xref: /openbmc/qemu/block/io.c (revision 40b9cd25f789e02145fda5e1f3fde7e7dd9e3b61)
1 /*
2  * Block layer I/O functions
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "trace.h"
27 #include "sysemu/block-backend.h"
28 #include "block/blockjob.h"
29 #include "block/block_int.h"
30 #include "qemu/cutils.h"
31 #include "qapi/error.h"
32 #include "qemu/error-report.h"
33 
34 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
35 
36 static BlockAIOCB *bdrv_co_aio_rw_vector(BdrvChild *child,
37                                          int64_t sector_num,
38                                          QEMUIOVector *qiov,
39                                          int nb_sectors,
40                                          BdrvRequestFlags flags,
41                                          BlockCompletionFunc *cb,
42                                          void *opaque,
43                                          bool is_write);
44 static void coroutine_fn bdrv_co_do_rw(void *opaque);
45 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
46     int64_t offset, int count, BdrvRequestFlags flags);
47 
48 static void bdrv_parent_drained_begin(BlockDriverState *bs)
49 {
50     BdrvChild *c;
51 
52     QLIST_FOREACH(c, &bs->parents, next_parent) {
53         if (c->role->drained_begin) {
54             c->role->drained_begin(c);
55         }
56     }
57 }
58 
59 static void bdrv_parent_drained_end(BlockDriverState *bs)
60 {
61     BdrvChild *c;
62 
63     QLIST_FOREACH(c, &bs->parents, next_parent) {
64         if (c->role->drained_end) {
65             c->role->drained_end(c);
66         }
67     }
68 }
69 
70 static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
71 {
72     dst->opt_transfer = MAX(dst->opt_transfer, src->opt_transfer);
73     dst->max_transfer = MIN_NON_ZERO(dst->max_transfer, src->max_transfer);
74     dst->opt_mem_alignment = MAX(dst->opt_mem_alignment,
75                                  src->opt_mem_alignment);
76     dst->min_mem_alignment = MAX(dst->min_mem_alignment,
77                                  src->min_mem_alignment);
78     dst->max_iov = MIN_NON_ZERO(dst->max_iov, src->max_iov);
79 }
80 
81 void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)
82 {
83     BlockDriver *drv = bs->drv;
84     Error *local_err = NULL;
85 
86     memset(&bs->bl, 0, sizeof(bs->bl));
87 
88     if (!drv) {
89         return;
90     }
91 
92     /* Default alignment based on whether driver has byte interface */
93     bs->bl.request_alignment = drv->bdrv_co_preadv ? 1 : 512;
94 
95     /* Take some limits from the children as a default */
96     if (bs->file) {
97         bdrv_refresh_limits(bs->file->bs, &local_err);
98         if (local_err) {
99             error_propagate(errp, local_err);
100             return;
101         }
102         bdrv_merge_limits(&bs->bl, &bs->file->bs->bl);
103     } else {
104         bs->bl.min_mem_alignment = 512;
105         bs->bl.opt_mem_alignment = getpagesize();
106 
107         /* Safe default since most protocols use readv()/writev()/etc */
108         bs->bl.max_iov = IOV_MAX;
109     }
110 
111     if (bs->backing) {
112         bdrv_refresh_limits(bs->backing->bs, &local_err);
113         if (local_err) {
114             error_propagate(errp, local_err);
115             return;
116         }
117         bdrv_merge_limits(&bs->bl, &bs->backing->bs->bl);
118     }
119 
120     /* Then let the driver override it */
121     if (drv->bdrv_refresh_limits) {
122         drv->bdrv_refresh_limits(bs, errp);
123     }
124 }
125 
126 /**
127  * The copy-on-read flag is actually a reference count so multiple users may
128  * use the feature without worrying about clobbering its previous state.
129  * Copy-on-read stays enabled until all users have called to disable it.
130  */
131 void bdrv_enable_copy_on_read(BlockDriverState *bs)
132 {
133     bs->copy_on_read++;
134 }
135 
136 void bdrv_disable_copy_on_read(BlockDriverState *bs)
137 {
138     assert(bs->copy_on_read > 0);
139     bs->copy_on_read--;
140 }
141 
142 /* Check if any requests are in-flight (including throttled requests) */
143 bool bdrv_requests_pending(BlockDriverState *bs)
144 {
145     BdrvChild *child;
146 
147     if (!QLIST_EMPTY(&bs->tracked_requests)) {
148         return true;
149     }
150 
151     QLIST_FOREACH(child, &bs->children, next) {
152         if (bdrv_requests_pending(child->bs)) {
153             return true;
154         }
155     }
156 
157     return false;
158 }
159 
160 static void bdrv_drain_recurse(BlockDriverState *bs)
161 {
162     BdrvChild *child;
163 
164     if (bs->drv && bs->drv->bdrv_drain) {
165         bs->drv->bdrv_drain(bs);
166     }
167     QLIST_FOREACH(child, &bs->children, next) {
168         bdrv_drain_recurse(child->bs);
169     }
170 }
171 
172 typedef struct {
173     Coroutine *co;
174     BlockDriverState *bs;
175     QEMUBH *bh;
176     bool done;
177 } BdrvCoDrainData;
178 
179 static void bdrv_drain_poll(BlockDriverState *bs)
180 {
181     bool busy = true;
182 
183     while (busy) {
184         /* Keep iterating */
185         busy = bdrv_requests_pending(bs);
186         busy |= aio_poll(bdrv_get_aio_context(bs), busy);
187     }
188 }
189 
190 static void bdrv_co_drain_bh_cb(void *opaque)
191 {
192     BdrvCoDrainData *data = opaque;
193     Coroutine *co = data->co;
194 
195     qemu_bh_delete(data->bh);
196     bdrv_drain_poll(data->bs);
197     data->done = true;
198     qemu_coroutine_enter(co);
199 }
200 
201 static void coroutine_fn bdrv_co_yield_to_drain(BlockDriverState *bs)
202 {
203     BdrvCoDrainData data;
204 
205     /* Calling bdrv_drain() from a BH ensures the current coroutine yields and
206      * other coroutines run if they were queued from
207      * qemu_co_queue_run_restart(). */
208 
209     assert(qemu_in_coroutine());
210     data = (BdrvCoDrainData) {
211         .co = qemu_coroutine_self(),
212         .bs = bs,
213         .done = false,
214         .bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_drain_bh_cb, &data),
215     };
216     qemu_bh_schedule(data.bh);
217 
218     qemu_coroutine_yield();
219     /* If we are resumed from some other event (such as an aio completion or a
220      * timer callback), it is a bug in the caller that should be fixed. */
221     assert(data.done);
222 }
223 
224 void bdrv_drained_begin(BlockDriverState *bs)
225 {
226     if (!bs->quiesce_counter++) {
227         aio_disable_external(bdrv_get_aio_context(bs));
228         bdrv_parent_drained_begin(bs);
229     }
230 
231     bdrv_io_unplugged_begin(bs);
232     bdrv_drain_recurse(bs);
233     if (qemu_in_coroutine()) {
234         bdrv_co_yield_to_drain(bs);
235     } else {
236         bdrv_drain_poll(bs);
237     }
238     bdrv_io_unplugged_end(bs);
239 }
240 
241 void bdrv_drained_end(BlockDriverState *bs)
242 {
243     assert(bs->quiesce_counter > 0);
244     if (--bs->quiesce_counter > 0) {
245         return;
246     }
247 
248     bdrv_parent_drained_end(bs);
249     aio_enable_external(bdrv_get_aio_context(bs));
250 }
251 
252 /*
253  * Wait for pending requests to complete on a single BlockDriverState subtree,
254  * and suspend block driver's internal I/O until next request arrives.
255  *
256  * Note that unlike bdrv_drain_all(), the caller must hold the BlockDriverState
257  * AioContext.
258  *
259  * Only this BlockDriverState's AioContext is run, so in-flight requests must
260  * not depend on events in other AioContexts.  In that case, use
261  * bdrv_drain_all() instead.
262  */
263 void coroutine_fn bdrv_co_drain(BlockDriverState *bs)
264 {
265     assert(qemu_in_coroutine());
266     bdrv_drained_begin(bs);
267     bdrv_drained_end(bs);
268 }
269 
270 void bdrv_drain(BlockDriverState *bs)
271 {
272     bdrv_drained_begin(bs);
273     bdrv_drained_end(bs);
274 }
275 
276 /*
277  * Wait for pending requests to complete across all BlockDriverStates
278  *
279  * This function does not flush data to disk, use bdrv_flush_all() for that
280  * after calling this function.
281  */
282 void bdrv_drain_all(void)
283 {
284     /* Always run first iteration so any pending completion BHs run */
285     bool busy = true;
286     BlockDriverState *bs;
287     BdrvNextIterator it;
288     BlockJob *job = NULL;
289     GSList *aio_ctxs = NULL, *ctx;
290 
291     while ((job = block_job_next(job))) {
292         AioContext *aio_context = blk_get_aio_context(job->blk);
293 
294         aio_context_acquire(aio_context);
295         block_job_pause(job);
296         aio_context_release(aio_context);
297     }
298 
299     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
300         AioContext *aio_context = bdrv_get_aio_context(bs);
301 
302         aio_context_acquire(aio_context);
303         bdrv_parent_drained_begin(bs);
304         bdrv_io_unplugged_begin(bs);
305         bdrv_drain_recurse(bs);
306         aio_context_release(aio_context);
307 
308         if (!g_slist_find(aio_ctxs, aio_context)) {
309             aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
310         }
311     }
312 
313     /* Note that completion of an asynchronous I/O operation can trigger any
314      * number of other I/O operations on other devices---for example a
315      * coroutine can submit an I/O request to another device in response to
316      * request completion.  Therefore we must keep looping until there was no
317      * more activity rather than simply draining each device independently.
318      */
319     while (busy) {
320         busy = false;
321 
322         for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
323             AioContext *aio_context = ctx->data;
324 
325             aio_context_acquire(aio_context);
326             for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
327                 if (aio_context == bdrv_get_aio_context(bs)) {
328                     if (bdrv_requests_pending(bs)) {
329                         busy = true;
330                         aio_poll(aio_context, busy);
331                     }
332                 }
333             }
334             busy |= aio_poll(aio_context, false);
335             aio_context_release(aio_context);
336         }
337     }
338 
339     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
340         AioContext *aio_context = bdrv_get_aio_context(bs);
341 
342         aio_context_acquire(aio_context);
343         bdrv_io_unplugged_end(bs);
344         bdrv_parent_drained_end(bs);
345         aio_context_release(aio_context);
346     }
347     g_slist_free(aio_ctxs);
348 
349     job = NULL;
350     while ((job = block_job_next(job))) {
351         AioContext *aio_context = blk_get_aio_context(job->blk);
352 
353         aio_context_acquire(aio_context);
354         block_job_resume(job);
355         aio_context_release(aio_context);
356     }
357 }
358 
359 /**
360  * Remove an active request from the tracked requests list
361  *
362  * This function should be called when a tracked request is completing.
363  */
364 static void tracked_request_end(BdrvTrackedRequest *req)
365 {
366     if (req->serialising) {
367         req->bs->serialising_in_flight--;
368     }
369 
370     QLIST_REMOVE(req, list);
371     qemu_co_queue_restart_all(&req->wait_queue);
372 }
373 
374 /**
375  * Add an active request to the tracked requests list
376  */
377 static void tracked_request_begin(BdrvTrackedRequest *req,
378                                   BlockDriverState *bs,
379                                   int64_t offset,
380                                   unsigned int bytes,
381                                   enum BdrvTrackedRequestType type)
382 {
383     *req = (BdrvTrackedRequest){
384         .bs = bs,
385         .offset         = offset,
386         .bytes          = bytes,
387         .type           = type,
388         .co             = qemu_coroutine_self(),
389         .serialising    = false,
390         .overlap_offset = offset,
391         .overlap_bytes  = bytes,
392     };
393 
394     qemu_co_queue_init(&req->wait_queue);
395 
396     QLIST_INSERT_HEAD(&bs->tracked_requests, req, list);
397 }
398 
399 static void mark_request_serialising(BdrvTrackedRequest *req, uint64_t align)
400 {
401     int64_t overlap_offset = req->offset & ~(align - 1);
402     unsigned int overlap_bytes = ROUND_UP(req->offset + req->bytes, align)
403                                - overlap_offset;
404 
405     if (!req->serialising) {
406         req->bs->serialising_in_flight++;
407         req->serialising = true;
408     }
409 
410     req->overlap_offset = MIN(req->overlap_offset, overlap_offset);
411     req->overlap_bytes = MAX(req->overlap_bytes, overlap_bytes);
412 }
413 
414 /**
415  * Round a region to cluster boundaries (sector-based)
416  */
417 void bdrv_round_sectors_to_clusters(BlockDriverState *bs,
418                                     int64_t sector_num, int nb_sectors,
419                                     int64_t *cluster_sector_num,
420                                     int *cluster_nb_sectors)
421 {
422     BlockDriverInfo bdi;
423 
424     if (bdrv_get_info(bs, &bdi) < 0 || bdi.cluster_size == 0) {
425         *cluster_sector_num = sector_num;
426         *cluster_nb_sectors = nb_sectors;
427     } else {
428         int64_t c = bdi.cluster_size / BDRV_SECTOR_SIZE;
429         *cluster_sector_num = QEMU_ALIGN_DOWN(sector_num, c);
430         *cluster_nb_sectors = QEMU_ALIGN_UP(sector_num - *cluster_sector_num +
431                                             nb_sectors, c);
432     }
433 }
434 
435 /**
436  * Round a region to cluster boundaries
437  */
438 void bdrv_round_to_clusters(BlockDriverState *bs,
439                             int64_t offset, unsigned int bytes,
440                             int64_t *cluster_offset,
441                             unsigned int *cluster_bytes)
442 {
443     BlockDriverInfo bdi;
444 
445     if (bdrv_get_info(bs, &bdi) < 0 || bdi.cluster_size == 0) {
446         *cluster_offset = offset;
447         *cluster_bytes = bytes;
448     } else {
449         int64_t c = bdi.cluster_size;
450         *cluster_offset = QEMU_ALIGN_DOWN(offset, c);
451         *cluster_bytes = QEMU_ALIGN_UP(offset - *cluster_offset + bytes, c);
452     }
453 }
454 
455 static int bdrv_get_cluster_size(BlockDriverState *bs)
456 {
457     BlockDriverInfo bdi;
458     int ret;
459 
460     ret = bdrv_get_info(bs, &bdi);
461     if (ret < 0 || bdi.cluster_size == 0) {
462         return bs->bl.request_alignment;
463     } else {
464         return bdi.cluster_size;
465     }
466 }
467 
468 static bool tracked_request_overlaps(BdrvTrackedRequest *req,
469                                      int64_t offset, unsigned int bytes)
470 {
471     /*        aaaa   bbbb */
472     if (offset >= req->overlap_offset + req->overlap_bytes) {
473         return false;
474     }
475     /* bbbb   aaaa        */
476     if (req->overlap_offset >= offset + bytes) {
477         return false;
478     }
479     return true;
480 }
481 
482 static bool coroutine_fn wait_serialising_requests(BdrvTrackedRequest *self)
483 {
484     BlockDriverState *bs = self->bs;
485     BdrvTrackedRequest *req;
486     bool retry;
487     bool waited = false;
488 
489     if (!bs->serialising_in_flight) {
490         return false;
491     }
492 
493     do {
494         retry = false;
495         QLIST_FOREACH(req, &bs->tracked_requests, list) {
496             if (req == self || (!req->serialising && !self->serialising)) {
497                 continue;
498             }
499             if (tracked_request_overlaps(req, self->overlap_offset,
500                                          self->overlap_bytes))
501             {
502                 /* Hitting this means there was a reentrant request, for
503                  * example, a block driver issuing nested requests.  This must
504                  * never happen since it means deadlock.
505                  */
506                 assert(qemu_coroutine_self() != req->co);
507 
508                 /* If the request is already (indirectly) waiting for us, or
509                  * will wait for us as soon as it wakes up, then just go on
510                  * (instead of producing a deadlock in the former case). */
511                 if (!req->waiting_for) {
512                     self->waiting_for = req;
513                     qemu_co_queue_wait(&req->wait_queue);
514                     self->waiting_for = NULL;
515                     retry = true;
516                     waited = true;
517                     break;
518                 }
519             }
520         }
521     } while (retry);
522 
523     return waited;
524 }
525 
526 static int bdrv_check_byte_request(BlockDriverState *bs, int64_t offset,
527                                    size_t size)
528 {
529     if (size > BDRV_REQUEST_MAX_SECTORS << BDRV_SECTOR_BITS) {
530         return -EIO;
531     }
532 
533     if (!bdrv_is_inserted(bs)) {
534         return -ENOMEDIUM;
535     }
536 
537     if (offset < 0) {
538         return -EIO;
539     }
540 
541     return 0;
542 }
543 
544 static int bdrv_check_request(BlockDriverState *bs, int64_t sector_num,
545                               int nb_sectors)
546 {
547     if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
548         return -EIO;
549     }
550 
551     return bdrv_check_byte_request(bs, sector_num * BDRV_SECTOR_SIZE,
552                                    nb_sectors * BDRV_SECTOR_SIZE);
553 }
554 
555 typedef struct RwCo {
556     BdrvChild *child;
557     int64_t offset;
558     QEMUIOVector *qiov;
559     bool is_write;
560     int ret;
561     BdrvRequestFlags flags;
562 } RwCo;
563 
564 static void coroutine_fn bdrv_rw_co_entry(void *opaque)
565 {
566     RwCo *rwco = opaque;
567 
568     if (!rwco->is_write) {
569         rwco->ret = bdrv_co_preadv(rwco->child, rwco->offset,
570                                    rwco->qiov->size, rwco->qiov,
571                                    rwco->flags);
572     } else {
573         rwco->ret = bdrv_co_pwritev(rwco->child, rwco->offset,
574                                     rwco->qiov->size, rwco->qiov,
575                                     rwco->flags);
576     }
577 }
578 
579 /*
580  * Process a vectored synchronous request using coroutines
581  */
582 static int bdrv_prwv_co(BdrvChild *child, int64_t offset,
583                         QEMUIOVector *qiov, bool is_write,
584                         BdrvRequestFlags flags)
585 {
586     Coroutine *co;
587     RwCo rwco = {
588         .child = child,
589         .offset = offset,
590         .qiov = qiov,
591         .is_write = is_write,
592         .ret = NOT_DONE,
593         .flags = flags,
594     };
595 
596     if (qemu_in_coroutine()) {
597         /* Fast-path if already in coroutine context */
598         bdrv_rw_co_entry(&rwco);
599     } else {
600         AioContext *aio_context = bdrv_get_aio_context(child->bs);
601 
602         co = qemu_coroutine_create(bdrv_rw_co_entry, &rwco);
603         qemu_coroutine_enter(co);
604         while (rwco.ret == NOT_DONE) {
605             aio_poll(aio_context, true);
606         }
607     }
608     return rwco.ret;
609 }
610 
611 /*
612  * Process a synchronous request using coroutines
613  */
614 static int bdrv_rw_co(BdrvChild *child, int64_t sector_num, uint8_t *buf,
615                       int nb_sectors, bool is_write, BdrvRequestFlags flags)
616 {
617     QEMUIOVector qiov;
618     struct iovec iov = {
619         .iov_base = (void *)buf,
620         .iov_len = nb_sectors * BDRV_SECTOR_SIZE,
621     };
622 
623     if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
624         return -EINVAL;
625     }
626 
627     qemu_iovec_init_external(&qiov, &iov, 1);
628     return bdrv_prwv_co(child, sector_num << BDRV_SECTOR_BITS,
629                         &qiov, is_write, flags);
630 }
631 
632 /* return < 0 if error. See bdrv_write() for the return codes */
633 int bdrv_read(BdrvChild *child, int64_t sector_num,
634               uint8_t *buf, int nb_sectors)
635 {
636     return bdrv_rw_co(child, sector_num, buf, nb_sectors, false, 0);
637 }
638 
639 /* Return < 0 if error. Important errors are:
640   -EIO         generic I/O error (may happen for all errors)
641   -ENOMEDIUM   No media inserted.
642   -EINVAL      Invalid sector number or nb_sectors
643   -EACCES      Trying to write a read-only device
644 */
645 int bdrv_write(BdrvChild *child, int64_t sector_num,
646                const uint8_t *buf, int nb_sectors)
647 {
648     return bdrv_rw_co(child, sector_num, (uint8_t *)buf, nb_sectors, true, 0);
649 }
650 
651 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
652                        int count, BdrvRequestFlags flags)
653 {
654     QEMUIOVector qiov;
655     struct iovec iov = {
656         .iov_base = NULL,
657         .iov_len = count,
658     };
659 
660     qemu_iovec_init_external(&qiov, &iov, 1);
661     return bdrv_prwv_co(child, offset, &qiov, true,
662                         BDRV_REQ_ZERO_WRITE | flags);
663 }
664 
665 /*
666  * Completely zero out a block device with the help of bdrv_pwrite_zeroes.
667  * The operation is sped up by checking the block status and only writing
668  * zeroes to the device if they currently do not return zeroes. Optional
669  * flags are passed through to bdrv_pwrite_zeroes (e.g. BDRV_REQ_MAY_UNMAP,
670  * BDRV_REQ_FUA).
671  *
672  * Returns < 0 on error, 0 on success. For error codes see bdrv_write().
673  */
674 int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags)
675 {
676     int64_t target_sectors, ret, nb_sectors, sector_num = 0;
677     BlockDriverState *bs = child->bs;
678     BlockDriverState *file;
679     int n;
680 
681     target_sectors = bdrv_nb_sectors(bs);
682     if (target_sectors < 0) {
683         return target_sectors;
684     }
685 
686     for (;;) {
687         nb_sectors = MIN(target_sectors - sector_num, BDRV_REQUEST_MAX_SECTORS);
688         if (nb_sectors <= 0) {
689             return 0;
690         }
691         ret = bdrv_get_block_status(bs, sector_num, nb_sectors, &n, &file);
692         if (ret < 0) {
693             error_report("error getting block status at sector %" PRId64 ": %s",
694                          sector_num, strerror(-ret));
695             return ret;
696         }
697         if (ret & BDRV_BLOCK_ZERO) {
698             sector_num += n;
699             continue;
700         }
701         ret = bdrv_pwrite_zeroes(child, sector_num << BDRV_SECTOR_BITS,
702                                  n << BDRV_SECTOR_BITS, flags);
703         if (ret < 0) {
704             error_report("error writing zeroes at sector %" PRId64 ": %s",
705                          sector_num, strerror(-ret));
706             return ret;
707         }
708         sector_num += n;
709     }
710 }
711 
712 int bdrv_preadv(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
713 {
714     int ret;
715 
716     ret = bdrv_prwv_co(child, offset, qiov, false, 0);
717     if (ret < 0) {
718         return ret;
719     }
720 
721     return qiov->size;
722 }
723 
724 int bdrv_pread(BdrvChild *child, int64_t offset, void *buf, int bytes)
725 {
726     QEMUIOVector qiov;
727     struct iovec iov = {
728         .iov_base = (void *)buf,
729         .iov_len = bytes,
730     };
731 
732     if (bytes < 0) {
733         return -EINVAL;
734     }
735 
736     qemu_iovec_init_external(&qiov, &iov, 1);
737     return bdrv_preadv(child, offset, &qiov);
738 }
739 
740 int bdrv_pwritev(BdrvChild *child, int64_t offset, QEMUIOVector *qiov)
741 {
742     int ret;
743 
744     ret = bdrv_prwv_co(child, offset, qiov, true, 0);
745     if (ret < 0) {
746         return ret;
747     }
748 
749     return qiov->size;
750 }
751 
752 int bdrv_pwrite(BdrvChild *child, int64_t offset, const void *buf, int bytes)
753 {
754     QEMUIOVector qiov;
755     struct iovec iov = {
756         .iov_base   = (void *) buf,
757         .iov_len    = bytes,
758     };
759 
760     if (bytes < 0) {
761         return -EINVAL;
762     }
763 
764     qemu_iovec_init_external(&qiov, &iov, 1);
765     return bdrv_pwritev(child, offset, &qiov);
766 }
767 
768 /*
769  * Writes to the file and ensures that no writes are reordered across this
770  * request (acts as a barrier)
771  *
772  * Returns 0 on success, -errno in error cases.
773  */
774 int bdrv_pwrite_sync(BdrvChild *child, int64_t offset,
775                      const void *buf, int count)
776 {
777     int ret;
778 
779     ret = bdrv_pwrite(child, offset, buf, count);
780     if (ret < 0) {
781         return ret;
782     }
783 
784     ret = bdrv_flush(child->bs);
785     if (ret < 0) {
786         return ret;
787     }
788 
789     return 0;
790 }
791 
792 typedef struct CoroutineIOCompletion {
793     Coroutine *coroutine;
794     int ret;
795 } CoroutineIOCompletion;
796 
797 static void bdrv_co_io_em_complete(void *opaque, int ret)
798 {
799     CoroutineIOCompletion *co = opaque;
800 
801     co->ret = ret;
802     qemu_coroutine_enter(co->coroutine);
803 }
804 
805 static int coroutine_fn bdrv_driver_preadv(BlockDriverState *bs,
806                                            uint64_t offset, uint64_t bytes,
807                                            QEMUIOVector *qiov, int flags)
808 {
809     BlockDriver *drv = bs->drv;
810     int64_t sector_num;
811     unsigned int nb_sectors;
812 
813     assert(!(flags & ~BDRV_REQ_MASK));
814 
815     if (drv->bdrv_co_preadv) {
816         return drv->bdrv_co_preadv(bs, offset, bytes, qiov, flags);
817     }
818 
819     sector_num = offset >> BDRV_SECTOR_BITS;
820     nb_sectors = bytes >> BDRV_SECTOR_BITS;
821 
822     assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
823     assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
824     assert((bytes >> BDRV_SECTOR_BITS) <= BDRV_REQUEST_MAX_SECTORS);
825 
826     if (drv->bdrv_co_readv) {
827         return drv->bdrv_co_readv(bs, sector_num, nb_sectors, qiov);
828     } else {
829         BlockAIOCB *acb;
830         CoroutineIOCompletion co = {
831             .coroutine = qemu_coroutine_self(),
832         };
833 
834         acb = bs->drv->bdrv_aio_readv(bs, sector_num, qiov, nb_sectors,
835                                       bdrv_co_io_em_complete, &co);
836         if (acb == NULL) {
837             return -EIO;
838         } else {
839             qemu_coroutine_yield();
840             return co.ret;
841         }
842     }
843 }
844 
845 static int coroutine_fn bdrv_driver_pwritev(BlockDriverState *bs,
846                                             uint64_t offset, uint64_t bytes,
847                                             QEMUIOVector *qiov, int flags)
848 {
849     BlockDriver *drv = bs->drv;
850     int64_t sector_num;
851     unsigned int nb_sectors;
852     int ret;
853 
854     assert(!(flags & ~BDRV_REQ_MASK));
855 
856     if (drv->bdrv_co_pwritev) {
857         ret = drv->bdrv_co_pwritev(bs, offset, bytes, qiov,
858                                    flags & bs->supported_write_flags);
859         flags &= ~bs->supported_write_flags;
860         goto emulate_flags;
861     }
862 
863     sector_num = offset >> BDRV_SECTOR_BITS;
864     nb_sectors = bytes >> BDRV_SECTOR_BITS;
865 
866     assert((offset & (BDRV_SECTOR_SIZE - 1)) == 0);
867     assert((bytes & (BDRV_SECTOR_SIZE - 1)) == 0);
868     assert((bytes >> BDRV_SECTOR_BITS) <= BDRV_REQUEST_MAX_SECTORS);
869 
870     if (drv->bdrv_co_writev_flags) {
871         ret = drv->bdrv_co_writev_flags(bs, sector_num, nb_sectors, qiov,
872                                         flags & bs->supported_write_flags);
873         flags &= ~bs->supported_write_flags;
874     } else if (drv->bdrv_co_writev) {
875         assert(!bs->supported_write_flags);
876         ret = drv->bdrv_co_writev(bs, sector_num, nb_sectors, qiov);
877     } else {
878         BlockAIOCB *acb;
879         CoroutineIOCompletion co = {
880             .coroutine = qemu_coroutine_self(),
881         };
882 
883         acb = bs->drv->bdrv_aio_writev(bs, sector_num, qiov, nb_sectors,
884                                        bdrv_co_io_em_complete, &co);
885         if (acb == NULL) {
886             ret = -EIO;
887         } else {
888             qemu_coroutine_yield();
889             ret = co.ret;
890         }
891     }
892 
893 emulate_flags:
894     if (ret == 0 && (flags & BDRV_REQ_FUA)) {
895         ret = bdrv_co_flush(bs);
896     }
897 
898     return ret;
899 }
900 
901 static int coroutine_fn bdrv_co_do_copy_on_readv(BlockDriverState *bs,
902         int64_t offset, unsigned int bytes, QEMUIOVector *qiov)
903 {
904     /* Perform I/O through a temporary buffer so that users who scribble over
905      * their read buffer while the operation is in progress do not end up
906      * modifying the image file.  This is critical for zero-copy guest I/O
907      * where anything might happen inside guest memory.
908      */
909     void *bounce_buffer;
910 
911     BlockDriver *drv = bs->drv;
912     struct iovec iov;
913     QEMUIOVector bounce_qiov;
914     int64_t cluster_offset;
915     unsigned int cluster_bytes;
916     size_t skip_bytes;
917     int ret;
918 
919     /* Cover entire cluster so no additional backing file I/O is required when
920      * allocating cluster in the image file.
921      */
922     bdrv_round_to_clusters(bs, offset, bytes, &cluster_offset, &cluster_bytes);
923 
924     trace_bdrv_co_do_copy_on_readv(bs, offset, bytes,
925                                    cluster_offset, cluster_bytes);
926 
927     iov.iov_len = cluster_bytes;
928     iov.iov_base = bounce_buffer = qemu_try_blockalign(bs, iov.iov_len);
929     if (bounce_buffer == NULL) {
930         ret = -ENOMEM;
931         goto err;
932     }
933 
934     qemu_iovec_init_external(&bounce_qiov, &iov, 1);
935 
936     ret = bdrv_driver_preadv(bs, cluster_offset, cluster_bytes,
937                              &bounce_qiov, 0);
938     if (ret < 0) {
939         goto err;
940     }
941 
942     if (drv->bdrv_co_pwrite_zeroes &&
943         buffer_is_zero(bounce_buffer, iov.iov_len)) {
944         /* FIXME: Should we (perhaps conditionally) be setting
945          * BDRV_REQ_MAY_UNMAP, if it will allow for a sparser copy
946          * that still correctly reads as zero? */
947         ret = bdrv_co_do_pwrite_zeroes(bs, cluster_offset, cluster_bytes, 0);
948     } else {
949         /* This does not change the data on the disk, it is not necessary
950          * to flush even in cache=writethrough mode.
951          */
952         ret = bdrv_driver_pwritev(bs, cluster_offset, cluster_bytes,
953                                   &bounce_qiov, 0);
954     }
955 
956     if (ret < 0) {
957         /* It might be okay to ignore write errors for guest requests.  If this
958          * is a deliberate copy-on-read then we don't want to ignore the error.
959          * Simply report it in all cases.
960          */
961         goto err;
962     }
963 
964     skip_bytes = offset - cluster_offset;
965     qemu_iovec_from_buf(qiov, 0, bounce_buffer + skip_bytes, bytes);
966 
967 err:
968     qemu_vfree(bounce_buffer);
969     return ret;
970 }
971 
972 /*
973  * Forwards an already correctly aligned request to the BlockDriver. This
974  * handles copy on read and zeroing after EOF; any other features must be
975  * implemented by the caller.
976  */
977 static int coroutine_fn bdrv_aligned_preadv(BlockDriverState *bs,
978     BdrvTrackedRequest *req, int64_t offset, unsigned int bytes,
979     int64_t align, QEMUIOVector *qiov, int flags)
980 {
981     int64_t total_bytes, max_bytes;
982     int ret;
983 
984     assert(is_power_of_2(align));
985     assert((offset & (align - 1)) == 0);
986     assert((bytes & (align - 1)) == 0);
987     assert(!qiov || bytes == qiov->size);
988     assert((bs->open_flags & BDRV_O_NO_IO) == 0);
989 
990     /* TODO: We would need a per-BDS .supported_read_flags and
991      * potential fallback support, if we ever implement any read flags
992      * to pass through to drivers.  For now, there aren't any
993      * passthrough flags.  */
994     assert(!(flags & ~(BDRV_REQ_NO_SERIALISING | BDRV_REQ_COPY_ON_READ)));
995 
996     /* Handle Copy on Read and associated serialisation */
997     if (flags & BDRV_REQ_COPY_ON_READ) {
998         /* If we touch the same cluster it counts as an overlap.  This
999          * guarantees that allocating writes will be serialized and not race
1000          * with each other for the same cluster.  For example, in copy-on-read
1001          * it ensures that the CoR read and write operations are atomic and
1002          * guest writes cannot interleave between them. */
1003         mark_request_serialising(req, bdrv_get_cluster_size(bs));
1004     }
1005 
1006     if (!(flags & BDRV_REQ_NO_SERIALISING)) {
1007         wait_serialising_requests(req);
1008     }
1009 
1010     if (flags & BDRV_REQ_COPY_ON_READ) {
1011         int64_t start_sector = offset >> BDRV_SECTOR_BITS;
1012         int64_t end_sector = DIV_ROUND_UP(offset + bytes, BDRV_SECTOR_SIZE);
1013         unsigned int nb_sectors = end_sector - start_sector;
1014         int pnum;
1015 
1016         ret = bdrv_is_allocated(bs, start_sector, nb_sectors, &pnum);
1017         if (ret < 0) {
1018             goto out;
1019         }
1020 
1021         if (!ret || pnum != nb_sectors) {
1022             ret = bdrv_co_do_copy_on_readv(bs, offset, bytes, qiov);
1023             goto out;
1024         }
1025     }
1026 
1027     /* Forward the request to the BlockDriver */
1028     total_bytes = bdrv_getlength(bs);
1029     if (total_bytes < 0) {
1030         ret = total_bytes;
1031         goto out;
1032     }
1033 
1034     max_bytes = ROUND_UP(MAX(0, total_bytes - offset), align);
1035     if (bytes <= max_bytes) {
1036         ret = bdrv_driver_preadv(bs, offset, bytes, qiov, 0);
1037     } else if (max_bytes > 0) {
1038         QEMUIOVector local_qiov;
1039 
1040         qemu_iovec_init(&local_qiov, qiov->niov);
1041         qemu_iovec_concat(&local_qiov, qiov, 0, max_bytes);
1042 
1043         ret = bdrv_driver_preadv(bs, offset, max_bytes, &local_qiov, 0);
1044 
1045         qemu_iovec_destroy(&local_qiov);
1046     } else {
1047         ret = 0;
1048     }
1049 
1050     /* Reading beyond end of file is supposed to produce zeroes */
1051     if (ret == 0 && total_bytes < offset + bytes) {
1052         uint64_t zero_offset = MAX(0, total_bytes - offset);
1053         uint64_t zero_bytes = offset + bytes - zero_offset;
1054         qemu_iovec_memset(qiov, zero_offset, 0, zero_bytes);
1055     }
1056 
1057 out:
1058     return ret;
1059 }
1060 
1061 /*
1062  * Handle a read request in coroutine context
1063  */
1064 int coroutine_fn bdrv_co_preadv(BdrvChild *child,
1065     int64_t offset, unsigned int bytes, QEMUIOVector *qiov,
1066     BdrvRequestFlags flags)
1067 {
1068     BlockDriverState *bs = child->bs;
1069     BlockDriver *drv = bs->drv;
1070     BdrvTrackedRequest req;
1071 
1072     uint64_t align = bs->bl.request_alignment;
1073     uint8_t *head_buf = NULL;
1074     uint8_t *tail_buf = NULL;
1075     QEMUIOVector local_qiov;
1076     bool use_local_qiov = false;
1077     int ret;
1078 
1079     if (!drv) {
1080         return -ENOMEDIUM;
1081     }
1082 
1083     ret = bdrv_check_byte_request(bs, offset, bytes);
1084     if (ret < 0) {
1085         return ret;
1086     }
1087 
1088     /* Don't do copy-on-read if we read data before write operation */
1089     if (bs->copy_on_read && !(flags & BDRV_REQ_NO_SERIALISING)) {
1090         flags |= BDRV_REQ_COPY_ON_READ;
1091     }
1092 
1093     /* Align read if necessary by padding qiov */
1094     if (offset & (align - 1)) {
1095         head_buf = qemu_blockalign(bs, align);
1096         qemu_iovec_init(&local_qiov, qiov->niov + 2);
1097         qemu_iovec_add(&local_qiov, head_buf, offset & (align - 1));
1098         qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
1099         use_local_qiov = true;
1100 
1101         bytes += offset & (align - 1);
1102         offset = offset & ~(align - 1);
1103     }
1104 
1105     if ((offset + bytes) & (align - 1)) {
1106         if (!use_local_qiov) {
1107             qemu_iovec_init(&local_qiov, qiov->niov + 1);
1108             qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
1109             use_local_qiov = true;
1110         }
1111         tail_buf = qemu_blockalign(bs, align);
1112         qemu_iovec_add(&local_qiov, tail_buf,
1113                        align - ((offset + bytes) & (align - 1)));
1114 
1115         bytes = ROUND_UP(bytes, align);
1116     }
1117 
1118     tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_READ);
1119     ret = bdrv_aligned_preadv(bs, &req, offset, bytes, align,
1120                               use_local_qiov ? &local_qiov : qiov,
1121                               flags);
1122     tracked_request_end(&req);
1123 
1124     if (use_local_qiov) {
1125         qemu_iovec_destroy(&local_qiov);
1126         qemu_vfree(head_buf);
1127         qemu_vfree(tail_buf);
1128     }
1129 
1130     return ret;
1131 }
1132 
1133 static int coroutine_fn bdrv_co_do_readv(BdrvChild *child,
1134     int64_t sector_num, int nb_sectors, QEMUIOVector *qiov,
1135     BdrvRequestFlags flags)
1136 {
1137     if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
1138         return -EINVAL;
1139     }
1140 
1141     return bdrv_co_preadv(child, sector_num << BDRV_SECTOR_BITS,
1142                           nb_sectors << BDRV_SECTOR_BITS, qiov, flags);
1143 }
1144 
1145 int coroutine_fn bdrv_co_readv(BdrvChild *child, int64_t sector_num,
1146                                int nb_sectors, QEMUIOVector *qiov)
1147 {
1148     trace_bdrv_co_readv(child->bs, sector_num, nb_sectors);
1149 
1150     return bdrv_co_do_readv(child, sector_num, nb_sectors, qiov, 0);
1151 }
1152 
1153 /* Maximum buffer for write zeroes fallback, in bytes */
1154 #define MAX_WRITE_ZEROES_BOUNCE_BUFFER (32768 << BDRV_SECTOR_BITS)
1155 
1156 static int coroutine_fn bdrv_co_do_pwrite_zeroes(BlockDriverState *bs,
1157     int64_t offset, int count, BdrvRequestFlags flags)
1158 {
1159     BlockDriver *drv = bs->drv;
1160     QEMUIOVector qiov;
1161     struct iovec iov = {0};
1162     int ret = 0;
1163     bool need_flush = false;
1164     int head = 0;
1165     int tail = 0;
1166 
1167     int max_write_zeroes = MIN_NON_ZERO(bs->bl.max_pwrite_zeroes, INT_MAX);
1168     int alignment = MAX(bs->bl.pwrite_zeroes_alignment,
1169                         bs->bl.request_alignment);
1170 
1171     assert(is_power_of_2(alignment));
1172     head = offset & (alignment - 1);
1173     tail = (offset + count) & (alignment - 1);
1174     max_write_zeroes &= ~(alignment - 1);
1175 
1176     while (count > 0 && !ret) {
1177         int num = count;
1178 
1179         /* Align request.  Block drivers can expect the "bulk" of the request
1180          * to be aligned, and that unaligned requests do not cross cluster
1181          * boundaries.
1182          */
1183         if (head) {
1184             /* Make a small request up to the first aligned sector.  */
1185             num = MIN(count, alignment - head);
1186             head = 0;
1187         } else if (tail && num > alignment) {
1188             /* Shorten the request to the last aligned sector.  */
1189             num -= tail;
1190         }
1191 
1192         /* limit request size */
1193         if (num > max_write_zeroes) {
1194             num = max_write_zeroes;
1195         }
1196 
1197         ret = -ENOTSUP;
1198         /* First try the efficient write zeroes operation */
1199         if (drv->bdrv_co_pwrite_zeroes) {
1200             ret = drv->bdrv_co_pwrite_zeroes(bs, offset, num,
1201                                              flags & bs->supported_zero_flags);
1202             if (ret != -ENOTSUP && (flags & BDRV_REQ_FUA) &&
1203                 !(bs->supported_zero_flags & BDRV_REQ_FUA)) {
1204                 need_flush = true;
1205             }
1206         } else {
1207             assert(!bs->supported_zero_flags);
1208         }
1209 
1210         if (ret == -ENOTSUP) {
1211             /* Fall back to bounce buffer if write zeroes is unsupported */
1212             int max_transfer = MIN_NON_ZERO(bs->bl.max_transfer,
1213                                             MAX_WRITE_ZEROES_BOUNCE_BUFFER);
1214             BdrvRequestFlags write_flags = flags & ~BDRV_REQ_ZERO_WRITE;
1215 
1216             if ((flags & BDRV_REQ_FUA) &&
1217                 !(bs->supported_write_flags & BDRV_REQ_FUA)) {
1218                 /* No need for bdrv_driver_pwrite() to do a fallback
1219                  * flush on each chunk; use just one at the end */
1220                 write_flags &= ~BDRV_REQ_FUA;
1221                 need_flush = true;
1222             }
1223             num = MIN(num, max_transfer);
1224             iov.iov_len = num;
1225             if (iov.iov_base == NULL) {
1226                 iov.iov_base = qemu_try_blockalign(bs, num);
1227                 if (iov.iov_base == NULL) {
1228                     ret = -ENOMEM;
1229                     goto fail;
1230                 }
1231                 memset(iov.iov_base, 0, num);
1232             }
1233             qemu_iovec_init_external(&qiov, &iov, 1);
1234 
1235             ret = bdrv_driver_pwritev(bs, offset, num, &qiov, write_flags);
1236 
1237             /* Keep bounce buffer around if it is big enough for all
1238              * all future requests.
1239              */
1240             if (num < max_transfer) {
1241                 qemu_vfree(iov.iov_base);
1242                 iov.iov_base = NULL;
1243             }
1244         }
1245 
1246         offset += num;
1247         count -= num;
1248     }
1249 
1250 fail:
1251     if (ret == 0 && need_flush) {
1252         ret = bdrv_co_flush(bs);
1253     }
1254     qemu_vfree(iov.iov_base);
1255     return ret;
1256 }
1257 
1258 /*
1259  * Forwards an already correctly aligned write request to the BlockDriver.
1260  */
1261 static int coroutine_fn bdrv_aligned_pwritev(BlockDriverState *bs,
1262     BdrvTrackedRequest *req, int64_t offset, unsigned int bytes,
1263     int64_t align, QEMUIOVector *qiov, int flags)
1264 {
1265     BlockDriver *drv = bs->drv;
1266     bool waited;
1267     int ret;
1268 
1269     int64_t start_sector = offset >> BDRV_SECTOR_BITS;
1270     int64_t end_sector = DIV_ROUND_UP(offset + bytes, BDRV_SECTOR_SIZE);
1271 
1272     assert(is_power_of_2(align));
1273     assert((offset & (align - 1)) == 0);
1274     assert((bytes & (align - 1)) == 0);
1275     assert(!qiov || bytes == qiov->size);
1276     assert((bs->open_flags & BDRV_O_NO_IO) == 0);
1277     assert(!(flags & ~BDRV_REQ_MASK));
1278 
1279     waited = wait_serialising_requests(req);
1280     assert(!waited || !req->serialising);
1281     assert(req->overlap_offset <= offset);
1282     assert(offset + bytes <= req->overlap_offset + req->overlap_bytes);
1283 
1284     ret = notifier_with_return_list_notify(&bs->before_write_notifiers, req);
1285 
1286     if (!ret && bs->detect_zeroes != BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF &&
1287         !(flags & BDRV_REQ_ZERO_WRITE) && drv->bdrv_co_pwrite_zeroes &&
1288         qemu_iovec_is_zero(qiov)) {
1289         flags |= BDRV_REQ_ZERO_WRITE;
1290         if (bs->detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP) {
1291             flags |= BDRV_REQ_MAY_UNMAP;
1292         }
1293     }
1294 
1295     if (ret < 0) {
1296         /* Do nothing, write notifier decided to fail this request */
1297     } else if (flags & BDRV_REQ_ZERO_WRITE) {
1298         bdrv_debug_event(bs, BLKDBG_PWRITEV_ZERO);
1299         ret = bdrv_co_do_pwrite_zeroes(bs, offset, bytes, flags);
1300     } else {
1301         bdrv_debug_event(bs, BLKDBG_PWRITEV);
1302         ret = bdrv_driver_pwritev(bs, offset, bytes, qiov, flags);
1303     }
1304     bdrv_debug_event(bs, BLKDBG_PWRITEV_DONE);
1305 
1306     bdrv_set_dirty(bs, start_sector, end_sector - start_sector);
1307 
1308     if (bs->wr_highest_offset < offset + bytes) {
1309         bs->wr_highest_offset = offset + bytes;
1310     }
1311 
1312     if (ret >= 0) {
1313         bs->total_sectors = MAX(bs->total_sectors, end_sector);
1314     }
1315 
1316     return ret;
1317 }
1318 
1319 static int coroutine_fn bdrv_co_do_zero_pwritev(BlockDriverState *bs,
1320                                                 int64_t offset,
1321                                                 unsigned int bytes,
1322                                                 BdrvRequestFlags flags,
1323                                                 BdrvTrackedRequest *req)
1324 {
1325     uint8_t *buf = NULL;
1326     QEMUIOVector local_qiov;
1327     struct iovec iov;
1328     uint64_t align = bs->bl.request_alignment;
1329     unsigned int head_padding_bytes, tail_padding_bytes;
1330     int ret = 0;
1331 
1332     head_padding_bytes = offset & (align - 1);
1333     tail_padding_bytes = align - ((offset + bytes) & (align - 1));
1334 
1335 
1336     assert(flags & BDRV_REQ_ZERO_WRITE);
1337     if (head_padding_bytes || tail_padding_bytes) {
1338         buf = qemu_blockalign(bs, align);
1339         iov = (struct iovec) {
1340             .iov_base   = buf,
1341             .iov_len    = align,
1342         };
1343         qemu_iovec_init_external(&local_qiov, &iov, 1);
1344     }
1345     if (head_padding_bytes) {
1346         uint64_t zero_bytes = MIN(bytes, align - head_padding_bytes);
1347 
1348         /* RMW the unaligned part before head. */
1349         mark_request_serialising(req, align);
1350         wait_serialising_requests(req);
1351         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
1352         ret = bdrv_aligned_preadv(bs, req, offset & ~(align - 1), align,
1353                                   align, &local_qiov, 0);
1354         if (ret < 0) {
1355             goto fail;
1356         }
1357         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
1358 
1359         memset(buf + head_padding_bytes, 0, zero_bytes);
1360         ret = bdrv_aligned_pwritev(bs, req, offset & ~(align - 1), align,
1361                                    align, &local_qiov,
1362                                    flags & ~BDRV_REQ_ZERO_WRITE);
1363         if (ret < 0) {
1364             goto fail;
1365         }
1366         offset += zero_bytes;
1367         bytes -= zero_bytes;
1368     }
1369 
1370     assert(!bytes || (offset & (align - 1)) == 0);
1371     if (bytes >= align) {
1372         /* Write the aligned part in the middle. */
1373         uint64_t aligned_bytes = bytes & ~(align - 1);
1374         ret = bdrv_aligned_pwritev(bs, req, offset, aligned_bytes, align,
1375                                    NULL, flags);
1376         if (ret < 0) {
1377             goto fail;
1378         }
1379         bytes -= aligned_bytes;
1380         offset += aligned_bytes;
1381     }
1382 
1383     assert(!bytes || (offset & (align - 1)) == 0);
1384     if (bytes) {
1385         assert(align == tail_padding_bytes + bytes);
1386         /* RMW the unaligned part after tail. */
1387         mark_request_serialising(req, align);
1388         wait_serialising_requests(req);
1389         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
1390         ret = bdrv_aligned_preadv(bs, req, offset, align,
1391                                   align, &local_qiov, 0);
1392         if (ret < 0) {
1393             goto fail;
1394         }
1395         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
1396 
1397         memset(buf, 0, bytes);
1398         ret = bdrv_aligned_pwritev(bs, req, offset, align, align,
1399                                    &local_qiov, flags & ~BDRV_REQ_ZERO_WRITE);
1400     }
1401 fail:
1402     qemu_vfree(buf);
1403     return ret;
1404 
1405 }
1406 
1407 /*
1408  * Handle a write request in coroutine context
1409  */
1410 int coroutine_fn bdrv_co_pwritev(BdrvChild *child,
1411     int64_t offset, unsigned int bytes, QEMUIOVector *qiov,
1412     BdrvRequestFlags flags)
1413 {
1414     BlockDriverState *bs = child->bs;
1415     BdrvTrackedRequest req;
1416     uint64_t align = bs->bl.request_alignment;
1417     uint8_t *head_buf = NULL;
1418     uint8_t *tail_buf = NULL;
1419     QEMUIOVector local_qiov;
1420     bool use_local_qiov = false;
1421     int ret;
1422 
1423     if (!bs->drv) {
1424         return -ENOMEDIUM;
1425     }
1426     if (bs->read_only) {
1427         return -EPERM;
1428     }
1429     assert(!(bs->open_flags & BDRV_O_INACTIVE));
1430 
1431     ret = bdrv_check_byte_request(bs, offset, bytes);
1432     if (ret < 0) {
1433         return ret;
1434     }
1435 
1436     /*
1437      * Align write if necessary by performing a read-modify-write cycle.
1438      * Pad qiov with the read parts and be sure to have a tracked request not
1439      * only for bdrv_aligned_pwritev, but also for the reads of the RMW cycle.
1440      */
1441     tracked_request_begin(&req, bs, offset, bytes, BDRV_TRACKED_WRITE);
1442 
1443     if (!qiov) {
1444         ret = bdrv_co_do_zero_pwritev(bs, offset, bytes, flags, &req);
1445         goto out;
1446     }
1447 
1448     if (offset & (align - 1)) {
1449         QEMUIOVector head_qiov;
1450         struct iovec head_iov;
1451 
1452         mark_request_serialising(&req, align);
1453         wait_serialising_requests(&req);
1454 
1455         head_buf = qemu_blockalign(bs, align);
1456         head_iov = (struct iovec) {
1457             .iov_base   = head_buf,
1458             .iov_len    = align,
1459         };
1460         qemu_iovec_init_external(&head_qiov, &head_iov, 1);
1461 
1462         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_HEAD);
1463         ret = bdrv_aligned_preadv(bs, &req, offset & ~(align - 1), align,
1464                                   align, &head_qiov, 0);
1465         if (ret < 0) {
1466             goto fail;
1467         }
1468         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_HEAD);
1469 
1470         qemu_iovec_init(&local_qiov, qiov->niov + 2);
1471         qemu_iovec_add(&local_qiov, head_buf, offset & (align - 1));
1472         qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
1473         use_local_qiov = true;
1474 
1475         bytes += offset & (align - 1);
1476         offset = offset & ~(align - 1);
1477 
1478         /* We have read the tail already if the request is smaller
1479          * than one aligned block.
1480          */
1481         if (bytes < align) {
1482             qemu_iovec_add(&local_qiov, head_buf + bytes, align - bytes);
1483             bytes = align;
1484         }
1485     }
1486 
1487     if ((offset + bytes) & (align - 1)) {
1488         QEMUIOVector tail_qiov;
1489         struct iovec tail_iov;
1490         size_t tail_bytes;
1491         bool waited;
1492 
1493         mark_request_serialising(&req, align);
1494         waited = wait_serialising_requests(&req);
1495         assert(!waited || !use_local_qiov);
1496 
1497         tail_buf = qemu_blockalign(bs, align);
1498         tail_iov = (struct iovec) {
1499             .iov_base   = tail_buf,
1500             .iov_len    = align,
1501         };
1502         qemu_iovec_init_external(&tail_qiov, &tail_iov, 1);
1503 
1504         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_TAIL);
1505         ret = bdrv_aligned_preadv(bs, &req, (offset + bytes) & ~(align - 1), align,
1506                                   align, &tail_qiov, 0);
1507         if (ret < 0) {
1508             goto fail;
1509         }
1510         bdrv_debug_event(bs, BLKDBG_PWRITEV_RMW_AFTER_TAIL);
1511 
1512         if (!use_local_qiov) {
1513             qemu_iovec_init(&local_qiov, qiov->niov + 1);
1514             qemu_iovec_concat(&local_qiov, qiov, 0, qiov->size);
1515             use_local_qiov = true;
1516         }
1517 
1518         tail_bytes = (offset + bytes) & (align - 1);
1519         qemu_iovec_add(&local_qiov, tail_buf + tail_bytes, align - tail_bytes);
1520 
1521         bytes = ROUND_UP(bytes, align);
1522     }
1523 
1524     ret = bdrv_aligned_pwritev(bs, &req, offset, bytes, align,
1525                                use_local_qiov ? &local_qiov : qiov,
1526                                flags);
1527 
1528 fail:
1529 
1530     if (use_local_qiov) {
1531         qemu_iovec_destroy(&local_qiov);
1532     }
1533     qemu_vfree(head_buf);
1534     qemu_vfree(tail_buf);
1535 out:
1536     tracked_request_end(&req);
1537     return ret;
1538 }
1539 
1540 static int coroutine_fn bdrv_co_do_writev(BdrvChild *child,
1541     int64_t sector_num, int nb_sectors, QEMUIOVector *qiov,
1542     BdrvRequestFlags flags)
1543 {
1544     if (nb_sectors < 0 || nb_sectors > BDRV_REQUEST_MAX_SECTORS) {
1545         return -EINVAL;
1546     }
1547 
1548     return bdrv_co_pwritev(child, sector_num << BDRV_SECTOR_BITS,
1549                            nb_sectors << BDRV_SECTOR_BITS, qiov, flags);
1550 }
1551 
1552 int coroutine_fn bdrv_co_writev(BdrvChild *child, int64_t sector_num,
1553     int nb_sectors, QEMUIOVector *qiov)
1554 {
1555     trace_bdrv_co_writev(child->bs, sector_num, nb_sectors);
1556 
1557     return bdrv_co_do_writev(child, sector_num, nb_sectors, qiov, 0);
1558 }
1559 
1560 int coroutine_fn bdrv_co_pwrite_zeroes(BdrvChild *child, int64_t offset,
1561                                        int count, BdrvRequestFlags flags)
1562 {
1563     trace_bdrv_co_pwrite_zeroes(child->bs, offset, count, flags);
1564 
1565     if (!(child->bs->open_flags & BDRV_O_UNMAP)) {
1566         flags &= ~BDRV_REQ_MAY_UNMAP;
1567     }
1568 
1569     return bdrv_co_pwritev(child, offset, count, NULL,
1570                            BDRV_REQ_ZERO_WRITE | flags);
1571 }
1572 
1573 typedef struct BdrvCoGetBlockStatusData {
1574     BlockDriverState *bs;
1575     BlockDriverState *base;
1576     BlockDriverState **file;
1577     int64_t sector_num;
1578     int nb_sectors;
1579     int *pnum;
1580     int64_t ret;
1581     bool done;
1582 } BdrvCoGetBlockStatusData;
1583 
1584 /*
1585  * Returns the allocation status of the specified sectors.
1586  * Drivers not implementing the functionality are assumed to not support
1587  * backing files, hence all their sectors are reported as allocated.
1588  *
1589  * If 'sector_num' is beyond the end of the disk image the return value is 0
1590  * and 'pnum' is set to 0.
1591  *
1592  * 'pnum' is set to the number of sectors (including and immediately following
1593  * the specified sector) that are known to be in the same
1594  * allocated/unallocated state.
1595  *
1596  * 'nb_sectors' is the max value 'pnum' should be set to.  If nb_sectors goes
1597  * beyond the end of the disk image it will be clamped.
1598  *
1599  * If returned value is positive and BDRV_BLOCK_OFFSET_VALID bit is set, 'file'
1600  * points to the BDS which the sector range is allocated in.
1601  */
1602 static int64_t coroutine_fn bdrv_co_get_block_status(BlockDriverState *bs,
1603                                                      int64_t sector_num,
1604                                                      int nb_sectors, int *pnum,
1605                                                      BlockDriverState **file)
1606 {
1607     int64_t total_sectors;
1608     int64_t n;
1609     int64_t ret, ret2;
1610 
1611     total_sectors = bdrv_nb_sectors(bs);
1612     if (total_sectors < 0) {
1613         return total_sectors;
1614     }
1615 
1616     if (sector_num >= total_sectors) {
1617         *pnum = 0;
1618         return 0;
1619     }
1620 
1621     n = total_sectors - sector_num;
1622     if (n < nb_sectors) {
1623         nb_sectors = n;
1624     }
1625 
1626     if (!bs->drv->bdrv_co_get_block_status) {
1627         *pnum = nb_sectors;
1628         ret = BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED;
1629         if (bs->drv->protocol_name) {
1630             ret |= BDRV_BLOCK_OFFSET_VALID | (sector_num * BDRV_SECTOR_SIZE);
1631         }
1632         return ret;
1633     }
1634 
1635     *file = NULL;
1636     ret = bs->drv->bdrv_co_get_block_status(bs, sector_num, nb_sectors, pnum,
1637                                             file);
1638     if (ret < 0) {
1639         *pnum = 0;
1640         return ret;
1641     }
1642 
1643     if (ret & BDRV_BLOCK_RAW) {
1644         assert(ret & BDRV_BLOCK_OFFSET_VALID);
1645         return bdrv_get_block_status(bs->file->bs, ret >> BDRV_SECTOR_BITS,
1646                                      *pnum, pnum, file);
1647     }
1648 
1649     if (ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ZERO)) {
1650         ret |= BDRV_BLOCK_ALLOCATED;
1651     } else {
1652         if (bdrv_unallocated_blocks_are_zero(bs)) {
1653             ret |= BDRV_BLOCK_ZERO;
1654         } else if (bs->backing) {
1655             BlockDriverState *bs2 = bs->backing->bs;
1656             int64_t nb_sectors2 = bdrv_nb_sectors(bs2);
1657             if (nb_sectors2 >= 0 && sector_num >= nb_sectors2) {
1658                 ret |= BDRV_BLOCK_ZERO;
1659             }
1660         }
1661     }
1662 
1663     if (*file && *file != bs &&
1664         (ret & BDRV_BLOCK_DATA) && !(ret & BDRV_BLOCK_ZERO) &&
1665         (ret & BDRV_BLOCK_OFFSET_VALID)) {
1666         BlockDriverState *file2;
1667         int file_pnum;
1668 
1669         ret2 = bdrv_co_get_block_status(*file, ret >> BDRV_SECTOR_BITS,
1670                                         *pnum, &file_pnum, &file2);
1671         if (ret2 >= 0) {
1672             /* Ignore errors.  This is just providing extra information, it
1673              * is useful but not necessary.
1674              */
1675             if (!file_pnum) {
1676                 /* !file_pnum indicates an offset at or beyond the EOF; it is
1677                  * perfectly valid for the format block driver to point to such
1678                  * offsets, so catch it and mark everything as zero */
1679                 ret |= BDRV_BLOCK_ZERO;
1680             } else {
1681                 /* Limit request to the range reported by the protocol driver */
1682                 *pnum = file_pnum;
1683                 ret |= (ret2 & BDRV_BLOCK_ZERO);
1684             }
1685         }
1686     }
1687 
1688     return ret;
1689 }
1690 
1691 static int64_t coroutine_fn bdrv_co_get_block_status_above(BlockDriverState *bs,
1692         BlockDriverState *base,
1693         int64_t sector_num,
1694         int nb_sectors,
1695         int *pnum,
1696         BlockDriverState **file)
1697 {
1698     BlockDriverState *p;
1699     int64_t ret = 0;
1700 
1701     assert(bs != base);
1702     for (p = bs; p != base; p = backing_bs(p)) {
1703         ret = bdrv_co_get_block_status(p, sector_num, nb_sectors, pnum, file);
1704         if (ret < 0 || ret & BDRV_BLOCK_ALLOCATED) {
1705             break;
1706         }
1707         /* [sector_num, pnum] unallocated on this layer, which could be only
1708          * the first part of [sector_num, nb_sectors].  */
1709         nb_sectors = MIN(nb_sectors, *pnum);
1710     }
1711     return ret;
1712 }
1713 
1714 /* Coroutine wrapper for bdrv_get_block_status_above() */
1715 static void coroutine_fn bdrv_get_block_status_above_co_entry(void *opaque)
1716 {
1717     BdrvCoGetBlockStatusData *data = opaque;
1718 
1719     data->ret = bdrv_co_get_block_status_above(data->bs, data->base,
1720                                                data->sector_num,
1721                                                data->nb_sectors,
1722                                                data->pnum,
1723                                                data->file);
1724     data->done = true;
1725 }
1726 
1727 /*
1728  * Synchronous wrapper around bdrv_co_get_block_status_above().
1729  *
1730  * See bdrv_co_get_block_status_above() for details.
1731  */
1732 int64_t bdrv_get_block_status_above(BlockDriverState *bs,
1733                                     BlockDriverState *base,
1734                                     int64_t sector_num,
1735                                     int nb_sectors, int *pnum,
1736                                     BlockDriverState **file)
1737 {
1738     Coroutine *co;
1739     BdrvCoGetBlockStatusData data = {
1740         .bs = bs,
1741         .base = base,
1742         .file = file,
1743         .sector_num = sector_num,
1744         .nb_sectors = nb_sectors,
1745         .pnum = pnum,
1746         .done = false,
1747     };
1748 
1749     if (qemu_in_coroutine()) {
1750         /* Fast-path if already in coroutine context */
1751         bdrv_get_block_status_above_co_entry(&data);
1752     } else {
1753         AioContext *aio_context = bdrv_get_aio_context(bs);
1754 
1755         co = qemu_coroutine_create(bdrv_get_block_status_above_co_entry,
1756                                    &data);
1757         qemu_coroutine_enter(co);
1758         while (!data.done) {
1759             aio_poll(aio_context, true);
1760         }
1761     }
1762     return data.ret;
1763 }
1764 
1765 int64_t bdrv_get_block_status(BlockDriverState *bs,
1766                               int64_t sector_num,
1767                               int nb_sectors, int *pnum,
1768                               BlockDriverState **file)
1769 {
1770     return bdrv_get_block_status_above(bs, backing_bs(bs),
1771                                        sector_num, nb_sectors, pnum, file);
1772 }
1773 
1774 int coroutine_fn bdrv_is_allocated(BlockDriverState *bs, int64_t sector_num,
1775                                    int nb_sectors, int *pnum)
1776 {
1777     BlockDriverState *file;
1778     int64_t ret = bdrv_get_block_status(bs, sector_num, nb_sectors, pnum,
1779                                         &file);
1780     if (ret < 0) {
1781         return ret;
1782     }
1783     return !!(ret & BDRV_BLOCK_ALLOCATED);
1784 }
1785 
1786 /*
1787  * Given an image chain: ... -> [BASE] -> [INTER1] -> [INTER2] -> [TOP]
1788  *
1789  * Return true if the given sector is allocated in any image between
1790  * BASE and TOP (inclusive).  BASE can be NULL to check if the given
1791  * sector is allocated in any image of the chain.  Return false otherwise.
1792  *
1793  * 'pnum' is set to the number of sectors (including and immediately following
1794  *  the specified sector) that are known to be in the same
1795  *  allocated/unallocated state.
1796  *
1797  */
1798 int bdrv_is_allocated_above(BlockDriverState *top,
1799                             BlockDriverState *base,
1800                             int64_t sector_num,
1801                             int nb_sectors, int *pnum)
1802 {
1803     BlockDriverState *intermediate;
1804     int ret, n = nb_sectors;
1805 
1806     intermediate = top;
1807     while (intermediate && intermediate != base) {
1808         int pnum_inter;
1809         ret = bdrv_is_allocated(intermediate, sector_num, nb_sectors,
1810                                 &pnum_inter);
1811         if (ret < 0) {
1812             return ret;
1813         } else if (ret) {
1814             *pnum = pnum_inter;
1815             return 1;
1816         }
1817 
1818         /*
1819          * [sector_num, nb_sectors] is unallocated on top but intermediate
1820          * might have
1821          *
1822          * [sector_num+x, nr_sectors] allocated.
1823          */
1824         if (n > pnum_inter &&
1825             (intermediate == top ||
1826              sector_num + pnum_inter < intermediate->total_sectors)) {
1827             n = pnum_inter;
1828         }
1829 
1830         intermediate = backing_bs(intermediate);
1831     }
1832 
1833     *pnum = n;
1834     return 0;
1835 }
1836 
1837 int bdrv_write_compressed(BlockDriverState *bs, int64_t sector_num,
1838                           const uint8_t *buf, int nb_sectors)
1839 {
1840     BlockDriver *drv = bs->drv;
1841     int ret;
1842 
1843     if (!drv) {
1844         return -ENOMEDIUM;
1845     }
1846     if (!drv->bdrv_write_compressed) {
1847         return -ENOTSUP;
1848     }
1849     ret = bdrv_check_request(bs, sector_num, nb_sectors);
1850     if (ret < 0) {
1851         return ret;
1852     }
1853 
1854     assert(QLIST_EMPTY(&bs->dirty_bitmaps));
1855 
1856     return drv->bdrv_write_compressed(bs, sector_num, buf, nb_sectors);
1857 }
1858 
1859 typedef struct BdrvVmstateCo {
1860     BlockDriverState    *bs;
1861     QEMUIOVector        *qiov;
1862     int64_t             pos;
1863     bool                is_read;
1864     int                 ret;
1865 } BdrvVmstateCo;
1866 
1867 static int coroutine_fn
1868 bdrv_co_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
1869                    bool is_read)
1870 {
1871     BlockDriver *drv = bs->drv;
1872 
1873     if (!drv) {
1874         return -ENOMEDIUM;
1875     } else if (drv->bdrv_load_vmstate) {
1876         return is_read ? drv->bdrv_load_vmstate(bs, qiov, pos)
1877                        : drv->bdrv_save_vmstate(bs, qiov, pos);
1878     } else if (bs->file) {
1879         return bdrv_co_rw_vmstate(bs->file->bs, qiov, pos, is_read);
1880     }
1881 
1882     return -ENOTSUP;
1883 }
1884 
1885 static void coroutine_fn bdrv_co_rw_vmstate_entry(void *opaque)
1886 {
1887     BdrvVmstateCo *co = opaque;
1888     co->ret = bdrv_co_rw_vmstate(co->bs, co->qiov, co->pos, co->is_read);
1889 }
1890 
1891 static inline int
1892 bdrv_rw_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos,
1893                 bool is_read)
1894 {
1895     if (qemu_in_coroutine()) {
1896         return bdrv_co_rw_vmstate(bs, qiov, pos, is_read);
1897     } else {
1898         BdrvVmstateCo data = {
1899             .bs         = bs,
1900             .qiov       = qiov,
1901             .pos        = pos,
1902             .is_read    = is_read,
1903             .ret        = -EINPROGRESS,
1904         };
1905         Coroutine *co = qemu_coroutine_create(bdrv_co_rw_vmstate_entry, &data);
1906 
1907         qemu_coroutine_enter(co);
1908         while (data.ret == -EINPROGRESS) {
1909             aio_poll(bdrv_get_aio_context(bs), true);
1910         }
1911         return data.ret;
1912     }
1913 }
1914 
1915 int bdrv_save_vmstate(BlockDriverState *bs, const uint8_t *buf,
1916                       int64_t pos, int size)
1917 {
1918     QEMUIOVector qiov;
1919     struct iovec iov = {
1920         .iov_base   = (void *) buf,
1921         .iov_len    = size,
1922     };
1923     int ret;
1924 
1925     qemu_iovec_init_external(&qiov, &iov, 1);
1926 
1927     ret = bdrv_writev_vmstate(bs, &qiov, pos);
1928     if (ret < 0) {
1929         return ret;
1930     }
1931 
1932     return size;
1933 }
1934 
1935 int bdrv_writev_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
1936 {
1937     return bdrv_rw_vmstate(bs, qiov, pos, false);
1938 }
1939 
1940 int bdrv_load_vmstate(BlockDriverState *bs, uint8_t *buf,
1941                       int64_t pos, int size)
1942 {
1943     QEMUIOVector qiov;
1944     struct iovec iov = {
1945         .iov_base   = buf,
1946         .iov_len    = size,
1947     };
1948     int ret;
1949 
1950     qemu_iovec_init_external(&qiov, &iov, 1);
1951     ret = bdrv_readv_vmstate(bs, &qiov, pos);
1952     if (ret < 0) {
1953         return ret;
1954     }
1955 
1956     return size;
1957 }
1958 
1959 int bdrv_readv_vmstate(BlockDriverState *bs, QEMUIOVector *qiov, int64_t pos)
1960 {
1961     return bdrv_rw_vmstate(bs, qiov, pos, true);
1962 }
1963 
1964 /**************************************************************/
1965 /* async I/Os */
1966 
1967 BlockAIOCB *bdrv_aio_readv(BdrvChild *child, int64_t sector_num,
1968                            QEMUIOVector *qiov, int nb_sectors,
1969                            BlockCompletionFunc *cb, void *opaque)
1970 {
1971     trace_bdrv_aio_readv(child->bs, sector_num, nb_sectors, opaque);
1972 
1973     return bdrv_co_aio_rw_vector(child, sector_num, qiov, nb_sectors, 0,
1974                                  cb, opaque, false);
1975 }
1976 
1977 BlockAIOCB *bdrv_aio_writev(BdrvChild *child, int64_t sector_num,
1978                             QEMUIOVector *qiov, int nb_sectors,
1979                             BlockCompletionFunc *cb, void *opaque)
1980 {
1981     trace_bdrv_aio_writev(child->bs, sector_num, nb_sectors, opaque);
1982 
1983     return bdrv_co_aio_rw_vector(child, sector_num, qiov, nb_sectors, 0,
1984                                  cb, opaque, true);
1985 }
1986 
1987 void bdrv_aio_cancel(BlockAIOCB *acb)
1988 {
1989     qemu_aio_ref(acb);
1990     bdrv_aio_cancel_async(acb);
1991     while (acb->refcnt > 1) {
1992         if (acb->aiocb_info->get_aio_context) {
1993             aio_poll(acb->aiocb_info->get_aio_context(acb), true);
1994         } else if (acb->bs) {
1995             aio_poll(bdrv_get_aio_context(acb->bs), true);
1996         } else {
1997             abort();
1998         }
1999     }
2000     qemu_aio_unref(acb);
2001 }
2002 
2003 /* Async version of aio cancel. The caller is not blocked if the acb implements
2004  * cancel_async, otherwise we do nothing and let the request normally complete.
2005  * In either case the completion callback must be called. */
2006 void bdrv_aio_cancel_async(BlockAIOCB *acb)
2007 {
2008     if (acb->aiocb_info->cancel_async) {
2009         acb->aiocb_info->cancel_async(acb);
2010     }
2011 }
2012 
2013 /**************************************************************/
2014 /* async block device emulation */
2015 
2016 typedef struct BlockRequest {
2017     union {
2018         /* Used during read, write, trim */
2019         struct {
2020             int64_t sector;
2021             int nb_sectors;
2022             int flags;
2023             QEMUIOVector *qiov;
2024         };
2025         /* Used during ioctl */
2026         struct {
2027             int req;
2028             void *buf;
2029         };
2030     };
2031     BlockCompletionFunc *cb;
2032     void *opaque;
2033 
2034     int error;
2035 } BlockRequest;
2036 
2037 typedef struct BlockAIOCBCoroutine {
2038     BlockAIOCB common;
2039     BdrvChild *child;
2040     BlockRequest req;
2041     bool is_write;
2042     bool need_bh;
2043     bool *done;
2044     QEMUBH* bh;
2045 } BlockAIOCBCoroutine;
2046 
2047 static const AIOCBInfo bdrv_em_co_aiocb_info = {
2048     .aiocb_size         = sizeof(BlockAIOCBCoroutine),
2049 };
2050 
2051 static void bdrv_co_complete(BlockAIOCBCoroutine *acb)
2052 {
2053     if (!acb->need_bh) {
2054         acb->common.cb(acb->common.opaque, acb->req.error);
2055         qemu_aio_unref(acb);
2056     }
2057 }
2058 
2059 static void bdrv_co_em_bh(void *opaque)
2060 {
2061     BlockAIOCBCoroutine *acb = opaque;
2062 
2063     assert(!acb->need_bh);
2064     qemu_bh_delete(acb->bh);
2065     bdrv_co_complete(acb);
2066 }
2067 
2068 static void bdrv_co_maybe_schedule_bh(BlockAIOCBCoroutine *acb)
2069 {
2070     acb->need_bh = false;
2071     if (acb->req.error != -EINPROGRESS) {
2072         BlockDriverState *bs = acb->common.bs;
2073 
2074         acb->bh = aio_bh_new(bdrv_get_aio_context(bs), bdrv_co_em_bh, acb);
2075         qemu_bh_schedule(acb->bh);
2076     }
2077 }
2078 
2079 /* Invoke bdrv_co_do_readv/bdrv_co_do_writev */
2080 static void coroutine_fn bdrv_co_do_rw(void *opaque)
2081 {
2082     BlockAIOCBCoroutine *acb = opaque;
2083 
2084     if (!acb->is_write) {
2085         acb->req.error = bdrv_co_do_readv(acb->child, acb->req.sector,
2086             acb->req.nb_sectors, acb->req.qiov, acb->req.flags);
2087     } else {
2088         acb->req.error = bdrv_co_do_writev(acb->child, acb->req.sector,
2089             acb->req.nb_sectors, acb->req.qiov, acb->req.flags);
2090     }
2091 
2092     bdrv_co_complete(acb);
2093 }
2094 
2095 static BlockAIOCB *bdrv_co_aio_rw_vector(BdrvChild *child,
2096                                          int64_t sector_num,
2097                                          QEMUIOVector *qiov,
2098                                          int nb_sectors,
2099                                          BdrvRequestFlags flags,
2100                                          BlockCompletionFunc *cb,
2101                                          void *opaque,
2102                                          bool is_write)
2103 {
2104     Coroutine *co;
2105     BlockAIOCBCoroutine *acb;
2106 
2107     acb = qemu_aio_get(&bdrv_em_co_aiocb_info, child->bs, cb, opaque);
2108     acb->child = child;
2109     acb->need_bh = true;
2110     acb->req.error = -EINPROGRESS;
2111     acb->req.sector = sector_num;
2112     acb->req.nb_sectors = nb_sectors;
2113     acb->req.qiov = qiov;
2114     acb->req.flags = flags;
2115     acb->is_write = is_write;
2116 
2117     co = qemu_coroutine_create(bdrv_co_do_rw, acb);
2118     qemu_coroutine_enter(co);
2119 
2120     bdrv_co_maybe_schedule_bh(acb);
2121     return &acb->common;
2122 }
2123 
2124 static void coroutine_fn bdrv_aio_flush_co_entry(void *opaque)
2125 {
2126     BlockAIOCBCoroutine *acb = opaque;
2127     BlockDriverState *bs = acb->common.bs;
2128 
2129     acb->req.error = bdrv_co_flush(bs);
2130     bdrv_co_complete(acb);
2131 }
2132 
2133 BlockAIOCB *bdrv_aio_flush(BlockDriverState *bs,
2134         BlockCompletionFunc *cb, void *opaque)
2135 {
2136     trace_bdrv_aio_flush(bs, opaque);
2137 
2138     Coroutine *co;
2139     BlockAIOCBCoroutine *acb;
2140 
2141     acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
2142     acb->need_bh = true;
2143     acb->req.error = -EINPROGRESS;
2144 
2145     co = qemu_coroutine_create(bdrv_aio_flush_co_entry, acb);
2146     qemu_coroutine_enter(co);
2147 
2148     bdrv_co_maybe_schedule_bh(acb);
2149     return &acb->common;
2150 }
2151 
2152 static void coroutine_fn bdrv_aio_discard_co_entry(void *opaque)
2153 {
2154     BlockAIOCBCoroutine *acb = opaque;
2155     BlockDriverState *bs = acb->common.bs;
2156 
2157     acb->req.error = bdrv_co_discard(bs, acb->req.sector, acb->req.nb_sectors);
2158     bdrv_co_complete(acb);
2159 }
2160 
2161 BlockAIOCB *bdrv_aio_discard(BlockDriverState *bs,
2162         int64_t sector_num, int nb_sectors,
2163         BlockCompletionFunc *cb, void *opaque)
2164 {
2165     Coroutine *co;
2166     BlockAIOCBCoroutine *acb;
2167 
2168     trace_bdrv_aio_discard(bs, sector_num, nb_sectors, opaque);
2169 
2170     acb = qemu_aio_get(&bdrv_em_co_aiocb_info, bs, cb, opaque);
2171     acb->need_bh = true;
2172     acb->req.error = -EINPROGRESS;
2173     acb->req.sector = sector_num;
2174     acb->req.nb_sectors = nb_sectors;
2175     co = qemu_coroutine_create(bdrv_aio_discard_co_entry, acb);
2176     qemu_coroutine_enter(co);
2177 
2178     bdrv_co_maybe_schedule_bh(acb);
2179     return &acb->common;
2180 }
2181 
2182 void *qemu_aio_get(const AIOCBInfo *aiocb_info, BlockDriverState *bs,
2183                    BlockCompletionFunc *cb, void *opaque)
2184 {
2185     BlockAIOCB *acb;
2186 
2187     acb = g_malloc(aiocb_info->aiocb_size);
2188     acb->aiocb_info = aiocb_info;
2189     acb->bs = bs;
2190     acb->cb = cb;
2191     acb->opaque = opaque;
2192     acb->refcnt = 1;
2193     return acb;
2194 }
2195 
2196 void qemu_aio_ref(void *p)
2197 {
2198     BlockAIOCB *acb = p;
2199     acb->refcnt++;
2200 }
2201 
2202 void qemu_aio_unref(void *p)
2203 {
2204     BlockAIOCB *acb = p;
2205     assert(acb->refcnt > 0);
2206     if (--acb->refcnt == 0) {
2207         g_free(acb);
2208     }
2209 }
2210 
2211 /**************************************************************/
2212 /* Coroutine block device emulation */
2213 
2214 typedef struct FlushCo {
2215     BlockDriverState *bs;
2216     int ret;
2217 } FlushCo;
2218 
2219 
2220 static void coroutine_fn bdrv_flush_co_entry(void *opaque)
2221 {
2222     FlushCo *rwco = opaque;
2223 
2224     rwco->ret = bdrv_co_flush(rwco->bs);
2225 }
2226 
2227 int coroutine_fn bdrv_co_flush(BlockDriverState *bs)
2228 {
2229     int ret;
2230     BdrvTrackedRequest req;
2231 
2232     if (!bs || !bdrv_is_inserted(bs) || bdrv_is_read_only(bs) ||
2233         bdrv_is_sg(bs)) {
2234         return 0;
2235     }
2236 
2237     tracked_request_begin(&req, bs, 0, 0, BDRV_TRACKED_FLUSH);
2238 
2239     /* Write back all layers by calling one driver function */
2240     if (bs->drv->bdrv_co_flush) {
2241         ret = bs->drv->bdrv_co_flush(bs);
2242         goto out;
2243     }
2244 
2245     /* Write back cached data to the OS even with cache=unsafe */
2246     BLKDBG_EVENT(bs->file, BLKDBG_FLUSH_TO_OS);
2247     if (bs->drv->bdrv_co_flush_to_os) {
2248         ret = bs->drv->bdrv_co_flush_to_os(bs);
2249         if (ret < 0) {
2250             goto out;
2251         }
2252     }
2253 
2254     /* But don't actually force it to the disk with cache=unsafe */
2255     if (bs->open_flags & BDRV_O_NO_FLUSH) {
2256         goto flush_parent;
2257     }
2258 
2259     BLKDBG_EVENT(bs->file, BLKDBG_FLUSH_TO_DISK);
2260     if (bs->drv->bdrv_co_flush_to_disk) {
2261         ret = bs->drv->bdrv_co_flush_to_disk(bs);
2262     } else if (bs->drv->bdrv_aio_flush) {
2263         BlockAIOCB *acb;
2264         CoroutineIOCompletion co = {
2265             .coroutine = qemu_coroutine_self(),
2266         };
2267 
2268         acb = bs->drv->bdrv_aio_flush(bs, bdrv_co_io_em_complete, &co);
2269         if (acb == NULL) {
2270             ret = -EIO;
2271         } else {
2272             qemu_coroutine_yield();
2273             ret = co.ret;
2274         }
2275     } else {
2276         /*
2277          * Some block drivers always operate in either writethrough or unsafe
2278          * mode and don't support bdrv_flush therefore. Usually qemu doesn't
2279          * know how the server works (because the behaviour is hardcoded or
2280          * depends on server-side configuration), so we can't ensure that
2281          * everything is safe on disk. Returning an error doesn't work because
2282          * that would break guests even if the server operates in writethrough
2283          * mode.
2284          *
2285          * Let's hope the user knows what he's doing.
2286          */
2287         ret = 0;
2288     }
2289     if (ret < 0) {
2290         goto out;
2291     }
2292 
2293     /* Now flush the underlying protocol.  It will also have BDRV_O_NO_FLUSH
2294      * in the case of cache=unsafe, so there are no useless flushes.
2295      */
2296 flush_parent:
2297     ret = bs->file ? bdrv_co_flush(bs->file->bs) : 0;
2298 out:
2299     tracked_request_end(&req);
2300     return ret;
2301 }
2302 
2303 int bdrv_flush(BlockDriverState *bs)
2304 {
2305     Coroutine *co;
2306     FlushCo flush_co = {
2307         .bs = bs,
2308         .ret = NOT_DONE,
2309     };
2310 
2311     if (qemu_in_coroutine()) {
2312         /* Fast-path if already in coroutine context */
2313         bdrv_flush_co_entry(&flush_co);
2314     } else {
2315         AioContext *aio_context = bdrv_get_aio_context(bs);
2316 
2317         co = qemu_coroutine_create(bdrv_flush_co_entry, &flush_co);
2318         qemu_coroutine_enter(co);
2319         while (flush_co.ret == NOT_DONE) {
2320             aio_poll(aio_context, true);
2321         }
2322     }
2323 
2324     return flush_co.ret;
2325 }
2326 
2327 typedef struct DiscardCo {
2328     BlockDriverState *bs;
2329     int64_t sector_num;
2330     int nb_sectors;
2331     int ret;
2332 } DiscardCo;
2333 static void coroutine_fn bdrv_discard_co_entry(void *opaque)
2334 {
2335     DiscardCo *rwco = opaque;
2336 
2337     rwco->ret = bdrv_co_discard(rwco->bs, rwco->sector_num, rwco->nb_sectors);
2338 }
2339 
2340 int coroutine_fn bdrv_co_discard(BlockDriverState *bs, int64_t sector_num,
2341                                  int nb_sectors)
2342 {
2343     BdrvTrackedRequest req;
2344     int max_discard, ret;
2345 
2346     if (!bs->drv) {
2347         return -ENOMEDIUM;
2348     }
2349 
2350     ret = bdrv_check_request(bs, sector_num, nb_sectors);
2351     if (ret < 0) {
2352         return ret;
2353     } else if (bs->read_only) {
2354         return -EPERM;
2355     }
2356     assert(!(bs->open_flags & BDRV_O_INACTIVE));
2357 
2358     /* Do nothing if disabled.  */
2359     if (!(bs->open_flags & BDRV_O_UNMAP)) {
2360         return 0;
2361     }
2362 
2363     if (!bs->drv->bdrv_co_discard && !bs->drv->bdrv_aio_discard) {
2364         return 0;
2365     }
2366 
2367     tracked_request_begin(&req, bs, sector_num << BDRV_SECTOR_BITS,
2368                           nb_sectors << BDRV_SECTOR_BITS, BDRV_TRACKED_DISCARD);
2369 
2370     ret = notifier_with_return_list_notify(&bs->before_write_notifiers, &req);
2371     if (ret < 0) {
2372         goto out;
2373     }
2374 
2375     max_discard = MIN_NON_ZERO(bs->bl.max_pdiscard >> BDRV_SECTOR_BITS,
2376                                BDRV_REQUEST_MAX_SECTORS);
2377     while (nb_sectors > 0) {
2378         int ret;
2379         int num = nb_sectors;
2380         int discard_alignment = bs->bl.pdiscard_alignment >> BDRV_SECTOR_BITS;
2381 
2382         /* align request */
2383         if (discard_alignment &&
2384             num >= discard_alignment &&
2385             sector_num % discard_alignment) {
2386             if (num > discard_alignment) {
2387                 num = discard_alignment;
2388             }
2389             num -= sector_num % discard_alignment;
2390         }
2391 
2392         /* limit request size */
2393         if (num > max_discard) {
2394             num = max_discard;
2395         }
2396 
2397         if (bs->drv->bdrv_co_discard) {
2398             ret = bs->drv->bdrv_co_discard(bs, sector_num, num);
2399         } else {
2400             BlockAIOCB *acb;
2401             CoroutineIOCompletion co = {
2402                 .coroutine = qemu_coroutine_self(),
2403             };
2404 
2405             acb = bs->drv->bdrv_aio_discard(bs, sector_num, nb_sectors,
2406                                             bdrv_co_io_em_complete, &co);
2407             if (acb == NULL) {
2408                 ret = -EIO;
2409                 goto out;
2410             } else {
2411                 qemu_coroutine_yield();
2412                 ret = co.ret;
2413             }
2414         }
2415         if (ret && ret != -ENOTSUP) {
2416             goto out;
2417         }
2418 
2419         sector_num += num;
2420         nb_sectors -= num;
2421     }
2422     ret = 0;
2423 out:
2424     bdrv_set_dirty(bs, req.offset >> BDRV_SECTOR_BITS,
2425                    req.bytes >> BDRV_SECTOR_BITS);
2426     tracked_request_end(&req);
2427     return ret;
2428 }
2429 
2430 int bdrv_discard(BlockDriverState *bs, int64_t sector_num, int nb_sectors)
2431 {
2432     Coroutine *co;
2433     DiscardCo rwco = {
2434         .bs = bs,
2435         .sector_num = sector_num,
2436         .nb_sectors = nb_sectors,
2437         .ret = NOT_DONE,
2438     };
2439 
2440     if (qemu_in_coroutine()) {
2441         /* Fast-path if already in coroutine context */
2442         bdrv_discard_co_entry(&rwco);
2443     } else {
2444         AioContext *aio_context = bdrv_get_aio_context(bs);
2445 
2446         co = qemu_coroutine_create(bdrv_discard_co_entry, &rwco);
2447         qemu_coroutine_enter(co);
2448         while (rwco.ret == NOT_DONE) {
2449             aio_poll(aio_context, true);
2450         }
2451     }
2452 
2453     return rwco.ret;
2454 }
2455 
2456 static int bdrv_co_do_ioctl(BlockDriverState *bs, int req, void *buf)
2457 {
2458     BlockDriver *drv = bs->drv;
2459     BdrvTrackedRequest tracked_req;
2460     CoroutineIOCompletion co = {
2461         .coroutine = qemu_coroutine_self(),
2462     };
2463     BlockAIOCB *acb;
2464 
2465     tracked_request_begin(&tracked_req, bs, 0, 0, BDRV_TRACKED_IOCTL);
2466     if (!drv || !drv->bdrv_aio_ioctl) {
2467         co.ret = -ENOTSUP;
2468         goto out;
2469     }
2470 
2471     acb = drv->bdrv_aio_ioctl(bs, req, buf, bdrv_co_io_em_complete, &co);
2472     if (!acb) {
2473         co.ret = -ENOTSUP;
2474         goto out;
2475     }
2476     qemu_coroutine_yield();
2477 out:
2478     tracked_request_end(&tracked_req);
2479     return co.ret;
2480 }
2481 
2482 typedef struct {
2483     BlockDriverState *bs;
2484     int req;
2485     void *buf;
2486     int ret;
2487 } BdrvIoctlCoData;
2488 
2489 static void coroutine_fn bdrv_co_ioctl_entry(void *opaque)
2490 {
2491     BdrvIoctlCoData *data = opaque;
2492     data->ret = bdrv_co_do_ioctl(data->bs, data->req, data->buf);
2493 }
2494 
2495 /* needed for generic scsi interface */
2496 int bdrv_ioctl(BlockDriverState *bs, unsigned long int req, void *buf)
2497 {
2498     BdrvIoctlCoData data = {
2499         .bs = bs,
2500         .req = req,
2501         .buf = buf,
2502         .ret = -EINPROGRESS,
2503     };
2504 
2505     if (qemu_in_coroutine()) {
2506         /* Fast-path if already in coroutine context */
2507         bdrv_co_ioctl_entry(&data);
2508     } else {
2509         Coroutine *co = qemu_coroutine_create(bdrv_co_ioctl_entry, &data);
2510 
2511         qemu_coroutine_enter(co);
2512         while (data.ret == -EINPROGRESS) {
2513             aio_poll(bdrv_get_aio_context(bs), true);
2514         }
2515     }
2516     return data.ret;
2517 }
2518 
2519 static void coroutine_fn bdrv_co_aio_ioctl_entry(void *opaque)
2520 {
2521     BlockAIOCBCoroutine *acb = opaque;
2522     acb->req.error = bdrv_co_do_ioctl(acb->common.bs,
2523                                       acb->req.req, acb->req.buf);
2524     bdrv_co_complete(acb);
2525 }
2526 
2527 BlockAIOCB *bdrv_aio_ioctl(BlockDriverState *bs,
2528         unsigned long int req, void *buf,
2529         BlockCompletionFunc *cb, void *opaque)
2530 {
2531     BlockAIOCBCoroutine *acb = qemu_aio_get(&bdrv_em_co_aiocb_info,
2532                                             bs, cb, opaque);
2533     Coroutine *co;
2534 
2535     acb->need_bh = true;
2536     acb->req.error = -EINPROGRESS;
2537     acb->req.req = req;
2538     acb->req.buf = buf;
2539     co = qemu_coroutine_create(bdrv_co_aio_ioctl_entry, acb);
2540     qemu_coroutine_enter(co);
2541 
2542     bdrv_co_maybe_schedule_bh(acb);
2543     return &acb->common;
2544 }
2545 
2546 void *qemu_blockalign(BlockDriverState *bs, size_t size)
2547 {
2548     return qemu_memalign(bdrv_opt_mem_align(bs), size);
2549 }
2550 
2551 void *qemu_blockalign0(BlockDriverState *bs, size_t size)
2552 {
2553     return memset(qemu_blockalign(bs, size), 0, size);
2554 }
2555 
2556 void *qemu_try_blockalign(BlockDriverState *bs, size_t size)
2557 {
2558     size_t align = bdrv_opt_mem_align(bs);
2559 
2560     /* Ensure that NULL is never returned on success */
2561     assert(align > 0);
2562     if (size == 0) {
2563         size = align;
2564     }
2565 
2566     return qemu_try_memalign(align, size);
2567 }
2568 
2569 void *qemu_try_blockalign0(BlockDriverState *bs, size_t size)
2570 {
2571     void *mem = qemu_try_blockalign(bs, size);
2572 
2573     if (mem) {
2574         memset(mem, 0, size);
2575     }
2576 
2577     return mem;
2578 }
2579 
2580 /*
2581  * Check if all memory in this vector is sector aligned.
2582  */
2583 bool bdrv_qiov_is_aligned(BlockDriverState *bs, QEMUIOVector *qiov)
2584 {
2585     int i;
2586     size_t alignment = bdrv_min_mem_align(bs);
2587 
2588     for (i = 0; i < qiov->niov; i++) {
2589         if ((uintptr_t) qiov->iov[i].iov_base % alignment) {
2590             return false;
2591         }
2592         if (qiov->iov[i].iov_len % alignment) {
2593             return false;
2594         }
2595     }
2596 
2597     return true;
2598 }
2599 
2600 void bdrv_add_before_write_notifier(BlockDriverState *bs,
2601                                     NotifierWithReturn *notifier)
2602 {
2603     notifier_with_return_list_add(&bs->before_write_notifiers, notifier);
2604 }
2605 
2606 void bdrv_io_plug(BlockDriverState *bs)
2607 {
2608     BdrvChild *child;
2609 
2610     QLIST_FOREACH(child, &bs->children, next) {
2611         bdrv_io_plug(child->bs);
2612     }
2613 
2614     if (bs->io_plugged++ == 0 && bs->io_plug_disabled == 0) {
2615         BlockDriver *drv = bs->drv;
2616         if (drv && drv->bdrv_io_plug) {
2617             drv->bdrv_io_plug(bs);
2618         }
2619     }
2620 }
2621 
2622 void bdrv_io_unplug(BlockDriverState *bs)
2623 {
2624     BdrvChild *child;
2625 
2626     assert(bs->io_plugged);
2627     if (--bs->io_plugged == 0 && bs->io_plug_disabled == 0) {
2628         BlockDriver *drv = bs->drv;
2629         if (drv && drv->bdrv_io_unplug) {
2630             drv->bdrv_io_unplug(bs);
2631         }
2632     }
2633 
2634     QLIST_FOREACH(child, &bs->children, next) {
2635         bdrv_io_unplug(child->bs);
2636     }
2637 }
2638 
2639 void bdrv_io_unplugged_begin(BlockDriverState *bs)
2640 {
2641     BdrvChild *child;
2642 
2643     if (bs->io_plug_disabled++ == 0 && bs->io_plugged > 0) {
2644         BlockDriver *drv = bs->drv;
2645         if (drv && drv->bdrv_io_unplug) {
2646             drv->bdrv_io_unplug(bs);
2647         }
2648     }
2649 
2650     QLIST_FOREACH(child, &bs->children, next) {
2651         bdrv_io_unplugged_begin(child->bs);
2652     }
2653 }
2654 
2655 void bdrv_io_unplugged_end(BlockDriverState *bs)
2656 {
2657     BdrvChild *child;
2658 
2659     assert(bs->io_plug_disabled);
2660     QLIST_FOREACH(child, &bs->children, next) {
2661         bdrv_io_unplugged_end(child->bs);
2662     }
2663 
2664     if (--bs->io_plug_disabled == 0 && bs->io_plugged > 0) {
2665         BlockDriver *drv = bs->drv;
2666         if (drv && drv->bdrv_io_plug) {
2667             drv->bdrv_io_plug(bs);
2668         }
2669     }
2670 }
2671