xref: /openbmc/qemu/block.c (revision 277f2007)
1 /*
2  * QEMU System Emulator block driver
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  * Copyright (c) 2020 Virtuozzo International GmbH.
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "block/trace.h"
28 #include "block/block_int.h"
29 #include "block/blockjob.h"
30 #include "block/dirty-bitmap.h"
31 #include "block/fuse.h"
32 #include "block/nbd.h"
33 #include "block/qdict.h"
34 #include "qemu/error-report.h"
35 #include "block/module_block.h"
36 #include "qemu/main-loop.h"
37 #include "qemu/module.h"
38 #include "qapi/error.h"
39 #include "qapi/qmp/qdict.h"
40 #include "qapi/qmp/qjson.h"
41 #include "qapi/qmp/qnull.h"
42 #include "qapi/qmp/qstring.h"
43 #include "qapi/qobject-output-visitor.h"
44 #include "qapi/qapi-visit-block-core.h"
45 #include "sysemu/block-backend.h"
46 #include "qemu/notify.h"
47 #include "qemu/option.h"
48 #include "qemu/coroutine.h"
49 #include "block/qapi.h"
50 #include "qemu/timer.h"
51 #include "qemu/cutils.h"
52 #include "qemu/id.h"
53 #include "qemu/range.h"
54 #include "qemu/rcu.h"
55 #include "block/coroutines.h"
56 
57 #ifdef CONFIG_BSD
58 #include <sys/ioctl.h>
59 #include <sys/queue.h>
60 #if defined(HAVE_SYS_DISK_H)
61 #include <sys/disk.h>
62 #endif
63 #endif
64 
65 #ifdef _WIN32
66 #include <windows.h>
67 #endif
68 
69 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
70 
71 /* Protected by BQL */
72 static QTAILQ_HEAD(, BlockDriverState) graph_bdrv_states =
73     QTAILQ_HEAD_INITIALIZER(graph_bdrv_states);
74 
75 /* Protected by BQL */
76 static QTAILQ_HEAD(, BlockDriverState) all_bdrv_states =
77     QTAILQ_HEAD_INITIALIZER(all_bdrv_states);
78 
79 /* Protected by BQL */
80 static QLIST_HEAD(, BlockDriver) bdrv_drivers =
81     QLIST_HEAD_INITIALIZER(bdrv_drivers);
82 
83 static BlockDriverState *bdrv_open_inherit(const char *filename,
84                                            const char *reference,
85                                            QDict *options, int flags,
86                                            BlockDriverState *parent,
87                                            const BdrvChildClass *child_class,
88                                            BdrvChildRole child_role,
89                                            Error **errp);
90 
91 static bool bdrv_recurse_has_child(BlockDriverState *bs,
92                                    BlockDriverState *child);
93 
94 static void GRAPH_WRLOCK
95 bdrv_replace_child_noperm(BdrvChild *child, BlockDriverState *new_bs);
96 
97 static void GRAPH_WRLOCK
98 bdrv_remove_child(BdrvChild *child, Transaction *tran);
99 
100 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
101                                BlockReopenQueue *queue,
102                                Transaction *change_child_tran, Error **errp);
103 static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
104 static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
105 
106 static bool bdrv_backing_overridden(BlockDriverState *bs);
107 
108 static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
109                                     GHashTable *visited, Transaction *tran,
110                                     Error **errp);
111 
112 /* If non-zero, use only whitelisted block drivers */
113 static int use_bdrv_whitelist;
114 
115 #ifdef _WIN32
116 static int is_windows_drive_prefix(const char *filename)
117 {
118     return (((filename[0] >= 'a' && filename[0] <= 'z') ||
119              (filename[0] >= 'A' && filename[0] <= 'Z')) &&
120             filename[1] == ':');
121 }
122 
123 int is_windows_drive(const char *filename)
124 {
125     if (is_windows_drive_prefix(filename) &&
126         filename[2] == '\0')
127         return 1;
128     if (strstart(filename, "\\\\.\\", NULL) ||
129         strstart(filename, "//./", NULL))
130         return 1;
131     return 0;
132 }
133 #endif
134 
135 size_t bdrv_opt_mem_align(BlockDriverState *bs)
136 {
137     if (!bs || !bs->drv) {
138         /* page size or 4k (hdd sector size) should be on the safe side */
139         return MAX(4096, qemu_real_host_page_size());
140     }
141     IO_CODE();
142 
143     return bs->bl.opt_mem_alignment;
144 }
145 
146 size_t bdrv_min_mem_align(BlockDriverState *bs)
147 {
148     if (!bs || !bs->drv) {
149         /* page size or 4k (hdd sector size) should be on the safe side */
150         return MAX(4096, qemu_real_host_page_size());
151     }
152     IO_CODE();
153 
154     return bs->bl.min_mem_alignment;
155 }
156 
157 /* check if the path starts with "<protocol>:" */
158 int path_has_protocol(const char *path)
159 {
160     const char *p;
161 
162 #ifdef _WIN32
163     if (is_windows_drive(path) ||
164         is_windows_drive_prefix(path)) {
165         return 0;
166     }
167     p = path + strcspn(path, ":/\\");
168 #else
169     p = path + strcspn(path, ":/");
170 #endif
171 
172     return *p == ':';
173 }
174 
175 int path_is_absolute(const char *path)
176 {
177 #ifdef _WIN32
178     /* specific case for names like: "\\.\d:" */
179     if (is_windows_drive(path) || is_windows_drive_prefix(path)) {
180         return 1;
181     }
182     return (*path == '/' || *path == '\\');
183 #else
184     return (*path == '/');
185 #endif
186 }
187 
188 /* if filename is absolute, just return its duplicate. Otherwise, build a
189    path to it by considering it is relative to base_path. URL are
190    supported. */
191 char *path_combine(const char *base_path, const char *filename)
192 {
193     const char *protocol_stripped = NULL;
194     const char *p, *p1;
195     char *result;
196     int len;
197 
198     if (path_is_absolute(filename)) {
199         return g_strdup(filename);
200     }
201 
202     if (path_has_protocol(base_path)) {
203         protocol_stripped = strchr(base_path, ':');
204         if (protocol_stripped) {
205             protocol_stripped++;
206         }
207     }
208     p = protocol_stripped ?: base_path;
209 
210     p1 = strrchr(base_path, '/');
211 #ifdef _WIN32
212     {
213         const char *p2;
214         p2 = strrchr(base_path, '\\');
215         if (!p1 || p2 > p1) {
216             p1 = p2;
217         }
218     }
219 #endif
220     if (p1) {
221         p1++;
222     } else {
223         p1 = base_path;
224     }
225     if (p1 > p) {
226         p = p1;
227     }
228     len = p - base_path;
229 
230     result = g_malloc(len + strlen(filename) + 1);
231     memcpy(result, base_path, len);
232     strcpy(result + len, filename);
233 
234     return result;
235 }
236 
237 /*
238  * Helper function for bdrv_parse_filename() implementations to remove optional
239  * protocol prefixes (especially "file:") from a filename and for putting the
240  * stripped filename into the options QDict if there is such a prefix.
241  */
242 void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
243                                       QDict *options)
244 {
245     if (strstart(filename, prefix, &filename)) {
246         /* Stripping the explicit protocol prefix may result in a protocol
247          * prefix being (wrongly) detected (if the filename contains a colon) */
248         if (path_has_protocol(filename)) {
249             GString *fat_filename;
250 
251             /* This means there is some colon before the first slash; therefore,
252              * this cannot be an absolute path */
253             assert(!path_is_absolute(filename));
254 
255             /* And we can thus fix the protocol detection issue by prefixing it
256              * by "./" */
257             fat_filename = g_string_new("./");
258             g_string_append(fat_filename, filename);
259 
260             assert(!path_has_protocol(fat_filename->str));
261 
262             qdict_put(options, "filename",
263                       qstring_from_gstring(fat_filename));
264         } else {
265             /* If no protocol prefix was detected, we can use the shortened
266              * filename as-is */
267             qdict_put_str(options, "filename", filename);
268         }
269     }
270 }
271 
272 
273 /* Returns whether the image file is opened as read-only. Note that this can
274  * return false and writing to the image file is still not possible because the
275  * image is inactivated. */
276 bool bdrv_is_read_only(BlockDriverState *bs)
277 {
278     IO_CODE();
279     return !(bs->open_flags & BDRV_O_RDWR);
280 }
281 
282 static int GRAPH_RDLOCK
283 bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
284                        bool ignore_allow_rdw, Error **errp)
285 {
286     IO_CODE();
287 
288     /* Do not set read_only if copy_on_read is enabled */
289     if (bs->copy_on_read && read_only) {
290         error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
291                    bdrv_get_device_or_node_name(bs));
292         return -EINVAL;
293     }
294 
295     /* Do not clear read_only if it is prohibited */
296     if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
297         !ignore_allow_rdw)
298     {
299         error_setg(errp, "Node '%s' is read only",
300                    bdrv_get_device_or_node_name(bs));
301         return -EPERM;
302     }
303 
304     return 0;
305 }
306 
307 /*
308  * Called by a driver that can only provide a read-only image.
309  *
310  * Returns 0 if the node is already read-only or it could switch the node to
311  * read-only because BDRV_O_AUTO_RDONLY is set.
312  *
313  * Returns -EACCES if the node is read-write and BDRV_O_AUTO_RDONLY is not set
314  * or bdrv_can_set_read_only() forbids making the node read-only. If @errmsg
315  * is not NULL, it is used as the error message for the Error object.
316  */
317 int bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
318                               Error **errp)
319 {
320     int ret = 0;
321     IO_CODE();
322 
323     assume_graph_lock(); /* FIXME */
324 
325     if (!(bs->open_flags & BDRV_O_RDWR)) {
326         return 0;
327     }
328     if (!(bs->open_flags & BDRV_O_AUTO_RDONLY)) {
329         goto fail;
330     }
331 
332     ret = bdrv_can_set_read_only(bs, true, false, NULL);
333     if (ret < 0) {
334         goto fail;
335     }
336 
337     bs->open_flags &= ~BDRV_O_RDWR;
338 
339     return 0;
340 
341 fail:
342     error_setg(errp, "%s", errmsg ?: "Image is read-only");
343     return -EACCES;
344 }
345 
346 /*
347  * If @backing is empty, this function returns NULL without setting
348  * @errp.  In all other cases, NULL will only be returned with @errp
349  * set.
350  *
351  * Therefore, a return value of NULL without @errp set means that
352  * there is no backing file; if @errp is set, there is one but its
353  * absolute filename cannot be generated.
354  */
355 char *bdrv_get_full_backing_filename_from_filename(const char *backed,
356                                                    const char *backing,
357                                                    Error **errp)
358 {
359     if (backing[0] == '\0') {
360         return NULL;
361     } else if (path_has_protocol(backing) || path_is_absolute(backing)) {
362         return g_strdup(backing);
363     } else if (backed[0] == '\0' || strstart(backed, "json:", NULL)) {
364         error_setg(errp, "Cannot use relative backing file names for '%s'",
365                    backed);
366         return NULL;
367     } else {
368         return path_combine(backed, backing);
369     }
370 }
371 
372 /*
373  * If @filename is empty or NULL, this function returns NULL without
374  * setting @errp.  In all other cases, NULL will only be returned with
375  * @errp set.
376  */
377 static char * GRAPH_RDLOCK
378 bdrv_make_absolute_filename(BlockDriverState *relative_to,
379                             const char *filename, Error **errp)
380 {
381     char *dir, *full_name;
382 
383     if (!filename || filename[0] == '\0') {
384         return NULL;
385     } else if (path_has_protocol(filename) || path_is_absolute(filename)) {
386         return g_strdup(filename);
387     }
388 
389     dir = bdrv_dirname(relative_to, errp);
390     if (!dir) {
391         return NULL;
392     }
393 
394     full_name = g_strconcat(dir, filename, NULL);
395     g_free(dir);
396     return full_name;
397 }
398 
399 char *bdrv_get_full_backing_filename(BlockDriverState *bs, Error **errp)
400 {
401     GLOBAL_STATE_CODE();
402     return bdrv_make_absolute_filename(bs, bs->backing_file, errp);
403 }
404 
405 void bdrv_register(BlockDriver *bdrv)
406 {
407     assert(bdrv->format_name);
408     GLOBAL_STATE_CODE();
409     QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
410 }
411 
412 BlockDriverState *bdrv_new(void)
413 {
414     BlockDriverState *bs;
415     int i;
416 
417     GLOBAL_STATE_CODE();
418 
419     bs = g_new0(BlockDriverState, 1);
420     QLIST_INIT(&bs->dirty_bitmaps);
421     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
422         QLIST_INIT(&bs->op_blockers[i]);
423     }
424     qemu_mutex_init(&bs->reqs_lock);
425     qemu_mutex_init(&bs->dirty_bitmap_mutex);
426     bs->refcnt = 1;
427     bs->aio_context = qemu_get_aio_context();
428 
429     qemu_co_queue_init(&bs->flush_queue);
430 
431     qemu_co_mutex_init(&bs->bsc_modify_lock);
432     bs->block_status_cache = g_new0(BdrvBlockStatusCache, 1);
433 
434     for (i = 0; i < bdrv_drain_all_count; i++) {
435         bdrv_drained_begin(bs);
436     }
437 
438     QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);
439 
440     return bs;
441 }
442 
443 static BlockDriver *bdrv_do_find_format(const char *format_name)
444 {
445     BlockDriver *drv1;
446     GLOBAL_STATE_CODE();
447 
448     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
449         if (!strcmp(drv1->format_name, format_name)) {
450             return drv1;
451         }
452     }
453 
454     return NULL;
455 }
456 
457 BlockDriver *bdrv_find_format(const char *format_name)
458 {
459     BlockDriver *drv1;
460     int i;
461 
462     GLOBAL_STATE_CODE();
463 
464     drv1 = bdrv_do_find_format(format_name);
465     if (drv1) {
466         return drv1;
467     }
468 
469     /* The driver isn't registered, maybe we need to load a module */
470     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
471         if (!strcmp(block_driver_modules[i].format_name, format_name)) {
472             Error *local_err = NULL;
473             int rv = block_module_load(block_driver_modules[i].library_name,
474                                        &local_err);
475             if (rv > 0) {
476                 return bdrv_do_find_format(format_name);
477             } else if (rv < 0) {
478                 error_report_err(local_err);
479             }
480             break;
481         }
482     }
483     return NULL;
484 }
485 
486 static int bdrv_format_is_whitelisted(const char *format_name, bool read_only)
487 {
488     static const char *whitelist_rw[] = {
489         CONFIG_BDRV_RW_WHITELIST
490         NULL
491     };
492     static const char *whitelist_ro[] = {
493         CONFIG_BDRV_RO_WHITELIST
494         NULL
495     };
496     const char **p;
497 
498     if (!whitelist_rw[0] && !whitelist_ro[0]) {
499         return 1;               /* no whitelist, anything goes */
500     }
501 
502     for (p = whitelist_rw; *p; p++) {
503         if (!strcmp(format_name, *p)) {
504             return 1;
505         }
506     }
507     if (read_only) {
508         for (p = whitelist_ro; *p; p++) {
509             if (!strcmp(format_name, *p)) {
510                 return 1;
511             }
512         }
513     }
514     return 0;
515 }
516 
517 int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
518 {
519     GLOBAL_STATE_CODE();
520     return bdrv_format_is_whitelisted(drv->format_name, read_only);
521 }
522 
523 bool bdrv_uses_whitelist(void)
524 {
525     return use_bdrv_whitelist;
526 }
527 
528 typedef struct CreateCo {
529     BlockDriver *drv;
530     char *filename;
531     QemuOpts *opts;
532     int ret;
533     Error *err;
534 } CreateCo;
535 
536 int coroutine_fn bdrv_co_create(BlockDriver *drv, const char *filename,
537                                 QemuOpts *opts, Error **errp)
538 {
539     int ret;
540     GLOBAL_STATE_CODE();
541     ERRP_GUARD();
542 
543     if (!drv->bdrv_co_create_opts) {
544         error_setg(errp, "Driver '%s' does not support image creation",
545                    drv->format_name);
546         return -ENOTSUP;
547     }
548 
549     ret = drv->bdrv_co_create_opts(drv, filename, opts, errp);
550     if (ret < 0 && !*errp) {
551         error_setg_errno(errp, -ret, "Could not create image");
552     }
553 
554     return ret;
555 }
556 
557 /**
558  * Helper function for bdrv_create_file_fallback(): Resize @blk to at
559  * least the given @minimum_size.
560  *
561  * On success, return @blk's actual length.
562  * Otherwise, return -errno.
563  */
564 static int64_t coroutine_fn GRAPH_UNLOCKED
565 create_file_fallback_truncate(BlockBackend *blk, int64_t minimum_size,
566                               Error **errp)
567 {
568     Error *local_err = NULL;
569     int64_t size;
570     int ret;
571 
572     GLOBAL_STATE_CODE();
573 
574     ret = blk_co_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
575                           &local_err);
576     if (ret < 0 && ret != -ENOTSUP) {
577         error_propagate(errp, local_err);
578         return ret;
579     }
580 
581     size = blk_co_getlength(blk);
582     if (size < 0) {
583         error_free(local_err);
584         error_setg_errno(errp, -size,
585                          "Failed to inquire the new image file's length");
586         return size;
587     }
588 
589     if (size < minimum_size) {
590         /* Need to grow the image, but we failed to do that */
591         error_propagate(errp, local_err);
592         return -ENOTSUP;
593     }
594 
595     error_free(local_err);
596     local_err = NULL;
597 
598     return size;
599 }
600 
601 /**
602  * Helper function for bdrv_create_file_fallback(): Zero the first
603  * sector to remove any potentially pre-existing image header.
604  */
605 static int coroutine_fn
606 create_file_fallback_zero_first_sector(BlockBackend *blk,
607                                        int64_t current_size,
608                                        Error **errp)
609 {
610     int64_t bytes_to_clear;
611     int ret;
612 
613     GLOBAL_STATE_CODE();
614 
615     bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
616     if (bytes_to_clear) {
617         ret = blk_co_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
618         if (ret < 0) {
619             error_setg_errno(errp, -ret,
620                              "Failed to clear the new image's first sector");
621             return ret;
622         }
623     }
624 
625     return 0;
626 }
627 
628 /**
629  * Simple implementation of bdrv_co_create_opts for protocol drivers
630  * which only support creation via opening a file
631  * (usually existing raw storage device)
632  */
633 int coroutine_fn bdrv_co_create_opts_simple(BlockDriver *drv,
634                                             const char *filename,
635                                             QemuOpts *opts,
636                                             Error **errp)
637 {
638     BlockBackend *blk;
639     QDict *options;
640     int64_t size = 0;
641     char *buf = NULL;
642     PreallocMode prealloc;
643     Error *local_err = NULL;
644     int ret;
645 
646     GLOBAL_STATE_CODE();
647 
648     size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
649     buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
650     prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
651                                PREALLOC_MODE_OFF, &local_err);
652     g_free(buf);
653     if (local_err) {
654         error_propagate(errp, local_err);
655         return -EINVAL;
656     }
657 
658     if (prealloc != PREALLOC_MODE_OFF) {
659         error_setg(errp, "Unsupported preallocation mode '%s'",
660                    PreallocMode_str(prealloc));
661         return -ENOTSUP;
662     }
663 
664     options = qdict_new();
665     qdict_put_str(options, "driver", drv->format_name);
666 
667     blk = blk_co_new_open(filename, NULL, options,
668                           BDRV_O_RDWR | BDRV_O_RESIZE, errp);
669     if (!blk) {
670         error_prepend(errp, "Protocol driver '%s' does not support creating "
671                       "new images, so an existing image must be selected as "
672                       "the target; however, opening the given target as an "
673                       "existing image failed: ",
674                       drv->format_name);
675         return -EINVAL;
676     }
677 
678     size = create_file_fallback_truncate(blk, size, errp);
679     if (size < 0) {
680         ret = size;
681         goto out;
682     }
683 
684     ret = create_file_fallback_zero_first_sector(blk, size, errp);
685     if (ret < 0) {
686         goto out;
687     }
688 
689     ret = 0;
690 out:
691     blk_co_unref(blk);
692     return ret;
693 }
694 
695 int coroutine_fn bdrv_co_create_file(const char *filename, QemuOpts *opts,
696                                      Error **errp)
697 {
698     QemuOpts *protocol_opts;
699     BlockDriver *drv;
700     QDict *qdict;
701     int ret;
702 
703     GLOBAL_STATE_CODE();
704 
705     drv = bdrv_find_protocol(filename, true, errp);
706     if (drv == NULL) {
707         return -ENOENT;
708     }
709 
710     if (!drv->create_opts) {
711         error_setg(errp, "Driver '%s' does not support image creation",
712                    drv->format_name);
713         return -ENOTSUP;
714     }
715 
716     /*
717      * 'opts' contains a QemuOptsList with a combination of format and protocol
718      * default values.
719      *
720      * The format properly removes its options, but the default values remain
721      * in 'opts->list'.  So if the protocol has options with the same name
722      * (e.g. rbd has 'cluster_size' as qcow2), it will see the default values
723      * of the format, since for overlapping options, the format wins.
724      *
725      * To avoid this issue, lets convert QemuOpts to QDict, in this way we take
726      * only the set options, and then convert it back to QemuOpts, using the
727      * create_opts of the protocol. So the new QemuOpts, will contain only the
728      * protocol defaults.
729      */
730     qdict = qemu_opts_to_qdict(opts, NULL);
731     protocol_opts = qemu_opts_from_qdict(drv->create_opts, qdict, errp);
732     if (protocol_opts == NULL) {
733         ret = -EINVAL;
734         goto out;
735     }
736 
737     ret = bdrv_co_create(drv, filename, protocol_opts, errp);
738 out:
739     qemu_opts_del(protocol_opts);
740     qobject_unref(qdict);
741     return ret;
742 }
743 
744 int coroutine_fn bdrv_co_delete_file(BlockDriverState *bs, Error **errp)
745 {
746     Error *local_err = NULL;
747     int ret;
748 
749     IO_CODE();
750     assert(bs != NULL);
751     assert_bdrv_graph_readable();
752 
753     if (!bs->drv) {
754         error_setg(errp, "Block node '%s' is not opened", bs->filename);
755         return -ENOMEDIUM;
756     }
757 
758     if (!bs->drv->bdrv_co_delete_file) {
759         error_setg(errp, "Driver '%s' does not support image deletion",
760                    bs->drv->format_name);
761         return -ENOTSUP;
762     }
763 
764     ret = bs->drv->bdrv_co_delete_file(bs, &local_err);
765     if (ret < 0) {
766         error_propagate(errp, local_err);
767     }
768 
769     return ret;
770 }
771 
772 void coroutine_fn bdrv_co_delete_file_noerr(BlockDriverState *bs)
773 {
774     Error *local_err = NULL;
775     int ret;
776     IO_CODE();
777 
778     if (!bs) {
779         return;
780     }
781 
782     ret = bdrv_co_delete_file(bs, &local_err);
783     /*
784      * ENOTSUP will happen if the block driver doesn't support
785      * the 'bdrv_co_delete_file' interface. This is a predictable
786      * scenario and shouldn't be reported back to the user.
787      */
788     if (ret == -ENOTSUP) {
789         error_free(local_err);
790     } else if (ret < 0) {
791         error_report_err(local_err);
792     }
793 }
794 
795 /**
796  * Try to get @bs's logical and physical block size.
797  * On success, store them in @bsz struct and return 0.
798  * On failure return -errno.
799  * @bs must not be empty.
800  */
801 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
802 {
803     BlockDriver *drv = bs->drv;
804     BlockDriverState *filtered = bdrv_filter_bs(bs);
805     GLOBAL_STATE_CODE();
806 
807     if (drv && drv->bdrv_probe_blocksizes) {
808         return drv->bdrv_probe_blocksizes(bs, bsz);
809     } else if (filtered) {
810         return bdrv_probe_blocksizes(filtered, bsz);
811     }
812 
813     return -ENOTSUP;
814 }
815 
816 /**
817  * Try to get @bs's geometry (cyls, heads, sectors).
818  * On success, store them in @geo struct and return 0.
819  * On failure return -errno.
820  * @bs must not be empty.
821  */
822 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
823 {
824     BlockDriver *drv = bs->drv;
825     BlockDriverState *filtered = bdrv_filter_bs(bs);
826     GLOBAL_STATE_CODE();
827 
828     if (drv && drv->bdrv_probe_geometry) {
829         return drv->bdrv_probe_geometry(bs, geo);
830     } else if (filtered) {
831         return bdrv_probe_geometry(filtered, geo);
832     }
833 
834     return -ENOTSUP;
835 }
836 
837 /*
838  * Create a uniquely-named empty temporary file.
839  * Return the actual file name used upon success, otherwise NULL.
840  * This string should be freed with g_free() when not needed any longer.
841  *
842  * Note: creating a temporary file for the caller to (re)open is
843  * inherently racy. Use g_file_open_tmp() instead whenever practical.
844  */
845 char *create_tmp_file(Error **errp)
846 {
847     int fd;
848     const char *tmpdir;
849     g_autofree char *filename = NULL;
850 
851     tmpdir = g_get_tmp_dir();
852 #ifndef _WIN32
853     /*
854      * See commit 69bef79 ("block: use /var/tmp instead of /tmp for -snapshot")
855      *
856      * This function is used to create temporary disk images (like -snapshot),
857      * so the files can become very large. /tmp is often a tmpfs where as
858      * /var/tmp is usually on a disk, so more appropriate for disk images.
859      */
860     if (!g_strcmp0(tmpdir, "/tmp")) {
861         tmpdir = "/var/tmp";
862     }
863 #endif
864 
865     filename = g_strdup_printf("%s/vl.XXXXXX", tmpdir);
866     fd = g_mkstemp(filename);
867     if (fd < 0) {
868         error_setg_errno(errp, errno, "Could not open temporary file '%s'",
869                          filename);
870         return NULL;
871     }
872     close(fd);
873 
874     return g_steal_pointer(&filename);
875 }
876 
877 /*
878  * Detect host devices. By convention, /dev/cdrom[N] is always
879  * recognized as a host CDROM.
880  */
881 static BlockDriver *find_hdev_driver(const char *filename)
882 {
883     int score_max = 0, score;
884     BlockDriver *drv = NULL, *d;
885     GLOBAL_STATE_CODE();
886 
887     QLIST_FOREACH(d, &bdrv_drivers, list) {
888         if (d->bdrv_probe_device) {
889             score = d->bdrv_probe_device(filename);
890             if (score > score_max) {
891                 score_max = score;
892                 drv = d;
893             }
894         }
895     }
896 
897     return drv;
898 }
899 
900 static BlockDriver *bdrv_do_find_protocol(const char *protocol)
901 {
902     BlockDriver *drv1;
903     GLOBAL_STATE_CODE();
904 
905     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
906         if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
907             return drv1;
908         }
909     }
910 
911     return NULL;
912 }
913 
914 BlockDriver *bdrv_find_protocol(const char *filename,
915                                 bool allow_protocol_prefix,
916                                 Error **errp)
917 {
918     BlockDriver *drv1;
919     char protocol[128];
920     int len;
921     const char *p;
922     int i;
923 
924     GLOBAL_STATE_CODE();
925     /* TODO Drivers without bdrv_file_open must be specified explicitly */
926 
927     /*
928      * XXX(hch): we really should not let host device detection
929      * override an explicit protocol specification, but moving this
930      * later breaks access to device names with colons in them.
931      * Thanks to the brain-dead persistent naming schemes on udev-
932      * based Linux systems those actually are quite common.
933      */
934     drv1 = find_hdev_driver(filename);
935     if (drv1) {
936         return drv1;
937     }
938 
939     if (!path_has_protocol(filename) || !allow_protocol_prefix) {
940         return &bdrv_file;
941     }
942 
943     p = strchr(filename, ':');
944     assert(p != NULL);
945     len = p - filename;
946     if (len > sizeof(protocol) - 1)
947         len = sizeof(protocol) - 1;
948     memcpy(protocol, filename, len);
949     protocol[len] = '\0';
950 
951     drv1 = bdrv_do_find_protocol(protocol);
952     if (drv1) {
953         return drv1;
954     }
955 
956     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
957         if (block_driver_modules[i].protocol_name &&
958             !strcmp(block_driver_modules[i].protocol_name, protocol)) {
959             int rv = block_module_load(block_driver_modules[i].library_name, errp);
960             if (rv > 0) {
961                 drv1 = bdrv_do_find_protocol(protocol);
962             } else if (rv < 0) {
963                 return NULL;
964             }
965             break;
966         }
967     }
968 
969     if (!drv1) {
970         error_setg(errp, "Unknown protocol '%s'", protocol);
971     }
972     return drv1;
973 }
974 
975 /*
976  * Guess image format by probing its contents.
977  * This is not a good idea when your image is raw (CVE-2008-2004), but
978  * we do it anyway for backward compatibility.
979  *
980  * @buf         contains the image's first @buf_size bytes.
981  * @buf_size    is the buffer size in bytes (generally BLOCK_PROBE_BUF_SIZE,
982  *              but can be smaller if the image file is smaller)
983  * @filename    is its filename.
984  *
985  * For all block drivers, call the bdrv_probe() method to get its
986  * probing score.
987  * Return the first block driver with the highest probing score.
988  */
989 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
990                             const char *filename)
991 {
992     int score_max = 0, score;
993     BlockDriver *drv = NULL, *d;
994     IO_CODE();
995 
996     QLIST_FOREACH(d, &bdrv_drivers, list) {
997         if (d->bdrv_probe) {
998             score = d->bdrv_probe(buf, buf_size, filename);
999             if (score > score_max) {
1000                 score_max = score;
1001                 drv = d;
1002             }
1003         }
1004     }
1005 
1006     return drv;
1007 }
1008 
1009 static int find_image_format(BlockBackend *file, const char *filename,
1010                              BlockDriver **pdrv, Error **errp)
1011 {
1012     BlockDriver *drv;
1013     uint8_t buf[BLOCK_PROBE_BUF_SIZE];
1014     int ret = 0;
1015 
1016     GLOBAL_STATE_CODE();
1017 
1018     /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
1019     if (blk_is_sg(file) || !blk_is_inserted(file) || blk_getlength(file) == 0) {
1020         *pdrv = &bdrv_raw;
1021         return ret;
1022     }
1023 
1024     ret = blk_pread(file, 0, sizeof(buf), buf, 0);
1025     if (ret < 0) {
1026         error_setg_errno(errp, -ret, "Could not read image for determining its "
1027                          "format");
1028         *pdrv = NULL;
1029         return ret;
1030     }
1031 
1032     drv = bdrv_probe_all(buf, sizeof(buf), filename);
1033     if (!drv) {
1034         error_setg(errp, "Could not determine image format: No compatible "
1035                    "driver found");
1036         *pdrv = NULL;
1037         return -ENOENT;
1038     }
1039 
1040     *pdrv = drv;
1041     return 0;
1042 }
1043 
1044 /**
1045  * Set the current 'total_sectors' value
1046  * Return 0 on success, -errno on error.
1047  */
1048 int coroutine_fn bdrv_co_refresh_total_sectors(BlockDriverState *bs,
1049                                                int64_t hint)
1050 {
1051     BlockDriver *drv = bs->drv;
1052     IO_CODE();
1053     assert_bdrv_graph_readable();
1054 
1055     if (!drv) {
1056         return -ENOMEDIUM;
1057     }
1058 
1059     /* Do not attempt drv->bdrv_co_getlength() on scsi-generic devices */
1060     if (bdrv_is_sg(bs))
1061         return 0;
1062 
1063     /* query actual device if possible, otherwise just trust the hint */
1064     if (drv->bdrv_co_getlength) {
1065         int64_t length = drv->bdrv_co_getlength(bs);
1066         if (length < 0) {
1067             return length;
1068         }
1069         hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
1070     }
1071 
1072     bs->total_sectors = hint;
1073 
1074     if (bs->total_sectors * BDRV_SECTOR_SIZE > BDRV_MAX_LENGTH) {
1075         return -EFBIG;
1076     }
1077 
1078     return 0;
1079 }
1080 
1081 /**
1082  * Combines a QDict of new block driver @options with any missing options taken
1083  * from @old_options, so that leaving out an option defaults to its old value.
1084  */
1085 static void bdrv_join_options(BlockDriverState *bs, QDict *options,
1086                               QDict *old_options)
1087 {
1088     GLOBAL_STATE_CODE();
1089     if (bs->drv && bs->drv->bdrv_join_options) {
1090         bs->drv->bdrv_join_options(options, old_options);
1091     } else {
1092         qdict_join(options, old_options, false);
1093     }
1094 }
1095 
1096 static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
1097                                                             int open_flags,
1098                                                             Error **errp)
1099 {
1100     Error *local_err = NULL;
1101     char *value = qemu_opt_get_del(opts, "detect-zeroes");
1102     BlockdevDetectZeroesOptions detect_zeroes =
1103         qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
1104                         BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
1105     GLOBAL_STATE_CODE();
1106     g_free(value);
1107     if (local_err) {
1108         error_propagate(errp, local_err);
1109         return detect_zeroes;
1110     }
1111 
1112     if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
1113         !(open_flags & BDRV_O_UNMAP))
1114     {
1115         error_setg(errp, "setting detect-zeroes to unmap is not allowed "
1116                    "without setting discard operation to unmap");
1117     }
1118 
1119     return detect_zeroes;
1120 }
1121 
1122 /**
1123  * Set open flags for aio engine
1124  *
1125  * Return 0 on success, -1 if the engine specified is invalid
1126  */
1127 int bdrv_parse_aio(const char *mode, int *flags)
1128 {
1129     if (!strcmp(mode, "threads")) {
1130         /* do nothing, default */
1131     } else if (!strcmp(mode, "native")) {
1132         *flags |= BDRV_O_NATIVE_AIO;
1133 #ifdef CONFIG_LINUX_IO_URING
1134     } else if (!strcmp(mode, "io_uring")) {
1135         *flags |= BDRV_O_IO_URING;
1136 #endif
1137     } else {
1138         return -1;
1139     }
1140 
1141     return 0;
1142 }
1143 
1144 /**
1145  * Set open flags for a given discard mode
1146  *
1147  * Return 0 on success, -1 if the discard mode was invalid.
1148  */
1149 int bdrv_parse_discard_flags(const char *mode, int *flags)
1150 {
1151     *flags &= ~BDRV_O_UNMAP;
1152 
1153     if (!strcmp(mode, "off") || !strcmp(mode, "ignore")) {
1154         /* do nothing */
1155     } else if (!strcmp(mode, "on") || !strcmp(mode, "unmap")) {
1156         *flags |= BDRV_O_UNMAP;
1157     } else {
1158         return -1;
1159     }
1160 
1161     return 0;
1162 }
1163 
1164 /**
1165  * Set open flags for a given cache mode
1166  *
1167  * Return 0 on success, -1 if the cache mode was invalid.
1168  */
1169 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough)
1170 {
1171     *flags &= ~BDRV_O_CACHE_MASK;
1172 
1173     if (!strcmp(mode, "off") || !strcmp(mode, "none")) {
1174         *writethrough = false;
1175         *flags |= BDRV_O_NOCACHE;
1176     } else if (!strcmp(mode, "directsync")) {
1177         *writethrough = true;
1178         *flags |= BDRV_O_NOCACHE;
1179     } else if (!strcmp(mode, "writeback")) {
1180         *writethrough = false;
1181     } else if (!strcmp(mode, "unsafe")) {
1182         *writethrough = false;
1183         *flags |= BDRV_O_NO_FLUSH;
1184     } else if (!strcmp(mode, "writethrough")) {
1185         *writethrough = true;
1186     } else {
1187         return -1;
1188     }
1189 
1190     return 0;
1191 }
1192 
1193 static char *bdrv_child_get_parent_desc(BdrvChild *c)
1194 {
1195     BlockDriverState *parent = c->opaque;
1196     return g_strdup_printf("node '%s'", bdrv_get_node_name(parent));
1197 }
1198 
1199 static void GRAPH_RDLOCK bdrv_child_cb_drained_begin(BdrvChild *child)
1200 {
1201     BlockDriverState *bs = child->opaque;
1202     bdrv_do_drained_begin_quiesce(bs, NULL);
1203 }
1204 
1205 static bool GRAPH_RDLOCK bdrv_child_cb_drained_poll(BdrvChild *child)
1206 {
1207     BlockDriverState *bs = child->opaque;
1208     return bdrv_drain_poll(bs, NULL, false);
1209 }
1210 
1211 static void GRAPH_RDLOCK bdrv_child_cb_drained_end(BdrvChild *child)
1212 {
1213     BlockDriverState *bs = child->opaque;
1214     bdrv_drained_end(bs);
1215 }
1216 
1217 static int bdrv_child_cb_inactivate(BdrvChild *child)
1218 {
1219     BlockDriverState *bs = child->opaque;
1220     GLOBAL_STATE_CODE();
1221     assert(bs->open_flags & BDRV_O_INACTIVE);
1222     return 0;
1223 }
1224 
1225 static bool bdrv_child_cb_change_aio_ctx(BdrvChild *child, AioContext *ctx,
1226                                          GHashTable *visited, Transaction *tran,
1227                                          Error **errp)
1228 {
1229     BlockDriverState *bs = child->opaque;
1230     return bdrv_change_aio_context(bs, ctx, visited, tran, errp);
1231 }
1232 
1233 /*
1234  * Returns the options and flags that a temporary snapshot should get, based on
1235  * the originally requested flags (the originally requested image will have
1236  * flags like a backing file)
1237  */
1238 static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
1239                                        int parent_flags, QDict *parent_options)
1240 {
1241     GLOBAL_STATE_CODE();
1242     *child_flags = (parent_flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
1243 
1244     /* For temporary files, unconditional cache=unsafe is fine */
1245     qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
1246     qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
1247 
1248     /* Copy the read-only and discard options from the parent */
1249     qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1250     qdict_copy_default(child_options, parent_options, BDRV_OPT_DISCARD);
1251 
1252     /* aio=native doesn't work for cache.direct=off, so disable it for the
1253      * temporary snapshot */
1254     *child_flags &= ~BDRV_O_NATIVE_AIO;
1255 }
1256 
1257 static void GRAPH_WRLOCK bdrv_backing_attach(BdrvChild *c)
1258 {
1259     BlockDriverState *parent = c->opaque;
1260     BlockDriverState *backing_hd = c->bs;
1261 
1262     GLOBAL_STATE_CODE();
1263     assert(!parent->backing_blocker);
1264     error_setg(&parent->backing_blocker,
1265                "node is used as backing hd of '%s'",
1266                bdrv_get_device_or_node_name(parent));
1267 
1268     bdrv_refresh_filename(backing_hd);
1269 
1270     parent->open_flags &= ~BDRV_O_NO_BACKING;
1271 
1272     bdrv_op_block_all(backing_hd, parent->backing_blocker);
1273     /* Otherwise we won't be able to commit or stream */
1274     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
1275                     parent->backing_blocker);
1276     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
1277                     parent->backing_blocker);
1278     /*
1279      * We do backup in 3 ways:
1280      * 1. drive backup
1281      *    The target bs is new opened, and the source is top BDS
1282      * 2. blockdev backup
1283      *    Both the source and the target are top BDSes.
1284      * 3. internal backup(used for block replication)
1285      *    Both the source and the target are backing file
1286      *
1287      * In case 1 and 2, neither the source nor the target is the backing file.
1288      * In case 3, we will block the top BDS, so there is only one block job
1289      * for the top BDS and its backing chain.
1290      */
1291     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
1292                     parent->backing_blocker);
1293     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
1294                     parent->backing_blocker);
1295 }
1296 
1297 static void bdrv_backing_detach(BdrvChild *c)
1298 {
1299     BlockDriverState *parent = c->opaque;
1300 
1301     GLOBAL_STATE_CODE();
1302     assert(parent->backing_blocker);
1303     bdrv_op_unblock_all(c->bs, parent->backing_blocker);
1304     error_free(parent->backing_blocker);
1305     parent->backing_blocker = NULL;
1306 }
1307 
1308 static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
1309                                         const char *filename, Error **errp)
1310 {
1311     BlockDriverState *parent = c->opaque;
1312     bool read_only = bdrv_is_read_only(parent);
1313     int ret;
1314     GLOBAL_STATE_CODE();
1315 
1316     if (read_only) {
1317         ret = bdrv_reopen_set_read_only(parent, false, errp);
1318         if (ret < 0) {
1319             return ret;
1320         }
1321     }
1322 
1323     ret = bdrv_change_backing_file(parent, filename,
1324                                    base->drv ? base->drv->format_name : "",
1325                                    false);
1326     if (ret < 0) {
1327         error_setg_errno(errp, -ret, "Could not update backing file link");
1328     }
1329 
1330     if (read_only) {
1331         bdrv_reopen_set_read_only(parent, true, NULL);
1332     }
1333 
1334     return ret;
1335 }
1336 
1337 /*
1338  * Returns the options and flags that a generic child of a BDS should
1339  * get, based on the given options and flags for the parent BDS.
1340  */
1341 static void bdrv_inherited_options(BdrvChildRole role, bool parent_is_format,
1342                                    int *child_flags, QDict *child_options,
1343                                    int parent_flags, QDict *parent_options)
1344 {
1345     int flags = parent_flags;
1346     GLOBAL_STATE_CODE();
1347 
1348     /*
1349      * First, decide whether to set, clear, or leave BDRV_O_PROTOCOL.
1350      * Generally, the question to answer is: Should this child be
1351      * format-probed by default?
1352      */
1353 
1354     /*
1355      * Pure and non-filtered data children of non-format nodes should
1356      * be probed by default (even when the node itself has BDRV_O_PROTOCOL
1357      * set).  This only affects a very limited set of drivers (namely
1358      * quorum and blkverify when this comment was written).
1359      * Force-clear BDRV_O_PROTOCOL then.
1360      */
1361     if (!parent_is_format &&
1362         (role & BDRV_CHILD_DATA) &&
1363         !(role & (BDRV_CHILD_METADATA | BDRV_CHILD_FILTERED)))
1364     {
1365         flags &= ~BDRV_O_PROTOCOL;
1366     }
1367 
1368     /*
1369      * All children of format nodes (except for COW children) and all
1370      * metadata children in general should never be format-probed.
1371      * Force-set BDRV_O_PROTOCOL then.
1372      */
1373     if ((parent_is_format && !(role & BDRV_CHILD_COW)) ||
1374         (role & BDRV_CHILD_METADATA))
1375     {
1376         flags |= BDRV_O_PROTOCOL;
1377     }
1378 
1379     /*
1380      * If the cache mode isn't explicitly set, inherit direct and no-flush from
1381      * the parent.
1382      */
1383     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1384     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1385     qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1386 
1387     if (role & BDRV_CHILD_COW) {
1388         /* backing files are opened read-only by default */
1389         qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
1390         qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
1391     } else {
1392         /* Inherit the read-only option from the parent if it's not set */
1393         qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1394         qdict_copy_default(child_options, parent_options,
1395                            BDRV_OPT_AUTO_READ_ONLY);
1396     }
1397 
1398     /*
1399      * bdrv_co_pdiscard() respects unmap policy for the parent, so we
1400      * can default to enable it on lower layers regardless of the
1401      * parent option.
1402      */
1403     qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
1404 
1405     /* Clear flags that only apply to the top layer */
1406     flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);
1407 
1408     if (role & BDRV_CHILD_METADATA) {
1409         flags &= ~BDRV_O_NO_IO;
1410     }
1411     if (role & BDRV_CHILD_COW) {
1412         flags &= ~BDRV_O_TEMPORARY;
1413     }
1414 
1415     *child_flags = flags;
1416 }
1417 
1418 static void GRAPH_WRLOCK bdrv_child_cb_attach(BdrvChild *child)
1419 {
1420     BlockDriverState *bs = child->opaque;
1421 
1422     assert_bdrv_graph_writable();
1423     QLIST_INSERT_HEAD(&bs->children, child, next);
1424     if (bs->drv->is_filter || (child->role & BDRV_CHILD_FILTERED)) {
1425         /*
1426          * Here we handle filters and block/raw-format.c when it behave like
1427          * filter. They generally have a single PRIMARY child, which is also the
1428          * FILTERED child, and that they may have multiple more children, which
1429          * are neither PRIMARY nor FILTERED. And never we have a COW child here.
1430          * So bs->file will be the PRIMARY child, unless the PRIMARY child goes
1431          * into bs->backing on exceptional cases; and bs->backing will be
1432          * nothing else.
1433          */
1434         assert(!(child->role & BDRV_CHILD_COW));
1435         if (child->role & BDRV_CHILD_PRIMARY) {
1436             assert(child->role & BDRV_CHILD_FILTERED);
1437             assert(!bs->backing);
1438             assert(!bs->file);
1439 
1440             if (bs->drv->filtered_child_is_backing) {
1441                 bs->backing = child;
1442             } else {
1443                 bs->file = child;
1444             }
1445         } else {
1446             assert(!(child->role & BDRV_CHILD_FILTERED));
1447         }
1448     } else if (child->role & BDRV_CHILD_COW) {
1449         assert(bs->drv->supports_backing);
1450         assert(!(child->role & BDRV_CHILD_PRIMARY));
1451         assert(!bs->backing);
1452         bs->backing = child;
1453         bdrv_backing_attach(child);
1454     } else if (child->role & BDRV_CHILD_PRIMARY) {
1455         assert(!bs->file);
1456         bs->file = child;
1457     }
1458 }
1459 
1460 static void GRAPH_WRLOCK bdrv_child_cb_detach(BdrvChild *child)
1461 {
1462     BlockDriverState *bs = child->opaque;
1463 
1464     if (child->role & BDRV_CHILD_COW) {
1465         bdrv_backing_detach(child);
1466     }
1467 
1468     assert_bdrv_graph_writable();
1469     QLIST_REMOVE(child, next);
1470     if (child == bs->backing) {
1471         assert(child != bs->file);
1472         bs->backing = NULL;
1473     } else if (child == bs->file) {
1474         bs->file = NULL;
1475     }
1476 }
1477 
1478 static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
1479                                          const char *filename, Error **errp)
1480 {
1481     if (c->role & BDRV_CHILD_COW) {
1482         return bdrv_backing_update_filename(c, base, filename, errp);
1483     }
1484     return 0;
1485 }
1486 
1487 AioContext *child_of_bds_get_parent_aio_context(BdrvChild *c)
1488 {
1489     BlockDriverState *bs = c->opaque;
1490     IO_CODE();
1491 
1492     return bdrv_get_aio_context(bs);
1493 }
1494 
1495 const BdrvChildClass child_of_bds = {
1496     .parent_is_bds   = true,
1497     .get_parent_desc = bdrv_child_get_parent_desc,
1498     .inherit_options = bdrv_inherited_options,
1499     .drained_begin   = bdrv_child_cb_drained_begin,
1500     .drained_poll    = bdrv_child_cb_drained_poll,
1501     .drained_end     = bdrv_child_cb_drained_end,
1502     .attach          = bdrv_child_cb_attach,
1503     .detach          = bdrv_child_cb_detach,
1504     .inactivate      = bdrv_child_cb_inactivate,
1505     .change_aio_ctx  = bdrv_child_cb_change_aio_ctx,
1506     .update_filename = bdrv_child_cb_update_filename,
1507     .get_parent_aio_context = child_of_bds_get_parent_aio_context,
1508 };
1509 
1510 AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c)
1511 {
1512     IO_CODE();
1513     return c->klass->get_parent_aio_context(c);
1514 }
1515 
1516 static int bdrv_open_flags(BlockDriverState *bs, int flags)
1517 {
1518     int open_flags = flags;
1519     GLOBAL_STATE_CODE();
1520 
1521     /*
1522      * Clear flags that are internal to the block layer before opening the
1523      * image.
1524      */
1525     open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_PROTOCOL);
1526 
1527     return open_flags;
1528 }
1529 
1530 static void update_flags_from_options(int *flags, QemuOpts *opts)
1531 {
1532     GLOBAL_STATE_CODE();
1533 
1534     *flags &= ~(BDRV_O_CACHE_MASK | BDRV_O_RDWR | BDRV_O_AUTO_RDONLY);
1535 
1536     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
1537         *flags |= BDRV_O_NO_FLUSH;
1538     }
1539 
1540     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
1541         *flags |= BDRV_O_NOCACHE;
1542     }
1543 
1544     if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
1545         *flags |= BDRV_O_RDWR;
1546     }
1547 
1548     if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
1549         *flags |= BDRV_O_AUTO_RDONLY;
1550     }
1551 }
1552 
1553 static void update_options_from_flags(QDict *options, int flags)
1554 {
1555     GLOBAL_STATE_CODE();
1556     if (!qdict_haskey(options, BDRV_OPT_CACHE_DIRECT)) {
1557         qdict_put_bool(options, BDRV_OPT_CACHE_DIRECT, flags & BDRV_O_NOCACHE);
1558     }
1559     if (!qdict_haskey(options, BDRV_OPT_CACHE_NO_FLUSH)) {
1560         qdict_put_bool(options, BDRV_OPT_CACHE_NO_FLUSH,
1561                        flags & BDRV_O_NO_FLUSH);
1562     }
1563     if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
1564         qdict_put_bool(options, BDRV_OPT_READ_ONLY, !(flags & BDRV_O_RDWR));
1565     }
1566     if (!qdict_haskey(options, BDRV_OPT_AUTO_READ_ONLY)) {
1567         qdict_put_bool(options, BDRV_OPT_AUTO_READ_ONLY,
1568                        flags & BDRV_O_AUTO_RDONLY);
1569     }
1570 }
1571 
1572 static void bdrv_assign_node_name(BlockDriverState *bs,
1573                                   const char *node_name,
1574                                   Error **errp)
1575 {
1576     char *gen_node_name = NULL;
1577     GLOBAL_STATE_CODE();
1578 
1579     if (!node_name) {
1580         node_name = gen_node_name = id_generate(ID_BLOCK);
1581     } else if (!id_wellformed(node_name)) {
1582         /*
1583          * Check for empty string or invalid characters, but not if it is
1584          * generated (generated names use characters not available to the user)
1585          */
1586         error_setg(errp, "Invalid node-name: '%s'", node_name);
1587         return;
1588     }
1589 
1590     /* takes care of avoiding namespaces collisions */
1591     if (blk_by_name(node_name)) {
1592         error_setg(errp, "node-name=%s is conflicting with a device id",
1593                    node_name);
1594         goto out;
1595     }
1596 
1597     /* takes care of avoiding duplicates node names */
1598     if (bdrv_find_node(node_name)) {
1599         error_setg(errp, "Duplicate nodes with node-name='%s'", node_name);
1600         goto out;
1601     }
1602 
1603     /* Make sure that the node name isn't truncated */
1604     if (strlen(node_name) >= sizeof(bs->node_name)) {
1605         error_setg(errp, "Node name too long");
1606         goto out;
1607     }
1608 
1609     /* copy node name into the bs and insert it into the graph list */
1610     pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
1611     QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
1612 out:
1613     g_free(gen_node_name);
1614 }
1615 
1616 /*
1617  * The caller must always hold @bs AioContext lock, because this function calls
1618  * bdrv_refresh_total_sectors() which polls when called from non-coroutine
1619  * context.
1620  */
1621 static int no_coroutine_fn GRAPH_UNLOCKED
1622 bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
1623                  QDict *options, int open_flags, Error **errp)
1624 {
1625     AioContext *ctx;
1626     Error *local_err = NULL;
1627     int i, ret;
1628     GLOBAL_STATE_CODE();
1629 
1630     bdrv_assign_node_name(bs, node_name, &local_err);
1631     if (local_err) {
1632         error_propagate(errp, local_err);
1633         return -EINVAL;
1634     }
1635 
1636     bs->drv = drv;
1637     bs->opaque = g_malloc0(drv->instance_size);
1638 
1639     if (drv->bdrv_file_open) {
1640         assert(!drv->bdrv_needs_filename || bs->filename[0]);
1641         ret = drv->bdrv_file_open(bs, options, open_flags, &local_err);
1642     } else if (drv->bdrv_open) {
1643         ret = drv->bdrv_open(bs, options, open_flags, &local_err);
1644     } else {
1645         ret = 0;
1646     }
1647 
1648     if (ret < 0) {
1649         if (local_err) {
1650             error_propagate(errp, local_err);
1651         } else if (bs->filename[0]) {
1652             error_setg_errno(errp, -ret, "Could not open '%s'", bs->filename);
1653         } else {
1654             error_setg_errno(errp, -ret, "Could not open image");
1655         }
1656         goto open_failed;
1657     }
1658 
1659     assert(!(bs->supported_read_flags & ~BDRV_REQ_MASK));
1660     assert(!(bs->supported_write_flags & ~BDRV_REQ_MASK));
1661 
1662     /*
1663      * Always allow the BDRV_REQ_REGISTERED_BUF optimization hint. This saves
1664      * drivers that pass read/write requests through to a child the trouble of
1665      * declaring support explicitly.
1666      *
1667      * Drivers must not propagate this flag accidentally when they initiate I/O
1668      * to a bounce buffer. That case should be rare though.
1669      */
1670     bs->supported_read_flags |= BDRV_REQ_REGISTERED_BUF;
1671     bs->supported_write_flags |= BDRV_REQ_REGISTERED_BUF;
1672 
1673     /* Get the context after .bdrv_open, it can change the context */
1674     ctx = bdrv_get_aio_context(bs);
1675     aio_context_acquire(ctx);
1676 
1677     ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
1678     if (ret < 0) {
1679         error_setg_errno(errp, -ret, "Could not refresh total sector count");
1680         aio_context_release(ctx);
1681         return ret;
1682     }
1683 
1684     bdrv_graph_rdlock_main_loop();
1685     bdrv_refresh_limits(bs, NULL, &local_err);
1686     bdrv_graph_rdunlock_main_loop();
1687     aio_context_release(ctx);
1688 
1689     if (local_err) {
1690         error_propagate(errp, local_err);
1691         return -EINVAL;
1692     }
1693 
1694     assert(bdrv_opt_mem_align(bs) != 0);
1695     assert(bdrv_min_mem_align(bs) != 0);
1696     assert(is_power_of_2(bs->bl.request_alignment));
1697 
1698     for (i = 0; i < bs->quiesce_counter; i++) {
1699         if (drv->bdrv_drain_begin) {
1700             drv->bdrv_drain_begin(bs);
1701         }
1702     }
1703 
1704     return 0;
1705 open_failed:
1706     bs->drv = NULL;
1707     if (bs->file != NULL) {
1708         bdrv_graph_wrlock(NULL);
1709         bdrv_unref_child(bs, bs->file);
1710         bdrv_graph_wrunlock();
1711         assert(!bs->file);
1712     }
1713     g_free(bs->opaque);
1714     bs->opaque = NULL;
1715     return ret;
1716 }
1717 
1718 /*
1719  * Create and open a block node.
1720  *
1721  * @options is a QDict of options to pass to the block drivers, or NULL for an
1722  * empty set of options. The reference to the QDict belongs to the block layer
1723  * after the call (even on failure), so if the caller intends to reuse the
1724  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
1725  */
1726 BlockDriverState *bdrv_new_open_driver_opts(BlockDriver *drv,
1727                                             const char *node_name,
1728                                             QDict *options, int flags,
1729                                             Error **errp)
1730 {
1731     BlockDriverState *bs;
1732     int ret;
1733 
1734     GLOBAL_STATE_CODE();
1735 
1736     bs = bdrv_new();
1737     bs->open_flags = flags;
1738     bs->options = options ?: qdict_new();
1739     bs->explicit_options = qdict_clone_shallow(bs->options);
1740     bs->opaque = NULL;
1741 
1742     update_options_from_flags(bs->options, flags);
1743 
1744     ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
1745     if (ret < 0) {
1746         qobject_unref(bs->explicit_options);
1747         bs->explicit_options = NULL;
1748         qobject_unref(bs->options);
1749         bs->options = NULL;
1750         bdrv_unref(bs);
1751         return NULL;
1752     }
1753 
1754     return bs;
1755 }
1756 
1757 /* Create and open a block node. */
1758 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
1759                                        int flags, Error **errp)
1760 {
1761     GLOBAL_STATE_CODE();
1762     return bdrv_new_open_driver_opts(drv, node_name, NULL, flags, errp);
1763 }
1764 
1765 QemuOptsList bdrv_runtime_opts = {
1766     .name = "bdrv_common",
1767     .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
1768     .desc = {
1769         {
1770             .name = "node-name",
1771             .type = QEMU_OPT_STRING,
1772             .help = "Node name of the block device node",
1773         },
1774         {
1775             .name = "driver",
1776             .type = QEMU_OPT_STRING,
1777             .help = "Block driver to use for the node",
1778         },
1779         {
1780             .name = BDRV_OPT_CACHE_DIRECT,
1781             .type = QEMU_OPT_BOOL,
1782             .help = "Bypass software writeback cache on the host",
1783         },
1784         {
1785             .name = BDRV_OPT_CACHE_NO_FLUSH,
1786             .type = QEMU_OPT_BOOL,
1787             .help = "Ignore flush requests",
1788         },
1789         {
1790             .name = BDRV_OPT_READ_ONLY,
1791             .type = QEMU_OPT_BOOL,
1792             .help = "Node is opened in read-only mode",
1793         },
1794         {
1795             .name = BDRV_OPT_AUTO_READ_ONLY,
1796             .type = QEMU_OPT_BOOL,
1797             .help = "Node can become read-only if opening read-write fails",
1798         },
1799         {
1800             .name = "detect-zeroes",
1801             .type = QEMU_OPT_STRING,
1802             .help = "try to optimize zero writes (off, on, unmap)",
1803         },
1804         {
1805             .name = BDRV_OPT_DISCARD,
1806             .type = QEMU_OPT_STRING,
1807             .help = "discard operation (ignore/off, unmap/on)",
1808         },
1809         {
1810             .name = BDRV_OPT_FORCE_SHARE,
1811             .type = QEMU_OPT_BOOL,
1812             .help = "always accept other writers (default: off)",
1813         },
1814         { /* end of list */ }
1815     },
1816 };
1817 
1818 QemuOptsList bdrv_create_opts_simple = {
1819     .name = "simple-create-opts",
1820     .head = QTAILQ_HEAD_INITIALIZER(bdrv_create_opts_simple.head),
1821     .desc = {
1822         {
1823             .name = BLOCK_OPT_SIZE,
1824             .type = QEMU_OPT_SIZE,
1825             .help = "Virtual disk size"
1826         },
1827         {
1828             .name = BLOCK_OPT_PREALLOC,
1829             .type = QEMU_OPT_STRING,
1830             .help = "Preallocation mode (allowed values: off)"
1831         },
1832         { /* end of list */ }
1833     }
1834 };
1835 
1836 /*
1837  * Common part for opening disk images and files
1838  *
1839  * Removes all processed options from *options.
1840  */
1841 static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
1842                             QDict *options, Error **errp)
1843 {
1844     int ret, open_flags;
1845     const char *filename;
1846     const char *driver_name = NULL;
1847     const char *node_name = NULL;
1848     const char *discard;
1849     QemuOpts *opts;
1850     BlockDriver *drv;
1851     Error *local_err = NULL;
1852     bool ro;
1853 
1854     assert(bs->file == NULL);
1855     assert(options != NULL && bs->options != options);
1856     GLOBAL_STATE_CODE();
1857 
1858     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
1859     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1860         ret = -EINVAL;
1861         goto fail_opts;
1862     }
1863 
1864     update_flags_from_options(&bs->open_flags, opts);
1865 
1866     driver_name = qemu_opt_get(opts, "driver");
1867     drv = bdrv_find_format(driver_name);
1868     assert(drv != NULL);
1869 
1870     bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
1871 
1872     if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
1873         error_setg(errp,
1874                    BDRV_OPT_FORCE_SHARE
1875                    "=on can only be used with read-only images");
1876         ret = -EINVAL;
1877         goto fail_opts;
1878     }
1879 
1880     if (file != NULL) {
1881         bdrv_graph_rdlock_main_loop();
1882         bdrv_refresh_filename(blk_bs(file));
1883         bdrv_graph_rdunlock_main_loop();
1884 
1885         filename = blk_bs(file)->filename;
1886     } else {
1887         /*
1888          * Caution: while qdict_get_try_str() is fine, getting
1889          * non-string types would require more care.  When @options
1890          * come from -blockdev or blockdev_add, its members are typed
1891          * according to the QAPI schema, but when they come from
1892          * -drive, they're all QString.
1893          */
1894         filename = qdict_get_try_str(options, "filename");
1895     }
1896 
1897     if (drv->bdrv_needs_filename && (!filename || !filename[0])) {
1898         error_setg(errp, "The '%s' block driver requires a file name",
1899                    drv->format_name);
1900         ret = -EINVAL;
1901         goto fail_opts;
1902     }
1903 
1904     trace_bdrv_open_common(bs, filename ?: "", bs->open_flags,
1905                            drv->format_name);
1906 
1907     ro = bdrv_is_read_only(bs);
1908 
1909     if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, ro)) {
1910         if (!ro && bdrv_is_whitelisted(drv, true)) {
1911             ret = bdrv_apply_auto_read_only(bs, NULL, NULL);
1912         } else {
1913             ret = -ENOTSUP;
1914         }
1915         if (ret < 0) {
1916             error_setg(errp,
1917                        !ro && bdrv_is_whitelisted(drv, true)
1918                        ? "Driver '%s' can only be used for read-only devices"
1919                        : "Driver '%s' is not whitelisted",
1920                        drv->format_name);
1921             goto fail_opts;
1922         }
1923     }
1924 
1925     /* bdrv_new() and bdrv_close() make it so */
1926     assert(qatomic_read(&bs->copy_on_read) == 0);
1927 
1928     if (bs->open_flags & BDRV_O_COPY_ON_READ) {
1929         if (!ro) {
1930             bdrv_enable_copy_on_read(bs);
1931         } else {
1932             error_setg(errp, "Can't use copy-on-read on read-only device");
1933             ret = -EINVAL;
1934             goto fail_opts;
1935         }
1936     }
1937 
1938     discard = qemu_opt_get(opts, BDRV_OPT_DISCARD);
1939     if (discard != NULL) {
1940         if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
1941             error_setg(errp, "Invalid discard option");
1942             ret = -EINVAL;
1943             goto fail_opts;
1944         }
1945     }
1946 
1947     bs->detect_zeroes =
1948         bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
1949     if (local_err) {
1950         error_propagate(errp, local_err);
1951         ret = -EINVAL;
1952         goto fail_opts;
1953     }
1954 
1955     if (filename != NULL) {
1956         pstrcpy(bs->filename, sizeof(bs->filename), filename);
1957     } else {
1958         bs->filename[0] = '\0';
1959     }
1960     pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), bs->filename);
1961 
1962     /* Open the image, either directly or using a protocol */
1963     open_flags = bdrv_open_flags(bs, bs->open_flags);
1964     node_name = qemu_opt_get(opts, "node-name");
1965 
1966     assert(!drv->bdrv_file_open || file == NULL);
1967     ret = bdrv_open_driver(bs, drv, node_name, options, open_flags, errp);
1968     if (ret < 0) {
1969         goto fail_opts;
1970     }
1971 
1972     qemu_opts_del(opts);
1973     return 0;
1974 
1975 fail_opts:
1976     qemu_opts_del(opts);
1977     return ret;
1978 }
1979 
1980 static QDict *parse_json_filename(const char *filename, Error **errp)
1981 {
1982     QObject *options_obj;
1983     QDict *options;
1984     int ret;
1985     GLOBAL_STATE_CODE();
1986 
1987     ret = strstart(filename, "json:", &filename);
1988     assert(ret);
1989 
1990     options_obj = qobject_from_json(filename, errp);
1991     if (!options_obj) {
1992         error_prepend(errp, "Could not parse the JSON options: ");
1993         return NULL;
1994     }
1995 
1996     options = qobject_to(QDict, options_obj);
1997     if (!options) {
1998         qobject_unref(options_obj);
1999         error_setg(errp, "Invalid JSON object given");
2000         return NULL;
2001     }
2002 
2003     qdict_flatten(options);
2004 
2005     return options;
2006 }
2007 
2008 static void parse_json_protocol(QDict *options, const char **pfilename,
2009                                 Error **errp)
2010 {
2011     QDict *json_options;
2012     Error *local_err = NULL;
2013     GLOBAL_STATE_CODE();
2014 
2015     /* Parse json: pseudo-protocol */
2016     if (!*pfilename || !g_str_has_prefix(*pfilename, "json:")) {
2017         return;
2018     }
2019 
2020     json_options = parse_json_filename(*pfilename, &local_err);
2021     if (local_err) {
2022         error_propagate(errp, local_err);
2023         return;
2024     }
2025 
2026     /* Options given in the filename have lower priority than options
2027      * specified directly */
2028     qdict_join(options, json_options, false);
2029     qobject_unref(json_options);
2030     *pfilename = NULL;
2031 }
2032 
2033 /*
2034  * Fills in default options for opening images and converts the legacy
2035  * filename/flags pair to option QDict entries.
2036  * The BDRV_O_PROTOCOL flag in *flags will be set or cleared accordingly if a
2037  * block driver has been specified explicitly.
2038  */
2039 static int bdrv_fill_options(QDict **options, const char *filename,
2040                              int *flags, Error **errp)
2041 {
2042     const char *drvname;
2043     bool protocol = *flags & BDRV_O_PROTOCOL;
2044     bool parse_filename = false;
2045     BlockDriver *drv = NULL;
2046     Error *local_err = NULL;
2047 
2048     GLOBAL_STATE_CODE();
2049 
2050     /*
2051      * Caution: while qdict_get_try_str() is fine, getting non-string
2052      * types would require more care.  When @options come from
2053      * -blockdev or blockdev_add, its members are typed according to
2054      * the QAPI schema, but when they come from -drive, they're all
2055      * QString.
2056      */
2057     drvname = qdict_get_try_str(*options, "driver");
2058     if (drvname) {
2059         drv = bdrv_find_format(drvname);
2060         if (!drv) {
2061             error_setg(errp, "Unknown driver '%s'", drvname);
2062             return -ENOENT;
2063         }
2064         /* If the user has explicitly specified the driver, this choice should
2065          * override the BDRV_O_PROTOCOL flag */
2066         protocol = drv->bdrv_file_open;
2067     }
2068 
2069     if (protocol) {
2070         *flags |= BDRV_O_PROTOCOL;
2071     } else {
2072         *flags &= ~BDRV_O_PROTOCOL;
2073     }
2074 
2075     /* Translate cache options from flags into options */
2076     update_options_from_flags(*options, *flags);
2077 
2078     /* Fetch the file name from the options QDict if necessary */
2079     if (protocol && filename) {
2080         if (!qdict_haskey(*options, "filename")) {
2081             qdict_put_str(*options, "filename", filename);
2082             parse_filename = true;
2083         } else {
2084             error_setg(errp, "Can't specify 'file' and 'filename' options at "
2085                              "the same time");
2086             return -EINVAL;
2087         }
2088     }
2089 
2090     /* Find the right block driver */
2091     /* See cautionary note on accessing @options above */
2092     filename = qdict_get_try_str(*options, "filename");
2093 
2094     if (!drvname && protocol) {
2095         if (filename) {
2096             drv = bdrv_find_protocol(filename, parse_filename, errp);
2097             if (!drv) {
2098                 return -EINVAL;
2099             }
2100 
2101             drvname = drv->format_name;
2102             qdict_put_str(*options, "driver", drvname);
2103         } else {
2104             error_setg(errp, "Must specify either driver or file");
2105             return -EINVAL;
2106         }
2107     }
2108 
2109     assert(drv || !protocol);
2110 
2111     /* Driver-specific filename parsing */
2112     if (drv && drv->bdrv_parse_filename && parse_filename) {
2113         drv->bdrv_parse_filename(filename, *options, &local_err);
2114         if (local_err) {
2115             error_propagate(errp, local_err);
2116             return -EINVAL;
2117         }
2118 
2119         if (!drv->bdrv_needs_filename) {
2120             qdict_del(*options, "filename");
2121         }
2122     }
2123 
2124     return 0;
2125 }
2126 
2127 typedef struct BlockReopenQueueEntry {
2128      bool prepared;
2129      BDRVReopenState state;
2130      QTAILQ_ENTRY(BlockReopenQueueEntry) entry;
2131 } BlockReopenQueueEntry;
2132 
2133 /*
2134  * Return the flags that @bs will have after the reopens in @q have
2135  * successfully completed. If @q is NULL (or @bs is not contained in @q),
2136  * return the current flags.
2137  */
2138 static int bdrv_reopen_get_flags(BlockReopenQueue *q, BlockDriverState *bs)
2139 {
2140     BlockReopenQueueEntry *entry;
2141 
2142     if (q != NULL) {
2143         QTAILQ_FOREACH(entry, q, entry) {
2144             if (entry->state.bs == bs) {
2145                 return entry->state.flags;
2146             }
2147         }
2148     }
2149 
2150     return bs->open_flags;
2151 }
2152 
2153 /* Returns whether the image file can be written to after the reopen queue @q
2154  * has been successfully applied, or right now if @q is NULL. */
2155 static bool bdrv_is_writable_after_reopen(BlockDriverState *bs,
2156                                           BlockReopenQueue *q)
2157 {
2158     int flags = bdrv_reopen_get_flags(q, bs);
2159 
2160     return (flags & (BDRV_O_RDWR | BDRV_O_INACTIVE)) == BDRV_O_RDWR;
2161 }
2162 
2163 /*
2164  * Return whether the BDS can be written to.  This is not necessarily
2165  * the same as !bdrv_is_read_only(bs), as inactivated images may not
2166  * be written to but do not count as read-only images.
2167  */
2168 bool bdrv_is_writable(BlockDriverState *bs)
2169 {
2170     IO_CODE();
2171     return bdrv_is_writable_after_reopen(bs, NULL);
2172 }
2173 
2174 static char *bdrv_child_user_desc(BdrvChild *c)
2175 {
2176     GLOBAL_STATE_CODE();
2177     return c->klass->get_parent_desc(c);
2178 }
2179 
2180 /*
2181  * Check that @a allows everything that @b needs. @a and @b must reference same
2182  * child node.
2183  */
2184 static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
2185 {
2186     const char *child_bs_name;
2187     g_autofree char *a_user = NULL;
2188     g_autofree char *b_user = NULL;
2189     g_autofree char *perms = NULL;
2190 
2191     assert(a->bs);
2192     assert(a->bs == b->bs);
2193     GLOBAL_STATE_CODE();
2194 
2195     if ((b->perm & a->shared_perm) == b->perm) {
2196         return true;
2197     }
2198 
2199     child_bs_name = bdrv_get_node_name(b->bs);
2200     a_user = bdrv_child_user_desc(a);
2201     b_user = bdrv_child_user_desc(b);
2202     perms = bdrv_perm_names(b->perm & ~a->shared_perm);
2203 
2204     error_setg(errp, "Permission conflict on node '%s': permissions '%s' are "
2205                "both required by %s (uses node '%s' as '%s' child) and "
2206                "unshared by %s (uses node '%s' as '%s' child).",
2207                child_bs_name, perms,
2208                b_user, child_bs_name, b->name,
2209                a_user, child_bs_name, a->name);
2210 
2211     return false;
2212 }
2213 
2214 static bool GRAPH_RDLOCK
2215 bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
2216 {
2217     BdrvChild *a, *b;
2218     GLOBAL_STATE_CODE();
2219 
2220     /*
2221      * During the loop we'll look at each pair twice. That's correct because
2222      * bdrv_a_allow_b() is asymmetric and we should check each pair in both
2223      * directions.
2224      */
2225     QLIST_FOREACH(a, &bs->parents, next_parent) {
2226         QLIST_FOREACH(b, &bs->parents, next_parent) {
2227             if (a == b) {
2228                 continue;
2229             }
2230 
2231             if (!bdrv_a_allow_b(a, b, errp)) {
2232                 return true;
2233             }
2234         }
2235     }
2236 
2237     return false;
2238 }
2239 
2240 static void GRAPH_RDLOCK
2241 bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
2242                 BdrvChild *c, BdrvChildRole role,
2243                 BlockReopenQueue *reopen_queue,
2244                 uint64_t parent_perm, uint64_t parent_shared,
2245                 uint64_t *nperm, uint64_t *nshared)
2246 {
2247     assert(bs->drv && bs->drv->bdrv_child_perm);
2248     GLOBAL_STATE_CODE();
2249     bs->drv->bdrv_child_perm(bs, c, role, reopen_queue,
2250                              parent_perm, parent_shared,
2251                              nperm, nshared);
2252     /* TODO Take force_share from reopen_queue */
2253     if (child_bs && child_bs->force_share) {
2254         *nshared = BLK_PERM_ALL;
2255     }
2256 }
2257 
2258 /*
2259  * Adds the whole subtree of @bs (including @bs itself) to the @list (except for
2260  * nodes that are already in the @list, of course) so that final list is
2261  * topologically sorted. Return the result (GSList @list object is updated, so
2262  * don't use old reference after function call).
2263  *
2264  * On function start @list must be already topologically sorted and for any node
2265  * in the @list the whole subtree of the node must be in the @list as well. The
2266  * simplest way to satisfy this criteria: use only result of
2267  * bdrv_topological_dfs() or NULL as @list parameter.
2268  */
2269 static GSList * GRAPH_RDLOCK
2270 bdrv_topological_dfs(GSList *list, GHashTable *found, BlockDriverState *bs)
2271 {
2272     BdrvChild *child;
2273     g_autoptr(GHashTable) local_found = NULL;
2274 
2275     GLOBAL_STATE_CODE();
2276 
2277     if (!found) {
2278         assert(!list);
2279         found = local_found = g_hash_table_new(NULL, NULL);
2280     }
2281 
2282     if (g_hash_table_contains(found, bs)) {
2283         return list;
2284     }
2285     g_hash_table_add(found, bs);
2286 
2287     QLIST_FOREACH(child, &bs->children, next) {
2288         list = bdrv_topological_dfs(list, found, child->bs);
2289     }
2290 
2291     return g_slist_prepend(list, bs);
2292 }
2293 
2294 typedef struct BdrvChildSetPermState {
2295     BdrvChild *child;
2296     uint64_t old_perm;
2297     uint64_t old_shared_perm;
2298 } BdrvChildSetPermState;
2299 
2300 static void bdrv_child_set_perm_abort(void *opaque)
2301 {
2302     BdrvChildSetPermState *s = opaque;
2303 
2304     GLOBAL_STATE_CODE();
2305 
2306     s->child->perm = s->old_perm;
2307     s->child->shared_perm = s->old_shared_perm;
2308 }
2309 
2310 static TransactionActionDrv bdrv_child_set_pem_drv = {
2311     .abort = bdrv_child_set_perm_abort,
2312     .clean = g_free,
2313 };
2314 
2315 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm,
2316                                 uint64_t shared, Transaction *tran)
2317 {
2318     BdrvChildSetPermState *s = g_new(BdrvChildSetPermState, 1);
2319     GLOBAL_STATE_CODE();
2320 
2321     *s = (BdrvChildSetPermState) {
2322         .child = c,
2323         .old_perm = c->perm,
2324         .old_shared_perm = c->shared_perm,
2325     };
2326 
2327     c->perm = perm;
2328     c->shared_perm = shared;
2329 
2330     tran_add(tran, &bdrv_child_set_pem_drv, s);
2331 }
2332 
2333 static void GRAPH_RDLOCK bdrv_drv_set_perm_commit(void *opaque)
2334 {
2335     BlockDriverState *bs = opaque;
2336     uint64_t cumulative_perms, cumulative_shared_perms;
2337     GLOBAL_STATE_CODE();
2338 
2339     if (bs->drv->bdrv_set_perm) {
2340         bdrv_get_cumulative_perm(bs, &cumulative_perms,
2341                                  &cumulative_shared_perms);
2342         bs->drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
2343     }
2344 }
2345 
2346 static void GRAPH_RDLOCK bdrv_drv_set_perm_abort(void *opaque)
2347 {
2348     BlockDriverState *bs = opaque;
2349     GLOBAL_STATE_CODE();
2350 
2351     if (bs->drv->bdrv_abort_perm_update) {
2352         bs->drv->bdrv_abort_perm_update(bs);
2353     }
2354 }
2355 
2356 TransactionActionDrv bdrv_drv_set_perm_drv = {
2357     .abort = bdrv_drv_set_perm_abort,
2358     .commit = bdrv_drv_set_perm_commit,
2359 };
2360 
2361 /*
2362  * After calling this function, the transaction @tran may only be completed
2363  * while holding a reader lock for the graph.
2364  */
2365 static int GRAPH_RDLOCK
2366 bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared_perm,
2367                   Transaction *tran, Error **errp)
2368 {
2369     GLOBAL_STATE_CODE();
2370     if (!bs->drv) {
2371         return 0;
2372     }
2373 
2374     if (bs->drv->bdrv_check_perm) {
2375         int ret = bs->drv->bdrv_check_perm(bs, perm, shared_perm, errp);
2376         if (ret < 0) {
2377             return ret;
2378         }
2379     }
2380 
2381     if (tran) {
2382         tran_add(tran, &bdrv_drv_set_perm_drv, bs);
2383     }
2384 
2385     return 0;
2386 }
2387 
2388 typedef struct BdrvReplaceChildState {
2389     BdrvChild *child;
2390     BlockDriverState *old_bs;
2391 } BdrvReplaceChildState;
2392 
2393 static void GRAPH_WRLOCK bdrv_replace_child_commit(void *opaque)
2394 {
2395     BdrvReplaceChildState *s = opaque;
2396     GLOBAL_STATE_CODE();
2397 
2398     bdrv_schedule_unref(s->old_bs);
2399 }
2400 
2401 static void GRAPH_WRLOCK bdrv_replace_child_abort(void *opaque)
2402 {
2403     BdrvReplaceChildState *s = opaque;
2404     BlockDriverState *new_bs = s->child->bs;
2405 
2406     GLOBAL_STATE_CODE();
2407     assert_bdrv_graph_writable();
2408 
2409     /* old_bs reference is transparently moved from @s to @s->child */
2410     if (!s->child->bs) {
2411         /*
2412          * The parents were undrained when removing old_bs from the child. New
2413          * requests can't have been made, though, because the child was empty.
2414          *
2415          * TODO Make bdrv_replace_child_noperm() transactionable to avoid
2416          * undraining the parent in the first place. Once this is done, having
2417          * new_bs drained when calling bdrv_replace_child_tran() is not a
2418          * requirement any more.
2419          */
2420         bdrv_parent_drained_begin_single(s->child);
2421         assert(!bdrv_parent_drained_poll_single(s->child));
2422     }
2423     assert(s->child->quiesced_parent);
2424     bdrv_replace_child_noperm(s->child, s->old_bs);
2425 
2426     bdrv_unref(new_bs);
2427 }
2428 
2429 static TransactionActionDrv bdrv_replace_child_drv = {
2430     .commit = bdrv_replace_child_commit,
2431     .abort = bdrv_replace_child_abort,
2432     .clean = g_free,
2433 };
2434 
2435 /*
2436  * bdrv_replace_child_tran
2437  *
2438  * Note: real unref of old_bs is done only on commit.
2439  *
2440  * Both @child->bs and @new_bs (if non-NULL) must be drained. @new_bs must be
2441  * kept drained until the transaction is completed.
2442  *
2443  * After calling this function, the transaction @tran may only be completed
2444  * while holding a writer lock for the graph.
2445  *
2446  * The function doesn't update permissions, caller is responsible for this.
2447  */
2448 static void GRAPH_WRLOCK
2449 bdrv_replace_child_tran(BdrvChild *child, BlockDriverState *new_bs,
2450                         Transaction *tran)
2451 {
2452     BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
2453 
2454     assert(child->quiesced_parent);
2455     assert(!new_bs || new_bs->quiesce_counter);
2456 
2457     *s = (BdrvReplaceChildState) {
2458         .child = child,
2459         .old_bs = child->bs,
2460     };
2461     tran_add(tran, &bdrv_replace_child_drv, s);
2462 
2463     if (new_bs) {
2464         bdrv_ref(new_bs);
2465     }
2466 
2467     bdrv_replace_child_noperm(child, new_bs);
2468     /* old_bs reference is transparently moved from @child to @s */
2469 }
2470 
2471 /*
2472  * Refresh permissions in @bs subtree. The function is intended to be called
2473  * after some graph modification that was done without permission update.
2474  *
2475  * After calling this function, the transaction @tran may only be completed
2476  * while holding a reader lock for the graph.
2477  */
2478 static int GRAPH_RDLOCK
2479 bdrv_node_refresh_perm(BlockDriverState *bs, BlockReopenQueue *q,
2480                        Transaction *tran, Error **errp)
2481 {
2482     BlockDriver *drv = bs->drv;
2483     BdrvChild *c;
2484     int ret;
2485     uint64_t cumulative_perms, cumulative_shared_perms;
2486     GLOBAL_STATE_CODE();
2487 
2488     bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
2489 
2490     /* Write permissions never work with read-only images */
2491     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2492         !bdrv_is_writable_after_reopen(bs, q))
2493     {
2494         if (!bdrv_is_writable_after_reopen(bs, NULL)) {
2495             error_setg(errp, "Block node is read-only");
2496         } else {
2497             error_setg(errp, "Read-only block node '%s' cannot support "
2498                        "read-write users", bdrv_get_node_name(bs));
2499         }
2500 
2501         return -EPERM;
2502     }
2503 
2504     /*
2505      * Unaligned requests will automatically be aligned to bl.request_alignment
2506      * and without RESIZE we can't extend requests to write to space beyond the
2507      * end of the image, so it's required that the image size is aligned.
2508      */
2509     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2510         !(cumulative_perms & BLK_PERM_RESIZE))
2511     {
2512         if ((bs->total_sectors * BDRV_SECTOR_SIZE) % bs->bl.request_alignment) {
2513             error_setg(errp, "Cannot get 'write' permission without 'resize': "
2514                              "Image size is not a multiple of request "
2515                              "alignment");
2516             return -EPERM;
2517         }
2518     }
2519 
2520     /* Check this node */
2521     if (!drv) {
2522         return 0;
2523     }
2524 
2525     ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, tran,
2526                             errp);
2527     if (ret < 0) {
2528         return ret;
2529     }
2530 
2531     /* Drivers that never have children can omit .bdrv_child_perm() */
2532     if (!drv->bdrv_child_perm) {
2533         assert(QLIST_EMPTY(&bs->children));
2534         return 0;
2535     }
2536 
2537     /* Check all children */
2538     QLIST_FOREACH(c, &bs->children, next) {
2539         uint64_t cur_perm, cur_shared;
2540 
2541         bdrv_child_perm(bs, c->bs, c, c->role, q,
2542                         cumulative_perms, cumulative_shared_perms,
2543                         &cur_perm, &cur_shared);
2544         bdrv_child_set_perm(c, cur_perm, cur_shared, tran);
2545     }
2546 
2547     return 0;
2548 }
2549 
2550 /*
2551  * @list is a product of bdrv_topological_dfs() (may be called several times) -
2552  * a topologically sorted subgraph.
2553  *
2554  * After calling this function, the transaction @tran may only be completed
2555  * while holding a reader lock for the graph.
2556  */
2557 static int GRAPH_RDLOCK
2558 bdrv_do_refresh_perms(GSList *list, BlockReopenQueue *q, Transaction *tran,
2559                       Error **errp)
2560 {
2561     int ret;
2562     BlockDriverState *bs;
2563     GLOBAL_STATE_CODE();
2564 
2565     for ( ; list; list = list->next) {
2566         bs = list->data;
2567 
2568         if (bdrv_parent_perms_conflict(bs, errp)) {
2569             return -EINVAL;
2570         }
2571 
2572         ret = bdrv_node_refresh_perm(bs, q, tran, errp);
2573         if (ret < 0) {
2574             return ret;
2575         }
2576     }
2577 
2578     return 0;
2579 }
2580 
2581 /*
2582  * @list is any list of nodes. List is completed by all subtrees and
2583  * topologically sorted. It's not a problem if some node occurs in the @list
2584  * several times.
2585  *
2586  * After calling this function, the transaction @tran may only be completed
2587  * while holding a reader lock for the graph.
2588  */
2589 static int GRAPH_RDLOCK
2590 bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q, Transaction *tran,
2591                         Error **errp)
2592 {
2593     g_autoptr(GHashTable) found = g_hash_table_new(NULL, NULL);
2594     g_autoptr(GSList) refresh_list = NULL;
2595 
2596     for ( ; list; list = list->next) {
2597         refresh_list = bdrv_topological_dfs(refresh_list, found, list->data);
2598     }
2599 
2600     return bdrv_do_refresh_perms(refresh_list, q, tran, errp);
2601 }
2602 
2603 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
2604                               uint64_t *shared_perm)
2605 {
2606     BdrvChild *c;
2607     uint64_t cumulative_perms = 0;
2608     uint64_t cumulative_shared_perms = BLK_PERM_ALL;
2609 
2610     GLOBAL_STATE_CODE();
2611 
2612     QLIST_FOREACH(c, &bs->parents, next_parent) {
2613         cumulative_perms |= c->perm;
2614         cumulative_shared_perms &= c->shared_perm;
2615     }
2616 
2617     *perm = cumulative_perms;
2618     *shared_perm = cumulative_shared_perms;
2619 }
2620 
2621 char *bdrv_perm_names(uint64_t perm)
2622 {
2623     struct perm_name {
2624         uint64_t perm;
2625         const char *name;
2626     } permissions[] = {
2627         { BLK_PERM_CONSISTENT_READ, "consistent read" },
2628         { BLK_PERM_WRITE,           "write" },
2629         { BLK_PERM_WRITE_UNCHANGED, "write unchanged" },
2630         { BLK_PERM_RESIZE,          "resize" },
2631         { 0, NULL }
2632     };
2633 
2634     GString *result = g_string_sized_new(30);
2635     struct perm_name *p;
2636 
2637     for (p = permissions; p->name; p++) {
2638         if (perm & p->perm) {
2639             if (result->len > 0) {
2640                 g_string_append(result, ", ");
2641             }
2642             g_string_append(result, p->name);
2643         }
2644     }
2645 
2646     return g_string_free(result, FALSE);
2647 }
2648 
2649 
2650 /*
2651  * @tran is allowed to be NULL. In this case no rollback is possible.
2652  *
2653  * After calling this function, the transaction @tran may only be completed
2654  * while holding a reader lock for the graph.
2655  */
2656 static int GRAPH_RDLOCK
2657 bdrv_refresh_perms(BlockDriverState *bs, Transaction *tran, Error **errp)
2658 {
2659     int ret;
2660     Transaction *local_tran = NULL;
2661     g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
2662     GLOBAL_STATE_CODE();
2663 
2664     if (!tran) {
2665         tran = local_tran = tran_new();
2666     }
2667 
2668     ret = bdrv_do_refresh_perms(list, NULL, tran, errp);
2669 
2670     if (local_tran) {
2671         tran_finalize(local_tran, ret);
2672     }
2673 
2674     return ret;
2675 }
2676 
2677 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
2678                             Error **errp)
2679 {
2680     Error *local_err = NULL;
2681     Transaction *tran = tran_new();
2682     int ret;
2683 
2684     GLOBAL_STATE_CODE();
2685 
2686     bdrv_child_set_perm(c, perm, shared, tran);
2687 
2688     ret = bdrv_refresh_perms(c->bs, tran, &local_err);
2689 
2690     tran_finalize(tran, ret);
2691 
2692     if (ret < 0) {
2693         if ((perm & ~c->perm) || (c->shared_perm & ~shared)) {
2694             /* tighten permissions */
2695             error_propagate(errp, local_err);
2696         } else {
2697             /*
2698              * Our caller may intend to only loosen restrictions and
2699              * does not expect this function to fail.  Errors are not
2700              * fatal in such a case, so we can just hide them from our
2701              * caller.
2702              */
2703             error_free(local_err);
2704             ret = 0;
2705         }
2706     }
2707 
2708     return ret;
2709 }
2710 
2711 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
2712 {
2713     uint64_t parent_perms, parent_shared;
2714     uint64_t perms, shared;
2715 
2716     GLOBAL_STATE_CODE();
2717 
2718     bdrv_get_cumulative_perm(bs, &parent_perms, &parent_shared);
2719     bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2720                     parent_perms, parent_shared, &perms, &shared);
2721 
2722     return bdrv_child_try_set_perm(c, perms, shared, errp);
2723 }
2724 
2725 /*
2726  * Default implementation for .bdrv_child_perm() for block filters:
2727  * Forward CONSISTENT_READ, WRITE, WRITE_UNCHANGED, and RESIZE to the
2728  * filtered child.
2729  */
2730 static void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
2731                                       BdrvChildRole role,
2732                                       BlockReopenQueue *reopen_queue,
2733                                       uint64_t perm, uint64_t shared,
2734                                       uint64_t *nperm, uint64_t *nshared)
2735 {
2736     GLOBAL_STATE_CODE();
2737     *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
2738     *nshared = (shared & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
2739 }
2740 
2741 static void bdrv_default_perms_for_cow(BlockDriverState *bs, BdrvChild *c,
2742                                        BdrvChildRole role,
2743                                        BlockReopenQueue *reopen_queue,
2744                                        uint64_t perm, uint64_t shared,
2745                                        uint64_t *nperm, uint64_t *nshared)
2746 {
2747     assert(role & BDRV_CHILD_COW);
2748     GLOBAL_STATE_CODE();
2749 
2750     /*
2751      * We want consistent read from backing files if the parent needs it.
2752      * No other operations are performed on backing files.
2753      */
2754     perm &= BLK_PERM_CONSISTENT_READ;
2755 
2756     /*
2757      * If the parent can deal with changing data, we're okay with a
2758      * writable and resizable backing file.
2759      * TODO Require !(perm & BLK_PERM_CONSISTENT_READ), too?
2760      */
2761     if (shared & BLK_PERM_WRITE) {
2762         shared = BLK_PERM_WRITE | BLK_PERM_RESIZE;
2763     } else {
2764         shared = 0;
2765     }
2766 
2767     shared |= BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED;
2768 
2769     if (bs->open_flags & BDRV_O_INACTIVE) {
2770         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2771     }
2772 
2773     *nperm = perm;
2774     *nshared = shared;
2775 }
2776 
2777 static void bdrv_default_perms_for_storage(BlockDriverState *bs, BdrvChild *c,
2778                                            BdrvChildRole role,
2779                                            BlockReopenQueue *reopen_queue,
2780                                            uint64_t perm, uint64_t shared,
2781                                            uint64_t *nperm, uint64_t *nshared)
2782 {
2783     int flags;
2784 
2785     GLOBAL_STATE_CODE();
2786     assert(role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA));
2787 
2788     flags = bdrv_reopen_get_flags(reopen_queue, bs);
2789 
2790     /*
2791      * Apart from the modifications below, the same permissions are
2792      * forwarded and left alone as for filters
2793      */
2794     bdrv_filter_default_perms(bs, c, role, reopen_queue,
2795                               perm, shared, &perm, &shared);
2796 
2797     if (role & BDRV_CHILD_METADATA) {
2798         /* Format drivers may touch metadata even if the guest doesn't write */
2799         if (bdrv_is_writable_after_reopen(bs, reopen_queue)) {
2800             perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2801         }
2802 
2803         /*
2804          * bs->file always needs to be consistent because of the
2805          * metadata. We can never allow other users to resize or write
2806          * to it.
2807          */
2808         if (!(flags & BDRV_O_NO_IO)) {
2809             perm |= BLK_PERM_CONSISTENT_READ;
2810         }
2811         shared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
2812     }
2813 
2814     if (role & BDRV_CHILD_DATA) {
2815         /*
2816          * Technically, everything in this block is a subset of the
2817          * BDRV_CHILD_METADATA path taken above, and so this could
2818          * be an "else if" branch.  However, that is not obvious, and
2819          * this function is not performance critical, therefore we let
2820          * this be an independent "if".
2821          */
2822 
2823         /*
2824          * We cannot allow other users to resize the file because the
2825          * format driver might have some assumptions about the size
2826          * (e.g. because it is stored in metadata, or because the file
2827          * is split into fixed-size data files).
2828          */
2829         shared &= ~BLK_PERM_RESIZE;
2830 
2831         /*
2832          * WRITE_UNCHANGED often cannot be performed as such on the
2833          * data file.  For example, the qcow2 driver may still need to
2834          * write copied clusters on copy-on-read.
2835          */
2836         if (perm & BLK_PERM_WRITE_UNCHANGED) {
2837             perm |= BLK_PERM_WRITE;
2838         }
2839 
2840         /*
2841          * If the data file is written to, the format driver may
2842          * expect to be able to resize it by writing beyond the EOF.
2843          */
2844         if (perm & BLK_PERM_WRITE) {
2845             perm |= BLK_PERM_RESIZE;
2846         }
2847     }
2848 
2849     if (bs->open_flags & BDRV_O_INACTIVE) {
2850         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2851     }
2852 
2853     *nperm = perm;
2854     *nshared = shared;
2855 }
2856 
2857 void bdrv_default_perms(BlockDriverState *bs, BdrvChild *c,
2858                         BdrvChildRole role, BlockReopenQueue *reopen_queue,
2859                         uint64_t perm, uint64_t shared,
2860                         uint64_t *nperm, uint64_t *nshared)
2861 {
2862     GLOBAL_STATE_CODE();
2863     if (role & BDRV_CHILD_FILTERED) {
2864         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
2865                          BDRV_CHILD_COW)));
2866         bdrv_filter_default_perms(bs, c, role, reopen_queue,
2867                                   perm, shared, nperm, nshared);
2868     } else if (role & BDRV_CHILD_COW) {
2869         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA)));
2870         bdrv_default_perms_for_cow(bs, c, role, reopen_queue,
2871                                    perm, shared, nperm, nshared);
2872     } else if (role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA)) {
2873         bdrv_default_perms_for_storage(bs, c, role, reopen_queue,
2874                                        perm, shared, nperm, nshared);
2875     } else {
2876         g_assert_not_reached();
2877     }
2878 }
2879 
2880 uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
2881 {
2882     static const uint64_t permissions[] = {
2883         [BLOCK_PERMISSION_CONSISTENT_READ]  = BLK_PERM_CONSISTENT_READ,
2884         [BLOCK_PERMISSION_WRITE]            = BLK_PERM_WRITE,
2885         [BLOCK_PERMISSION_WRITE_UNCHANGED]  = BLK_PERM_WRITE_UNCHANGED,
2886         [BLOCK_PERMISSION_RESIZE]           = BLK_PERM_RESIZE,
2887     };
2888 
2889     QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
2890     QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
2891 
2892     assert(qapi_perm < BLOCK_PERMISSION__MAX);
2893 
2894     return permissions[qapi_perm];
2895 }
2896 
2897 /*
2898  * Replaces the node that a BdrvChild points to without updating permissions.
2899  *
2900  * If @new_bs is non-NULL, the parent of @child must already be drained through
2901  * @child and the caller must hold the AioContext lock for @new_bs.
2902  */
2903 static void GRAPH_WRLOCK
2904 bdrv_replace_child_noperm(BdrvChild *child, BlockDriverState *new_bs)
2905 {
2906     BlockDriverState *old_bs = child->bs;
2907     int new_bs_quiesce_counter;
2908 
2909     assert(!child->frozen);
2910 
2911     /*
2912      * If we want to change the BdrvChild to point to a drained node as its new
2913      * child->bs, we need to make sure that its new parent is drained, too. In
2914      * other words, either child->quiesce_parent must already be true or we must
2915      * be able to set it and keep the parent's quiesce_counter consistent with
2916      * that, but without polling or starting new requests (this function
2917      * guarantees that it doesn't poll, and starting new requests would be
2918      * against the invariants of drain sections).
2919      *
2920      * To keep things simple, we pick the first option (child->quiesce_parent
2921      * must already be true). We also generalise the rule a bit to make it
2922      * easier to verify in callers and more likely to be covered in test cases:
2923      * The parent must be quiesced through this child even if new_bs isn't
2924      * currently drained.
2925      *
2926      * The only exception is for callers that always pass new_bs == NULL. In
2927      * this case, we obviously never need to consider the case of a drained
2928      * new_bs, so we can keep the callers simpler by allowing them not to drain
2929      * the parent.
2930      */
2931     assert(!new_bs || child->quiesced_parent);
2932     assert(old_bs != new_bs);
2933     GLOBAL_STATE_CODE();
2934 
2935     if (old_bs && new_bs) {
2936         assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
2937     }
2938 
2939     if (old_bs) {
2940         if (child->klass->detach) {
2941             child->klass->detach(child);
2942         }
2943         QLIST_REMOVE(child, next_parent);
2944     }
2945 
2946     child->bs = new_bs;
2947 
2948     if (new_bs) {
2949         QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
2950         if (child->klass->attach) {
2951             child->klass->attach(child);
2952         }
2953     }
2954 
2955     /*
2956      * If the parent was drained through this BdrvChild previously, but new_bs
2957      * is not drained, allow requests to come in only after the new node has
2958      * been attached.
2959      */
2960     new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
2961     if (!new_bs_quiesce_counter && child->quiesced_parent) {
2962         bdrv_parent_drained_end_single(child);
2963     }
2964 }
2965 
2966 /**
2967  * Free the given @child.
2968  *
2969  * The child must be empty (i.e. `child->bs == NULL`) and it must be
2970  * unused (i.e. not in a children list).
2971  */
2972 static void bdrv_child_free(BdrvChild *child)
2973 {
2974     assert(!child->bs);
2975     GLOBAL_STATE_CODE();
2976     assert(!child->next.le_prev); /* not in children list */
2977 
2978     g_free(child->name);
2979     g_free(child);
2980 }
2981 
2982 typedef struct BdrvAttachChildCommonState {
2983     BdrvChild *child;
2984     AioContext *old_parent_ctx;
2985     AioContext *old_child_ctx;
2986 } BdrvAttachChildCommonState;
2987 
2988 static void GRAPH_WRLOCK bdrv_attach_child_common_abort(void *opaque)
2989 {
2990     BdrvAttachChildCommonState *s = opaque;
2991     BlockDriverState *bs = s->child->bs;
2992 
2993     GLOBAL_STATE_CODE();
2994     assert_bdrv_graph_writable();
2995 
2996     bdrv_replace_child_noperm(s->child, NULL);
2997 
2998     if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
2999         bdrv_try_change_aio_context(bs, s->old_child_ctx, NULL, &error_abort);
3000     }
3001 
3002     if (bdrv_child_get_parent_aio_context(s->child) != s->old_parent_ctx) {
3003         Transaction *tran;
3004         GHashTable *visited;
3005         bool ret;
3006 
3007         tran = tran_new();
3008 
3009         /* No need to visit `child`, because it has been detached already */
3010         visited = g_hash_table_new(NULL, NULL);
3011         ret = s->child->klass->change_aio_ctx(s->child, s->old_parent_ctx,
3012                                               visited, tran, &error_abort);
3013         g_hash_table_destroy(visited);
3014 
3015         /* transaction is supposed to always succeed */
3016         assert(ret == true);
3017         tran_commit(tran);
3018     }
3019 
3020     bdrv_schedule_unref(bs);
3021     bdrv_child_free(s->child);
3022 }
3023 
3024 static TransactionActionDrv bdrv_attach_child_common_drv = {
3025     .abort = bdrv_attach_child_common_abort,
3026     .clean = g_free,
3027 };
3028 
3029 /*
3030  * Common part of attaching bdrv child to bs or to blk or to job
3031  *
3032  * Function doesn't update permissions, caller is responsible for this.
3033  *
3034  * After calling this function, the transaction @tran may only be completed
3035  * while holding a writer lock for the graph.
3036  *
3037  * Returns new created child.
3038  *
3039  * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
3040  * @child_bs can move to a different AioContext in this function. Callers must
3041  * make sure that their AioContext locking is still correct after this.
3042  */
3043 static BdrvChild * GRAPH_WRLOCK
3044 bdrv_attach_child_common(BlockDriverState *child_bs,
3045                          const char *child_name,
3046                          const BdrvChildClass *child_class,
3047                          BdrvChildRole child_role,
3048                          uint64_t perm, uint64_t shared_perm,
3049                          void *opaque,
3050                          Transaction *tran, Error **errp)
3051 {
3052     BdrvChild *new_child;
3053     AioContext *parent_ctx, *new_child_ctx;
3054     AioContext *child_ctx = bdrv_get_aio_context(child_bs);
3055 
3056     assert(child_class->get_parent_desc);
3057     GLOBAL_STATE_CODE();
3058 
3059     new_child = g_new(BdrvChild, 1);
3060     *new_child = (BdrvChild) {
3061         .bs             = NULL,
3062         .name           = g_strdup(child_name),
3063         .klass          = child_class,
3064         .role           = child_role,
3065         .perm           = perm,
3066         .shared_perm    = shared_perm,
3067         .opaque         = opaque,
3068     };
3069 
3070     /*
3071      * If the AioContexts don't match, first try to move the subtree of
3072      * child_bs into the AioContext of the new parent. If this doesn't work,
3073      * try moving the parent into the AioContext of child_bs instead.
3074      */
3075     parent_ctx = bdrv_child_get_parent_aio_context(new_child);
3076     if (child_ctx != parent_ctx) {
3077         Error *local_err = NULL;
3078         int ret = bdrv_try_change_aio_context(child_bs, parent_ctx, NULL,
3079                                               &local_err);
3080 
3081         if (ret < 0 && child_class->change_aio_ctx) {
3082             Transaction *aio_ctx_tran = tran_new();
3083             GHashTable *visited = g_hash_table_new(NULL, NULL);
3084             bool ret_child;
3085 
3086             g_hash_table_add(visited, new_child);
3087             ret_child = child_class->change_aio_ctx(new_child, child_ctx,
3088                                                     visited, aio_ctx_tran,
3089                                                     NULL);
3090             if (ret_child == true) {
3091                 error_free(local_err);
3092                 ret = 0;
3093             }
3094             tran_finalize(aio_ctx_tran, ret_child == true ? 0 : -1);
3095             g_hash_table_destroy(visited);
3096         }
3097 
3098         if (ret < 0) {
3099             error_propagate(errp, local_err);
3100             bdrv_child_free(new_child);
3101             return NULL;
3102         }
3103     }
3104 
3105     new_child_ctx = bdrv_get_aio_context(child_bs);
3106     if (new_child_ctx != child_ctx) {
3107         aio_context_release(child_ctx);
3108         aio_context_acquire(new_child_ctx);
3109     }
3110 
3111     bdrv_ref(child_bs);
3112     /*
3113      * Let every new BdrvChild start with a drained parent. Inserting the child
3114      * in the graph with bdrv_replace_child_noperm() will undrain it if
3115      * @child_bs is not drained.
3116      *
3117      * The child was only just created and is not yet visible in global state
3118      * until bdrv_replace_child_noperm() inserts it into the graph, so nobody
3119      * could have sent requests and polling is not necessary.
3120      *
3121      * Note that this means that the parent isn't fully drained yet, we only
3122      * stop new requests from coming in. This is fine, we don't care about the
3123      * old requests here, they are not for this child. If another place enters a
3124      * drain section for the same parent, but wants it to be fully quiesced, it
3125      * will not run most of the the code in .drained_begin() again (which is not
3126      * a problem, we already did this), but it will still poll until the parent
3127      * is fully quiesced, so it will not be negatively affected either.
3128      */
3129     bdrv_parent_drained_begin_single(new_child);
3130     bdrv_replace_child_noperm(new_child, child_bs);
3131 
3132     BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
3133     *s = (BdrvAttachChildCommonState) {
3134         .child = new_child,
3135         .old_parent_ctx = parent_ctx,
3136         .old_child_ctx = child_ctx,
3137     };
3138     tran_add(tran, &bdrv_attach_child_common_drv, s);
3139 
3140     if (new_child_ctx != child_ctx) {
3141         aio_context_release(new_child_ctx);
3142         aio_context_acquire(child_ctx);
3143     }
3144 
3145     return new_child;
3146 }
3147 
3148 /*
3149  * Function doesn't update permissions, caller is responsible for this.
3150  *
3151  * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
3152  * @child_bs can move to a different AioContext in this function. Callers must
3153  * make sure that their AioContext locking is still correct after this.
3154  *
3155  * After calling this function, the transaction @tran may only be completed
3156  * while holding a writer lock for the graph.
3157  */
3158 static BdrvChild * GRAPH_WRLOCK
3159 bdrv_attach_child_noperm(BlockDriverState *parent_bs,
3160                          BlockDriverState *child_bs,
3161                          const char *child_name,
3162                          const BdrvChildClass *child_class,
3163                          BdrvChildRole child_role,
3164                          Transaction *tran,
3165                          Error **errp)
3166 {
3167     uint64_t perm, shared_perm;
3168 
3169     assert(parent_bs->drv);
3170     GLOBAL_STATE_CODE();
3171 
3172     if (bdrv_recurse_has_child(child_bs, parent_bs)) {
3173         error_setg(errp, "Making '%s' a %s child of '%s' would create a cycle",
3174                    child_bs->node_name, child_name, parent_bs->node_name);
3175         return NULL;
3176     }
3177 
3178     bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
3179     bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
3180                     perm, shared_perm, &perm, &shared_perm);
3181 
3182     return bdrv_attach_child_common(child_bs, child_name, child_class,
3183                                     child_role, perm, shared_perm, parent_bs,
3184                                     tran, errp);
3185 }
3186 
3187 /*
3188  * This function steals the reference to child_bs from the caller.
3189  * That reference is later dropped by bdrv_root_unref_child().
3190  *
3191  * On failure NULL is returned, errp is set and the reference to
3192  * child_bs is also dropped.
3193  *
3194  * The caller must hold the AioContext lock @child_bs, but not that of @ctx
3195  * (unless @child_bs is already in @ctx).
3196  */
3197 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
3198                                   const char *child_name,
3199                                   const BdrvChildClass *child_class,
3200                                   BdrvChildRole child_role,
3201                                   uint64_t perm, uint64_t shared_perm,
3202                                   void *opaque, Error **errp)
3203 {
3204     int ret;
3205     BdrvChild *child;
3206     Transaction *tran = tran_new();
3207 
3208     GLOBAL_STATE_CODE();
3209 
3210     bdrv_graph_wrlock(child_bs);
3211 
3212     child = bdrv_attach_child_common(child_bs, child_name, child_class,
3213                                    child_role, perm, shared_perm, opaque,
3214                                    tran, errp);
3215     if (!child) {
3216         ret = -EINVAL;
3217         goto out;
3218     }
3219 
3220     ret = bdrv_refresh_perms(child_bs, tran, errp);
3221 
3222 out:
3223     tran_finalize(tran, ret);
3224     bdrv_graph_wrunlock();
3225 
3226     bdrv_unref(child_bs);
3227 
3228     return ret < 0 ? NULL : child;
3229 }
3230 
3231 /*
3232  * This function transfers the reference to child_bs from the caller
3233  * to parent_bs. That reference is later dropped by parent_bs on
3234  * bdrv_close() or if someone calls bdrv_unref_child().
3235  *
3236  * On failure NULL is returned, errp is set and the reference to
3237  * child_bs is also dropped.
3238  *
3239  * If @parent_bs and @child_bs are in different AioContexts, the caller must
3240  * hold the AioContext lock for @child_bs, but not for @parent_bs.
3241  */
3242 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
3243                              BlockDriverState *child_bs,
3244                              const char *child_name,
3245                              const BdrvChildClass *child_class,
3246                              BdrvChildRole child_role,
3247                              Error **errp)
3248 {
3249     int ret;
3250     BdrvChild *child;
3251     Transaction *tran = tran_new();
3252 
3253     GLOBAL_STATE_CODE();
3254 
3255     child = bdrv_attach_child_noperm(parent_bs, child_bs, child_name,
3256                                      child_class, child_role, tran, errp);
3257     if (!child) {
3258         ret = -EINVAL;
3259         goto out;
3260     }
3261 
3262     ret = bdrv_refresh_perms(parent_bs, tran, errp);
3263     if (ret < 0) {
3264         goto out;
3265     }
3266 
3267 out:
3268     tran_finalize(tran, ret);
3269 
3270     bdrv_schedule_unref(child_bs);
3271 
3272     return ret < 0 ? NULL : child;
3273 }
3274 
3275 /* Callers must ensure that child->frozen is false. */
3276 void bdrv_root_unref_child(BdrvChild *child)
3277 {
3278     BlockDriverState *child_bs = child->bs;
3279 
3280     GLOBAL_STATE_CODE();
3281     bdrv_replace_child_noperm(child, NULL);
3282     bdrv_child_free(child);
3283 
3284     if (child_bs) {
3285         /*
3286          * Update permissions for old node. We're just taking a parent away, so
3287          * we're loosening restrictions. Errors of permission update are not
3288          * fatal in this case, ignore them.
3289          */
3290         bdrv_refresh_perms(child_bs, NULL, NULL);
3291 
3292         /*
3293          * When the parent requiring a non-default AioContext is removed, the
3294          * node moves back to the main AioContext
3295          */
3296         bdrv_try_change_aio_context(child_bs, qemu_get_aio_context(), NULL,
3297                                     NULL);
3298     }
3299 
3300     bdrv_schedule_unref(child_bs);
3301 }
3302 
3303 typedef struct BdrvSetInheritsFrom {
3304     BlockDriverState *bs;
3305     BlockDriverState *old_inherits_from;
3306 } BdrvSetInheritsFrom;
3307 
3308 static void bdrv_set_inherits_from_abort(void *opaque)
3309 {
3310     BdrvSetInheritsFrom *s = opaque;
3311 
3312     s->bs->inherits_from = s->old_inherits_from;
3313 }
3314 
3315 static TransactionActionDrv bdrv_set_inherits_from_drv = {
3316     .abort = bdrv_set_inherits_from_abort,
3317     .clean = g_free,
3318 };
3319 
3320 /* @tran is allowed to be NULL. In this case no rollback is possible */
3321 static void bdrv_set_inherits_from(BlockDriverState *bs,
3322                                    BlockDriverState *new_inherits_from,
3323                                    Transaction *tran)
3324 {
3325     if (tran) {
3326         BdrvSetInheritsFrom *s = g_new(BdrvSetInheritsFrom, 1);
3327 
3328         *s = (BdrvSetInheritsFrom) {
3329             .bs = bs,
3330             .old_inherits_from = bs->inherits_from,
3331         };
3332 
3333         tran_add(tran, &bdrv_set_inherits_from_drv, s);
3334     }
3335 
3336     bs->inherits_from = new_inherits_from;
3337 }
3338 
3339 /**
3340  * Clear all inherits_from pointers from children and grandchildren of
3341  * @root that point to @root, where necessary.
3342  * @tran is allowed to be NULL. In this case no rollback is possible
3343  */
3344 static void GRAPH_WRLOCK
3345 bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child,
3346                          Transaction *tran)
3347 {
3348     BdrvChild *c;
3349 
3350     if (child->bs->inherits_from == root) {
3351         /*
3352          * Remove inherits_from only when the last reference between root and
3353          * child->bs goes away.
3354          */
3355         QLIST_FOREACH(c, &root->children, next) {
3356             if (c != child && c->bs == child->bs) {
3357                 break;
3358             }
3359         }
3360         if (c == NULL) {
3361             bdrv_set_inherits_from(child->bs, NULL, tran);
3362         }
3363     }
3364 
3365     QLIST_FOREACH(c, &child->bs->children, next) {
3366         bdrv_unset_inherits_from(root, c, tran);
3367     }
3368 }
3369 
3370 /* Callers must ensure that child->frozen is false. */
3371 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
3372 {
3373     GLOBAL_STATE_CODE();
3374     if (child == NULL) {
3375         return;
3376     }
3377 
3378     bdrv_unset_inherits_from(parent, child, NULL);
3379     bdrv_root_unref_child(child);
3380 }
3381 
3382 
3383 static void GRAPH_RDLOCK
3384 bdrv_parent_cb_change_media(BlockDriverState *bs, bool load)
3385 {
3386     BdrvChild *c;
3387     GLOBAL_STATE_CODE();
3388     QLIST_FOREACH(c, &bs->parents, next_parent) {
3389         if (c->klass->change_media) {
3390             c->klass->change_media(c, load);
3391         }
3392     }
3393 }
3394 
3395 /* Return true if you can reach parent going through child->inherits_from
3396  * recursively. If parent or child are NULL, return false */
3397 static bool bdrv_inherits_from_recursive(BlockDriverState *child,
3398                                          BlockDriverState *parent)
3399 {
3400     while (child && child != parent) {
3401         child = child->inherits_from;
3402     }
3403 
3404     return child != NULL;
3405 }
3406 
3407 /*
3408  * Return the BdrvChildRole for @bs's backing child.  bs->backing is
3409  * mostly used for COW backing children (role = COW), but also for
3410  * filtered children (role = FILTERED | PRIMARY).
3411  */
3412 static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
3413 {
3414     if (bs->drv && bs->drv->is_filter) {
3415         return BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
3416     } else {
3417         return BDRV_CHILD_COW;
3418     }
3419 }
3420 
3421 /*
3422  * Sets the bs->backing or bs->file link of a BDS. A new reference is created;
3423  * callers which don't need their own reference any more must call bdrv_unref().
3424  *
3425  * If the respective child is already present (i.e. we're detaching a node),
3426  * that child node must be drained.
3427  *
3428  * Function doesn't update permissions, caller is responsible for this.
3429  *
3430  * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
3431  * @child_bs can move to a different AioContext in this function. Callers must
3432  * make sure that their AioContext locking is still correct after this.
3433  *
3434  * After calling this function, the transaction @tran may only be completed
3435  * while holding a writer lock for the graph.
3436  */
3437 static int GRAPH_WRLOCK
3438 bdrv_set_file_or_backing_noperm(BlockDriverState *parent_bs,
3439                                 BlockDriverState *child_bs,
3440                                 bool is_backing,
3441                                 Transaction *tran, Error **errp)
3442 {
3443     bool update_inherits_from =
3444         bdrv_inherits_from_recursive(child_bs, parent_bs);
3445     BdrvChild *child = is_backing ? parent_bs->backing : parent_bs->file;
3446     BdrvChildRole role;
3447 
3448     GLOBAL_STATE_CODE();
3449 
3450     if (!parent_bs->drv) {
3451         /*
3452          * Node without drv is an object without a class :/. TODO: finally fix
3453          * qcow2 driver to never clear bs->drv and implement format corruption
3454          * handling in other way.
3455          */
3456         error_setg(errp, "Node corrupted");
3457         return -EINVAL;
3458     }
3459 
3460     if (child && child->frozen) {
3461         error_setg(errp, "Cannot change frozen '%s' link from '%s' to '%s'",
3462                    child->name, parent_bs->node_name, child->bs->node_name);
3463         return -EPERM;
3464     }
3465 
3466     if (is_backing && !parent_bs->drv->is_filter &&
3467         !parent_bs->drv->supports_backing)
3468     {
3469         error_setg(errp, "Driver '%s' of node '%s' does not support backing "
3470                    "files", parent_bs->drv->format_name, parent_bs->node_name);
3471         return -EINVAL;
3472     }
3473 
3474     if (parent_bs->drv->is_filter) {
3475         role = BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
3476     } else if (is_backing) {
3477         role = BDRV_CHILD_COW;
3478     } else {
3479         /*
3480          * We only can use same role as it is in existing child. We don't have
3481          * infrastructure to determine role of file child in generic way
3482          */
3483         if (!child) {
3484             error_setg(errp, "Cannot set file child to format node without "
3485                        "file child");
3486             return -EINVAL;
3487         }
3488         role = child->role;
3489     }
3490 
3491     if (child) {
3492         assert(child->bs->quiesce_counter);
3493         bdrv_unset_inherits_from(parent_bs, child, tran);
3494         bdrv_remove_child(child, tran);
3495     }
3496 
3497     if (!child_bs) {
3498         goto out;
3499     }
3500 
3501     child = bdrv_attach_child_noperm(parent_bs, child_bs,
3502                                      is_backing ? "backing" : "file",
3503                                      &child_of_bds, role,
3504                                      tran, errp);
3505     if (!child) {
3506         return -EINVAL;
3507     }
3508 
3509 
3510     /*
3511      * If inherits_from pointed recursively to bs then let's update it to
3512      * point directly to bs (else it will become NULL).
3513      */
3514     if (update_inherits_from) {
3515         bdrv_set_inherits_from(child_bs, parent_bs, tran);
3516     }
3517 
3518 out:
3519     bdrv_refresh_limits(parent_bs, tran, NULL);
3520 
3521     return 0;
3522 }
3523 
3524 /*
3525  * The caller must hold the AioContext lock for @backing_hd. Both @bs and
3526  * @backing_hd can move to a different AioContext in this function. Callers must
3527  * make sure that their AioContext locking is still correct after this.
3528  *
3529  * If a backing child is already present (i.e. we're detaching a node), that
3530  * child node must be drained.
3531  *
3532  * After calling this function, the transaction @tran may only be completed
3533  * while holding a writer lock for the graph.
3534  */
3535 static int GRAPH_WRLOCK
3536 bdrv_set_backing_noperm(BlockDriverState *bs,
3537                         BlockDriverState *backing_hd,
3538                         Transaction *tran, Error **errp)
3539 {
3540     GLOBAL_STATE_CODE();
3541     return bdrv_set_file_or_backing_noperm(bs, backing_hd, true, tran, errp);
3542 }
3543 
3544 int bdrv_set_backing_hd_drained(BlockDriverState *bs,
3545                                 BlockDriverState *backing_hd,
3546                                 Error **errp)
3547 {
3548     int ret;
3549     Transaction *tran = tran_new();
3550 
3551     GLOBAL_STATE_CODE();
3552     assert(bs->quiesce_counter > 0);
3553     if (bs->backing) {
3554         assert(bs->backing->bs->quiesce_counter > 0);
3555     }
3556     bdrv_graph_wrlock(backing_hd);
3557 
3558     ret = bdrv_set_backing_noperm(bs, backing_hd, tran, errp);
3559     if (ret < 0) {
3560         goto out;
3561     }
3562 
3563     ret = bdrv_refresh_perms(bs, tran, errp);
3564 out:
3565     tran_finalize(tran, ret);
3566     bdrv_graph_wrunlock();
3567     return ret;
3568 }
3569 
3570 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
3571                         Error **errp)
3572 {
3573     BlockDriverState *drain_bs = bs->backing ? bs->backing->bs : bs;
3574     int ret;
3575     GLOBAL_STATE_CODE();
3576 
3577     bdrv_ref(drain_bs);
3578     bdrv_drained_begin(drain_bs);
3579     ret = bdrv_set_backing_hd_drained(bs, backing_hd, errp);
3580     bdrv_drained_end(drain_bs);
3581     bdrv_unref(drain_bs);
3582 
3583     return ret;
3584 }
3585 
3586 /*
3587  * Opens the backing file for a BlockDriverState if not yet open
3588  *
3589  * bdref_key specifies the key for the image's BlockdevRef in the options QDict.
3590  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3591  * itself, all options starting with "${bdref_key}." are considered part of the
3592  * BlockdevRef.
3593  *
3594  * The caller must hold the main AioContext lock.
3595  *
3596  * TODO Can this be unified with bdrv_open_image()?
3597  */
3598 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
3599                            const char *bdref_key, Error **errp)
3600 {
3601     char *backing_filename = NULL;
3602     char *bdref_key_dot;
3603     const char *reference = NULL;
3604     int ret = 0;
3605     bool implicit_backing = false;
3606     BlockDriverState *backing_hd;
3607     AioContext *backing_hd_ctx;
3608     QDict *options;
3609     QDict *tmp_parent_options = NULL;
3610     Error *local_err = NULL;
3611 
3612     GLOBAL_STATE_CODE();
3613 
3614     if (bs->backing != NULL) {
3615         goto free_exit;
3616     }
3617 
3618     /* NULL means an empty set of options */
3619     if (parent_options == NULL) {
3620         tmp_parent_options = qdict_new();
3621         parent_options = tmp_parent_options;
3622     }
3623 
3624     bs->open_flags &= ~BDRV_O_NO_BACKING;
3625 
3626     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3627     qdict_extract_subqdict(parent_options, &options, bdref_key_dot);
3628     g_free(bdref_key_dot);
3629 
3630     /*
3631      * Caution: while qdict_get_try_str() is fine, getting non-string
3632      * types would require more care.  When @parent_options come from
3633      * -blockdev or blockdev_add, its members are typed according to
3634      * the QAPI schema, but when they come from -drive, they're all
3635      * QString.
3636      */
3637     reference = qdict_get_try_str(parent_options, bdref_key);
3638     if (reference || qdict_haskey(options, "file.filename")) {
3639         /* keep backing_filename NULL */
3640     } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
3641         qobject_unref(options);
3642         goto free_exit;
3643     } else {
3644         if (qdict_size(options) == 0) {
3645             /* If the user specifies options that do not modify the
3646              * backing file's behavior, we might still consider it the
3647              * implicit backing file.  But it's easier this way, and
3648              * just specifying some of the backing BDS's options is
3649              * only possible with -drive anyway (otherwise the QAPI
3650              * schema forces the user to specify everything). */
3651             implicit_backing = !strcmp(bs->auto_backing_file, bs->backing_file);
3652         }
3653 
3654         bdrv_graph_rdlock_main_loop();
3655         backing_filename = bdrv_get_full_backing_filename(bs, &local_err);
3656         bdrv_graph_rdunlock_main_loop();
3657 
3658         if (local_err) {
3659             ret = -EINVAL;
3660             error_propagate(errp, local_err);
3661             qobject_unref(options);
3662             goto free_exit;
3663         }
3664     }
3665 
3666     if (!bs->drv || !bs->drv->supports_backing) {
3667         ret = -EINVAL;
3668         error_setg(errp, "Driver doesn't support backing files");
3669         qobject_unref(options);
3670         goto free_exit;
3671     }
3672 
3673     if (!reference &&
3674         bs->backing_format[0] != '\0' && !qdict_haskey(options, "driver")) {
3675         qdict_put_str(options, "driver", bs->backing_format);
3676     }
3677 
3678     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
3679                                    &child_of_bds, bdrv_backing_role(bs), errp);
3680     if (!backing_hd) {
3681         bs->open_flags |= BDRV_O_NO_BACKING;
3682         error_prepend(errp, "Could not open backing file: ");
3683         ret = -EINVAL;
3684         goto free_exit;
3685     }
3686 
3687     if (implicit_backing) {
3688         bdrv_graph_rdlock_main_loop();
3689         bdrv_refresh_filename(backing_hd);
3690         bdrv_graph_rdunlock_main_loop();
3691         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
3692                 backing_hd->filename);
3693     }
3694 
3695     /* Hook up the backing file link; drop our reference, bs owns the
3696      * backing_hd reference now */
3697     backing_hd_ctx = bdrv_get_aio_context(backing_hd);
3698     aio_context_acquire(backing_hd_ctx);
3699     ret = bdrv_set_backing_hd(bs, backing_hd, errp);
3700     bdrv_unref(backing_hd);
3701     aio_context_release(backing_hd_ctx);
3702 
3703     if (ret < 0) {
3704         goto free_exit;
3705     }
3706 
3707     qdict_del(parent_options, bdref_key);
3708 
3709 free_exit:
3710     g_free(backing_filename);
3711     qobject_unref(tmp_parent_options);
3712     return ret;
3713 }
3714 
3715 static BlockDriverState *
3716 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
3717                    BlockDriverState *parent, const BdrvChildClass *child_class,
3718                    BdrvChildRole child_role, bool allow_none, Error **errp)
3719 {
3720     BlockDriverState *bs = NULL;
3721     QDict *image_options;
3722     char *bdref_key_dot;
3723     const char *reference;
3724 
3725     assert(child_class != NULL);
3726 
3727     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3728     qdict_extract_subqdict(options, &image_options, bdref_key_dot);
3729     g_free(bdref_key_dot);
3730 
3731     /*
3732      * Caution: while qdict_get_try_str() is fine, getting non-string
3733      * types would require more care.  When @options come from
3734      * -blockdev or blockdev_add, its members are typed according to
3735      * the QAPI schema, but when they come from -drive, they're all
3736      * QString.
3737      */
3738     reference = qdict_get_try_str(options, bdref_key);
3739     if (!filename && !reference && !qdict_size(image_options)) {
3740         if (!allow_none) {
3741             error_setg(errp, "A block device must be specified for \"%s\"",
3742                        bdref_key);
3743         }
3744         qobject_unref(image_options);
3745         goto done;
3746     }
3747 
3748     bs = bdrv_open_inherit(filename, reference, image_options, 0,
3749                            parent, child_class, child_role, errp);
3750     if (!bs) {
3751         goto done;
3752     }
3753 
3754 done:
3755     qdict_del(options, bdref_key);
3756     return bs;
3757 }
3758 
3759 /*
3760  * Opens a disk image whose options are given as BlockdevRef in another block
3761  * device's options.
3762  *
3763  * If allow_none is true, no image will be opened if filename is false and no
3764  * BlockdevRef is given. NULL will be returned, but errp remains unset.
3765  *
3766  * bdrev_key specifies the key for the image's BlockdevRef in the options QDict.
3767  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3768  * itself, all options starting with "${bdref_key}." are considered part of the
3769  * BlockdevRef.
3770  *
3771  * The BlockdevRef will be removed from the options QDict.
3772  *
3773  * The caller must hold the lock of the main AioContext and no other AioContext.
3774  * @parent can move to a different AioContext in this function. Callers must
3775  * make sure that their AioContext locking is still correct after this.
3776  */
3777 BdrvChild *bdrv_open_child(const char *filename,
3778                            QDict *options, const char *bdref_key,
3779                            BlockDriverState *parent,
3780                            const BdrvChildClass *child_class,
3781                            BdrvChildRole child_role,
3782                            bool allow_none, Error **errp)
3783 {
3784     BlockDriverState *bs;
3785     BdrvChild *child;
3786     AioContext *ctx;
3787 
3788     GLOBAL_STATE_CODE();
3789 
3790     bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
3791                             child_role, allow_none, errp);
3792     if (bs == NULL) {
3793         return NULL;
3794     }
3795 
3796     bdrv_graph_wrlock(NULL);
3797     ctx = bdrv_get_aio_context(bs);
3798     aio_context_acquire(ctx);
3799     child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
3800                               errp);
3801     aio_context_release(ctx);
3802     bdrv_graph_wrunlock();
3803 
3804     return child;
3805 }
3806 
3807 /*
3808  * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
3809  *
3810  * The caller must hold the lock of the main AioContext and no other AioContext.
3811  * @parent can move to a different AioContext in this function. Callers must
3812  * make sure that their AioContext locking is still correct after this.
3813  */
3814 int bdrv_open_file_child(const char *filename,
3815                          QDict *options, const char *bdref_key,
3816                          BlockDriverState *parent, Error **errp)
3817 {
3818     BdrvChildRole role;
3819 
3820     /* commit_top and mirror_top don't use this function */
3821     assert(!parent->drv->filtered_child_is_backing);
3822     role = parent->drv->is_filter ?
3823         (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
3824 
3825     if (!bdrv_open_child(filename, options, bdref_key, parent,
3826                          &child_of_bds, role, false, errp))
3827     {
3828         return -EINVAL;
3829     }
3830 
3831     return 0;
3832 }
3833 
3834 /*
3835  * TODO Future callers may need to specify parent/child_class in order for
3836  * option inheritance to work. Existing callers use it for the root node.
3837  */
3838 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
3839 {
3840     BlockDriverState *bs = NULL;
3841     QObject *obj = NULL;
3842     QDict *qdict = NULL;
3843     const char *reference = NULL;
3844     Visitor *v = NULL;
3845 
3846     GLOBAL_STATE_CODE();
3847 
3848     if (ref->type == QTYPE_QSTRING) {
3849         reference = ref->u.reference;
3850     } else {
3851         BlockdevOptions *options = &ref->u.definition;
3852         assert(ref->type == QTYPE_QDICT);
3853 
3854         v = qobject_output_visitor_new(&obj);
3855         visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3856         visit_complete(v, &obj);
3857 
3858         qdict = qobject_to(QDict, obj);
3859         qdict_flatten(qdict);
3860 
3861         /* bdrv_open_inherit() defaults to the values in bdrv_flags (for
3862          * compatibility with other callers) rather than what we want as the
3863          * real defaults. Apply the defaults here instead. */
3864         qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
3865         qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
3866         qdict_set_default_str(qdict, BDRV_OPT_READ_ONLY, "off");
3867         qdict_set_default_str(qdict, BDRV_OPT_AUTO_READ_ONLY, "off");
3868 
3869     }
3870 
3871     bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, errp);
3872     obj = NULL;
3873     qobject_unref(obj);
3874     visit_free(v);
3875     return bs;
3876 }
3877 
3878 static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
3879                                                    int flags,
3880                                                    QDict *snapshot_options,
3881                                                    Error **errp)
3882 {
3883     g_autofree char *tmp_filename = NULL;
3884     int64_t total_size;
3885     QemuOpts *opts = NULL;
3886     BlockDriverState *bs_snapshot = NULL;
3887     AioContext *ctx = bdrv_get_aio_context(bs);
3888     int ret;
3889 
3890     GLOBAL_STATE_CODE();
3891 
3892     /* if snapshot, we create a temporary backing file and open it
3893        instead of opening 'filename' directly */
3894 
3895     /* Get the required size from the image */
3896     aio_context_acquire(ctx);
3897     total_size = bdrv_getlength(bs);
3898     aio_context_release(ctx);
3899 
3900     if (total_size < 0) {
3901         error_setg_errno(errp, -total_size, "Could not get image size");
3902         goto out;
3903     }
3904 
3905     /* Create the temporary image */
3906     tmp_filename = create_tmp_file(errp);
3907     if (!tmp_filename) {
3908         goto out;
3909     }
3910 
3911     opts = qemu_opts_create(bdrv_qcow2.create_opts, NULL, 0,
3912                             &error_abort);
3913     qemu_opt_set_number(opts, BLOCK_OPT_SIZE, total_size, &error_abort);
3914     ret = bdrv_create(&bdrv_qcow2, tmp_filename, opts, errp);
3915     qemu_opts_del(opts);
3916     if (ret < 0) {
3917         error_prepend(errp, "Could not create temporary overlay '%s': ",
3918                       tmp_filename);
3919         goto out;
3920     }
3921 
3922     /* Prepare options QDict for the temporary file */
3923     qdict_put_str(snapshot_options, "file.driver", "file");
3924     qdict_put_str(snapshot_options, "file.filename", tmp_filename);
3925     qdict_put_str(snapshot_options, "driver", "qcow2");
3926 
3927     bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
3928     snapshot_options = NULL;
3929     if (!bs_snapshot) {
3930         goto out;
3931     }
3932 
3933     aio_context_acquire(ctx);
3934     ret = bdrv_append(bs_snapshot, bs, errp);
3935     aio_context_release(ctx);
3936 
3937     if (ret < 0) {
3938         bs_snapshot = NULL;
3939         goto out;
3940     }
3941 
3942 out:
3943     qobject_unref(snapshot_options);
3944     return bs_snapshot;
3945 }
3946 
3947 /*
3948  * Opens a disk image (raw, qcow2, vmdk, ...)
3949  *
3950  * options is a QDict of options to pass to the block drivers, or NULL for an
3951  * empty set of options. The reference to the QDict belongs to the block layer
3952  * after the call (even on failure), so if the caller intends to reuse the
3953  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
3954  *
3955  * If *pbs is NULL, a new BDS will be created with a pointer to it stored there.
3956  * If it is not NULL, the referenced BDS will be reused.
3957  *
3958  * The reference parameter may be used to specify an existing block device which
3959  * should be opened. If specified, neither options nor a filename may be given,
3960  * nor can an existing BDS be reused (that is, *pbs has to be NULL).
3961  *
3962  * The caller must always hold the main AioContext lock.
3963  */
3964 static BlockDriverState * no_coroutine_fn
3965 bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
3966                   int flags, BlockDriverState *parent,
3967                   const BdrvChildClass *child_class, BdrvChildRole child_role,
3968                   Error **errp)
3969 {
3970     int ret;
3971     BlockBackend *file = NULL;
3972     BlockDriverState *bs;
3973     BlockDriver *drv = NULL;
3974     BdrvChild *child;
3975     const char *drvname;
3976     const char *backing;
3977     Error *local_err = NULL;
3978     QDict *snapshot_options = NULL;
3979     int snapshot_flags = 0;
3980     AioContext *ctx = qemu_get_aio_context();
3981 
3982     assert(!child_class || !flags);
3983     assert(!child_class == !parent);
3984     GLOBAL_STATE_CODE();
3985     assert(!qemu_in_coroutine());
3986 
3987     /* TODO We'll eventually have to take a writer lock in this function */
3988     GRAPH_RDLOCK_GUARD_MAINLOOP();
3989 
3990     if (reference) {
3991         bool options_non_empty = options ? qdict_size(options) : false;
3992         qobject_unref(options);
3993 
3994         if (filename || options_non_empty) {
3995             error_setg(errp, "Cannot reference an existing block device with "
3996                        "additional options or a new filename");
3997             return NULL;
3998         }
3999 
4000         bs = bdrv_lookup_bs(reference, reference, errp);
4001         if (!bs) {
4002             return NULL;
4003         }
4004 
4005         bdrv_ref(bs);
4006         return bs;
4007     }
4008 
4009     bs = bdrv_new();
4010 
4011     /* NULL means an empty set of options */
4012     if (options == NULL) {
4013         options = qdict_new();
4014     }
4015 
4016     /* json: syntax counts as explicit options, as if in the QDict */
4017     parse_json_protocol(options, &filename, &local_err);
4018     if (local_err) {
4019         goto fail;
4020     }
4021 
4022     bs->explicit_options = qdict_clone_shallow(options);
4023 
4024     if (child_class) {
4025         bool parent_is_format;
4026 
4027         if (parent->drv) {
4028             parent_is_format = parent->drv->is_format;
4029         } else {
4030             /*
4031              * parent->drv is not set yet because this node is opened for
4032              * (potential) format probing.  That means that @parent is going
4033              * to be a format node.
4034              */
4035             parent_is_format = true;
4036         }
4037 
4038         bs->inherits_from = parent;
4039         child_class->inherit_options(child_role, parent_is_format,
4040                                      &flags, options,
4041                                      parent->open_flags, parent->options);
4042     }
4043 
4044     ret = bdrv_fill_options(&options, filename, &flags, &local_err);
4045     if (ret < 0) {
4046         goto fail;
4047     }
4048 
4049     /*
4050      * Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
4051      * Caution: getting a boolean member of @options requires care.
4052      * When @options come from -blockdev or blockdev_add, members are
4053      * typed according to the QAPI schema, but when they come from
4054      * -drive, they're all QString.
4055      */
4056     if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
4057         !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
4058         flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
4059     } else {
4060         flags &= ~BDRV_O_RDWR;
4061     }
4062 
4063     if (flags & BDRV_O_SNAPSHOT) {
4064         snapshot_options = qdict_new();
4065         bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
4066                                    flags, options);
4067         /* Let bdrv_backing_options() override "read-only" */
4068         qdict_del(options, BDRV_OPT_READ_ONLY);
4069         bdrv_inherited_options(BDRV_CHILD_COW, true,
4070                                &flags, options, flags, options);
4071     }
4072 
4073     bs->open_flags = flags;
4074     bs->options = options;
4075     options = qdict_clone_shallow(options);
4076 
4077     /* Find the right image format driver */
4078     /* See cautionary note on accessing @options above */
4079     drvname = qdict_get_try_str(options, "driver");
4080     if (drvname) {
4081         drv = bdrv_find_format(drvname);
4082         if (!drv) {
4083             error_setg(errp, "Unknown driver: '%s'", drvname);
4084             goto fail;
4085         }
4086     }
4087 
4088     assert(drvname || !(flags & BDRV_O_PROTOCOL));
4089 
4090     /* See cautionary note on accessing @options above */
4091     backing = qdict_get_try_str(options, "backing");
4092     if (qobject_to(QNull, qdict_get(options, "backing")) != NULL ||
4093         (backing && *backing == '\0'))
4094     {
4095         if (backing) {
4096             warn_report("Use of \"backing\": \"\" is deprecated; "
4097                         "use \"backing\": null instead");
4098         }
4099         flags |= BDRV_O_NO_BACKING;
4100         qdict_del(bs->explicit_options, "backing");
4101         qdict_del(bs->options, "backing");
4102         qdict_del(options, "backing");
4103     }
4104 
4105     /* Open image file without format layer. This BlockBackend is only used for
4106      * probing, the block drivers will do their own bdrv_open_child() for the
4107      * same BDS, which is why we put the node name back into options. */
4108     if ((flags & BDRV_O_PROTOCOL) == 0) {
4109         BlockDriverState *file_bs;
4110 
4111         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
4112                                      &child_of_bds, BDRV_CHILD_IMAGE,
4113                                      true, &local_err);
4114         if (local_err) {
4115             goto fail;
4116         }
4117         if (file_bs != NULL) {
4118             /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
4119              * looking at the header to guess the image format. This works even
4120              * in cases where a guest would not see a consistent state. */
4121             ctx = bdrv_get_aio_context(file_bs);
4122             aio_context_acquire(ctx);
4123             file = blk_new(ctx, 0, BLK_PERM_ALL);
4124             blk_insert_bs(file, file_bs, &local_err);
4125             bdrv_unref(file_bs);
4126             aio_context_release(ctx);
4127 
4128             if (local_err) {
4129                 goto fail;
4130             }
4131 
4132             qdict_put_str(options, "file", bdrv_get_node_name(file_bs));
4133         }
4134     }
4135 
4136     /* Image format probing */
4137     bs->probed = !drv;
4138     if (!drv && file) {
4139         ret = find_image_format(file, filename, &drv, &local_err);
4140         if (ret < 0) {
4141             goto fail;
4142         }
4143         /*
4144          * This option update would logically belong in bdrv_fill_options(),
4145          * but we first need to open bs->file for the probing to work, while
4146          * opening bs->file already requires the (mostly) final set of options
4147          * so that cache mode etc. can be inherited.
4148          *
4149          * Adding the driver later is somewhat ugly, but it's not an option
4150          * that would ever be inherited, so it's correct. We just need to make
4151          * sure to update both bs->options (which has the full effective
4152          * options for bs) and options (which has file.* already removed).
4153          */
4154         qdict_put_str(bs->options, "driver", drv->format_name);
4155         qdict_put_str(options, "driver", drv->format_name);
4156     } else if (!drv) {
4157         error_setg(errp, "Must specify either driver or file");
4158         goto fail;
4159     }
4160 
4161     /* BDRV_O_PROTOCOL must be set iff a protocol BDS is about to be created */
4162     assert(!!(flags & BDRV_O_PROTOCOL) == !!drv->bdrv_file_open);
4163     /* file must be NULL if a protocol BDS is about to be created
4164      * (the inverse results in an error message from bdrv_open_common()) */
4165     assert(!(flags & BDRV_O_PROTOCOL) || !file);
4166 
4167     /* Open the image */
4168     ret = bdrv_open_common(bs, file, options, &local_err);
4169     if (ret < 0) {
4170         goto fail;
4171     }
4172 
4173     /* The AioContext could have changed during bdrv_open_common() */
4174     ctx = bdrv_get_aio_context(bs);
4175 
4176     if (file) {
4177         aio_context_acquire(ctx);
4178         blk_unref(file);
4179         aio_context_release(ctx);
4180         file = NULL;
4181     }
4182 
4183     /* If there is a backing file, use it */
4184     if ((flags & BDRV_O_NO_BACKING) == 0) {
4185         ret = bdrv_open_backing_file(bs, options, "backing", &local_err);
4186         if (ret < 0) {
4187             goto close_and_fail;
4188         }
4189     }
4190 
4191     /* Remove all children options and references
4192      * from bs->options and bs->explicit_options */
4193     QLIST_FOREACH(child, &bs->children, next) {
4194         char *child_key_dot;
4195         child_key_dot = g_strdup_printf("%s.", child->name);
4196         qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
4197         qdict_extract_subqdict(bs->options, NULL, child_key_dot);
4198         qdict_del(bs->explicit_options, child->name);
4199         qdict_del(bs->options, child->name);
4200         g_free(child_key_dot);
4201     }
4202 
4203     /* Check if any unknown options were used */
4204     if (qdict_size(options) != 0) {
4205         const QDictEntry *entry = qdict_first(options);
4206         if (flags & BDRV_O_PROTOCOL) {
4207             error_setg(errp, "Block protocol '%s' doesn't support the option "
4208                        "'%s'", drv->format_name, entry->key);
4209         } else {
4210             error_setg(errp,
4211                        "Block format '%s' does not support the option '%s'",
4212                        drv->format_name, entry->key);
4213         }
4214 
4215         goto close_and_fail;
4216     }
4217 
4218     bdrv_parent_cb_change_media(bs, true);
4219 
4220     qobject_unref(options);
4221     options = NULL;
4222 
4223     /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
4224      * temporary snapshot afterwards. */
4225     if (snapshot_flags) {
4226         BlockDriverState *snapshot_bs;
4227         snapshot_bs = bdrv_append_temp_snapshot(bs, snapshot_flags,
4228                                                 snapshot_options, &local_err);
4229         snapshot_options = NULL;
4230         if (local_err) {
4231             goto close_and_fail;
4232         }
4233         /* We are not going to return bs but the overlay on top of it
4234          * (snapshot_bs); thus, we have to drop the strong reference to bs
4235          * (which we obtained by calling bdrv_new()). bs will not be deleted,
4236          * though, because the overlay still has a reference to it. */
4237         aio_context_acquire(ctx);
4238         bdrv_unref(bs);
4239         aio_context_release(ctx);
4240         bs = snapshot_bs;
4241     }
4242 
4243     return bs;
4244 
4245 fail:
4246     aio_context_acquire(ctx);
4247     blk_unref(file);
4248     qobject_unref(snapshot_options);
4249     qobject_unref(bs->explicit_options);
4250     qobject_unref(bs->options);
4251     qobject_unref(options);
4252     bs->options = NULL;
4253     bs->explicit_options = NULL;
4254     bdrv_unref(bs);
4255     aio_context_release(ctx);
4256     error_propagate(errp, local_err);
4257     return NULL;
4258 
4259 close_and_fail:
4260     aio_context_acquire(ctx);
4261     bdrv_unref(bs);
4262     aio_context_release(ctx);
4263     qobject_unref(snapshot_options);
4264     qobject_unref(options);
4265     error_propagate(errp, local_err);
4266     return NULL;
4267 }
4268 
4269 /* The caller must always hold the main AioContext lock. */
4270 BlockDriverState *bdrv_open(const char *filename, const char *reference,
4271                             QDict *options, int flags, Error **errp)
4272 {
4273     GLOBAL_STATE_CODE();
4274 
4275     return bdrv_open_inherit(filename, reference, options, flags, NULL,
4276                              NULL, 0, errp);
4277 }
4278 
4279 /* Return true if the NULL-terminated @list contains @str */
4280 static bool is_str_in_list(const char *str, const char *const *list)
4281 {
4282     if (str && list) {
4283         int i;
4284         for (i = 0; list[i] != NULL; i++) {
4285             if (!strcmp(str, list[i])) {
4286                 return true;
4287             }
4288         }
4289     }
4290     return false;
4291 }
4292 
4293 /*
4294  * Check that every option set in @bs->options is also set in
4295  * @new_opts.
4296  *
4297  * Options listed in the common_options list and in
4298  * @bs->drv->mutable_opts are skipped.
4299  *
4300  * Return 0 on success, otherwise return -EINVAL and set @errp.
4301  */
4302 static int bdrv_reset_options_allowed(BlockDriverState *bs,
4303                                       const QDict *new_opts, Error **errp)
4304 {
4305     const QDictEntry *e;
4306     /* These options are common to all block drivers and are handled
4307      * in bdrv_reopen_prepare() so they can be left out of @new_opts */
4308     const char *const common_options[] = {
4309         "node-name", "discard", "cache.direct", "cache.no-flush",
4310         "read-only", "auto-read-only", "detect-zeroes", NULL
4311     };
4312 
4313     for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
4314         if (!qdict_haskey(new_opts, e->key) &&
4315             !is_str_in_list(e->key, common_options) &&
4316             !is_str_in_list(e->key, bs->drv->mutable_opts)) {
4317             error_setg(errp, "Option '%s' cannot be reset "
4318                        "to its default value", e->key);
4319             return -EINVAL;
4320         }
4321     }
4322 
4323     return 0;
4324 }
4325 
4326 /*
4327  * Returns true if @child can be reached recursively from @bs
4328  */
4329 static bool GRAPH_RDLOCK
4330 bdrv_recurse_has_child(BlockDriverState *bs, BlockDriverState *child)
4331 {
4332     BdrvChild *c;
4333 
4334     if (bs == child) {
4335         return true;
4336     }
4337 
4338     QLIST_FOREACH(c, &bs->children, next) {
4339         if (bdrv_recurse_has_child(c->bs, child)) {
4340             return true;
4341         }
4342     }
4343 
4344     return false;
4345 }
4346 
4347 /*
4348  * Adds a BlockDriverState to a simple queue for an atomic, transactional
4349  * reopen of multiple devices.
4350  *
4351  * bs_queue can either be an existing BlockReopenQueue that has had QTAILQ_INIT
4352  * already performed, or alternatively may be NULL a new BlockReopenQueue will
4353  * be created and initialized. This newly created BlockReopenQueue should be
4354  * passed back in for subsequent calls that are intended to be of the same
4355  * atomic 'set'.
4356  *
4357  * bs is the BlockDriverState to add to the reopen queue.
4358  *
4359  * options contains the changed options for the associated bs
4360  * (the BlockReopenQueue takes ownership)
4361  *
4362  * flags contains the open flags for the associated bs
4363  *
4364  * returns a pointer to bs_queue, which is either the newly allocated
4365  * bs_queue, or the existing bs_queue being used.
4366  *
4367  * bs is drained here and undrained by bdrv_reopen_queue_free().
4368  *
4369  * To be called with bs->aio_context locked.
4370  */
4371 static BlockReopenQueue * GRAPH_RDLOCK
4372 bdrv_reopen_queue_child(BlockReopenQueue *bs_queue, BlockDriverState *bs,
4373                         QDict *options, const BdrvChildClass *klass,
4374                         BdrvChildRole role, bool parent_is_format,
4375                         QDict *parent_options, int parent_flags,
4376                         bool keep_old_opts)
4377 {
4378     assert(bs != NULL);
4379 
4380     BlockReopenQueueEntry *bs_entry;
4381     BdrvChild *child;
4382     QDict *old_options, *explicit_options, *options_copy;
4383     int flags;
4384     QemuOpts *opts;
4385 
4386     GLOBAL_STATE_CODE();
4387 
4388     /*
4389      * Strictly speaking, draining is illegal under GRAPH_RDLOCK. We know that
4390      * we've been called with bdrv_graph_rdlock_main_loop(), though, so it's ok
4391      * in practice.
4392      */
4393     bdrv_drained_begin(bs);
4394 
4395     if (bs_queue == NULL) {
4396         bs_queue = g_new0(BlockReopenQueue, 1);
4397         QTAILQ_INIT(bs_queue);
4398     }
4399 
4400     if (!options) {
4401         options = qdict_new();
4402     }
4403 
4404     /* Check if this BlockDriverState is already in the queue */
4405     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4406         if (bs == bs_entry->state.bs) {
4407             break;
4408         }
4409     }
4410 
4411     /*
4412      * Precedence of options:
4413      * 1. Explicitly passed in options (highest)
4414      * 2. Retained from explicitly set options of bs
4415      * 3. Inherited from parent node
4416      * 4. Retained from effective options of bs
4417      */
4418 
4419     /* Old explicitly set values (don't overwrite by inherited value) */
4420     if (bs_entry || keep_old_opts) {
4421         old_options = qdict_clone_shallow(bs_entry ?
4422                                           bs_entry->state.explicit_options :
4423                                           bs->explicit_options);
4424         bdrv_join_options(bs, options, old_options);
4425         qobject_unref(old_options);
4426     }
4427 
4428     explicit_options = qdict_clone_shallow(options);
4429 
4430     /* Inherit from parent node */
4431     if (parent_options) {
4432         flags = 0;
4433         klass->inherit_options(role, parent_is_format, &flags, options,
4434                                parent_flags, parent_options);
4435     } else {
4436         flags = bdrv_get_flags(bs);
4437     }
4438 
4439     if (keep_old_opts) {
4440         /* Old values are used for options that aren't set yet */
4441         old_options = qdict_clone_shallow(bs->options);
4442         bdrv_join_options(bs, options, old_options);
4443         qobject_unref(old_options);
4444     }
4445 
4446     /* We have the final set of options so let's update the flags */
4447     options_copy = qdict_clone_shallow(options);
4448     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
4449     qemu_opts_absorb_qdict(opts, options_copy, NULL);
4450     update_flags_from_options(&flags, opts);
4451     qemu_opts_del(opts);
4452     qobject_unref(options_copy);
4453 
4454     /* bdrv_open_inherit() sets and clears some additional flags internally */
4455     flags &= ~BDRV_O_PROTOCOL;
4456     if (flags & BDRV_O_RDWR) {
4457         flags |= BDRV_O_ALLOW_RDWR;
4458     }
4459 
4460     if (!bs_entry) {
4461         bs_entry = g_new0(BlockReopenQueueEntry, 1);
4462         QTAILQ_INSERT_TAIL(bs_queue, bs_entry, entry);
4463     } else {
4464         qobject_unref(bs_entry->state.options);
4465         qobject_unref(bs_entry->state.explicit_options);
4466     }
4467 
4468     bs_entry->state.bs = bs;
4469     bs_entry->state.options = options;
4470     bs_entry->state.explicit_options = explicit_options;
4471     bs_entry->state.flags = flags;
4472 
4473     /*
4474      * If keep_old_opts is false then it means that unspecified
4475      * options must be reset to their original value. We don't allow
4476      * resetting 'backing' but we need to know if the option is
4477      * missing in order to decide if we have to return an error.
4478      */
4479     if (!keep_old_opts) {
4480         bs_entry->state.backing_missing =
4481             !qdict_haskey(options, "backing") &&
4482             !qdict_haskey(options, "backing.driver");
4483     }
4484 
4485     QLIST_FOREACH(child, &bs->children, next) {
4486         QDict *new_child_options = NULL;
4487         bool child_keep_old = keep_old_opts;
4488 
4489         /* reopen can only change the options of block devices that were
4490          * implicitly created and inherited options. For other (referenced)
4491          * block devices, a syntax like "backing.foo" results in an error. */
4492         if (child->bs->inherits_from != bs) {
4493             continue;
4494         }
4495 
4496         /* Check if the options contain a child reference */
4497         if (qdict_haskey(options, child->name)) {
4498             const char *childref = qdict_get_try_str(options, child->name);
4499             /*
4500              * The current child must not be reopened if the child
4501              * reference is null or points to a different node.
4502              */
4503             if (g_strcmp0(childref, child->bs->node_name)) {
4504                 continue;
4505             }
4506             /*
4507              * If the child reference points to the current child then
4508              * reopen it with its existing set of options (note that
4509              * it can still inherit new options from the parent).
4510              */
4511             child_keep_old = true;
4512         } else {
4513             /* Extract child options ("child-name.*") */
4514             char *child_key_dot = g_strdup_printf("%s.", child->name);
4515             qdict_extract_subqdict(explicit_options, NULL, child_key_dot);
4516             qdict_extract_subqdict(options, &new_child_options, child_key_dot);
4517             g_free(child_key_dot);
4518         }
4519 
4520         bdrv_reopen_queue_child(bs_queue, child->bs, new_child_options,
4521                                 child->klass, child->role, bs->drv->is_format,
4522                                 options, flags, child_keep_old);
4523     }
4524 
4525     return bs_queue;
4526 }
4527 
4528 /* To be called with bs->aio_context locked */
4529 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
4530                                     BlockDriverState *bs,
4531                                     QDict *options, bool keep_old_opts)
4532 {
4533     GLOBAL_STATE_CODE();
4534     GRAPH_RDLOCK_GUARD_MAINLOOP();
4535 
4536     return bdrv_reopen_queue_child(bs_queue, bs, options, NULL, 0, false,
4537                                    NULL, 0, keep_old_opts);
4538 }
4539 
4540 void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
4541 {
4542     GLOBAL_STATE_CODE();
4543     if (bs_queue) {
4544         BlockReopenQueueEntry *bs_entry, *next;
4545         QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
4546             AioContext *ctx = bdrv_get_aio_context(bs_entry->state.bs);
4547 
4548             aio_context_acquire(ctx);
4549             bdrv_drained_end(bs_entry->state.bs);
4550             aio_context_release(ctx);
4551 
4552             qobject_unref(bs_entry->state.explicit_options);
4553             qobject_unref(bs_entry->state.options);
4554             g_free(bs_entry);
4555         }
4556         g_free(bs_queue);
4557     }
4558 }
4559 
4560 /*
4561  * Reopen multiple BlockDriverStates atomically & transactionally.
4562  *
4563  * The queue passed in (bs_queue) must have been built up previous
4564  * via bdrv_reopen_queue().
4565  *
4566  * Reopens all BDS specified in the queue, with the appropriate
4567  * flags.  All devices are prepared for reopen, and failure of any
4568  * device will cause all device changes to be abandoned, and intermediate
4569  * data cleaned up.
4570  *
4571  * If all devices prepare successfully, then the changes are committed
4572  * to all devices.
4573  *
4574  * All affected nodes must be drained between bdrv_reopen_queue() and
4575  * bdrv_reopen_multiple().
4576  *
4577  * To be called from the main thread, with all other AioContexts unlocked.
4578  */
4579 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
4580 {
4581     int ret = -1;
4582     BlockReopenQueueEntry *bs_entry, *next;
4583     AioContext *ctx;
4584     Transaction *tran = tran_new();
4585     g_autoptr(GSList) refresh_list = NULL;
4586 
4587     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
4588     assert(bs_queue != NULL);
4589     GLOBAL_STATE_CODE();
4590 
4591     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4592         ctx = bdrv_get_aio_context(bs_entry->state.bs);
4593         aio_context_acquire(ctx);
4594         ret = bdrv_flush(bs_entry->state.bs);
4595         aio_context_release(ctx);
4596         if (ret < 0) {
4597             error_setg_errno(errp, -ret, "Error flushing drive");
4598             goto abort;
4599         }
4600     }
4601 
4602     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4603         assert(bs_entry->state.bs->quiesce_counter > 0);
4604         ctx = bdrv_get_aio_context(bs_entry->state.bs);
4605         aio_context_acquire(ctx);
4606         ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
4607         aio_context_release(ctx);
4608         if (ret < 0) {
4609             goto abort;
4610         }
4611         bs_entry->prepared = true;
4612     }
4613 
4614     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4615         BDRVReopenState *state = &bs_entry->state;
4616 
4617         refresh_list = g_slist_prepend(refresh_list, state->bs);
4618         if (state->old_backing_bs) {
4619             refresh_list = g_slist_prepend(refresh_list, state->old_backing_bs);
4620         }
4621         if (state->old_file_bs) {
4622             refresh_list = g_slist_prepend(refresh_list, state->old_file_bs);
4623         }
4624     }
4625 
4626     /*
4627      * Note that file-posix driver rely on permission update done during reopen
4628      * (even if no permission changed), because it wants "new" permissions for
4629      * reconfiguring the fd and that's why it does it in raw_check_perm(), not
4630      * in raw_reopen_prepare() which is called with "old" permissions.
4631      */
4632     bdrv_graph_rdlock_main_loop();
4633     ret = bdrv_list_refresh_perms(refresh_list, bs_queue, tran, errp);
4634     bdrv_graph_rdunlock_main_loop();
4635 
4636     if (ret < 0) {
4637         goto abort;
4638     }
4639 
4640     /*
4641      * If we reach this point, we have success and just need to apply the
4642      * changes.
4643      *
4644      * Reverse order is used to comfort qcow2 driver: on commit it need to write
4645      * IN_USE flag to the image, to mark bitmaps in the image as invalid. But
4646      * children are usually goes after parents in reopen-queue, so go from last
4647      * to first element.
4648      */
4649     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
4650         ctx = bdrv_get_aio_context(bs_entry->state.bs);
4651         aio_context_acquire(ctx);
4652         bdrv_reopen_commit(&bs_entry->state);
4653         aio_context_release(ctx);
4654     }
4655 
4656     bdrv_graph_wrlock(NULL);
4657     tran_commit(tran);
4658     bdrv_graph_wrunlock();
4659 
4660     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
4661         BlockDriverState *bs = bs_entry->state.bs;
4662 
4663         if (bs->drv->bdrv_reopen_commit_post) {
4664             ctx = bdrv_get_aio_context(bs);
4665             aio_context_acquire(ctx);
4666             bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
4667             aio_context_release(ctx);
4668         }
4669     }
4670 
4671     ret = 0;
4672     goto cleanup;
4673 
4674 abort:
4675     bdrv_graph_wrlock(NULL);
4676     tran_abort(tran);
4677     bdrv_graph_wrunlock();
4678 
4679     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
4680         if (bs_entry->prepared) {
4681             ctx = bdrv_get_aio_context(bs_entry->state.bs);
4682             aio_context_acquire(ctx);
4683             bdrv_reopen_abort(&bs_entry->state);
4684             aio_context_release(ctx);
4685         }
4686     }
4687 
4688 cleanup:
4689     bdrv_reopen_queue_free(bs_queue);
4690 
4691     return ret;
4692 }
4693 
4694 int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
4695                 Error **errp)
4696 {
4697     AioContext *ctx = bdrv_get_aio_context(bs);
4698     BlockReopenQueue *queue;
4699     int ret;
4700 
4701     GLOBAL_STATE_CODE();
4702 
4703     queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
4704 
4705     if (ctx != qemu_get_aio_context()) {
4706         aio_context_release(ctx);
4707     }
4708     ret = bdrv_reopen_multiple(queue, errp);
4709 
4710     if (ctx != qemu_get_aio_context()) {
4711         aio_context_acquire(ctx);
4712     }
4713 
4714     return ret;
4715 }
4716 
4717 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
4718                               Error **errp)
4719 {
4720     QDict *opts = qdict_new();
4721 
4722     GLOBAL_STATE_CODE();
4723 
4724     qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
4725 
4726     return bdrv_reopen(bs, opts, true, errp);
4727 }
4728 
4729 /*
4730  * Take a BDRVReopenState and check if the value of 'backing' in the
4731  * reopen_state->options QDict is valid or not.
4732  *
4733  * If 'backing' is missing from the QDict then return 0.
4734  *
4735  * If 'backing' contains the node name of the backing file of
4736  * reopen_state->bs then return 0.
4737  *
4738  * If 'backing' contains a different node name (or is null) then check
4739  * whether the current backing file can be replaced with the new one.
4740  * If that's the case then reopen_state->replace_backing_bs is set to
4741  * true and reopen_state->new_backing_bs contains a pointer to the new
4742  * backing BlockDriverState (or NULL).
4743  *
4744  * After calling this function, the transaction @tran may only be completed
4745  * while holding a writer lock for the graph.
4746  *
4747  * Return 0 on success, otherwise return < 0 and set @errp.
4748  *
4749  * The caller must hold the AioContext lock of @reopen_state->bs.
4750  * @reopen_state->bs can move to a different AioContext in this function.
4751  * Callers must make sure that their AioContext locking is still correct after
4752  * this.
4753  */
4754 static int GRAPH_UNLOCKED
4755 bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
4756                                   bool is_backing, Transaction *tran,
4757                                   Error **errp)
4758 {
4759     BlockDriverState *bs = reopen_state->bs;
4760     BlockDriverState *new_child_bs;
4761     BlockDriverState *old_child_bs = is_backing ? child_bs(bs->backing) :
4762                                                   child_bs(bs->file);
4763     const char *child_name = is_backing ? "backing" : "file";
4764     QObject *value;
4765     const char *str;
4766     AioContext *ctx, *old_ctx;
4767     bool has_child;
4768     int ret;
4769 
4770     GLOBAL_STATE_CODE();
4771 
4772     value = qdict_get(reopen_state->options, child_name);
4773     if (value == NULL) {
4774         return 0;
4775     }
4776 
4777     switch (qobject_type(value)) {
4778     case QTYPE_QNULL:
4779         assert(is_backing); /* The 'file' option does not allow a null value */
4780         new_child_bs = NULL;
4781         break;
4782     case QTYPE_QSTRING:
4783         str = qstring_get_str(qobject_to(QString, value));
4784         new_child_bs = bdrv_lookup_bs(NULL, str, errp);
4785         if (new_child_bs == NULL) {
4786             return -EINVAL;
4787         }
4788 
4789         bdrv_graph_rdlock_main_loop();
4790         has_child = bdrv_recurse_has_child(new_child_bs, bs);
4791         bdrv_graph_rdunlock_main_loop();
4792 
4793         if (has_child) {
4794             error_setg(errp, "Making '%s' a %s child of '%s' would create a "
4795                        "cycle", str, child_name, bs->node_name);
4796             return -EINVAL;
4797         }
4798         break;
4799     default:
4800         /*
4801          * The options QDict has been flattened, so 'backing' and 'file'
4802          * do not allow any other data type here.
4803          */
4804         g_assert_not_reached();
4805     }
4806 
4807     if (old_child_bs == new_child_bs) {
4808         return 0;
4809     }
4810 
4811     if (old_child_bs) {
4812         if (bdrv_skip_implicit_filters(old_child_bs) == new_child_bs) {
4813             return 0;
4814         }
4815 
4816         if (old_child_bs->implicit) {
4817             error_setg(errp, "Cannot replace implicit %s child of %s",
4818                        child_name, bs->node_name);
4819             return -EPERM;
4820         }
4821     }
4822 
4823     if (bs->drv->is_filter && !old_child_bs) {
4824         /*
4825          * Filters always have a file or a backing child, so we are trying to
4826          * change wrong child
4827          */
4828         error_setg(errp, "'%s' is a %s filter node that does not support a "
4829                    "%s child", bs->node_name, bs->drv->format_name, child_name);
4830         return -EINVAL;
4831     }
4832 
4833     if (is_backing) {
4834         reopen_state->old_backing_bs = old_child_bs;
4835     } else {
4836         reopen_state->old_file_bs = old_child_bs;
4837     }
4838 
4839     if (old_child_bs) {
4840         bdrv_ref(old_child_bs);
4841         bdrv_drained_begin(old_child_bs);
4842     }
4843 
4844     old_ctx = bdrv_get_aio_context(bs);
4845     ctx = bdrv_get_aio_context(new_child_bs);
4846     if (old_ctx != ctx) {
4847         aio_context_release(old_ctx);
4848         aio_context_acquire(ctx);
4849     }
4850 
4851     bdrv_graph_wrlock(new_child_bs);
4852 
4853     ret = bdrv_set_file_or_backing_noperm(bs, new_child_bs, is_backing,
4854                                           tran, errp);
4855 
4856     bdrv_graph_wrunlock();
4857 
4858     if (old_ctx != ctx) {
4859         aio_context_release(ctx);
4860         aio_context_acquire(old_ctx);
4861     }
4862 
4863     if (old_child_bs) {
4864         bdrv_drained_end(old_child_bs);
4865         bdrv_unref(old_child_bs);
4866     }
4867 
4868     return ret;
4869 }
4870 
4871 /*
4872  * Prepares a BlockDriverState for reopen. All changes are staged in the
4873  * 'opaque' field of the BDRVReopenState, which is used and allocated by
4874  * the block driver layer .bdrv_reopen_prepare()
4875  *
4876  * bs is the BlockDriverState to reopen
4877  * flags are the new open flags
4878  * queue is the reopen queue
4879  *
4880  * Returns 0 on success, non-zero on error.  On error errp will be set
4881  * as well.
4882  *
4883  * On failure, bdrv_reopen_abort() will be called to clean up any data.
4884  * It is the responsibility of the caller to then call the abort() or
4885  * commit() for any other BDS that have been left in a prepare() state
4886  *
4887  * The caller must hold the AioContext lock of @reopen_state->bs.
4888  *
4889  * After calling this function, the transaction @change_child_tran may only be
4890  * completed while holding a writer lock for the graph.
4891  */
4892 static int GRAPH_UNLOCKED
4893 bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
4894                     Transaction *change_child_tran, Error **errp)
4895 {
4896     int ret = -1;
4897     int old_flags;
4898     Error *local_err = NULL;
4899     BlockDriver *drv;
4900     QemuOpts *opts;
4901     QDict *orig_reopen_opts;
4902     char *discard = NULL;
4903     bool read_only;
4904     bool drv_prepared = false;
4905 
4906     assert(reopen_state != NULL);
4907     assert(reopen_state->bs->drv != NULL);
4908     GLOBAL_STATE_CODE();
4909     drv = reopen_state->bs->drv;
4910 
4911     /* This function and each driver's bdrv_reopen_prepare() remove
4912      * entries from reopen_state->options as they are processed, so
4913      * we need to make a copy of the original QDict. */
4914     orig_reopen_opts = qdict_clone_shallow(reopen_state->options);
4915 
4916     /* Process generic block layer options */
4917     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
4918     if (!qemu_opts_absorb_qdict(opts, reopen_state->options, errp)) {
4919         ret = -EINVAL;
4920         goto error;
4921     }
4922 
4923     /* This was already called in bdrv_reopen_queue_child() so the flags
4924      * are up-to-date. This time we simply want to remove the options from
4925      * QemuOpts in order to indicate that they have been processed. */
4926     old_flags = reopen_state->flags;
4927     update_flags_from_options(&reopen_state->flags, opts);
4928     assert(old_flags == reopen_state->flags);
4929 
4930     discard = qemu_opt_get_del(opts, BDRV_OPT_DISCARD);
4931     if (discard != NULL) {
4932         if (bdrv_parse_discard_flags(discard, &reopen_state->flags) != 0) {
4933             error_setg(errp, "Invalid discard option");
4934             ret = -EINVAL;
4935             goto error;
4936         }
4937     }
4938 
4939     reopen_state->detect_zeroes =
4940         bdrv_parse_detect_zeroes(opts, reopen_state->flags, &local_err);
4941     if (local_err) {
4942         error_propagate(errp, local_err);
4943         ret = -EINVAL;
4944         goto error;
4945     }
4946 
4947     /* All other options (including node-name and driver) must be unchanged.
4948      * Put them back into the QDict, so that they are checked at the end
4949      * of this function. */
4950     qemu_opts_to_qdict(opts, reopen_state->options);
4951 
4952     /* If we are to stay read-only, do not allow permission change
4953      * to r/w. Attempting to set to r/w may fail if either BDRV_O_ALLOW_RDWR is
4954      * not set, or if the BDS still has copy_on_read enabled */
4955     read_only = !(reopen_state->flags & BDRV_O_RDWR);
4956 
4957     bdrv_graph_rdlock_main_loop();
4958     ret = bdrv_can_set_read_only(reopen_state->bs, read_only, true, &local_err);
4959     bdrv_graph_rdunlock_main_loop();
4960     if (local_err) {
4961         error_propagate(errp, local_err);
4962         goto error;
4963     }
4964 
4965     if (drv->bdrv_reopen_prepare) {
4966         /*
4967          * If a driver-specific option is missing, it means that we
4968          * should reset it to its default value.
4969          * But not all options allow that, so we need to check it first.
4970          */
4971         ret = bdrv_reset_options_allowed(reopen_state->bs,
4972                                          reopen_state->options, errp);
4973         if (ret) {
4974             goto error;
4975         }
4976 
4977         ret = drv->bdrv_reopen_prepare(reopen_state, queue, &local_err);
4978         if (ret) {
4979             if (local_err != NULL) {
4980                 error_propagate(errp, local_err);
4981             } else {
4982                 bdrv_graph_rdlock_main_loop();
4983                 bdrv_refresh_filename(reopen_state->bs);
4984                 bdrv_graph_rdunlock_main_loop();
4985                 error_setg(errp, "failed while preparing to reopen image '%s'",
4986                            reopen_state->bs->filename);
4987             }
4988             goto error;
4989         }
4990     } else {
4991         /* It is currently mandatory to have a bdrv_reopen_prepare()
4992          * handler for each supported drv. */
4993         bdrv_graph_rdlock_main_loop();
4994         error_setg(errp, "Block format '%s' used by node '%s' "
4995                    "does not support reopening files", drv->format_name,
4996                    bdrv_get_device_or_node_name(reopen_state->bs));
4997         bdrv_graph_rdunlock_main_loop();
4998         ret = -1;
4999         goto error;
5000     }
5001 
5002     drv_prepared = true;
5003 
5004     /*
5005      * We must provide the 'backing' option if the BDS has a backing
5006      * file or if the image file has a backing file name as part of
5007      * its metadata. Otherwise the 'backing' option can be omitted.
5008      */
5009     if (drv->supports_backing && reopen_state->backing_missing &&
5010         (reopen_state->bs->backing || reopen_state->bs->backing_file[0])) {
5011         error_setg(errp, "backing is missing for '%s'",
5012                    reopen_state->bs->node_name);
5013         ret = -EINVAL;
5014         goto error;
5015     }
5016 
5017     /*
5018      * Allow changing the 'backing' option. The new value can be
5019      * either a reference to an existing node (using its node name)
5020      * or NULL to simply detach the current backing file.
5021      */
5022     ret = bdrv_reopen_parse_file_or_backing(reopen_state, true,
5023                                             change_child_tran, errp);
5024     if (ret < 0) {
5025         goto error;
5026     }
5027     qdict_del(reopen_state->options, "backing");
5028 
5029     /* Allow changing the 'file' option. In this case NULL is not allowed */
5030     ret = bdrv_reopen_parse_file_or_backing(reopen_state, false,
5031                                             change_child_tran, errp);
5032     if (ret < 0) {
5033         goto error;
5034     }
5035     qdict_del(reopen_state->options, "file");
5036 
5037     /* Options that are not handled are only okay if they are unchanged
5038      * compared to the old state. It is expected that some options are only
5039      * used for the initial open, but not reopen (e.g. filename) */
5040     if (qdict_size(reopen_state->options)) {
5041         const QDictEntry *entry = qdict_first(reopen_state->options);
5042 
5043         GRAPH_RDLOCK_GUARD_MAINLOOP();
5044 
5045         do {
5046             QObject *new = entry->value;
5047             QObject *old = qdict_get(reopen_state->bs->options, entry->key);
5048 
5049             /* Allow child references (child_name=node_name) as long as they
5050              * point to the current child (i.e. everything stays the same). */
5051             if (qobject_type(new) == QTYPE_QSTRING) {
5052                 BdrvChild *child;
5053                 QLIST_FOREACH(child, &reopen_state->bs->children, next) {
5054                     if (!strcmp(child->name, entry->key)) {
5055                         break;
5056                     }
5057                 }
5058 
5059                 if (child) {
5060                     if (!strcmp(child->bs->node_name,
5061                                 qstring_get_str(qobject_to(QString, new)))) {
5062                         continue; /* Found child with this name, skip option */
5063                     }
5064                 }
5065             }
5066 
5067             /*
5068              * TODO: When using -drive to specify blockdev options, all values
5069              * will be strings; however, when using -blockdev, blockdev-add or
5070              * filenames using the json:{} pseudo-protocol, they will be
5071              * correctly typed.
5072              * In contrast, reopening options are (currently) always strings
5073              * (because you can only specify them through qemu-io; all other
5074              * callers do not specify any options).
5075              * Therefore, when using anything other than -drive to create a BDS,
5076              * this cannot detect non-string options as unchanged, because
5077              * qobject_is_equal() always returns false for objects of different
5078              * type.  In the future, this should be remedied by correctly typing
5079              * all options.  For now, this is not too big of an issue because
5080              * the user can simply omit options which cannot be changed anyway,
5081              * so they will stay unchanged.
5082              */
5083             if (!qobject_is_equal(new, old)) {
5084                 error_setg(errp, "Cannot change the option '%s'", entry->key);
5085                 ret = -EINVAL;
5086                 goto error;
5087             }
5088         } while ((entry = qdict_next(reopen_state->options, entry)));
5089     }
5090 
5091     ret = 0;
5092 
5093     /* Restore the original reopen_state->options QDict */
5094     qobject_unref(reopen_state->options);
5095     reopen_state->options = qobject_ref(orig_reopen_opts);
5096 
5097 error:
5098     if (ret < 0 && drv_prepared) {
5099         /* drv->bdrv_reopen_prepare() has succeeded, so we need to
5100          * call drv->bdrv_reopen_abort() before signaling an error
5101          * (bdrv_reopen_multiple() will not call bdrv_reopen_abort()
5102          * when the respective bdrv_reopen_prepare() has failed) */
5103         if (drv->bdrv_reopen_abort) {
5104             drv->bdrv_reopen_abort(reopen_state);
5105         }
5106     }
5107     qemu_opts_del(opts);
5108     qobject_unref(orig_reopen_opts);
5109     g_free(discard);
5110     return ret;
5111 }
5112 
5113 /*
5114  * Takes the staged changes for the reopen from bdrv_reopen_prepare(), and
5115  * makes them final by swapping the staging BlockDriverState contents into
5116  * the active BlockDriverState contents.
5117  */
5118 static void GRAPH_UNLOCKED bdrv_reopen_commit(BDRVReopenState *reopen_state)
5119 {
5120     BlockDriver *drv;
5121     BlockDriverState *bs;
5122     BdrvChild *child;
5123 
5124     assert(reopen_state != NULL);
5125     bs = reopen_state->bs;
5126     drv = bs->drv;
5127     assert(drv != NULL);
5128     GLOBAL_STATE_CODE();
5129 
5130     /* If there are any driver level actions to take */
5131     if (drv->bdrv_reopen_commit) {
5132         drv->bdrv_reopen_commit(reopen_state);
5133     }
5134 
5135     GRAPH_RDLOCK_GUARD_MAINLOOP();
5136 
5137     /* set BDS specific flags now */
5138     qobject_unref(bs->explicit_options);
5139     qobject_unref(bs->options);
5140     qobject_ref(reopen_state->explicit_options);
5141     qobject_ref(reopen_state->options);
5142 
5143     bs->explicit_options   = reopen_state->explicit_options;
5144     bs->options            = reopen_state->options;
5145     bs->open_flags         = reopen_state->flags;
5146     bs->detect_zeroes      = reopen_state->detect_zeroes;
5147 
5148     /* Remove child references from bs->options and bs->explicit_options.
5149      * Child options were already removed in bdrv_reopen_queue_child() */
5150     QLIST_FOREACH(child, &bs->children, next) {
5151         qdict_del(bs->explicit_options, child->name);
5152         qdict_del(bs->options, child->name);
5153     }
5154     /* backing is probably removed, so it's not handled by previous loop */
5155     qdict_del(bs->explicit_options, "backing");
5156     qdict_del(bs->options, "backing");
5157 
5158     bdrv_refresh_limits(bs, NULL, NULL);
5159     bdrv_refresh_total_sectors(bs, bs->total_sectors);
5160 }
5161 
5162 /*
5163  * Abort the reopen, and delete and free the staged changes in
5164  * reopen_state
5165  */
5166 static void GRAPH_UNLOCKED bdrv_reopen_abort(BDRVReopenState *reopen_state)
5167 {
5168     BlockDriver *drv;
5169 
5170     assert(reopen_state != NULL);
5171     drv = reopen_state->bs->drv;
5172     assert(drv != NULL);
5173     GLOBAL_STATE_CODE();
5174 
5175     if (drv->bdrv_reopen_abort) {
5176         drv->bdrv_reopen_abort(reopen_state);
5177     }
5178 }
5179 
5180 
5181 static void bdrv_close(BlockDriverState *bs)
5182 {
5183     BdrvAioNotifier *ban, *ban_next;
5184     BdrvChild *child, *next;
5185 
5186     GLOBAL_STATE_CODE();
5187     assert(!bs->refcnt);
5188 
5189     bdrv_drained_begin(bs); /* complete I/O */
5190     bdrv_flush(bs);
5191     bdrv_drain(bs); /* in case flush left pending I/O */
5192 
5193     if (bs->drv) {
5194         if (bs->drv->bdrv_close) {
5195             /* Must unfreeze all children, so bdrv_unref_child() works */
5196             bs->drv->bdrv_close(bs);
5197         }
5198         bs->drv = NULL;
5199     }
5200 
5201     bdrv_graph_wrlock(NULL);
5202     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
5203         bdrv_unref_child(bs, child);
5204     }
5205     bdrv_graph_wrunlock();
5206 
5207     assert(!bs->backing);
5208     assert(!bs->file);
5209     g_free(bs->opaque);
5210     bs->opaque = NULL;
5211     qatomic_set(&bs->copy_on_read, 0);
5212     bs->backing_file[0] = '\0';
5213     bs->backing_format[0] = '\0';
5214     bs->total_sectors = 0;
5215     bs->encrypted = false;
5216     bs->sg = false;
5217     qobject_unref(bs->options);
5218     qobject_unref(bs->explicit_options);
5219     bs->options = NULL;
5220     bs->explicit_options = NULL;
5221     qobject_unref(bs->full_open_options);
5222     bs->full_open_options = NULL;
5223     g_free(bs->block_status_cache);
5224     bs->block_status_cache = NULL;
5225 
5226     bdrv_release_named_dirty_bitmaps(bs);
5227     assert(QLIST_EMPTY(&bs->dirty_bitmaps));
5228 
5229     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
5230         g_free(ban);
5231     }
5232     QLIST_INIT(&bs->aio_notifiers);
5233     bdrv_drained_end(bs);
5234 
5235     /*
5236      * If we're still inside some bdrv_drain_all_begin()/end() sections, end
5237      * them now since this BDS won't exist anymore when bdrv_drain_all_end()
5238      * gets called.
5239      */
5240     if (bs->quiesce_counter) {
5241         bdrv_drain_all_end_quiesce(bs);
5242     }
5243 }
5244 
5245 void bdrv_close_all(void)
5246 {
5247     GLOBAL_STATE_CODE();
5248     assert(job_next(NULL) == NULL);
5249 
5250     /* Drop references from requests still in flight, such as canceled block
5251      * jobs whose AIO context has not been polled yet */
5252     bdrv_drain_all();
5253 
5254     blk_remove_all_bs();
5255     blockdev_close_all_bdrv_states();
5256 
5257     assert(QTAILQ_EMPTY(&all_bdrv_states));
5258 }
5259 
5260 static bool GRAPH_RDLOCK should_update_child(BdrvChild *c, BlockDriverState *to)
5261 {
5262     GQueue *queue;
5263     GHashTable *found;
5264     bool ret;
5265 
5266     if (c->klass->stay_at_node) {
5267         return false;
5268     }
5269 
5270     /* If the child @c belongs to the BDS @to, replacing the current
5271      * c->bs by @to would mean to create a loop.
5272      *
5273      * Such a case occurs when appending a BDS to a backing chain.
5274      * For instance, imagine the following chain:
5275      *
5276      *   guest device -> node A -> further backing chain...
5277      *
5278      * Now we create a new BDS B which we want to put on top of this
5279      * chain, so we first attach A as its backing node:
5280      *
5281      *                   node B
5282      *                     |
5283      *                     v
5284      *   guest device -> node A -> further backing chain...
5285      *
5286      * Finally we want to replace A by B.  When doing that, we want to
5287      * replace all pointers to A by pointers to B -- except for the
5288      * pointer from B because (1) that would create a loop, and (2)
5289      * that pointer should simply stay intact:
5290      *
5291      *   guest device -> node B
5292      *                     |
5293      *                     v
5294      *                   node A -> further backing chain...
5295      *
5296      * In general, when replacing a node A (c->bs) by a node B (@to),
5297      * if A is a child of B, that means we cannot replace A by B there
5298      * because that would create a loop.  Silently detaching A from B
5299      * is also not really an option.  So overall just leaving A in
5300      * place there is the most sensible choice.
5301      *
5302      * We would also create a loop in any cases where @c is only
5303      * indirectly referenced by @to. Prevent this by returning false
5304      * if @c is found (by breadth-first search) anywhere in the whole
5305      * subtree of @to.
5306      */
5307 
5308     ret = true;
5309     found = g_hash_table_new(NULL, NULL);
5310     g_hash_table_add(found, to);
5311     queue = g_queue_new();
5312     g_queue_push_tail(queue, to);
5313 
5314     while (!g_queue_is_empty(queue)) {
5315         BlockDriverState *v = g_queue_pop_head(queue);
5316         BdrvChild *c2;
5317 
5318         QLIST_FOREACH(c2, &v->children, next) {
5319             if (c2 == c) {
5320                 ret = false;
5321                 break;
5322             }
5323 
5324             if (g_hash_table_contains(found, c2->bs)) {
5325                 continue;
5326             }
5327 
5328             g_queue_push_tail(queue, c2->bs);
5329             g_hash_table_add(found, c2->bs);
5330         }
5331     }
5332 
5333     g_queue_free(queue);
5334     g_hash_table_destroy(found);
5335 
5336     return ret;
5337 }
5338 
5339 static void bdrv_remove_child_commit(void *opaque)
5340 {
5341     GLOBAL_STATE_CODE();
5342     bdrv_child_free(opaque);
5343 }
5344 
5345 static TransactionActionDrv bdrv_remove_child_drv = {
5346     .commit = bdrv_remove_child_commit,
5347 };
5348 
5349 /*
5350  * Function doesn't update permissions, caller is responsible for this.
5351  *
5352  * @child->bs (if non-NULL) must be drained.
5353  *
5354  * After calling this function, the transaction @tran may only be completed
5355  * while holding a writer lock for the graph.
5356  */
5357 static void GRAPH_WRLOCK bdrv_remove_child(BdrvChild *child, Transaction *tran)
5358 {
5359     if (!child) {
5360         return;
5361     }
5362 
5363     if (child->bs) {
5364         assert(child->quiesced_parent);
5365         bdrv_replace_child_tran(child, NULL, tran);
5366     }
5367 
5368     tran_add(tran, &bdrv_remove_child_drv, child);
5369 }
5370 
5371 /*
5372  * Both @from and @to (if non-NULL) must be drained. @to must be kept drained
5373  * until the transaction is completed.
5374  *
5375  * After calling this function, the transaction @tran may only be completed
5376  * while holding a writer lock for the graph.
5377  */
5378 static int GRAPH_WRLOCK
5379 bdrv_replace_node_noperm(BlockDriverState *from,
5380                          BlockDriverState *to,
5381                          bool auto_skip, Transaction *tran,
5382                          Error **errp)
5383 {
5384     BdrvChild *c, *next;
5385 
5386     GLOBAL_STATE_CODE();
5387 
5388     assert(from->quiesce_counter);
5389     assert(to->quiesce_counter);
5390 
5391     QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
5392         assert(c->bs == from);
5393         if (!should_update_child(c, to)) {
5394             if (auto_skip) {
5395                 continue;
5396             }
5397             error_setg(errp, "Should not change '%s' link to '%s'",
5398                        c->name, from->node_name);
5399             return -EINVAL;
5400         }
5401         if (c->frozen) {
5402             error_setg(errp, "Cannot change '%s' link to '%s'",
5403                        c->name, from->node_name);
5404             return -EPERM;
5405         }
5406         bdrv_replace_child_tran(c, to, tran);
5407     }
5408 
5409     return 0;
5410 }
5411 
5412 /*
5413  * With auto_skip=true bdrv_replace_node_common skips updating from parents
5414  * if it creates a parent-child relation loop or if parent is block-job.
5415  *
5416  * With auto_skip=false the error is returned if from has a parent which should
5417  * not be updated.
5418  *
5419  * With @detach_subchain=true @to must be in a backing chain of @from. In this
5420  * case backing link of the cow-parent of @to is removed.
5421  */
5422 static int bdrv_replace_node_common(BlockDriverState *from,
5423                                     BlockDriverState *to,
5424                                     bool auto_skip, bool detach_subchain,
5425                                     Error **errp)
5426 {
5427     Transaction *tran = tran_new();
5428     g_autoptr(GSList) refresh_list = NULL;
5429     BlockDriverState *to_cow_parent = NULL;
5430     int ret;
5431 
5432     GLOBAL_STATE_CODE();
5433 
5434     if (detach_subchain) {
5435         assert(bdrv_chain_contains(from, to));
5436         assert(from != to);
5437         for (to_cow_parent = from;
5438              bdrv_filter_or_cow_bs(to_cow_parent) != to;
5439              to_cow_parent = bdrv_filter_or_cow_bs(to_cow_parent))
5440         {
5441             ;
5442         }
5443     }
5444 
5445     /* Make sure that @from doesn't go away until we have successfully attached
5446      * all of its parents to @to. */
5447     bdrv_ref(from);
5448 
5449     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
5450     assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
5451     bdrv_drained_begin(from);
5452     bdrv_drained_begin(to);
5453 
5454     bdrv_graph_wrlock(to);
5455 
5456     /*
5457      * Do the replacement without permission update.
5458      * Replacement may influence the permissions, we should calculate new
5459      * permissions based on new graph. If we fail, we'll roll-back the
5460      * replacement.
5461      */
5462     ret = bdrv_replace_node_noperm(from, to, auto_skip, tran, errp);
5463     if (ret < 0) {
5464         goto out;
5465     }
5466 
5467     if (detach_subchain) {
5468         /* to_cow_parent is already drained because from is drained */
5469         bdrv_remove_child(bdrv_filter_or_cow_child(to_cow_parent), tran);
5470     }
5471 
5472     refresh_list = g_slist_prepend(refresh_list, to);
5473     refresh_list = g_slist_prepend(refresh_list, from);
5474 
5475     ret = bdrv_list_refresh_perms(refresh_list, NULL, tran, errp);
5476     if (ret < 0) {
5477         goto out;
5478     }
5479 
5480     ret = 0;
5481 
5482 out:
5483     tran_finalize(tran, ret);
5484     bdrv_graph_wrunlock();
5485 
5486     bdrv_drained_end(to);
5487     bdrv_drained_end(from);
5488     bdrv_unref(from);
5489 
5490     return ret;
5491 }
5492 
5493 int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
5494                       Error **errp)
5495 {
5496     GLOBAL_STATE_CODE();
5497 
5498     return bdrv_replace_node_common(from, to, true, false, errp);
5499 }
5500 
5501 int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
5502 {
5503     GLOBAL_STATE_CODE();
5504 
5505     return bdrv_replace_node_common(bs, bdrv_filter_or_cow_bs(bs), true, true,
5506                                     errp);
5507 }
5508 
5509 /*
5510  * Add new bs contents at the top of an image chain while the chain is
5511  * live, while keeping required fields on the top layer.
5512  *
5513  * This will modify the BlockDriverState fields, and swap contents
5514  * between bs_new and bs_top. Both bs_new and bs_top are modified.
5515  *
5516  * bs_new must not be attached to a BlockBackend and must not have backing
5517  * child.
5518  *
5519  * This function does not create any image files.
5520  *
5521  * The caller must hold the AioContext lock for @bs_top.
5522  */
5523 int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
5524                 Error **errp)
5525 {
5526     int ret;
5527     BdrvChild *child;
5528     Transaction *tran = tran_new();
5529     AioContext *old_context, *new_context = NULL;
5530 
5531     GLOBAL_STATE_CODE();
5532 
5533     assert(!bs_new->backing);
5534 
5535     old_context = bdrv_get_aio_context(bs_top);
5536     bdrv_drained_begin(bs_top);
5537 
5538     /*
5539      * bdrv_drained_begin() requires that only the AioContext of the drained
5540      * node is locked, and at this point it can still differ from the AioContext
5541      * of bs_top.
5542      */
5543     new_context = bdrv_get_aio_context(bs_new);
5544     aio_context_release(old_context);
5545     aio_context_acquire(new_context);
5546     bdrv_drained_begin(bs_new);
5547     aio_context_release(new_context);
5548     aio_context_acquire(old_context);
5549     new_context = NULL;
5550 
5551     bdrv_graph_wrlock(bs_top);
5552 
5553     child = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
5554                                      &child_of_bds, bdrv_backing_role(bs_new),
5555                                      tran, errp);
5556     if (!child) {
5557         ret = -EINVAL;
5558         goto out;
5559     }
5560 
5561     /*
5562      * bdrv_attach_child_noperm could change the AioContext of bs_top and
5563      * bs_new, but at least they are in the same AioContext now. This is the
5564      * AioContext that we need to lock for the rest of the function.
5565      */
5566     new_context = bdrv_get_aio_context(bs_top);
5567 
5568     if (old_context != new_context) {
5569         aio_context_release(old_context);
5570         aio_context_acquire(new_context);
5571     }
5572 
5573     ret = bdrv_replace_node_noperm(bs_top, bs_new, true, tran, errp);
5574     if (ret < 0) {
5575         goto out;
5576     }
5577 
5578     ret = bdrv_refresh_perms(bs_new, tran, errp);
5579 out:
5580     tran_finalize(tran, ret);
5581 
5582     bdrv_refresh_limits(bs_top, NULL, NULL);
5583     bdrv_graph_wrunlock();
5584 
5585     bdrv_drained_end(bs_top);
5586     bdrv_drained_end(bs_new);
5587 
5588     if (new_context && old_context != new_context) {
5589         aio_context_release(new_context);
5590         aio_context_acquire(old_context);
5591     }
5592 
5593     return ret;
5594 }
5595 
5596 /* Not for empty child */
5597 int bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs,
5598                           Error **errp)
5599 {
5600     int ret;
5601     Transaction *tran = tran_new();
5602     g_autoptr(GSList) refresh_list = NULL;
5603     BlockDriverState *old_bs = child->bs;
5604 
5605     GLOBAL_STATE_CODE();
5606 
5607     bdrv_ref(old_bs);
5608     bdrv_drained_begin(old_bs);
5609     bdrv_drained_begin(new_bs);
5610     bdrv_graph_wrlock(new_bs);
5611 
5612     bdrv_replace_child_tran(child, new_bs, tran);
5613 
5614     refresh_list = g_slist_prepend(refresh_list, old_bs);
5615     refresh_list = g_slist_prepend(refresh_list, new_bs);
5616 
5617     ret = bdrv_list_refresh_perms(refresh_list, NULL, tran, errp);
5618 
5619     tran_finalize(tran, ret);
5620 
5621     bdrv_graph_wrunlock();
5622     bdrv_drained_end(old_bs);
5623     bdrv_drained_end(new_bs);
5624     bdrv_unref(old_bs);
5625 
5626     return ret;
5627 }
5628 
5629 static void bdrv_delete(BlockDriverState *bs)
5630 {
5631     assert(bdrv_op_blocker_is_empty(bs));
5632     assert(!bs->refcnt);
5633     GLOBAL_STATE_CODE();
5634 
5635     /* remove from list, if necessary */
5636     if (bs->node_name[0] != '\0') {
5637         QTAILQ_REMOVE(&graph_bdrv_states, bs, node_list);
5638     }
5639     QTAILQ_REMOVE(&all_bdrv_states, bs, bs_list);
5640 
5641     bdrv_close(bs);
5642 
5643     qemu_mutex_destroy(&bs->reqs_lock);
5644 
5645     g_free(bs);
5646 }
5647 
5648 
5649 /*
5650  * Replace @bs by newly created block node.
5651  *
5652  * @options is a QDict of options to pass to the block drivers, or NULL for an
5653  * empty set of options. The reference to the QDict belongs to the block layer
5654  * after the call (even on failure), so if the caller intends to reuse the
5655  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
5656  *
5657  * The caller holds the AioContext lock for @bs. It must make sure that @bs
5658  * stays in the same AioContext, i.e. @options must not refer to nodes in a
5659  * different AioContext.
5660  */
5661 BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *options,
5662                                    int flags, Error **errp)
5663 {
5664     ERRP_GUARD();
5665     int ret;
5666     AioContext *ctx = bdrv_get_aio_context(bs);
5667     BlockDriverState *new_node_bs = NULL;
5668     const char *drvname, *node_name;
5669     BlockDriver *drv;
5670 
5671     drvname = qdict_get_try_str(options, "driver");
5672     if (!drvname) {
5673         error_setg(errp, "driver is not specified");
5674         goto fail;
5675     }
5676 
5677     drv = bdrv_find_format(drvname);
5678     if (!drv) {
5679         error_setg(errp, "Unknown driver: '%s'", drvname);
5680         goto fail;
5681     }
5682 
5683     node_name = qdict_get_try_str(options, "node-name");
5684 
5685     GLOBAL_STATE_CODE();
5686 
5687     aio_context_release(ctx);
5688     aio_context_acquire(qemu_get_aio_context());
5689     new_node_bs = bdrv_new_open_driver_opts(drv, node_name, options, flags,
5690                                             errp);
5691     aio_context_release(qemu_get_aio_context());
5692     aio_context_acquire(ctx);
5693     assert(bdrv_get_aio_context(bs) == ctx);
5694 
5695     options = NULL; /* bdrv_new_open_driver() eats options */
5696     if (!new_node_bs) {
5697         error_prepend(errp, "Could not create node: ");
5698         goto fail;
5699     }
5700 
5701     bdrv_drained_begin(bs);
5702     ret = bdrv_replace_node(bs, new_node_bs, errp);
5703     bdrv_drained_end(bs);
5704 
5705     if (ret < 0) {
5706         error_prepend(errp, "Could not replace node: ");
5707         goto fail;
5708     }
5709 
5710     return new_node_bs;
5711 
5712 fail:
5713     qobject_unref(options);
5714     bdrv_unref(new_node_bs);
5715     return NULL;
5716 }
5717 
5718 /*
5719  * Run consistency checks on an image
5720  *
5721  * Returns 0 if the check could be completed (it doesn't mean that the image is
5722  * free of errors) or -errno when an internal error occurred. The results of the
5723  * check are stored in res.
5724  */
5725 int coroutine_fn bdrv_co_check(BlockDriverState *bs,
5726                                BdrvCheckResult *res, BdrvCheckMode fix)
5727 {
5728     IO_CODE();
5729     assert_bdrv_graph_readable();
5730     if (bs->drv == NULL) {
5731         return -ENOMEDIUM;
5732     }
5733     if (bs->drv->bdrv_co_check == NULL) {
5734         return -ENOTSUP;
5735     }
5736 
5737     memset(res, 0, sizeof(*res));
5738     return bs->drv->bdrv_co_check(bs, res, fix);
5739 }
5740 
5741 /*
5742  * Return values:
5743  * 0        - success
5744  * -EINVAL  - backing format specified, but no file
5745  * -ENOSPC  - can't update the backing file because no space is left in the
5746  *            image file header
5747  * -ENOTSUP - format driver doesn't support changing the backing file
5748  */
5749 int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
5750                              const char *backing_fmt, bool require)
5751 {
5752     BlockDriver *drv = bs->drv;
5753     int ret;
5754 
5755     GLOBAL_STATE_CODE();
5756 
5757     if (!drv) {
5758         return -ENOMEDIUM;
5759     }
5760 
5761     /* Backing file format doesn't make sense without a backing file */
5762     if (backing_fmt && !backing_file) {
5763         return -EINVAL;
5764     }
5765 
5766     if (require && backing_file && !backing_fmt) {
5767         return -EINVAL;
5768     }
5769 
5770     if (drv->bdrv_change_backing_file != NULL) {
5771         ret = drv->bdrv_change_backing_file(bs, backing_file, backing_fmt);
5772     } else {
5773         ret = -ENOTSUP;
5774     }
5775 
5776     if (ret == 0) {
5777         pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
5778         pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
5779         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
5780                 backing_file ?: "");
5781     }
5782     return ret;
5783 }
5784 
5785 /*
5786  * Finds the first non-filter node above bs in the chain between
5787  * active and bs.  The returned node is either an immediate parent of
5788  * bs, or there are only filter nodes between the two.
5789  *
5790  * Returns NULL if bs is not found in active's image chain,
5791  * or if active == bs.
5792  *
5793  * Returns the bottommost base image if bs == NULL.
5794  */
5795 BlockDriverState *bdrv_find_overlay(BlockDriverState *active,
5796                                     BlockDriverState *bs)
5797 {
5798 
5799     GLOBAL_STATE_CODE();
5800 
5801     bs = bdrv_skip_filters(bs);
5802     active = bdrv_skip_filters(active);
5803 
5804     while (active) {
5805         BlockDriverState *next = bdrv_backing_chain_next(active);
5806         if (bs == next) {
5807             return active;
5808         }
5809         active = next;
5810     }
5811 
5812     return NULL;
5813 }
5814 
5815 /* Given a BDS, searches for the base layer. */
5816 BlockDriverState *bdrv_find_base(BlockDriverState *bs)
5817 {
5818     GLOBAL_STATE_CODE();
5819 
5820     return bdrv_find_overlay(bs, NULL);
5821 }
5822 
5823 /*
5824  * Return true if at least one of the COW (backing) and filter links
5825  * between @bs and @base is frozen. @errp is set if that's the case.
5826  * @base must be reachable from @bs, or NULL.
5827  */
5828 bool bdrv_is_backing_chain_frozen(BlockDriverState *bs, BlockDriverState *base,
5829                                   Error **errp)
5830 {
5831     BlockDriverState *i;
5832     BdrvChild *child;
5833 
5834     GLOBAL_STATE_CODE();
5835 
5836     for (i = bs; i != base; i = child_bs(child)) {
5837         child = bdrv_filter_or_cow_child(i);
5838 
5839         if (child && child->frozen) {
5840             error_setg(errp, "Cannot change '%s' link from '%s' to '%s'",
5841                        child->name, i->node_name, child->bs->node_name);
5842             return true;
5843         }
5844     }
5845 
5846     return false;
5847 }
5848 
5849 /*
5850  * Freeze all COW (backing) and filter links between @bs and @base.
5851  * If any of the links is already frozen the operation is aborted and
5852  * none of the links are modified.
5853  * @base must be reachable from @bs, or NULL.
5854  * Returns 0 on success. On failure returns < 0 and sets @errp.
5855  */
5856 int bdrv_freeze_backing_chain(BlockDriverState *bs, BlockDriverState *base,
5857                               Error **errp)
5858 {
5859     BlockDriverState *i;
5860     BdrvChild *child;
5861 
5862     GLOBAL_STATE_CODE();
5863 
5864     if (bdrv_is_backing_chain_frozen(bs, base, errp)) {
5865         return -EPERM;
5866     }
5867 
5868     for (i = bs; i != base; i = child_bs(child)) {
5869         child = bdrv_filter_or_cow_child(i);
5870         if (child && child->bs->never_freeze) {
5871             error_setg(errp, "Cannot freeze '%s' link to '%s'",
5872                        child->name, child->bs->node_name);
5873             return -EPERM;
5874         }
5875     }
5876 
5877     for (i = bs; i != base; i = child_bs(child)) {
5878         child = bdrv_filter_or_cow_child(i);
5879         if (child) {
5880             child->frozen = true;
5881         }
5882     }
5883 
5884     return 0;
5885 }
5886 
5887 /*
5888  * Unfreeze all COW (backing) and filter links between @bs and @base.
5889  * The caller must ensure that all links are frozen before using this
5890  * function.
5891  * @base must be reachable from @bs, or NULL.
5892  */
5893 void bdrv_unfreeze_backing_chain(BlockDriverState *bs, BlockDriverState *base)
5894 {
5895     BlockDriverState *i;
5896     BdrvChild *child;
5897 
5898     GLOBAL_STATE_CODE();
5899 
5900     for (i = bs; i != base; i = child_bs(child)) {
5901         child = bdrv_filter_or_cow_child(i);
5902         if (child) {
5903             assert(child->frozen);
5904             child->frozen = false;
5905         }
5906     }
5907 }
5908 
5909 /*
5910  * Drops images above 'base' up to and including 'top', and sets the image
5911  * above 'top' to have base as its backing file.
5912  *
5913  * Requires that the overlay to 'top' is opened r/w, so that the backing file
5914  * information in 'bs' can be properly updated.
5915  *
5916  * E.g., this will convert the following chain:
5917  * bottom <- base <- intermediate <- top <- active
5918  *
5919  * to
5920  *
5921  * bottom <- base <- active
5922  *
5923  * It is allowed for bottom==base, in which case it converts:
5924  *
5925  * base <- intermediate <- top <- active
5926  *
5927  * to
5928  *
5929  * base <- active
5930  *
5931  * If backing_file_str is non-NULL, it will be used when modifying top's
5932  * overlay image metadata.
5933  *
5934  * Error conditions:
5935  *  if active == top, that is considered an error
5936  *
5937  */
5938 int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
5939                            const char *backing_file_str)
5940 {
5941     BlockDriverState *explicit_top = top;
5942     bool update_inherits_from;
5943     BdrvChild *c;
5944     Error *local_err = NULL;
5945     int ret = -EIO;
5946     g_autoptr(GSList) updated_children = NULL;
5947     GSList *p;
5948 
5949     GLOBAL_STATE_CODE();
5950 
5951     bdrv_ref(top);
5952     bdrv_drained_begin(base);
5953     bdrv_graph_rdlock_main_loop();
5954 
5955     if (!top->drv || !base->drv) {
5956         goto exit;
5957     }
5958 
5959     /* Make sure that base is in the backing chain of top */
5960     if (!bdrv_chain_contains(top, base)) {
5961         goto exit;
5962     }
5963 
5964     /* If 'base' recursively inherits from 'top' then we should set
5965      * base->inherits_from to top->inherits_from after 'top' and all
5966      * other intermediate nodes have been dropped.
5967      * If 'top' is an implicit node (e.g. "commit_top") we should skip
5968      * it because no one inherits from it. We use explicit_top for that. */
5969     explicit_top = bdrv_skip_implicit_filters(explicit_top);
5970     update_inherits_from = bdrv_inherits_from_recursive(base, explicit_top);
5971 
5972     /* success - we can delete the intermediate states, and link top->base */
5973     if (!backing_file_str) {
5974         bdrv_refresh_filename(base);
5975         backing_file_str = base->filename;
5976     }
5977 
5978     QLIST_FOREACH(c, &top->parents, next_parent) {
5979         updated_children = g_slist_prepend(updated_children, c);
5980     }
5981 
5982     /*
5983      * It seems correct to pass detach_subchain=true here, but it triggers
5984      * one more yet not fixed bug, when due to nested aio_poll loop we switch to
5985      * another drained section, which modify the graph (for example, removing
5986      * the child, which we keep in updated_children list). So, it's a TODO.
5987      *
5988      * Note, bug triggered if pass detach_subchain=true here and run
5989      * test-bdrv-drain. test_drop_intermediate_poll() test-case will crash.
5990      * That's a FIXME.
5991      */
5992     bdrv_replace_node_common(top, base, false, false, &local_err);
5993     if (local_err) {
5994         error_report_err(local_err);
5995         goto exit;
5996     }
5997 
5998     for (p = updated_children; p; p = p->next) {
5999         c = p->data;
6000 
6001         if (c->klass->update_filename) {
6002             ret = c->klass->update_filename(c, base, backing_file_str,
6003                                             &local_err);
6004             if (ret < 0) {
6005                 /*
6006                  * TODO: Actually, we want to rollback all previous iterations
6007                  * of this loop, and (which is almost impossible) previous
6008                  * bdrv_replace_node()...
6009                  *
6010                  * Note, that c->klass->update_filename may lead to permission
6011                  * update, so it's a bad idea to call it inside permission
6012                  * update transaction of bdrv_replace_node.
6013                  */
6014                 error_report_err(local_err);
6015                 goto exit;
6016             }
6017         }
6018     }
6019 
6020     if (update_inherits_from) {
6021         base->inherits_from = explicit_top->inherits_from;
6022     }
6023 
6024     ret = 0;
6025 exit:
6026     bdrv_graph_rdunlock_main_loop();
6027     bdrv_drained_end(base);
6028     bdrv_unref(top);
6029     return ret;
6030 }
6031 
6032 /**
6033  * Implementation of BlockDriver.bdrv_co_get_allocated_file_size() that
6034  * sums the size of all data-bearing children.  (This excludes backing
6035  * children.)
6036  */
6037 static int64_t coroutine_fn GRAPH_RDLOCK
6038 bdrv_sum_allocated_file_size(BlockDriverState *bs)
6039 {
6040     BdrvChild *child;
6041     int64_t child_size, sum = 0;
6042 
6043     QLIST_FOREACH(child, &bs->children, next) {
6044         if (child->role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
6045                            BDRV_CHILD_FILTERED))
6046         {
6047             child_size = bdrv_co_get_allocated_file_size(child->bs);
6048             if (child_size < 0) {
6049                 return child_size;
6050             }
6051             sum += child_size;
6052         }
6053     }
6054 
6055     return sum;
6056 }
6057 
6058 /**
6059  * Length of a allocated file in bytes. Sparse files are counted by actual
6060  * allocated space. Return < 0 if error or unknown.
6061  */
6062 int64_t coroutine_fn bdrv_co_get_allocated_file_size(BlockDriverState *bs)
6063 {
6064     BlockDriver *drv = bs->drv;
6065     IO_CODE();
6066     assert_bdrv_graph_readable();
6067 
6068     if (!drv) {
6069         return -ENOMEDIUM;
6070     }
6071     if (drv->bdrv_co_get_allocated_file_size) {
6072         return drv->bdrv_co_get_allocated_file_size(bs);
6073     }
6074 
6075     if (drv->bdrv_file_open) {
6076         /*
6077          * Protocol drivers default to -ENOTSUP (most of their data is
6078          * not stored in any of their children (if they even have any),
6079          * so there is no generic way to figure it out).
6080          */
6081         return -ENOTSUP;
6082     } else if (drv->is_filter) {
6083         /* Filter drivers default to the size of their filtered child */
6084         return bdrv_co_get_allocated_file_size(bdrv_filter_bs(bs));
6085     } else {
6086         /* Other drivers default to summing their children's sizes */
6087         return bdrv_sum_allocated_file_size(bs);
6088     }
6089 }
6090 
6091 /*
6092  * bdrv_measure:
6093  * @drv: Format driver
6094  * @opts: Creation options for new image
6095  * @in_bs: Existing image containing data for new image (may be NULL)
6096  * @errp: Error object
6097  * Returns: A #BlockMeasureInfo (free using qapi_free_BlockMeasureInfo())
6098  *          or NULL on error
6099  *
6100  * Calculate file size required to create a new image.
6101  *
6102  * If @in_bs is given then space for allocated clusters and zero clusters
6103  * from that image are included in the calculation.  If @opts contains a
6104  * backing file that is shared by @in_bs then backing clusters may be omitted
6105  * from the calculation.
6106  *
6107  * If @in_bs is NULL then the calculation includes no allocated clusters
6108  * unless a preallocation option is given in @opts.
6109  *
6110  * Note that @in_bs may use a different BlockDriver from @drv.
6111  *
6112  * If an error occurs the @errp pointer is set.
6113  */
6114 BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
6115                                BlockDriverState *in_bs, Error **errp)
6116 {
6117     IO_CODE();
6118     if (!drv->bdrv_measure) {
6119         error_setg(errp, "Block driver '%s' does not support size measurement",
6120                    drv->format_name);
6121         return NULL;
6122     }
6123 
6124     return drv->bdrv_measure(opts, in_bs, errp);
6125 }
6126 
6127 /**
6128  * Return number of sectors on success, -errno on error.
6129  */
6130 int64_t coroutine_fn bdrv_co_nb_sectors(BlockDriverState *bs)
6131 {
6132     BlockDriver *drv = bs->drv;
6133     IO_CODE();
6134     assert_bdrv_graph_readable();
6135 
6136     if (!drv)
6137         return -ENOMEDIUM;
6138 
6139     if (bs->bl.has_variable_length) {
6140         int ret = bdrv_co_refresh_total_sectors(bs, bs->total_sectors);
6141         if (ret < 0) {
6142             return ret;
6143         }
6144     }
6145     return bs->total_sectors;
6146 }
6147 
6148 /*
6149  * This wrapper is written by hand because this function is in the hot I/O path,
6150  * via blk_get_geometry.
6151  */
6152 int64_t coroutine_mixed_fn bdrv_nb_sectors(BlockDriverState *bs)
6153 {
6154     BlockDriver *drv = bs->drv;
6155     IO_CODE();
6156 
6157     if (!drv)
6158         return -ENOMEDIUM;
6159 
6160     if (bs->bl.has_variable_length) {
6161         int ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
6162         if (ret < 0) {
6163             return ret;
6164         }
6165     }
6166 
6167     return bs->total_sectors;
6168 }
6169 
6170 /**
6171  * Return length in bytes on success, -errno on error.
6172  * The length is always a multiple of BDRV_SECTOR_SIZE.
6173  */
6174 int64_t coroutine_fn bdrv_co_getlength(BlockDriverState *bs)
6175 {
6176     int64_t ret;
6177     IO_CODE();
6178     assert_bdrv_graph_readable();
6179 
6180     ret = bdrv_co_nb_sectors(bs);
6181     if (ret < 0) {
6182         return ret;
6183     }
6184     if (ret > INT64_MAX / BDRV_SECTOR_SIZE) {
6185         return -EFBIG;
6186     }
6187     return ret * BDRV_SECTOR_SIZE;
6188 }
6189 
6190 bool bdrv_is_sg(BlockDriverState *bs)
6191 {
6192     IO_CODE();
6193     return bs->sg;
6194 }
6195 
6196 /**
6197  * Return whether the given node supports compressed writes.
6198  */
6199 bool bdrv_supports_compressed_writes(BlockDriverState *bs)
6200 {
6201     BlockDriverState *filtered;
6202     IO_CODE();
6203 
6204     if (!bs->drv || !block_driver_can_compress(bs->drv)) {
6205         return false;
6206     }
6207 
6208     filtered = bdrv_filter_bs(bs);
6209     if (filtered) {
6210         /*
6211          * Filters can only forward compressed writes, so we have to
6212          * check the child.
6213          */
6214         return bdrv_supports_compressed_writes(filtered);
6215     }
6216 
6217     return true;
6218 }
6219 
6220 const char *bdrv_get_format_name(BlockDriverState *bs)
6221 {
6222     IO_CODE();
6223     return bs->drv ? bs->drv->format_name : NULL;
6224 }
6225 
6226 static int qsort_strcmp(const void *a, const void *b)
6227 {
6228     return strcmp(*(char *const *)a, *(char *const *)b);
6229 }
6230 
6231 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
6232                          void *opaque, bool read_only)
6233 {
6234     BlockDriver *drv;
6235     int count = 0;
6236     int i;
6237     const char **formats = NULL;
6238 
6239     GLOBAL_STATE_CODE();
6240 
6241     QLIST_FOREACH(drv, &bdrv_drivers, list) {
6242         if (drv->format_name) {
6243             bool found = false;
6244 
6245             if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, read_only)) {
6246                 continue;
6247             }
6248 
6249             i = count;
6250             while (formats && i && !found) {
6251                 found = !strcmp(formats[--i], drv->format_name);
6252             }
6253 
6254             if (!found) {
6255                 formats = g_renew(const char *, formats, count + 1);
6256                 formats[count++] = drv->format_name;
6257             }
6258         }
6259     }
6260 
6261     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); i++) {
6262         const char *format_name = block_driver_modules[i].format_name;
6263 
6264         if (format_name) {
6265             bool found = false;
6266             int j = count;
6267 
6268             if (use_bdrv_whitelist &&
6269                 !bdrv_format_is_whitelisted(format_name, read_only)) {
6270                 continue;
6271             }
6272 
6273             while (formats && j && !found) {
6274                 found = !strcmp(formats[--j], format_name);
6275             }
6276 
6277             if (!found) {
6278                 formats = g_renew(const char *, formats, count + 1);
6279                 formats[count++] = format_name;
6280             }
6281         }
6282     }
6283 
6284     qsort(formats, count, sizeof(formats[0]), qsort_strcmp);
6285 
6286     for (i = 0; i < count; i++) {
6287         it(opaque, formats[i]);
6288     }
6289 
6290     g_free(formats);
6291 }
6292 
6293 /* This function is to find a node in the bs graph */
6294 BlockDriverState *bdrv_find_node(const char *node_name)
6295 {
6296     BlockDriverState *bs;
6297 
6298     assert(node_name);
6299     GLOBAL_STATE_CODE();
6300 
6301     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
6302         if (!strcmp(node_name, bs->node_name)) {
6303             return bs;
6304         }
6305     }
6306     return NULL;
6307 }
6308 
6309 /* Put this QMP function here so it can access the static graph_bdrv_states. */
6310 BlockDeviceInfoList *bdrv_named_nodes_list(bool flat,
6311                                            Error **errp)
6312 {
6313     BlockDeviceInfoList *list;
6314     BlockDriverState *bs;
6315 
6316     GLOBAL_STATE_CODE();
6317     GRAPH_RDLOCK_GUARD_MAINLOOP();
6318 
6319     list = NULL;
6320     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
6321         BlockDeviceInfo *info = bdrv_block_device_info(NULL, bs, flat, errp);
6322         if (!info) {
6323             qapi_free_BlockDeviceInfoList(list);
6324             return NULL;
6325         }
6326         QAPI_LIST_PREPEND(list, info);
6327     }
6328 
6329     return list;
6330 }
6331 
6332 typedef struct XDbgBlockGraphConstructor {
6333     XDbgBlockGraph *graph;
6334     GHashTable *graph_nodes;
6335 } XDbgBlockGraphConstructor;
6336 
6337 static XDbgBlockGraphConstructor *xdbg_graph_new(void)
6338 {
6339     XDbgBlockGraphConstructor *gr = g_new(XDbgBlockGraphConstructor, 1);
6340 
6341     gr->graph = g_new0(XDbgBlockGraph, 1);
6342     gr->graph_nodes = g_hash_table_new(NULL, NULL);
6343 
6344     return gr;
6345 }
6346 
6347 static XDbgBlockGraph *xdbg_graph_finalize(XDbgBlockGraphConstructor *gr)
6348 {
6349     XDbgBlockGraph *graph = gr->graph;
6350 
6351     g_hash_table_destroy(gr->graph_nodes);
6352     g_free(gr);
6353 
6354     return graph;
6355 }
6356 
6357 static uintptr_t xdbg_graph_node_num(XDbgBlockGraphConstructor *gr, void *node)
6358 {
6359     uintptr_t ret = (uintptr_t)g_hash_table_lookup(gr->graph_nodes, node);
6360 
6361     if (ret != 0) {
6362         return ret;
6363     }
6364 
6365     /*
6366      * Start counting from 1, not 0, because 0 interferes with not-found (NULL)
6367      * answer of g_hash_table_lookup.
6368      */
6369     ret = g_hash_table_size(gr->graph_nodes) + 1;
6370     g_hash_table_insert(gr->graph_nodes, node, (void *)ret);
6371 
6372     return ret;
6373 }
6374 
6375 static void xdbg_graph_add_node(XDbgBlockGraphConstructor *gr, void *node,
6376                                 XDbgBlockGraphNodeType type, const char *name)
6377 {
6378     XDbgBlockGraphNode *n;
6379 
6380     n = g_new0(XDbgBlockGraphNode, 1);
6381 
6382     n->id = xdbg_graph_node_num(gr, node);
6383     n->type = type;
6384     n->name = g_strdup(name);
6385 
6386     QAPI_LIST_PREPEND(gr->graph->nodes, n);
6387 }
6388 
6389 static void xdbg_graph_add_edge(XDbgBlockGraphConstructor *gr, void *parent,
6390                                 const BdrvChild *child)
6391 {
6392     BlockPermission qapi_perm;
6393     XDbgBlockGraphEdge *edge;
6394     GLOBAL_STATE_CODE();
6395 
6396     edge = g_new0(XDbgBlockGraphEdge, 1);
6397 
6398     edge->parent = xdbg_graph_node_num(gr, parent);
6399     edge->child = xdbg_graph_node_num(gr, child->bs);
6400     edge->name = g_strdup(child->name);
6401 
6402     for (qapi_perm = 0; qapi_perm < BLOCK_PERMISSION__MAX; qapi_perm++) {
6403         uint64_t flag = bdrv_qapi_perm_to_blk_perm(qapi_perm);
6404 
6405         if (flag & child->perm) {
6406             QAPI_LIST_PREPEND(edge->perm, qapi_perm);
6407         }
6408         if (flag & child->shared_perm) {
6409             QAPI_LIST_PREPEND(edge->shared_perm, qapi_perm);
6410         }
6411     }
6412 
6413     QAPI_LIST_PREPEND(gr->graph->edges, edge);
6414 }
6415 
6416 
6417 XDbgBlockGraph *bdrv_get_xdbg_block_graph(Error **errp)
6418 {
6419     BlockBackend *blk;
6420     BlockJob *job;
6421     BlockDriverState *bs;
6422     BdrvChild *child;
6423     XDbgBlockGraphConstructor *gr = xdbg_graph_new();
6424 
6425     GLOBAL_STATE_CODE();
6426 
6427     for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
6428         char *allocated_name = NULL;
6429         const char *name = blk_name(blk);
6430 
6431         if (!*name) {
6432             name = allocated_name = blk_get_attached_dev_id(blk);
6433         }
6434         xdbg_graph_add_node(gr, blk, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_BACKEND,
6435                            name);
6436         g_free(allocated_name);
6437         if (blk_root(blk)) {
6438             xdbg_graph_add_edge(gr, blk, blk_root(blk));
6439         }
6440     }
6441 
6442     WITH_JOB_LOCK_GUARD() {
6443         for (job = block_job_next_locked(NULL); job;
6444              job = block_job_next_locked(job)) {
6445             GSList *el;
6446 
6447             xdbg_graph_add_node(gr, job, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_JOB,
6448                                 job->job.id);
6449             for (el = job->nodes; el; el = el->next) {
6450                 xdbg_graph_add_edge(gr, job, (BdrvChild *)el->data);
6451             }
6452         }
6453     }
6454 
6455     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
6456         xdbg_graph_add_node(gr, bs, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_DRIVER,
6457                            bs->node_name);
6458         QLIST_FOREACH(child, &bs->children, next) {
6459             xdbg_graph_add_edge(gr, bs, child);
6460         }
6461     }
6462 
6463     return xdbg_graph_finalize(gr);
6464 }
6465 
6466 BlockDriverState *bdrv_lookup_bs(const char *device,
6467                                  const char *node_name,
6468                                  Error **errp)
6469 {
6470     BlockBackend *blk;
6471     BlockDriverState *bs;
6472 
6473     GLOBAL_STATE_CODE();
6474 
6475     if (device) {
6476         blk = blk_by_name(device);
6477 
6478         if (blk) {
6479             bs = blk_bs(blk);
6480             if (!bs) {
6481                 error_setg(errp, "Device '%s' has no medium", device);
6482             }
6483 
6484             return bs;
6485         }
6486     }
6487 
6488     if (node_name) {
6489         bs = bdrv_find_node(node_name);
6490 
6491         if (bs) {
6492             return bs;
6493         }
6494     }
6495 
6496     error_setg(errp, "Cannot find device=\'%s\' nor node-name=\'%s\'",
6497                      device ? device : "",
6498                      node_name ? node_name : "");
6499     return NULL;
6500 }
6501 
6502 /* If 'base' is in the same chain as 'top', return true. Otherwise,
6503  * return false.  If either argument is NULL, return false. */
6504 bool bdrv_chain_contains(BlockDriverState *top, BlockDriverState *base)
6505 {
6506 
6507     GLOBAL_STATE_CODE();
6508 
6509     while (top && top != base) {
6510         top = bdrv_filter_or_cow_bs(top);
6511     }
6512 
6513     return top != NULL;
6514 }
6515 
6516 BlockDriverState *bdrv_next_node(BlockDriverState *bs)
6517 {
6518     GLOBAL_STATE_CODE();
6519     if (!bs) {
6520         return QTAILQ_FIRST(&graph_bdrv_states);
6521     }
6522     return QTAILQ_NEXT(bs, node_list);
6523 }
6524 
6525 BlockDriverState *bdrv_next_all_states(BlockDriverState *bs)
6526 {
6527     GLOBAL_STATE_CODE();
6528     if (!bs) {
6529         return QTAILQ_FIRST(&all_bdrv_states);
6530     }
6531     return QTAILQ_NEXT(bs, bs_list);
6532 }
6533 
6534 const char *bdrv_get_node_name(const BlockDriverState *bs)
6535 {
6536     IO_CODE();
6537     return bs->node_name;
6538 }
6539 
6540 const char *bdrv_get_parent_name(const BlockDriverState *bs)
6541 {
6542     BdrvChild *c;
6543     const char *name;
6544     IO_CODE();
6545 
6546     /* If multiple parents have a name, just pick the first one. */
6547     QLIST_FOREACH(c, &bs->parents, next_parent) {
6548         if (c->klass->get_name) {
6549             name = c->klass->get_name(c);
6550             if (name && *name) {
6551                 return name;
6552             }
6553         }
6554     }
6555 
6556     return NULL;
6557 }
6558 
6559 /* TODO check what callers really want: bs->node_name or blk_name() */
6560 const char *bdrv_get_device_name(const BlockDriverState *bs)
6561 {
6562     IO_CODE();
6563     return bdrv_get_parent_name(bs) ?: "";
6564 }
6565 
6566 /* This can be used to identify nodes that might not have a device
6567  * name associated. Since node and device names live in the same
6568  * namespace, the result is unambiguous. The exception is if both are
6569  * absent, then this returns an empty (non-null) string. */
6570 const char *bdrv_get_device_or_node_name(const BlockDriverState *bs)
6571 {
6572     IO_CODE();
6573     return bdrv_get_parent_name(bs) ?: bs->node_name;
6574 }
6575 
6576 int bdrv_get_flags(BlockDriverState *bs)
6577 {
6578     IO_CODE();
6579     return bs->open_flags;
6580 }
6581 
6582 int bdrv_has_zero_init_1(BlockDriverState *bs)
6583 {
6584     GLOBAL_STATE_CODE();
6585     return 1;
6586 }
6587 
6588 int bdrv_has_zero_init(BlockDriverState *bs)
6589 {
6590     BlockDriverState *filtered;
6591     GLOBAL_STATE_CODE();
6592 
6593     if (!bs->drv) {
6594         return 0;
6595     }
6596 
6597     /* If BS is a copy on write image, it is initialized to
6598        the contents of the base image, which may not be zeroes.  */
6599     if (bdrv_cow_child(bs)) {
6600         return 0;
6601     }
6602     if (bs->drv->bdrv_has_zero_init) {
6603         return bs->drv->bdrv_has_zero_init(bs);
6604     }
6605 
6606     filtered = bdrv_filter_bs(bs);
6607     if (filtered) {
6608         return bdrv_has_zero_init(filtered);
6609     }
6610 
6611     /* safe default */
6612     return 0;
6613 }
6614 
6615 bool bdrv_can_write_zeroes_with_unmap(BlockDriverState *bs)
6616 {
6617     IO_CODE();
6618     if (!(bs->open_flags & BDRV_O_UNMAP)) {
6619         return false;
6620     }
6621 
6622     return bs->supported_zero_flags & BDRV_REQ_MAY_UNMAP;
6623 }
6624 
6625 void bdrv_get_backing_filename(BlockDriverState *bs,
6626                                char *filename, int filename_size)
6627 {
6628     IO_CODE();
6629     pstrcpy(filename, filename_size, bs->backing_file);
6630 }
6631 
6632 int coroutine_fn bdrv_co_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
6633 {
6634     int ret;
6635     BlockDriver *drv = bs->drv;
6636     IO_CODE();
6637     assert_bdrv_graph_readable();
6638 
6639     /* if bs->drv == NULL, bs is closed, so there's nothing to do here */
6640     if (!drv) {
6641         return -ENOMEDIUM;
6642     }
6643     if (!drv->bdrv_co_get_info) {
6644         BlockDriverState *filtered = bdrv_filter_bs(bs);
6645         if (filtered) {
6646             return bdrv_co_get_info(filtered, bdi);
6647         }
6648         return -ENOTSUP;
6649     }
6650     memset(bdi, 0, sizeof(*bdi));
6651     ret = drv->bdrv_co_get_info(bs, bdi);
6652     if (bdi->subcluster_size == 0) {
6653         /*
6654          * If the driver left this unset, subclusters are not supported.
6655          * Then it is safe to treat each cluster as having only one subcluster.
6656          */
6657         bdi->subcluster_size = bdi->cluster_size;
6658     }
6659     if (ret < 0) {
6660         return ret;
6661     }
6662 
6663     if (bdi->cluster_size > BDRV_MAX_ALIGNMENT) {
6664         return -EINVAL;
6665     }
6666 
6667     return 0;
6668 }
6669 
6670 ImageInfoSpecific *bdrv_get_specific_info(BlockDriverState *bs,
6671                                           Error **errp)
6672 {
6673     BlockDriver *drv = bs->drv;
6674     IO_CODE();
6675     if (drv && drv->bdrv_get_specific_info) {
6676         return drv->bdrv_get_specific_info(bs, errp);
6677     }
6678     return NULL;
6679 }
6680 
6681 BlockStatsSpecific *bdrv_get_specific_stats(BlockDriverState *bs)
6682 {
6683     BlockDriver *drv = bs->drv;
6684     IO_CODE();
6685     if (!drv || !drv->bdrv_get_specific_stats) {
6686         return NULL;
6687     }
6688     return drv->bdrv_get_specific_stats(bs);
6689 }
6690 
6691 void coroutine_fn bdrv_co_debug_event(BlockDriverState *bs, BlkdebugEvent event)
6692 {
6693     IO_CODE();
6694     assert_bdrv_graph_readable();
6695 
6696     if (!bs || !bs->drv || !bs->drv->bdrv_co_debug_event) {
6697         return;
6698     }
6699 
6700     bs->drv->bdrv_co_debug_event(bs, event);
6701 }
6702 
6703 static BlockDriverState * GRAPH_RDLOCK
6704 bdrv_find_debug_node(BlockDriverState *bs)
6705 {
6706     GLOBAL_STATE_CODE();
6707     while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {
6708         bs = bdrv_primary_bs(bs);
6709     }
6710 
6711     if (bs && bs->drv && bs->drv->bdrv_debug_breakpoint) {
6712         assert(bs->drv->bdrv_debug_remove_breakpoint);
6713         return bs;
6714     }
6715 
6716     return NULL;
6717 }
6718 
6719 int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
6720                           const char *tag)
6721 {
6722     GLOBAL_STATE_CODE();
6723     GRAPH_RDLOCK_GUARD_MAINLOOP();
6724 
6725     bs = bdrv_find_debug_node(bs);
6726     if (bs) {
6727         return bs->drv->bdrv_debug_breakpoint(bs, event, tag);
6728     }
6729 
6730     return -ENOTSUP;
6731 }
6732 
6733 int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag)
6734 {
6735     GLOBAL_STATE_CODE();
6736     GRAPH_RDLOCK_GUARD_MAINLOOP();
6737 
6738     bs = bdrv_find_debug_node(bs);
6739     if (bs) {
6740         return bs->drv->bdrv_debug_remove_breakpoint(bs, tag);
6741     }
6742 
6743     return -ENOTSUP;
6744 }
6745 
6746 int bdrv_debug_resume(BlockDriverState *bs, const char *tag)
6747 {
6748     GLOBAL_STATE_CODE();
6749     GRAPH_RDLOCK_GUARD_MAINLOOP();
6750 
6751     while (bs && (!bs->drv || !bs->drv->bdrv_debug_resume)) {
6752         bs = bdrv_primary_bs(bs);
6753     }
6754 
6755     if (bs && bs->drv && bs->drv->bdrv_debug_resume) {
6756         return bs->drv->bdrv_debug_resume(bs, tag);
6757     }
6758 
6759     return -ENOTSUP;
6760 }
6761 
6762 bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)
6763 {
6764     GLOBAL_STATE_CODE();
6765     GRAPH_RDLOCK_GUARD_MAINLOOP();
6766 
6767     while (bs && bs->drv && !bs->drv->bdrv_debug_is_suspended) {
6768         bs = bdrv_primary_bs(bs);
6769     }
6770 
6771     if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {
6772         return bs->drv->bdrv_debug_is_suspended(bs, tag);
6773     }
6774 
6775     return false;
6776 }
6777 
6778 /* backing_file can either be relative, or absolute, or a protocol.  If it is
6779  * relative, it must be relative to the chain.  So, passing in bs->filename
6780  * from a BDS as backing_file should not be done, as that may be relative to
6781  * the CWD rather than the chain. */
6782 BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
6783         const char *backing_file)
6784 {
6785     char *filename_full = NULL;
6786     char *backing_file_full = NULL;
6787     char *filename_tmp = NULL;
6788     int is_protocol = 0;
6789     bool filenames_refreshed = false;
6790     BlockDriverState *curr_bs = NULL;
6791     BlockDriverState *retval = NULL;
6792     BlockDriverState *bs_below;
6793 
6794     GLOBAL_STATE_CODE();
6795     GRAPH_RDLOCK_GUARD_MAINLOOP();
6796 
6797     if (!bs || !bs->drv || !backing_file) {
6798         return NULL;
6799     }
6800 
6801     filename_full     = g_malloc(PATH_MAX);
6802     backing_file_full = g_malloc(PATH_MAX);
6803 
6804     is_protocol = path_has_protocol(backing_file);
6805 
6806     /*
6807      * Being largely a legacy function, skip any filters here
6808      * (because filters do not have normal filenames, so they cannot
6809      * match anyway; and allowing json:{} filenames is a bit out of
6810      * scope).
6811      */
6812     for (curr_bs = bdrv_skip_filters(bs);
6813          bdrv_cow_child(curr_bs) != NULL;
6814          curr_bs = bs_below)
6815     {
6816         bs_below = bdrv_backing_chain_next(curr_bs);
6817 
6818         if (bdrv_backing_overridden(curr_bs)) {
6819             /*
6820              * If the backing file was overridden, we can only compare
6821              * directly against the backing node's filename.
6822              */
6823 
6824             if (!filenames_refreshed) {
6825                 /*
6826                  * This will automatically refresh all of the
6827                  * filenames in the rest of the backing chain, so we
6828                  * only need to do this once.
6829                  */
6830                 bdrv_refresh_filename(bs_below);
6831                 filenames_refreshed = true;
6832             }
6833 
6834             if (strcmp(backing_file, bs_below->filename) == 0) {
6835                 retval = bs_below;
6836                 break;
6837             }
6838         } else if (is_protocol || path_has_protocol(curr_bs->backing_file)) {
6839             /*
6840              * If either of the filename paths is actually a protocol, then
6841              * compare unmodified paths; otherwise make paths relative.
6842              */
6843             char *backing_file_full_ret;
6844 
6845             if (strcmp(backing_file, curr_bs->backing_file) == 0) {
6846                 retval = bs_below;
6847                 break;
6848             }
6849             /* Also check against the full backing filename for the image */
6850             backing_file_full_ret = bdrv_get_full_backing_filename(curr_bs,
6851                                                                    NULL);
6852             if (backing_file_full_ret) {
6853                 bool equal = strcmp(backing_file, backing_file_full_ret) == 0;
6854                 g_free(backing_file_full_ret);
6855                 if (equal) {
6856                     retval = bs_below;
6857                     break;
6858                 }
6859             }
6860         } else {
6861             /* If not an absolute filename path, make it relative to the current
6862              * image's filename path */
6863             filename_tmp = bdrv_make_absolute_filename(curr_bs, backing_file,
6864                                                        NULL);
6865             /* We are going to compare canonicalized absolute pathnames */
6866             if (!filename_tmp || !realpath(filename_tmp, filename_full)) {
6867                 g_free(filename_tmp);
6868                 continue;
6869             }
6870             g_free(filename_tmp);
6871 
6872             /* We need to make sure the backing filename we are comparing against
6873              * is relative to the current image filename (or absolute) */
6874             filename_tmp = bdrv_get_full_backing_filename(curr_bs, NULL);
6875             if (!filename_tmp || !realpath(filename_tmp, backing_file_full)) {
6876                 g_free(filename_tmp);
6877                 continue;
6878             }
6879             g_free(filename_tmp);
6880 
6881             if (strcmp(backing_file_full, filename_full) == 0) {
6882                 retval = bs_below;
6883                 break;
6884             }
6885         }
6886     }
6887 
6888     g_free(filename_full);
6889     g_free(backing_file_full);
6890     return retval;
6891 }
6892 
6893 void bdrv_init(void)
6894 {
6895 #ifdef CONFIG_BDRV_WHITELIST_TOOLS
6896     use_bdrv_whitelist = 1;
6897 #endif
6898     module_call_init(MODULE_INIT_BLOCK);
6899 }
6900 
6901 void bdrv_init_with_whitelist(void)
6902 {
6903     use_bdrv_whitelist = 1;
6904     bdrv_init();
6905 }
6906 
6907 int bdrv_activate(BlockDriverState *bs, Error **errp)
6908 {
6909     BdrvChild *child, *parent;
6910     Error *local_err = NULL;
6911     int ret;
6912     BdrvDirtyBitmap *bm;
6913 
6914     GLOBAL_STATE_CODE();
6915     GRAPH_RDLOCK_GUARD_MAINLOOP();
6916 
6917     if (!bs->drv)  {
6918         return -ENOMEDIUM;
6919     }
6920 
6921     QLIST_FOREACH(child, &bs->children, next) {
6922         bdrv_activate(child->bs, &local_err);
6923         if (local_err) {
6924             error_propagate(errp, local_err);
6925             return -EINVAL;
6926         }
6927     }
6928 
6929     /*
6930      * Update permissions, they may differ for inactive nodes.
6931      *
6932      * Note that the required permissions of inactive images are always a
6933      * subset of the permissions required after activating the image. This
6934      * allows us to just get the permissions upfront without restricting
6935      * bdrv_co_invalidate_cache().
6936      *
6937      * It also means that in error cases, we don't have to try and revert to
6938      * the old permissions (which is an operation that could fail, too). We can
6939      * just keep the extended permissions for the next time that an activation
6940      * of the image is tried.
6941      */
6942     if (bs->open_flags & BDRV_O_INACTIVE) {
6943         bs->open_flags &= ~BDRV_O_INACTIVE;
6944         ret = bdrv_refresh_perms(bs, NULL, errp);
6945         if (ret < 0) {
6946             bs->open_flags |= BDRV_O_INACTIVE;
6947             return ret;
6948         }
6949 
6950         ret = bdrv_invalidate_cache(bs, errp);
6951         if (ret < 0) {
6952             bs->open_flags |= BDRV_O_INACTIVE;
6953             return ret;
6954         }
6955 
6956         FOR_EACH_DIRTY_BITMAP(bs, bm) {
6957             bdrv_dirty_bitmap_skip_store(bm, false);
6958         }
6959 
6960         ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
6961         if (ret < 0) {
6962             bs->open_flags |= BDRV_O_INACTIVE;
6963             error_setg_errno(errp, -ret, "Could not refresh total sector count");
6964             return ret;
6965         }
6966     }
6967 
6968     QLIST_FOREACH(parent, &bs->parents, next_parent) {
6969         if (parent->klass->activate) {
6970             parent->klass->activate(parent, &local_err);
6971             if (local_err) {
6972                 bs->open_flags |= BDRV_O_INACTIVE;
6973                 error_propagate(errp, local_err);
6974                 return -EINVAL;
6975             }
6976         }
6977     }
6978 
6979     return 0;
6980 }
6981 
6982 int coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs, Error **errp)
6983 {
6984     Error *local_err = NULL;
6985     IO_CODE();
6986 
6987     assert(!(bs->open_flags & BDRV_O_INACTIVE));
6988     assert_bdrv_graph_readable();
6989 
6990     if (bs->drv->bdrv_co_invalidate_cache) {
6991         bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
6992         if (local_err) {
6993             error_propagate(errp, local_err);
6994             return -EINVAL;
6995         }
6996     }
6997 
6998     return 0;
6999 }
7000 
7001 void bdrv_activate_all(Error **errp)
7002 {
7003     BlockDriverState *bs;
7004     BdrvNextIterator it;
7005 
7006     GLOBAL_STATE_CODE();
7007     GRAPH_RDLOCK_GUARD_MAINLOOP();
7008 
7009     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
7010         AioContext *aio_context = bdrv_get_aio_context(bs);
7011         int ret;
7012 
7013         aio_context_acquire(aio_context);
7014         ret = bdrv_activate(bs, errp);
7015         aio_context_release(aio_context);
7016         if (ret < 0) {
7017             bdrv_next_cleanup(&it);
7018             return;
7019         }
7020     }
7021 }
7022 
7023 static bool GRAPH_RDLOCK
7024 bdrv_has_bds_parent(BlockDriverState *bs, bool only_active)
7025 {
7026     BdrvChild *parent;
7027     GLOBAL_STATE_CODE();
7028 
7029     QLIST_FOREACH(parent, &bs->parents, next_parent) {
7030         if (parent->klass->parent_is_bds) {
7031             BlockDriverState *parent_bs = parent->opaque;
7032             if (!only_active || !(parent_bs->open_flags & BDRV_O_INACTIVE)) {
7033                 return true;
7034             }
7035         }
7036     }
7037 
7038     return false;
7039 }
7040 
7041 static int GRAPH_RDLOCK bdrv_inactivate_recurse(BlockDriverState *bs)
7042 {
7043     BdrvChild *child, *parent;
7044     int ret;
7045     uint64_t cumulative_perms, cumulative_shared_perms;
7046 
7047     GLOBAL_STATE_CODE();
7048 
7049     if (!bs->drv) {
7050         return -ENOMEDIUM;
7051     }
7052 
7053     /* Make sure that we don't inactivate a child before its parent.
7054      * It will be covered by recursion from the yet active parent. */
7055     if (bdrv_has_bds_parent(bs, true)) {
7056         return 0;
7057     }
7058 
7059     assert(!(bs->open_flags & BDRV_O_INACTIVE));
7060 
7061     /* Inactivate this node */
7062     if (bs->drv->bdrv_inactivate) {
7063         ret = bs->drv->bdrv_inactivate(bs);
7064         if (ret < 0) {
7065             return ret;
7066         }
7067     }
7068 
7069     QLIST_FOREACH(parent, &bs->parents, next_parent) {
7070         if (parent->klass->inactivate) {
7071             ret = parent->klass->inactivate(parent);
7072             if (ret < 0) {
7073                 return ret;
7074             }
7075         }
7076     }
7077 
7078     bdrv_get_cumulative_perm(bs, &cumulative_perms,
7079                              &cumulative_shared_perms);
7080     if (cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
7081         /* Our inactive parents still need write access. Inactivation failed. */
7082         return -EPERM;
7083     }
7084 
7085     bs->open_flags |= BDRV_O_INACTIVE;
7086 
7087     /*
7088      * Update permissions, they may differ for inactive nodes.
7089      * We only tried to loosen restrictions, so errors are not fatal, ignore
7090      * them.
7091      */
7092     bdrv_refresh_perms(bs, NULL, NULL);
7093 
7094     /* Recursively inactivate children */
7095     QLIST_FOREACH(child, &bs->children, next) {
7096         ret = bdrv_inactivate_recurse(child->bs);
7097         if (ret < 0) {
7098             return ret;
7099         }
7100     }
7101 
7102     return 0;
7103 }
7104 
7105 int bdrv_inactivate_all(void)
7106 {
7107     BlockDriverState *bs = NULL;
7108     BdrvNextIterator it;
7109     int ret = 0;
7110     GSList *aio_ctxs = NULL, *ctx;
7111 
7112     GLOBAL_STATE_CODE();
7113     GRAPH_RDLOCK_GUARD_MAINLOOP();
7114 
7115     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
7116         AioContext *aio_context = bdrv_get_aio_context(bs);
7117 
7118         if (!g_slist_find(aio_ctxs, aio_context)) {
7119             aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
7120             aio_context_acquire(aio_context);
7121         }
7122     }
7123 
7124     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
7125         /* Nodes with BDS parents are covered by recursion from the last
7126          * parent that gets inactivated. Don't inactivate them a second
7127          * time if that has already happened. */
7128         if (bdrv_has_bds_parent(bs, false)) {
7129             continue;
7130         }
7131         ret = bdrv_inactivate_recurse(bs);
7132         if (ret < 0) {
7133             bdrv_next_cleanup(&it);
7134             goto out;
7135         }
7136     }
7137 
7138 out:
7139     for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
7140         AioContext *aio_context = ctx->data;
7141         aio_context_release(aio_context);
7142     }
7143     g_slist_free(aio_ctxs);
7144 
7145     return ret;
7146 }
7147 
7148 /**************************************************************/
7149 /* removable device support */
7150 
7151 /**
7152  * Return TRUE if the media is present
7153  */
7154 bool coroutine_fn bdrv_co_is_inserted(BlockDriverState *bs)
7155 {
7156     BlockDriver *drv = bs->drv;
7157     BdrvChild *child;
7158     IO_CODE();
7159     assert_bdrv_graph_readable();
7160 
7161     if (!drv) {
7162         return false;
7163     }
7164     if (drv->bdrv_co_is_inserted) {
7165         return drv->bdrv_co_is_inserted(bs);
7166     }
7167     QLIST_FOREACH(child, &bs->children, next) {
7168         if (!bdrv_co_is_inserted(child->bs)) {
7169             return false;
7170         }
7171     }
7172     return true;
7173 }
7174 
7175 /**
7176  * If eject_flag is TRUE, eject the media. Otherwise, close the tray
7177  */
7178 void coroutine_fn bdrv_co_eject(BlockDriverState *bs, bool eject_flag)
7179 {
7180     BlockDriver *drv = bs->drv;
7181     IO_CODE();
7182     assert_bdrv_graph_readable();
7183 
7184     if (drv && drv->bdrv_co_eject) {
7185         drv->bdrv_co_eject(bs, eject_flag);
7186     }
7187 }
7188 
7189 /**
7190  * Lock or unlock the media (if it is locked, the user won't be able
7191  * to eject it manually).
7192  */
7193 void coroutine_fn bdrv_co_lock_medium(BlockDriverState *bs, bool locked)
7194 {
7195     BlockDriver *drv = bs->drv;
7196     IO_CODE();
7197     assert_bdrv_graph_readable();
7198     trace_bdrv_lock_medium(bs, locked);
7199 
7200     if (drv && drv->bdrv_co_lock_medium) {
7201         drv->bdrv_co_lock_medium(bs, locked);
7202     }
7203 }
7204 
7205 /* Get a reference to bs */
7206 void bdrv_ref(BlockDriverState *bs)
7207 {
7208     GLOBAL_STATE_CODE();
7209     bs->refcnt++;
7210 }
7211 
7212 /* Release a previously grabbed reference to bs.
7213  * If after releasing, reference count is zero, the BlockDriverState is
7214  * deleted. */
7215 void bdrv_unref(BlockDriverState *bs)
7216 {
7217     GLOBAL_STATE_CODE();
7218     if (!bs) {
7219         return;
7220     }
7221     assert(bs->refcnt > 0);
7222     if (--bs->refcnt == 0) {
7223         bdrv_delete(bs);
7224     }
7225 }
7226 
7227 /*
7228  * Release a BlockDriverState reference while holding the graph write lock.
7229  *
7230  * Calling bdrv_unref() directly is forbidden while holding the graph lock
7231  * because bdrv_close() both involves polling and taking the graph lock
7232  * internally. bdrv_schedule_unref() instead delays decreasing the refcount and
7233  * possibly closing @bs until the graph lock is released.
7234  */
7235 void bdrv_schedule_unref(BlockDriverState *bs)
7236 {
7237     if (!bs) {
7238         return;
7239     }
7240     aio_bh_schedule_oneshot(qemu_get_aio_context(),
7241                             (QEMUBHFunc *) bdrv_unref, bs);
7242 }
7243 
7244 struct BdrvOpBlocker {
7245     Error *reason;
7246     QLIST_ENTRY(BdrvOpBlocker) list;
7247 };
7248 
7249 bool bdrv_op_is_blocked(BlockDriverState *bs, BlockOpType op, Error **errp)
7250 {
7251     BdrvOpBlocker *blocker;
7252     GLOBAL_STATE_CODE();
7253 
7254     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
7255     if (!QLIST_EMPTY(&bs->op_blockers[op])) {
7256         blocker = QLIST_FIRST(&bs->op_blockers[op]);
7257         error_propagate_prepend(errp, error_copy(blocker->reason),
7258                                 "Node '%s' is busy: ",
7259                                 bdrv_get_device_or_node_name(bs));
7260         return true;
7261     }
7262     return false;
7263 }
7264 
7265 void bdrv_op_block(BlockDriverState *bs, BlockOpType op, Error *reason)
7266 {
7267     BdrvOpBlocker *blocker;
7268     GLOBAL_STATE_CODE();
7269     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
7270 
7271     blocker = g_new0(BdrvOpBlocker, 1);
7272     blocker->reason = reason;
7273     QLIST_INSERT_HEAD(&bs->op_blockers[op], blocker, list);
7274 }
7275 
7276 void bdrv_op_unblock(BlockDriverState *bs, BlockOpType op, Error *reason)
7277 {
7278     BdrvOpBlocker *blocker, *next;
7279     GLOBAL_STATE_CODE();
7280     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
7281     QLIST_FOREACH_SAFE(blocker, &bs->op_blockers[op], list, next) {
7282         if (blocker->reason == reason) {
7283             QLIST_REMOVE(blocker, list);
7284             g_free(blocker);
7285         }
7286     }
7287 }
7288 
7289 void bdrv_op_block_all(BlockDriverState *bs, Error *reason)
7290 {
7291     int i;
7292     GLOBAL_STATE_CODE();
7293     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
7294         bdrv_op_block(bs, i, reason);
7295     }
7296 }
7297 
7298 void bdrv_op_unblock_all(BlockDriverState *bs, Error *reason)
7299 {
7300     int i;
7301     GLOBAL_STATE_CODE();
7302     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
7303         bdrv_op_unblock(bs, i, reason);
7304     }
7305 }
7306 
7307 bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
7308 {
7309     int i;
7310     GLOBAL_STATE_CODE();
7311     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
7312         if (!QLIST_EMPTY(&bs->op_blockers[i])) {
7313             return false;
7314         }
7315     }
7316     return true;
7317 }
7318 
7319 /*
7320  * Must not be called while holding the lock of an AioContext other than the
7321  * current one.
7322  */
7323 void bdrv_img_create(const char *filename, const char *fmt,
7324                      const char *base_filename, const char *base_fmt,
7325                      char *options, uint64_t img_size, int flags, bool quiet,
7326                      Error **errp)
7327 {
7328     QemuOptsList *create_opts = NULL;
7329     QemuOpts *opts = NULL;
7330     const char *backing_fmt, *backing_file;
7331     int64_t size;
7332     BlockDriver *drv, *proto_drv;
7333     Error *local_err = NULL;
7334     int ret = 0;
7335 
7336     GLOBAL_STATE_CODE();
7337 
7338     /* Find driver and parse its options */
7339     drv = bdrv_find_format(fmt);
7340     if (!drv) {
7341         error_setg(errp, "Unknown file format '%s'", fmt);
7342         return;
7343     }
7344 
7345     proto_drv = bdrv_find_protocol(filename, true, errp);
7346     if (!proto_drv) {
7347         return;
7348     }
7349 
7350     if (!drv->create_opts) {
7351         error_setg(errp, "Format driver '%s' does not support image creation",
7352                    drv->format_name);
7353         return;
7354     }
7355 
7356     if (!proto_drv->create_opts) {
7357         error_setg(errp, "Protocol driver '%s' does not support image creation",
7358                    proto_drv->format_name);
7359         return;
7360     }
7361 
7362     aio_context_acquire(qemu_get_aio_context());
7363 
7364     /* Create parameter list */
7365     create_opts = qemu_opts_append(create_opts, drv->create_opts);
7366     create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
7367 
7368     opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
7369 
7370     /* Parse -o options */
7371     if (options) {
7372         if (!qemu_opts_do_parse(opts, options, NULL, errp)) {
7373             goto out;
7374         }
7375     }
7376 
7377     if (!qemu_opt_get(opts, BLOCK_OPT_SIZE)) {
7378         qemu_opt_set_number(opts, BLOCK_OPT_SIZE, img_size, &error_abort);
7379     } else if (img_size != UINT64_C(-1)) {
7380         error_setg(errp, "The image size must be specified only once");
7381         goto out;
7382     }
7383 
7384     if (base_filename) {
7385         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, base_filename,
7386                           NULL)) {
7387             error_setg(errp, "Backing file not supported for file format '%s'",
7388                        fmt);
7389             goto out;
7390         }
7391     }
7392 
7393     if (base_fmt) {
7394         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, base_fmt, NULL)) {
7395             error_setg(errp, "Backing file format not supported for file "
7396                              "format '%s'", fmt);
7397             goto out;
7398         }
7399     }
7400 
7401     backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
7402     if (backing_file) {
7403         if (!strcmp(filename, backing_file)) {
7404             error_setg(errp, "Error: Trying to create an image with the "
7405                              "same filename as the backing file");
7406             goto out;
7407         }
7408         if (backing_file[0] == '\0') {
7409             error_setg(errp, "Expected backing file name, got empty string");
7410             goto out;
7411         }
7412     }
7413 
7414     backing_fmt = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
7415 
7416     /* The size for the image must always be specified, unless we have a backing
7417      * file and we have not been forbidden from opening it. */
7418     size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, img_size);
7419     if (backing_file && !(flags & BDRV_O_NO_BACKING)) {
7420         BlockDriverState *bs;
7421         char *full_backing;
7422         int back_flags;
7423         QDict *backing_options = NULL;
7424 
7425         full_backing =
7426             bdrv_get_full_backing_filename_from_filename(filename, backing_file,
7427                                                          &local_err);
7428         if (local_err) {
7429             goto out;
7430         }
7431         assert(full_backing);
7432 
7433         /*
7434          * No need to do I/O here, which allows us to open encrypted
7435          * backing images without needing the secret
7436          */
7437         back_flags = flags;
7438         back_flags &= ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
7439         back_flags |= BDRV_O_NO_IO;
7440 
7441         backing_options = qdict_new();
7442         if (backing_fmt) {
7443             qdict_put_str(backing_options, "driver", backing_fmt);
7444         }
7445         qdict_put_bool(backing_options, BDRV_OPT_FORCE_SHARE, true);
7446 
7447         bs = bdrv_open(full_backing, NULL, backing_options, back_flags,
7448                        &local_err);
7449         g_free(full_backing);
7450         if (!bs) {
7451             error_append_hint(&local_err, "Could not open backing image.\n");
7452             goto out;
7453         } else {
7454             if (!backing_fmt) {
7455                 error_setg(&local_err,
7456                            "Backing file specified without backing format");
7457                 error_append_hint(&local_err, "Detected format of %s.\n",
7458                                   bs->drv->format_name);
7459                 goto out;
7460             }
7461             if (size == -1) {
7462                 /* Opened BS, have no size */
7463                 size = bdrv_getlength(bs);
7464                 if (size < 0) {
7465                     error_setg_errno(errp, -size, "Could not get size of '%s'",
7466                                      backing_file);
7467                     bdrv_unref(bs);
7468                     goto out;
7469                 }
7470                 qemu_opt_set_number(opts, BLOCK_OPT_SIZE, size, &error_abort);
7471             }
7472             bdrv_unref(bs);
7473         }
7474         /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
7475     } else if (backing_file && !backing_fmt) {
7476         error_setg(&local_err,
7477                    "Backing file specified without backing format");
7478         goto out;
7479     }
7480 
7481     if (size == -1) {
7482         error_setg(errp, "Image creation needs a size parameter");
7483         goto out;
7484     }
7485 
7486     if (!quiet) {
7487         printf("Formatting '%s', fmt=%s ", filename, fmt);
7488         qemu_opts_print(opts, " ");
7489         puts("");
7490         fflush(stdout);
7491     }
7492 
7493     ret = bdrv_create(drv, filename, opts, &local_err);
7494 
7495     if (ret == -EFBIG) {
7496         /* This is generally a better message than whatever the driver would
7497          * deliver (especially because of the cluster_size_hint), since that
7498          * is most probably not much different from "image too large". */
7499         const char *cluster_size_hint = "";
7500         if (qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, 0)) {
7501             cluster_size_hint = " (try using a larger cluster size)";
7502         }
7503         error_setg(errp, "The image size is too large for file format '%s'"
7504                    "%s", fmt, cluster_size_hint);
7505         error_free(local_err);
7506         local_err = NULL;
7507     }
7508 
7509 out:
7510     qemu_opts_del(opts);
7511     qemu_opts_free(create_opts);
7512     error_propagate(errp, local_err);
7513     aio_context_release(qemu_get_aio_context());
7514 }
7515 
7516 AioContext *bdrv_get_aio_context(BlockDriverState *bs)
7517 {
7518     IO_CODE();
7519     return bs ? bs->aio_context : qemu_get_aio_context();
7520 }
7521 
7522 AioContext *coroutine_fn bdrv_co_enter(BlockDriverState *bs)
7523 {
7524     Coroutine *self = qemu_coroutine_self();
7525     AioContext *old_ctx = qemu_coroutine_get_aio_context(self);
7526     AioContext *new_ctx;
7527     IO_CODE();
7528 
7529     /*
7530      * Increase bs->in_flight to ensure that this operation is completed before
7531      * moving the node to a different AioContext. Read new_ctx only afterwards.
7532      */
7533     bdrv_inc_in_flight(bs);
7534 
7535     new_ctx = bdrv_get_aio_context(bs);
7536     aio_co_reschedule_self(new_ctx);
7537     return old_ctx;
7538 }
7539 
7540 void coroutine_fn bdrv_co_leave(BlockDriverState *bs, AioContext *old_ctx)
7541 {
7542     IO_CODE();
7543     aio_co_reschedule_self(old_ctx);
7544     bdrv_dec_in_flight(bs);
7545 }
7546 
7547 void coroutine_fn bdrv_co_lock(BlockDriverState *bs)
7548 {
7549     AioContext *ctx = bdrv_get_aio_context(bs);
7550 
7551     /* In the main thread, bs->aio_context won't change concurrently */
7552     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
7553 
7554     /*
7555      * We're in coroutine context, so we already hold the lock of the main
7556      * loop AioContext. Don't lock it twice to avoid deadlocks.
7557      */
7558     assert(qemu_in_coroutine());
7559     if (ctx != qemu_get_aio_context()) {
7560         aio_context_acquire(ctx);
7561     }
7562 }
7563 
7564 void coroutine_fn bdrv_co_unlock(BlockDriverState *bs)
7565 {
7566     AioContext *ctx = bdrv_get_aio_context(bs);
7567 
7568     assert(qemu_in_coroutine());
7569     if (ctx != qemu_get_aio_context()) {
7570         aio_context_release(ctx);
7571     }
7572 }
7573 
7574 static void bdrv_do_remove_aio_context_notifier(BdrvAioNotifier *ban)
7575 {
7576     GLOBAL_STATE_CODE();
7577     QLIST_REMOVE(ban, list);
7578     g_free(ban);
7579 }
7580 
7581 static void bdrv_detach_aio_context(BlockDriverState *bs)
7582 {
7583     BdrvAioNotifier *baf, *baf_tmp;
7584 
7585     assert(!bs->walking_aio_notifiers);
7586     GLOBAL_STATE_CODE();
7587     bs->walking_aio_notifiers = true;
7588     QLIST_FOREACH_SAFE(baf, &bs->aio_notifiers, list, baf_tmp) {
7589         if (baf->deleted) {
7590             bdrv_do_remove_aio_context_notifier(baf);
7591         } else {
7592             baf->detach_aio_context(baf->opaque);
7593         }
7594     }
7595     /* Never mind iterating again to check for ->deleted.  bdrv_close() will
7596      * remove remaining aio notifiers if we aren't called again.
7597      */
7598     bs->walking_aio_notifiers = false;
7599 
7600     if (bs->drv && bs->drv->bdrv_detach_aio_context) {
7601         bs->drv->bdrv_detach_aio_context(bs);
7602     }
7603 
7604     bs->aio_context = NULL;
7605 }
7606 
7607 static void bdrv_attach_aio_context(BlockDriverState *bs,
7608                                     AioContext *new_context)
7609 {
7610     BdrvAioNotifier *ban, *ban_tmp;
7611     GLOBAL_STATE_CODE();
7612 
7613     bs->aio_context = new_context;
7614 
7615     if (bs->drv && bs->drv->bdrv_attach_aio_context) {
7616         bs->drv->bdrv_attach_aio_context(bs, new_context);
7617     }
7618 
7619     assert(!bs->walking_aio_notifiers);
7620     bs->walking_aio_notifiers = true;
7621     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_tmp) {
7622         if (ban->deleted) {
7623             bdrv_do_remove_aio_context_notifier(ban);
7624         } else {
7625             ban->attached_aio_context(new_context, ban->opaque);
7626         }
7627     }
7628     bs->walking_aio_notifiers = false;
7629 }
7630 
7631 typedef struct BdrvStateSetAioContext {
7632     AioContext *new_ctx;
7633     BlockDriverState *bs;
7634 } BdrvStateSetAioContext;
7635 
7636 static bool bdrv_parent_change_aio_context(BdrvChild *c, AioContext *ctx,
7637                                            GHashTable *visited,
7638                                            Transaction *tran,
7639                                            Error **errp)
7640 {
7641     GLOBAL_STATE_CODE();
7642     if (g_hash_table_contains(visited, c)) {
7643         return true;
7644     }
7645     g_hash_table_add(visited, c);
7646 
7647     /*
7648      * A BdrvChildClass that doesn't handle AioContext changes cannot
7649      * tolerate any AioContext changes
7650      */
7651     if (!c->klass->change_aio_ctx) {
7652         char *user = bdrv_child_user_desc(c);
7653         error_setg(errp, "Changing iothreads is not supported by %s", user);
7654         g_free(user);
7655         return false;
7656     }
7657     if (!c->klass->change_aio_ctx(c, ctx, visited, tran, errp)) {
7658         assert(!errp || *errp);
7659         return false;
7660     }
7661     return true;
7662 }
7663 
7664 bool bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
7665                                    GHashTable *visited, Transaction *tran,
7666                                    Error **errp)
7667 {
7668     GLOBAL_STATE_CODE();
7669     if (g_hash_table_contains(visited, c)) {
7670         return true;
7671     }
7672     g_hash_table_add(visited, c);
7673     return bdrv_change_aio_context(c->bs, ctx, visited, tran, errp);
7674 }
7675 
7676 static void bdrv_set_aio_context_clean(void *opaque)
7677 {
7678     BdrvStateSetAioContext *state = (BdrvStateSetAioContext *) opaque;
7679     BlockDriverState *bs = (BlockDriverState *) state->bs;
7680 
7681     /* Paired with bdrv_drained_begin in bdrv_change_aio_context() */
7682     bdrv_drained_end(bs);
7683 
7684     g_free(state);
7685 }
7686 
7687 static void bdrv_set_aio_context_commit(void *opaque)
7688 {
7689     BdrvStateSetAioContext *state = (BdrvStateSetAioContext *) opaque;
7690     BlockDriverState *bs = (BlockDriverState *) state->bs;
7691     AioContext *new_context = state->new_ctx;
7692     AioContext *old_context = bdrv_get_aio_context(bs);
7693 
7694     /*
7695      * Take the old AioContex when detaching it from bs.
7696      * At this point, new_context lock is already acquired, and we are now
7697      * also taking old_context. This is safe as long as bdrv_detach_aio_context
7698      * does not call AIO_POLL_WHILE().
7699      */
7700     if (old_context != qemu_get_aio_context()) {
7701         aio_context_acquire(old_context);
7702     }
7703     bdrv_detach_aio_context(bs);
7704     if (old_context != qemu_get_aio_context()) {
7705         aio_context_release(old_context);
7706     }
7707     bdrv_attach_aio_context(bs, new_context);
7708 }
7709 
7710 static TransactionActionDrv set_aio_context = {
7711     .commit = bdrv_set_aio_context_commit,
7712     .clean = bdrv_set_aio_context_clean,
7713 };
7714 
7715 /*
7716  * Changes the AioContext used for fd handlers, timers, and BHs by this
7717  * BlockDriverState and all its children and parents.
7718  *
7719  * Must be called from the main AioContext.
7720  *
7721  * The caller must own the AioContext lock for the old AioContext of bs, but it
7722  * must not own the AioContext lock for new_context (unless new_context is the
7723  * same as the current context of bs).
7724  *
7725  * @visited will accumulate all visited BdrvChild objects. The caller is
7726  * responsible for freeing the list afterwards.
7727  */
7728 static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
7729                                     GHashTable *visited, Transaction *tran,
7730                                     Error **errp)
7731 {
7732     BdrvChild *c;
7733     BdrvStateSetAioContext *state;
7734 
7735     GLOBAL_STATE_CODE();
7736 
7737     if (bdrv_get_aio_context(bs) == ctx) {
7738         return true;
7739     }
7740 
7741     bdrv_graph_rdlock_main_loop();
7742     QLIST_FOREACH(c, &bs->parents, next_parent) {
7743         if (!bdrv_parent_change_aio_context(c, ctx, visited, tran, errp)) {
7744             bdrv_graph_rdunlock_main_loop();
7745             return false;
7746         }
7747     }
7748 
7749     QLIST_FOREACH(c, &bs->children, next) {
7750         if (!bdrv_child_change_aio_context(c, ctx, visited, tran, errp)) {
7751             bdrv_graph_rdunlock_main_loop();
7752             return false;
7753         }
7754     }
7755     bdrv_graph_rdunlock_main_loop();
7756 
7757     state = g_new(BdrvStateSetAioContext, 1);
7758     *state = (BdrvStateSetAioContext) {
7759         .new_ctx = ctx,
7760         .bs = bs,
7761     };
7762 
7763     /* Paired with bdrv_drained_end in bdrv_set_aio_context_clean() */
7764     bdrv_drained_begin(bs);
7765 
7766     tran_add(tran, &set_aio_context, state);
7767 
7768     return true;
7769 }
7770 
7771 /*
7772  * Change bs's and recursively all of its parents' and children's AioContext
7773  * to the given new context, returning an error if that isn't possible.
7774  *
7775  * If ignore_child is not NULL, that child (and its subgraph) will not
7776  * be touched.
7777  *
7778  * This function still requires the caller to take the bs current
7779  * AioContext lock, otherwise draining will fail since AIO_WAIT_WHILE
7780  * assumes the lock is always held if bs is in another AioContext.
7781  * For the same reason, it temporarily also holds the new AioContext, since
7782  * bdrv_drained_end calls BDRV_POLL_WHILE that assumes the lock is taken too.
7783  * Therefore the new AioContext lock must not be taken by the caller.
7784  */
7785 int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
7786                                 BdrvChild *ignore_child, Error **errp)
7787 {
7788     Transaction *tran;
7789     GHashTable *visited;
7790     int ret;
7791     AioContext *old_context = bdrv_get_aio_context(bs);
7792     GLOBAL_STATE_CODE();
7793 
7794     /*
7795      * Recursion phase: go through all nodes of the graph.
7796      * Take care of checking that all nodes support changing AioContext
7797      * and drain them, building a linear list of callbacks to run if everything
7798      * is successful (the transaction itself).
7799      */
7800     tran = tran_new();
7801     visited = g_hash_table_new(NULL, NULL);
7802     if (ignore_child) {
7803         g_hash_table_add(visited, ignore_child);
7804     }
7805     ret = bdrv_change_aio_context(bs, ctx, visited, tran, errp);
7806     g_hash_table_destroy(visited);
7807 
7808     /*
7809      * Linear phase: go through all callbacks collected in the transaction.
7810      * Run all callbacks collected in the recursion to switch all nodes
7811      * AioContext lock (transaction commit), or undo all changes done in the
7812      * recursion (transaction abort).
7813      */
7814 
7815     if (!ret) {
7816         /* Just run clean() callbacks. No AioContext changed. */
7817         tran_abort(tran);
7818         return -EPERM;
7819     }
7820 
7821     /*
7822      * Release old AioContext, it won't be needed anymore, as all
7823      * bdrv_drained_begin() have been called already.
7824      */
7825     if (qemu_get_aio_context() != old_context) {
7826         aio_context_release(old_context);
7827     }
7828 
7829     /*
7830      * Acquire new AioContext since bdrv_drained_end() is going to be called
7831      * after we switched all nodes in the new AioContext, and the function
7832      * assumes that the lock of the bs is always taken.
7833      */
7834     if (qemu_get_aio_context() != ctx) {
7835         aio_context_acquire(ctx);
7836     }
7837 
7838     tran_commit(tran);
7839 
7840     if (qemu_get_aio_context() != ctx) {
7841         aio_context_release(ctx);
7842     }
7843 
7844     /* Re-acquire the old AioContext, since the caller takes and releases it. */
7845     if (qemu_get_aio_context() != old_context) {
7846         aio_context_acquire(old_context);
7847     }
7848 
7849     return 0;
7850 }
7851 
7852 void bdrv_add_aio_context_notifier(BlockDriverState *bs,
7853         void (*attached_aio_context)(AioContext *new_context, void *opaque),
7854         void (*detach_aio_context)(void *opaque), void *opaque)
7855 {
7856     BdrvAioNotifier *ban = g_new(BdrvAioNotifier, 1);
7857     *ban = (BdrvAioNotifier){
7858         .attached_aio_context = attached_aio_context,
7859         .detach_aio_context   = detach_aio_context,
7860         .opaque               = opaque
7861     };
7862     GLOBAL_STATE_CODE();
7863 
7864     QLIST_INSERT_HEAD(&bs->aio_notifiers, ban, list);
7865 }
7866 
7867 void bdrv_remove_aio_context_notifier(BlockDriverState *bs,
7868                                       void (*attached_aio_context)(AioContext *,
7869                                                                    void *),
7870                                       void (*detach_aio_context)(void *),
7871                                       void *opaque)
7872 {
7873     BdrvAioNotifier *ban, *ban_next;
7874     GLOBAL_STATE_CODE();
7875 
7876     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
7877         if (ban->attached_aio_context == attached_aio_context &&
7878             ban->detach_aio_context   == detach_aio_context   &&
7879             ban->opaque               == opaque               &&
7880             ban->deleted              == false)
7881         {
7882             if (bs->walking_aio_notifiers) {
7883                 ban->deleted = true;
7884             } else {
7885                 bdrv_do_remove_aio_context_notifier(ban);
7886             }
7887             return;
7888         }
7889     }
7890 
7891     abort();
7892 }
7893 
7894 int bdrv_amend_options(BlockDriverState *bs, QemuOpts *opts,
7895                        BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
7896                        bool force,
7897                        Error **errp)
7898 {
7899     GLOBAL_STATE_CODE();
7900     if (!bs->drv) {
7901         error_setg(errp, "Node is ejected");
7902         return -ENOMEDIUM;
7903     }
7904     if (!bs->drv->bdrv_amend_options) {
7905         error_setg(errp, "Block driver '%s' does not support option amendment",
7906                    bs->drv->format_name);
7907         return -ENOTSUP;
7908     }
7909     return bs->drv->bdrv_amend_options(bs, opts, status_cb,
7910                                        cb_opaque, force, errp);
7911 }
7912 
7913 /*
7914  * This function checks whether the given @to_replace is allowed to be
7915  * replaced by a node that always shows the same data as @bs.  This is
7916  * used for example to verify whether the mirror job can replace
7917  * @to_replace by the target mirrored from @bs.
7918  * To be replaceable, @bs and @to_replace may either be guaranteed to
7919  * always show the same data (because they are only connected through
7920  * filters), or some driver may allow replacing one of its children
7921  * because it can guarantee that this child's data is not visible at
7922  * all (for example, for dissenting quorum children that have no other
7923  * parents).
7924  */
7925 bool bdrv_recurse_can_replace(BlockDriverState *bs,
7926                               BlockDriverState *to_replace)
7927 {
7928     BlockDriverState *filtered;
7929 
7930     GLOBAL_STATE_CODE();
7931 
7932     if (!bs || !bs->drv) {
7933         return false;
7934     }
7935 
7936     if (bs == to_replace) {
7937         return true;
7938     }
7939 
7940     /* See what the driver can do */
7941     if (bs->drv->bdrv_recurse_can_replace) {
7942         return bs->drv->bdrv_recurse_can_replace(bs, to_replace);
7943     }
7944 
7945     /* For filters without an own implementation, we can recurse on our own */
7946     filtered = bdrv_filter_bs(bs);
7947     if (filtered) {
7948         return bdrv_recurse_can_replace(filtered, to_replace);
7949     }
7950 
7951     /* Safe default */
7952     return false;
7953 }
7954 
7955 /*
7956  * Check whether the given @node_name can be replaced by a node that
7957  * has the same data as @parent_bs.  If so, return @node_name's BDS;
7958  * NULL otherwise.
7959  *
7960  * @node_name must be a (recursive) *child of @parent_bs (or this
7961  * function will return NULL).
7962  *
7963  * The result (whether the node can be replaced or not) is only valid
7964  * for as long as no graph or permission changes occur.
7965  */
7966 BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
7967                                         const char *node_name, Error **errp)
7968 {
7969     BlockDriverState *to_replace_bs = bdrv_find_node(node_name);
7970     AioContext *aio_context;
7971 
7972     GLOBAL_STATE_CODE();
7973 
7974     if (!to_replace_bs) {
7975         error_setg(errp, "Failed to find node with node-name='%s'", node_name);
7976         return NULL;
7977     }
7978 
7979     aio_context = bdrv_get_aio_context(to_replace_bs);
7980     aio_context_acquire(aio_context);
7981 
7982     if (bdrv_op_is_blocked(to_replace_bs, BLOCK_OP_TYPE_REPLACE, errp)) {
7983         to_replace_bs = NULL;
7984         goto out;
7985     }
7986 
7987     /* We don't want arbitrary node of the BDS chain to be replaced only the top
7988      * most non filter in order to prevent data corruption.
7989      * Another benefit is that this tests exclude backing files which are
7990      * blocked by the backing blockers.
7991      */
7992     if (!bdrv_recurse_can_replace(parent_bs, to_replace_bs)) {
7993         error_setg(errp, "Cannot replace '%s' by a node mirrored from '%s', "
7994                    "because it cannot be guaranteed that doing so would not "
7995                    "lead to an abrupt change of visible data",
7996                    node_name, parent_bs->node_name);
7997         to_replace_bs = NULL;
7998         goto out;
7999     }
8000 
8001 out:
8002     aio_context_release(aio_context);
8003     return to_replace_bs;
8004 }
8005 
8006 /**
8007  * Iterates through the list of runtime option keys that are said to
8008  * be "strong" for a BDS.  An option is called "strong" if it changes
8009  * a BDS's data.  For example, the null block driver's "size" and
8010  * "read-zeroes" options are strong, but its "latency-ns" option is
8011  * not.
8012  *
8013  * If a key returned by this function ends with a dot, all options
8014  * starting with that prefix are strong.
8015  */
8016 static const char *const *strong_options(BlockDriverState *bs,
8017                                          const char *const *curopt)
8018 {
8019     static const char *const global_options[] = {
8020         "driver", "filename", NULL
8021     };
8022 
8023     if (!curopt) {
8024         return &global_options[0];
8025     }
8026 
8027     curopt++;
8028     if (curopt == &global_options[ARRAY_SIZE(global_options) - 1] && bs->drv) {
8029         curopt = bs->drv->strong_runtime_opts;
8030     }
8031 
8032     return (curopt && *curopt) ? curopt : NULL;
8033 }
8034 
8035 /**
8036  * Copies all strong runtime options from bs->options to the given
8037  * QDict.  The set of strong option keys is determined by invoking
8038  * strong_options().
8039  *
8040  * Returns true iff any strong option was present in bs->options (and
8041  * thus copied to the target QDict) with the exception of "filename"
8042  * and "driver".  The caller is expected to use this value to decide
8043  * whether the existence of strong options prevents the generation of
8044  * a plain filename.
8045  */
8046 static bool append_strong_runtime_options(QDict *d, BlockDriverState *bs)
8047 {
8048     bool found_any = false;
8049     const char *const *option_name = NULL;
8050 
8051     if (!bs->drv) {
8052         return false;
8053     }
8054 
8055     while ((option_name = strong_options(bs, option_name))) {
8056         bool option_given = false;
8057 
8058         assert(strlen(*option_name) > 0);
8059         if ((*option_name)[strlen(*option_name) - 1] != '.') {
8060             QObject *entry = qdict_get(bs->options, *option_name);
8061             if (!entry) {
8062                 continue;
8063             }
8064 
8065             qdict_put_obj(d, *option_name, qobject_ref(entry));
8066             option_given = true;
8067         } else {
8068             const QDictEntry *entry;
8069             for (entry = qdict_first(bs->options); entry;
8070                  entry = qdict_next(bs->options, entry))
8071             {
8072                 if (strstart(qdict_entry_key(entry), *option_name, NULL)) {
8073                     qdict_put_obj(d, qdict_entry_key(entry),
8074                                   qobject_ref(qdict_entry_value(entry)));
8075                     option_given = true;
8076                 }
8077             }
8078         }
8079 
8080         /* While "driver" and "filename" need to be included in a JSON filename,
8081          * their existence does not prohibit generation of a plain filename. */
8082         if (!found_any && option_given &&
8083             strcmp(*option_name, "driver") && strcmp(*option_name, "filename"))
8084         {
8085             found_any = true;
8086         }
8087     }
8088 
8089     if (!qdict_haskey(d, "driver")) {
8090         /* Drivers created with bdrv_new_open_driver() may not have a
8091          * @driver option.  Add it here. */
8092         qdict_put_str(d, "driver", bs->drv->format_name);
8093     }
8094 
8095     return found_any;
8096 }
8097 
8098 /* Note: This function may return false positives; it may return true
8099  * even if opening the backing file specified by bs's image header
8100  * would result in exactly bs->backing. */
8101 static bool bdrv_backing_overridden(BlockDriverState *bs)
8102 {
8103     GLOBAL_STATE_CODE();
8104     if (bs->backing) {
8105         return strcmp(bs->auto_backing_file,
8106                       bs->backing->bs->filename);
8107     } else {
8108         /* No backing BDS, so if the image header reports any backing
8109          * file, it must have been suppressed */
8110         return bs->auto_backing_file[0] != '\0';
8111     }
8112 }
8113 
8114 /* Updates the following BDS fields:
8115  *  - exact_filename: A filename which may be used for opening a block device
8116  *                    which (mostly) equals the given BDS (even without any
8117  *                    other options; so reading and writing must return the same
8118  *                    results, but caching etc. may be different)
8119  *  - full_open_options: Options which, when given when opening a block device
8120  *                       (without a filename), result in a BDS (mostly)
8121  *                       equalling the given one
8122  *  - filename: If exact_filename is set, it is copied here. Otherwise,
8123  *              full_open_options is converted to a JSON object, prefixed with
8124  *              "json:" (for use through the JSON pseudo protocol) and put here.
8125  */
8126 void bdrv_refresh_filename(BlockDriverState *bs)
8127 {
8128     BlockDriver *drv = bs->drv;
8129     BdrvChild *child;
8130     BlockDriverState *primary_child_bs;
8131     QDict *opts;
8132     bool backing_overridden;
8133     bool generate_json_filename; /* Whether our default implementation should
8134                                     fill exact_filename (false) or not (true) */
8135 
8136     GLOBAL_STATE_CODE();
8137 
8138     if (!drv) {
8139         return;
8140     }
8141 
8142     /* This BDS's file name may depend on any of its children's file names, so
8143      * refresh those first */
8144     QLIST_FOREACH(child, &bs->children, next) {
8145         bdrv_refresh_filename(child->bs);
8146     }
8147 
8148     if (bs->implicit) {
8149         /* For implicit nodes, just copy everything from the single child */
8150         child = QLIST_FIRST(&bs->children);
8151         assert(QLIST_NEXT(child, next) == NULL);
8152 
8153         pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
8154                 child->bs->exact_filename);
8155         pstrcpy(bs->filename, sizeof(bs->filename), child->bs->filename);
8156 
8157         qobject_unref(bs->full_open_options);
8158         bs->full_open_options = qobject_ref(child->bs->full_open_options);
8159 
8160         return;
8161     }
8162 
8163     backing_overridden = bdrv_backing_overridden(bs);
8164 
8165     if (bs->open_flags & BDRV_O_NO_IO) {
8166         /* Without I/O, the backing file does not change anything.
8167          * Therefore, in such a case (primarily qemu-img), we can
8168          * pretend the backing file has not been overridden even if
8169          * it technically has been. */
8170         backing_overridden = false;
8171     }
8172 
8173     /* Gather the options QDict */
8174     opts = qdict_new();
8175     generate_json_filename = append_strong_runtime_options(opts, bs);
8176     generate_json_filename |= backing_overridden;
8177 
8178     if (drv->bdrv_gather_child_options) {
8179         /* Some block drivers may not want to present all of their children's
8180          * options, or name them differently from BdrvChild.name */
8181         drv->bdrv_gather_child_options(bs, opts, backing_overridden);
8182     } else {
8183         QLIST_FOREACH(child, &bs->children, next) {
8184             if (child == bs->backing && !backing_overridden) {
8185                 /* We can skip the backing BDS if it has not been overridden */
8186                 continue;
8187             }
8188 
8189             qdict_put(opts, child->name,
8190                       qobject_ref(child->bs->full_open_options));
8191         }
8192 
8193         if (backing_overridden && !bs->backing) {
8194             /* Force no backing file */
8195             qdict_put_null(opts, "backing");
8196         }
8197     }
8198 
8199     qobject_unref(bs->full_open_options);
8200     bs->full_open_options = opts;
8201 
8202     primary_child_bs = bdrv_primary_bs(bs);
8203 
8204     if (drv->bdrv_refresh_filename) {
8205         /* Obsolete information is of no use here, so drop the old file name
8206          * information before refreshing it */
8207         bs->exact_filename[0] = '\0';
8208 
8209         drv->bdrv_refresh_filename(bs);
8210     } else if (primary_child_bs) {
8211         /*
8212          * Try to reconstruct valid information from the underlying
8213          * file -- this only works for format nodes (filter nodes
8214          * cannot be probed and as such must be selected by the user
8215          * either through an options dict, or through a special
8216          * filename which the filter driver must construct in its
8217          * .bdrv_refresh_filename() implementation).
8218          */
8219 
8220         bs->exact_filename[0] = '\0';
8221 
8222         /*
8223          * We can use the underlying file's filename if:
8224          * - it has a filename,
8225          * - the current BDS is not a filter,
8226          * - the file is a protocol BDS, and
8227          * - opening that file (as this BDS's format) will automatically create
8228          *   the BDS tree we have right now, that is:
8229          *   - the user did not significantly change this BDS's behavior with
8230          *     some explicit (strong) options
8231          *   - no non-file child of this BDS has been overridden by the user
8232          *   Both of these conditions are represented by generate_json_filename.
8233          */
8234         if (primary_child_bs->exact_filename[0] &&
8235             primary_child_bs->drv->bdrv_file_open &&
8236             !drv->is_filter && !generate_json_filename)
8237         {
8238             strcpy(bs->exact_filename, primary_child_bs->exact_filename);
8239         }
8240     }
8241 
8242     if (bs->exact_filename[0]) {
8243         pstrcpy(bs->filename, sizeof(bs->filename), bs->exact_filename);
8244     } else {
8245         GString *json = qobject_to_json(QOBJECT(bs->full_open_options));
8246         if (snprintf(bs->filename, sizeof(bs->filename), "json:%s",
8247                      json->str) >= sizeof(bs->filename)) {
8248             /* Give user a hint if we truncated things. */
8249             strcpy(bs->filename + sizeof(bs->filename) - 4, "...");
8250         }
8251         g_string_free(json, true);
8252     }
8253 }
8254 
8255 char *bdrv_dirname(BlockDriverState *bs, Error **errp)
8256 {
8257     BlockDriver *drv = bs->drv;
8258     BlockDriverState *child_bs;
8259 
8260     GLOBAL_STATE_CODE();
8261 
8262     if (!drv) {
8263         error_setg(errp, "Node '%s' is ejected", bs->node_name);
8264         return NULL;
8265     }
8266 
8267     if (drv->bdrv_dirname) {
8268         return drv->bdrv_dirname(bs, errp);
8269     }
8270 
8271     child_bs = bdrv_primary_bs(bs);
8272     if (child_bs) {
8273         return bdrv_dirname(child_bs, errp);
8274     }
8275 
8276     bdrv_refresh_filename(bs);
8277     if (bs->exact_filename[0] != '\0') {
8278         return path_combine(bs->exact_filename, "");
8279     }
8280 
8281     error_setg(errp, "Cannot generate a base directory for %s nodes",
8282                drv->format_name);
8283     return NULL;
8284 }
8285 
8286 /*
8287  * Hot add/remove a BDS's child. So the user can take a child offline when
8288  * it is broken and take a new child online
8289  */
8290 void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
8291                     Error **errp)
8292 {
8293     GLOBAL_STATE_CODE();
8294     if (!parent_bs->drv || !parent_bs->drv->bdrv_add_child) {
8295         error_setg(errp, "The node %s does not support adding a child",
8296                    bdrv_get_device_or_node_name(parent_bs));
8297         return;
8298     }
8299 
8300     /*
8301      * Non-zoned block drivers do not follow zoned storage constraints
8302      * (i.e. sequential writes to zones). Refuse mixing zoned and non-zoned
8303      * drivers in a graph.
8304      */
8305     if (!parent_bs->drv->supports_zoned_children &&
8306         child_bs->bl.zoned == BLK_Z_HM) {
8307         /*
8308          * The host-aware model allows zoned storage constraints and random
8309          * write. Allow mixing host-aware and non-zoned drivers. Using
8310          * host-aware device as a regular device.
8311          */
8312         error_setg(errp, "Cannot add a %s child to a %s parent",
8313                    child_bs->bl.zoned == BLK_Z_HM ? "zoned" : "non-zoned",
8314                    parent_bs->drv->supports_zoned_children ?
8315                    "support zoned children" : "not support zoned children");
8316         return;
8317     }
8318 
8319     if (!QLIST_EMPTY(&child_bs->parents)) {
8320         error_setg(errp, "The node %s already has a parent",
8321                    child_bs->node_name);
8322         return;
8323     }
8324 
8325     parent_bs->drv->bdrv_add_child(parent_bs, child_bs, errp);
8326 }
8327 
8328 void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)
8329 {
8330     BdrvChild *tmp;
8331 
8332     GLOBAL_STATE_CODE();
8333     if (!parent_bs->drv || !parent_bs->drv->bdrv_del_child) {
8334         error_setg(errp, "The node %s does not support removing a child",
8335                    bdrv_get_device_or_node_name(parent_bs));
8336         return;
8337     }
8338 
8339     QLIST_FOREACH(tmp, &parent_bs->children, next) {
8340         if (tmp == child) {
8341             break;
8342         }
8343     }
8344 
8345     if (!tmp) {
8346         error_setg(errp, "The node %s does not have a child named %s",
8347                    bdrv_get_device_or_node_name(parent_bs),
8348                    bdrv_get_device_or_node_name(child->bs));
8349         return;
8350     }
8351 
8352     parent_bs->drv->bdrv_del_child(parent_bs, child, errp);
8353 }
8354 
8355 int bdrv_make_empty(BdrvChild *c, Error **errp)
8356 {
8357     BlockDriver *drv = c->bs->drv;
8358     int ret;
8359 
8360     GLOBAL_STATE_CODE();
8361     assert(c->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED));
8362 
8363     if (!drv->bdrv_make_empty) {
8364         error_setg(errp, "%s does not support emptying nodes",
8365                    drv->format_name);
8366         return -ENOTSUP;
8367     }
8368 
8369     ret = drv->bdrv_make_empty(c->bs);
8370     if (ret < 0) {
8371         error_setg_errno(errp, -ret, "Failed to empty %s",
8372                          c->bs->filename);
8373         return ret;
8374     }
8375 
8376     return 0;
8377 }
8378 
8379 /*
8380  * Return the child that @bs acts as an overlay for, and from which data may be
8381  * copied in COW or COR operations.  Usually this is the backing file.
8382  */
8383 BdrvChild *bdrv_cow_child(BlockDriverState *bs)
8384 {
8385     IO_CODE();
8386 
8387     if (!bs || !bs->drv) {
8388         return NULL;
8389     }
8390 
8391     if (bs->drv->is_filter) {
8392         return NULL;
8393     }
8394 
8395     if (!bs->backing) {
8396         return NULL;
8397     }
8398 
8399     assert(bs->backing->role & BDRV_CHILD_COW);
8400     return bs->backing;
8401 }
8402 
8403 /*
8404  * If @bs acts as a filter for exactly one of its children, return
8405  * that child.
8406  */
8407 BdrvChild *bdrv_filter_child(BlockDriverState *bs)
8408 {
8409     BdrvChild *c;
8410     IO_CODE();
8411 
8412     if (!bs || !bs->drv) {
8413         return NULL;
8414     }
8415 
8416     if (!bs->drv->is_filter) {
8417         return NULL;
8418     }
8419 
8420     /* Only one of @backing or @file may be used */
8421     assert(!(bs->backing && bs->file));
8422 
8423     c = bs->backing ?: bs->file;
8424     if (!c) {
8425         return NULL;
8426     }
8427 
8428     assert(c->role & BDRV_CHILD_FILTERED);
8429     return c;
8430 }
8431 
8432 /*
8433  * Return either the result of bdrv_cow_child() or bdrv_filter_child(),
8434  * whichever is non-NULL.
8435  *
8436  * Return NULL if both are NULL.
8437  */
8438 BdrvChild *bdrv_filter_or_cow_child(BlockDriverState *bs)
8439 {
8440     BdrvChild *cow_child = bdrv_cow_child(bs);
8441     BdrvChild *filter_child = bdrv_filter_child(bs);
8442     IO_CODE();
8443 
8444     /* Filter nodes cannot have COW backing files */
8445     assert(!(cow_child && filter_child));
8446 
8447     return cow_child ?: filter_child;
8448 }
8449 
8450 /*
8451  * Return the primary child of this node: For filters, that is the
8452  * filtered child.  For other nodes, that is usually the child storing
8453  * metadata.
8454  * (A generally more helpful description is that this is (usually) the
8455  * child that has the same filename as @bs.)
8456  *
8457  * Drivers do not necessarily have a primary child; for example quorum
8458  * does not.
8459  */
8460 BdrvChild *bdrv_primary_child(BlockDriverState *bs)
8461 {
8462     BdrvChild *c, *found = NULL;
8463     IO_CODE();
8464 
8465     QLIST_FOREACH(c, &bs->children, next) {
8466         if (c->role & BDRV_CHILD_PRIMARY) {
8467             assert(!found);
8468             found = c;
8469         }
8470     }
8471 
8472     return found;
8473 }
8474 
8475 static BlockDriverState *bdrv_do_skip_filters(BlockDriverState *bs,
8476                                               bool stop_on_explicit_filter)
8477 {
8478     BdrvChild *c;
8479 
8480     if (!bs) {
8481         return NULL;
8482     }
8483 
8484     while (!(stop_on_explicit_filter && !bs->implicit)) {
8485         c = bdrv_filter_child(bs);
8486         if (!c) {
8487             /*
8488              * A filter that is embedded in a working block graph must
8489              * have a child.  Assert this here so this function does
8490              * not return a filter node that is not expected by the
8491              * caller.
8492              */
8493             assert(!bs->drv || !bs->drv->is_filter);
8494             break;
8495         }
8496         bs = c->bs;
8497     }
8498     /*
8499      * Note that this treats nodes with bs->drv == NULL as not being
8500      * filters (bs->drv == NULL should be replaced by something else
8501      * anyway).
8502      * The advantage of this behavior is that this function will thus
8503      * always return a non-NULL value (given a non-NULL @bs).
8504      */
8505 
8506     return bs;
8507 }
8508 
8509 /*
8510  * Return the first BDS that has not been added implicitly or that
8511  * does not have a filtered child down the chain starting from @bs
8512  * (including @bs itself).
8513  */
8514 BlockDriverState *bdrv_skip_implicit_filters(BlockDriverState *bs)
8515 {
8516     GLOBAL_STATE_CODE();
8517     return bdrv_do_skip_filters(bs, true);
8518 }
8519 
8520 /*
8521  * Return the first BDS that does not have a filtered child down the
8522  * chain starting from @bs (including @bs itself).
8523  */
8524 BlockDriverState *bdrv_skip_filters(BlockDriverState *bs)
8525 {
8526     IO_CODE();
8527     return bdrv_do_skip_filters(bs, false);
8528 }
8529 
8530 /*
8531  * For a backing chain, return the first non-filter backing image of
8532  * the first non-filter image.
8533  */
8534 BlockDriverState *bdrv_backing_chain_next(BlockDriverState *bs)
8535 {
8536     IO_CODE();
8537     return bdrv_skip_filters(bdrv_cow_bs(bdrv_skip_filters(bs)));
8538 }
8539 
8540 /**
8541  * Check whether [offset, offset + bytes) overlaps with the cached
8542  * block-status data region.
8543  *
8544  * If so, and @pnum is not NULL, set *pnum to `bsc.data_end - offset`,
8545  * which is what bdrv_bsc_is_data()'s interface needs.
8546  * Otherwise, *pnum is not touched.
8547  */
8548 static bool bdrv_bsc_range_overlaps_locked(BlockDriverState *bs,
8549                                            int64_t offset, int64_t bytes,
8550                                            int64_t *pnum)
8551 {
8552     BdrvBlockStatusCache *bsc = qatomic_rcu_read(&bs->block_status_cache);
8553     bool overlaps;
8554 
8555     overlaps =
8556         qatomic_read(&bsc->valid) &&
8557         ranges_overlap(offset, bytes, bsc->data_start,
8558                        bsc->data_end - bsc->data_start);
8559 
8560     if (overlaps && pnum) {
8561         *pnum = bsc->data_end - offset;
8562     }
8563 
8564     return overlaps;
8565 }
8566 
8567 /**
8568  * See block_int.h for this function's documentation.
8569  */
8570 bool bdrv_bsc_is_data(BlockDriverState *bs, int64_t offset, int64_t *pnum)
8571 {
8572     IO_CODE();
8573     RCU_READ_LOCK_GUARD();
8574     return bdrv_bsc_range_overlaps_locked(bs, offset, 1, pnum);
8575 }
8576 
8577 /**
8578  * See block_int.h for this function's documentation.
8579  */
8580 void bdrv_bsc_invalidate_range(BlockDriverState *bs,
8581                                int64_t offset, int64_t bytes)
8582 {
8583     IO_CODE();
8584     RCU_READ_LOCK_GUARD();
8585 
8586     if (bdrv_bsc_range_overlaps_locked(bs, offset, bytes, NULL)) {
8587         qatomic_set(&bs->block_status_cache->valid, false);
8588     }
8589 }
8590 
8591 /**
8592  * See block_int.h for this function's documentation.
8593  */
8594 void bdrv_bsc_fill(BlockDriverState *bs, int64_t offset, int64_t bytes)
8595 {
8596     BdrvBlockStatusCache *new_bsc = g_new(BdrvBlockStatusCache, 1);
8597     BdrvBlockStatusCache *old_bsc;
8598     IO_CODE();
8599 
8600     *new_bsc = (BdrvBlockStatusCache) {
8601         .valid = true,
8602         .data_start = offset,
8603         .data_end = offset + bytes,
8604     };
8605 
8606     QEMU_LOCK_GUARD(&bs->bsc_modify_lock);
8607 
8608     old_bsc = qatomic_rcu_read(&bs->block_status_cache);
8609     qatomic_rcu_set(&bs->block_status_cache, new_bsc);
8610     if (old_bsc) {
8611         g_free_rcu(old_bsc, rcu);
8612     }
8613 }
8614