriverState *bs)
3429 {
3430     GLOBAL_STATE_CODE();
3431     if (!bs || !bs->drv) {
3432         return;
3433     }
3434
3435     if (bs->drv->bdrv_cancel_in_flight) {
3436         bs->drv->bdrv_cancel_in_flight(bs);
3437     }
3438 }
3439
3440 int coroutine_fn
3441 bdrv_co_preadv_snapshot(BdrvChild *child, int64_t offset, int64_t bytes,
3442                         QEMUIOVector *qiov, size_t qiov_offset)
3443 {
3444     BlockDriverState *bs = child->bs;
3445     BlockDriver *drv = bs->drv;
3446     int ret;
3447     IO_CODE();
3448
3449     if (!drv) {
3450         return -ENOMEDIUM;
3451     }
3452
3453     if (!drv->bdrv_co_preadv_snapshot) {
3454         return -ENOTSUP;
3455     }
3456
3457     bdrv_inc_in_flight(bs);
3458     ret = drv->bdrv_co_preadv_snapshot(bs, offset, bytes, qiov, qiov_offset);
3459     bdrv_dec_in_flight(bs);
3460
3461     return ret;
3462 }
3463
3464 int coroutine_fn
3465 bdrv_co_snapshot_block_status(BlockDriverState *bs,
3466                               bool want_zero, int64_t offset, int64_t bytes,
3467                               int64_t *pnum, int64_t *map,
3468                               BlockDriverState **file)
3469 {
3470     BlockDriver *drv = bs->drv;
3471     int ret;
3472     IO_CODE();
3473
3474     if (!drv) {
3475         return -ENOMEDIUM;
3476     }
3477
3478     if (!drv->bdrv_co_snapshot_block_status) {
3479         return -ENOTSUP;
3480     }
3481
3482     bdrv_inc_in_flight(bs);
3483     ret = drv->bdrv_co_snapshot_block_status(bs, want_zero, offset, bytes,
3484                                              pnum, map, file);
3485     bdrv_dec_in_flight(bs);
3486
3487     return ret;
3488 }
3489
3490 int coroutine_fn
3491 bdrv_co_pdiscard_snapshot(BlockDriverState *bs, int64_t offset, int64_t bytes)
3492 {
3493     BlockDriver *drv = bs->drv;
3494     int ret;
3495     IO_CODE();
3496
3497     if (!drv) {
3498         return -ENOMEDIUM;
3499     }
3500
3501     if (!drv->bdrv_co_pdiscard_snapshot) {
3502         return -ENOTSUP;
3503     }
3504
3505     bdrv_inc_in_flight(bs);
3506     ret = drv->bdrv_co_pdiscard_snapshot(bs, offset, bytes);
3507     bdrv_dec_in_flight(bs);
3508
3509     return ret;
3510 }