xref: /openbmc/qemu/block.c (revision 3c4b89c3)
1 /*
2  * QEMU System Emulator block driver
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "block/trace.h"
27 #include "block/block_int.h"
28 #include "block/blockjob.h"
29 #include "block/nbd.h"
30 #include "block/qdict.h"
31 #include "qemu/error-report.h"
32 #include "module_block.h"
33 #include "qemu/main-loop.h"
34 #include "qemu/module.h"
35 #include "qapi/error.h"
36 #include "qapi/qmp/qdict.h"
37 #include "qapi/qmp/qjson.h"
38 #include "qapi/qmp/qnull.h"
39 #include "qapi/qmp/qstring.h"
40 #include "qapi/qobject-output-visitor.h"
41 #include "qapi/qapi-visit-block-core.h"
42 #include "sysemu/block-backend.h"
43 #include "sysemu/sysemu.h"
44 #include "qemu/notify.h"
45 #include "qemu/option.h"
46 #include "qemu/coroutine.h"
47 #include "block/qapi.h"
48 #include "qemu/timer.h"
49 #include "qemu/cutils.h"
50 #include "qemu/id.h"
51 
52 #ifdef CONFIG_BSD
53 #include <sys/ioctl.h>
54 #include <sys/queue.h>
55 #ifndef __DragonFly__
56 #include <sys/disk.h>
57 #endif
58 #endif
59 
60 #ifdef _WIN32
61 #include <windows.h>
62 #endif
63 
64 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
65 
66 static QTAILQ_HEAD(, BlockDriverState) graph_bdrv_states =
67     QTAILQ_HEAD_INITIALIZER(graph_bdrv_states);
68 
69 static QTAILQ_HEAD(, BlockDriverState) all_bdrv_states =
70     QTAILQ_HEAD_INITIALIZER(all_bdrv_states);
71 
72 static QLIST_HEAD(, BlockDriver) bdrv_drivers =
73     QLIST_HEAD_INITIALIZER(bdrv_drivers);
74 
75 static BlockDriverState *bdrv_open_inherit(const char *filename,
76                                            const char *reference,
77                                            QDict *options, int flags,
78                                            BlockDriverState *parent,
79                                            const BdrvChildClass *child_class,
80                                            BdrvChildRole child_role,
81                                            Error **errp);
82 
83 /* If non-zero, use only whitelisted block drivers */
84 static int use_bdrv_whitelist;
85 
86 #ifdef _WIN32
87 static int is_windows_drive_prefix(const char *filename)
88 {
89     return (((filename[0] >= 'a' && filename[0] <= 'z') ||
90              (filename[0] >= 'A' && filename[0] <= 'Z')) &&
91             filename[1] == ':');
92 }
93 
94 int is_windows_drive(const char *filename)
95 {
96     if (is_windows_drive_prefix(filename) &&
97         filename[2] == '\0')
98         return 1;
99     if (strstart(filename, "\\\\.\\", NULL) ||
100         strstart(filename, "//./", NULL))
101         return 1;
102     return 0;
103 }
104 #endif
105 
106 size_t bdrv_opt_mem_align(BlockDriverState *bs)
107 {
108     if (!bs || !bs->drv) {
109         /* page size or 4k (hdd sector size) should be on the safe side */
110         return MAX(4096, qemu_real_host_page_size);
111     }
112 
113     return bs->bl.opt_mem_alignment;
114 }
115 
116 size_t bdrv_min_mem_align(BlockDriverState *bs)
117 {
118     if (!bs || !bs->drv) {
119         /* page size or 4k (hdd sector size) should be on the safe side */
120         return MAX(4096, qemu_real_host_page_size);
121     }
122 
123     return bs->bl.min_mem_alignment;
124 }
125 
126 /* check if the path starts with "<protocol>:" */
127 int path_has_protocol(const char *path)
128 {
129     const char *p;
130 
131 #ifdef _WIN32
132     if (is_windows_drive(path) ||
133         is_windows_drive_prefix(path)) {
134         return 0;
135     }
136     p = path + strcspn(path, ":/\\");
137 #else
138     p = path + strcspn(path, ":/");
139 #endif
140 
141     return *p == ':';
142 }
143 
144 int path_is_absolute(const char *path)
145 {
146 #ifdef _WIN32
147     /* specific case for names like: "\\.\d:" */
148     if (is_windows_drive(path) || is_windows_drive_prefix(path)) {
149         return 1;
150     }
151     return (*path == '/' || *path == '\\');
152 #else
153     return (*path == '/');
154 #endif
155 }
156 
157 /* if filename is absolute, just return its duplicate. Otherwise, build a
158    path to it by considering it is relative to base_path. URL are
159    supported. */
160 char *path_combine(const char *base_path, const char *filename)
161 {
162     const char *protocol_stripped = NULL;
163     const char *p, *p1;
164     char *result;
165     int len;
166 
167     if (path_is_absolute(filename)) {
168         return g_strdup(filename);
169     }
170 
171     if (path_has_protocol(base_path)) {
172         protocol_stripped = strchr(base_path, ':');
173         if (protocol_stripped) {
174             protocol_stripped++;
175         }
176     }
177     p = protocol_stripped ?: base_path;
178 
179     p1 = strrchr(base_path, '/');
180 #ifdef _WIN32
181     {
182         const char *p2;
183         p2 = strrchr(base_path, '\\');
184         if (!p1 || p2 > p1) {
185             p1 = p2;
186         }
187     }
188 #endif
189     if (p1) {
190         p1++;
191     } else {
192         p1 = base_path;
193     }
194     if (p1 > p) {
195         p = p1;
196     }
197     len = p - base_path;
198 
199     result = g_malloc(len + strlen(filename) + 1);
200     memcpy(result, base_path, len);
201     strcpy(result + len, filename);
202 
203     return result;
204 }
205 
206 /*
207  * Helper function for bdrv_parse_filename() implementations to remove optional
208  * protocol prefixes (especially "file:") from a filename and for putting the
209  * stripped filename into the options QDict if there is such a prefix.
210  */
211 void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
212                                       QDict *options)
213 {
214     if (strstart(filename, prefix, &filename)) {
215         /* Stripping the explicit protocol prefix may result in a protocol
216          * prefix being (wrongly) detected (if the filename contains a colon) */
217         if (path_has_protocol(filename)) {
218             QString *fat_filename;
219 
220             /* This means there is some colon before the first slash; therefore,
221              * this cannot be an absolute path */
222             assert(!path_is_absolute(filename));
223 
224             /* And we can thus fix the protocol detection issue by prefixing it
225              * by "./" */
226             fat_filename = qstring_from_str("./");
227             qstring_append(fat_filename, filename);
228 
229             assert(!path_has_protocol(qstring_get_str(fat_filename)));
230 
231             qdict_put(options, "filename", fat_filename);
232         } else {
233             /* If no protocol prefix was detected, we can use the shortened
234              * filename as-is */
235             qdict_put_str(options, "filename", filename);
236         }
237     }
238 }
239 
240 
241 /* Returns whether the image file is opened as read-only. Note that this can
242  * return false and writing to the image file is still not possible because the
243  * image is inactivated. */
244 bool bdrv_is_read_only(BlockDriverState *bs)
245 {
246     return bs->read_only;
247 }
248 
249 int bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
250                            bool ignore_allow_rdw, Error **errp)
251 {
252     /* Do not set read_only if copy_on_read is enabled */
253     if (bs->copy_on_read && read_only) {
254         error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
255                    bdrv_get_device_or_node_name(bs));
256         return -EINVAL;
257     }
258 
259     /* Do not clear read_only if it is prohibited */
260     if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
261         !ignore_allow_rdw)
262     {
263         error_setg(errp, "Node '%s' is read only",
264                    bdrv_get_device_or_node_name(bs));
265         return -EPERM;
266     }
267 
268     return 0;
269 }
270 
271 /*
272  * Called by a driver that can only provide a read-only image.
273  *
274  * Returns 0 if the node is already read-only or it could switch the node to
275  * read-only because BDRV_O_AUTO_RDONLY is set.
276  *
277  * Returns -EACCES if the node is read-write and BDRV_O_AUTO_RDONLY is not set
278  * or bdrv_can_set_read_only() forbids making the node read-only. If @errmsg
279  * is not NULL, it is used as the error message for the Error object.
280  */
281 int bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
282                               Error **errp)
283 {
284     int ret = 0;
285 
286     if (!(bs->open_flags & BDRV_O_RDWR)) {
287         return 0;
288     }
289     if (!(bs->open_flags & BDRV_O_AUTO_RDONLY)) {
290         goto fail;
291     }
292 
293     ret = bdrv_can_set_read_only(bs, true, false, NULL);
294     if (ret < 0) {
295         goto fail;
296     }
297 
298     bs->read_only = true;
299     bs->open_flags &= ~BDRV_O_RDWR;
300 
301     return 0;
302 
303 fail:
304     error_setg(errp, "%s", errmsg ?: "Image is read-only");
305     return -EACCES;
306 }
307 
308 /*
309  * If @backing is empty, this function returns NULL without setting
310  * @errp.  In all other cases, NULL will only be returned with @errp
311  * set.
312  *
313  * Therefore, a return value of NULL without @errp set means that
314  * there is no backing file; if @errp is set, there is one but its
315  * absolute filename cannot be generated.
316  */
317 char *bdrv_get_full_backing_filename_from_filename(const char *backed,
318                                                    const char *backing,
319                                                    Error **errp)
320 {
321     if (backing[0] == '\0') {
322         return NULL;
323     } else if (path_has_protocol(backing) || path_is_absolute(backing)) {
324         return g_strdup(backing);
325     } else if (backed[0] == '\0' || strstart(backed, "json:", NULL)) {
326         error_setg(errp, "Cannot use relative backing file names for '%s'",
327                    backed);
328         return NULL;
329     } else {
330         return path_combine(backed, backing);
331     }
332 }
333 
334 /*
335  * If @filename is empty or NULL, this function returns NULL without
336  * setting @errp.  In all other cases, NULL will only be returned with
337  * @errp set.
338  */
339 static char *bdrv_make_absolute_filename(BlockDriverState *relative_to,
340                                          const char *filename, Error **errp)
341 {
342     char *dir, *full_name;
343 
344     if (!filename || filename[0] == '\0') {
345         return NULL;
346     } else if (path_has_protocol(filename) || path_is_absolute(filename)) {
347         return g_strdup(filename);
348     }
349 
350     dir = bdrv_dirname(relative_to, errp);
351     if (!dir) {
352         return NULL;
353     }
354 
355     full_name = g_strconcat(dir, filename, NULL);
356     g_free(dir);
357     return full_name;
358 }
359 
360 char *bdrv_get_full_backing_filename(BlockDriverState *bs, Error **errp)
361 {
362     return bdrv_make_absolute_filename(bs, bs->backing_file, errp);
363 }
364 
365 void bdrv_register(BlockDriver *bdrv)
366 {
367     assert(bdrv->format_name);
368     QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
369 }
370 
371 BlockDriverState *bdrv_new(void)
372 {
373     BlockDriverState *bs;
374     int i;
375 
376     bs = g_new0(BlockDriverState, 1);
377     QLIST_INIT(&bs->dirty_bitmaps);
378     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
379         QLIST_INIT(&bs->op_blockers[i]);
380     }
381     notifier_with_return_list_init(&bs->before_write_notifiers);
382     qemu_co_mutex_init(&bs->reqs_lock);
383     qemu_mutex_init(&bs->dirty_bitmap_mutex);
384     bs->refcnt = 1;
385     bs->aio_context = qemu_get_aio_context();
386 
387     qemu_co_queue_init(&bs->flush_queue);
388 
389     for (i = 0; i < bdrv_drain_all_count; i++) {
390         bdrv_drained_begin(bs);
391     }
392 
393     QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);
394 
395     return bs;
396 }
397 
398 static BlockDriver *bdrv_do_find_format(const char *format_name)
399 {
400     BlockDriver *drv1;
401 
402     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
403         if (!strcmp(drv1->format_name, format_name)) {
404             return drv1;
405         }
406     }
407 
408     return NULL;
409 }
410 
411 BlockDriver *bdrv_find_format(const char *format_name)
412 {
413     BlockDriver *drv1;
414     int i;
415 
416     drv1 = bdrv_do_find_format(format_name);
417     if (drv1) {
418         return drv1;
419     }
420 
421     /* The driver isn't registered, maybe we need to load a module */
422     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
423         if (!strcmp(block_driver_modules[i].format_name, format_name)) {
424             block_module_load_one(block_driver_modules[i].library_name);
425             break;
426         }
427     }
428 
429     return bdrv_do_find_format(format_name);
430 }
431 
432 static int bdrv_format_is_whitelisted(const char *format_name, bool read_only)
433 {
434     static const char *whitelist_rw[] = {
435         CONFIG_BDRV_RW_WHITELIST
436     };
437     static const char *whitelist_ro[] = {
438         CONFIG_BDRV_RO_WHITELIST
439     };
440     const char **p;
441 
442     if (!whitelist_rw[0] && !whitelist_ro[0]) {
443         return 1;               /* no whitelist, anything goes */
444     }
445 
446     for (p = whitelist_rw; *p; p++) {
447         if (!strcmp(format_name, *p)) {
448             return 1;
449         }
450     }
451     if (read_only) {
452         for (p = whitelist_ro; *p; p++) {
453             if (!strcmp(format_name, *p)) {
454                 return 1;
455             }
456         }
457     }
458     return 0;
459 }
460 
461 int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
462 {
463     return bdrv_format_is_whitelisted(drv->format_name, read_only);
464 }
465 
466 bool bdrv_uses_whitelist(void)
467 {
468     return use_bdrv_whitelist;
469 }
470 
471 typedef struct CreateCo {
472     BlockDriver *drv;
473     char *filename;
474     QemuOpts *opts;
475     int ret;
476     Error *err;
477 } CreateCo;
478 
479 static void coroutine_fn bdrv_create_co_entry(void *opaque)
480 {
481     Error *local_err = NULL;
482     int ret;
483 
484     CreateCo *cco = opaque;
485     assert(cco->drv);
486 
487     ret = cco->drv->bdrv_co_create_opts(cco->drv,
488                                         cco->filename, cco->opts, &local_err);
489     error_propagate(&cco->err, local_err);
490     cco->ret = ret;
491 }
492 
493 int bdrv_create(BlockDriver *drv, const char* filename,
494                 QemuOpts *opts, Error **errp)
495 {
496     int ret;
497 
498     Coroutine *co;
499     CreateCo cco = {
500         .drv = drv,
501         .filename = g_strdup(filename),
502         .opts = opts,
503         .ret = NOT_DONE,
504         .err = NULL,
505     };
506 
507     if (!drv->bdrv_co_create_opts) {
508         error_setg(errp, "Driver '%s' does not support image creation", drv->format_name);
509         ret = -ENOTSUP;
510         goto out;
511     }
512 
513     if (qemu_in_coroutine()) {
514         /* Fast-path if already in coroutine context */
515         bdrv_create_co_entry(&cco);
516     } else {
517         co = qemu_coroutine_create(bdrv_create_co_entry, &cco);
518         qemu_coroutine_enter(co);
519         while (cco.ret == NOT_DONE) {
520             aio_poll(qemu_get_aio_context(), true);
521         }
522     }
523 
524     ret = cco.ret;
525     if (ret < 0) {
526         if (cco.err) {
527             error_propagate(errp, cco.err);
528         } else {
529             error_setg_errno(errp, -ret, "Could not create image");
530         }
531     }
532 
533 out:
534     g_free(cco.filename);
535     return ret;
536 }
537 
538 /**
539  * Helper function for bdrv_create_file_fallback(): Resize @blk to at
540  * least the given @minimum_size.
541  *
542  * On success, return @blk's actual length.
543  * Otherwise, return -errno.
544  */
545 static int64_t create_file_fallback_truncate(BlockBackend *blk,
546                                              int64_t minimum_size, Error **errp)
547 {
548     Error *local_err = NULL;
549     int64_t size;
550     int ret;
551 
552     ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
553                        &local_err);
554     if (ret < 0 && ret != -ENOTSUP) {
555         error_propagate(errp, local_err);
556         return ret;
557     }
558 
559     size = blk_getlength(blk);
560     if (size < 0) {
561         error_free(local_err);
562         error_setg_errno(errp, -size,
563                          "Failed to inquire the new image file's length");
564         return size;
565     }
566 
567     if (size < minimum_size) {
568         /* Need to grow the image, but we failed to do that */
569         error_propagate(errp, local_err);
570         return -ENOTSUP;
571     }
572 
573     error_free(local_err);
574     local_err = NULL;
575 
576     return size;
577 }
578 
579 /**
580  * Helper function for bdrv_create_file_fallback(): Zero the first
581  * sector to remove any potentially pre-existing image header.
582  */
583 static int create_file_fallback_zero_first_sector(BlockBackend *blk,
584                                                   int64_t current_size,
585                                                   Error **errp)
586 {
587     int64_t bytes_to_clear;
588     int ret;
589 
590     bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
591     if (bytes_to_clear) {
592         ret = blk_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
593         if (ret < 0) {
594             error_setg_errno(errp, -ret,
595                              "Failed to clear the new image's first sector");
596             return ret;
597         }
598     }
599 
600     return 0;
601 }
602 
603 /**
604  * Simple implementation of bdrv_co_create_opts for protocol drivers
605  * which only support creation via opening a file
606  * (usually existing raw storage device)
607  */
608 int coroutine_fn bdrv_co_create_opts_simple(BlockDriver *drv,
609                                             const char *filename,
610                                             QemuOpts *opts,
611                                             Error **errp)
612 {
613     BlockBackend *blk;
614     QDict *options;
615     int64_t size = 0;
616     char *buf = NULL;
617     PreallocMode prealloc;
618     Error *local_err = NULL;
619     int ret;
620 
621     size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
622     buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
623     prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
624                                PREALLOC_MODE_OFF, &local_err);
625     g_free(buf);
626     if (local_err) {
627         error_propagate(errp, local_err);
628         return -EINVAL;
629     }
630 
631     if (prealloc != PREALLOC_MODE_OFF) {
632         error_setg(errp, "Unsupported preallocation mode '%s'",
633                    PreallocMode_str(prealloc));
634         return -ENOTSUP;
635     }
636 
637     options = qdict_new();
638     qdict_put_str(options, "driver", drv->format_name);
639 
640     blk = blk_new_open(filename, NULL, options,
641                        BDRV_O_RDWR | BDRV_O_RESIZE, errp);
642     if (!blk) {
643         error_prepend(errp, "Protocol driver '%s' does not support image "
644                       "creation, and opening the image failed: ",
645                       drv->format_name);
646         return -EINVAL;
647     }
648 
649     size = create_file_fallback_truncate(blk, size, errp);
650     if (size < 0) {
651         ret = size;
652         goto out;
653     }
654 
655     ret = create_file_fallback_zero_first_sector(blk, size, errp);
656     if (ret < 0) {
657         goto out;
658     }
659 
660     ret = 0;
661 out:
662     blk_unref(blk);
663     return ret;
664 }
665 
666 int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp)
667 {
668     BlockDriver *drv;
669 
670     drv = bdrv_find_protocol(filename, true, errp);
671     if (drv == NULL) {
672         return -ENOENT;
673     }
674 
675     return bdrv_create(drv, filename, opts, errp);
676 }
677 
678 int coroutine_fn bdrv_co_delete_file(BlockDriverState *bs, Error **errp)
679 {
680     Error *local_err = NULL;
681     int ret;
682 
683     assert(bs != NULL);
684 
685     if (!bs->drv) {
686         error_setg(errp, "Block node '%s' is not opened", bs->filename);
687         return -ENOMEDIUM;
688     }
689 
690     if (!bs->drv->bdrv_co_delete_file) {
691         error_setg(errp, "Driver '%s' does not support image deletion",
692                    bs->drv->format_name);
693         return -ENOTSUP;
694     }
695 
696     ret = bs->drv->bdrv_co_delete_file(bs, &local_err);
697     if (ret < 0) {
698         error_propagate(errp, local_err);
699     }
700 
701     return ret;
702 }
703 
704 /**
705  * Try to get @bs's logical and physical block size.
706  * On success, store them in @bsz struct and return 0.
707  * On failure return -errno.
708  * @bs must not be empty.
709  */
710 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
711 {
712     BlockDriver *drv = bs->drv;
713 
714     if (drv && drv->bdrv_probe_blocksizes) {
715         return drv->bdrv_probe_blocksizes(bs, bsz);
716     } else if (drv && drv->is_filter && bs->file) {
717         return bdrv_probe_blocksizes(bs->file->bs, bsz);
718     }
719 
720     return -ENOTSUP;
721 }
722 
723 /**
724  * Try to get @bs's geometry (cyls, heads, sectors).
725  * On success, store them in @geo struct and return 0.
726  * On failure return -errno.
727  * @bs must not be empty.
728  */
729 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
730 {
731     BlockDriver *drv = bs->drv;
732 
733     if (drv && drv->bdrv_probe_geometry) {
734         return drv->bdrv_probe_geometry(bs, geo);
735     } else if (drv && drv->is_filter && bs->file) {
736         return bdrv_probe_geometry(bs->file->bs, geo);
737     }
738 
739     return -ENOTSUP;
740 }
741 
742 /*
743  * Create a uniquely-named empty temporary file.
744  * Return 0 upon success, otherwise a negative errno value.
745  */
746 int get_tmp_filename(char *filename, int size)
747 {
748 #ifdef _WIN32
749     char temp_dir[MAX_PATH];
750     /* GetTempFileName requires that its output buffer (4th param)
751        have length MAX_PATH or greater.  */
752     assert(size >= MAX_PATH);
753     return (GetTempPath(MAX_PATH, temp_dir)
754             && GetTempFileName(temp_dir, "qem", 0, filename)
755             ? 0 : -GetLastError());
756 #else
757     int fd;
758     const char *tmpdir;
759     tmpdir = getenv("TMPDIR");
760     if (!tmpdir) {
761         tmpdir = "/var/tmp";
762     }
763     if (snprintf(filename, size, "%s/vl.XXXXXX", tmpdir) >= size) {
764         return -EOVERFLOW;
765     }
766     fd = mkstemp(filename);
767     if (fd < 0) {
768         return -errno;
769     }
770     if (close(fd) != 0) {
771         unlink(filename);
772         return -errno;
773     }
774     return 0;
775 #endif
776 }
777 
778 /*
779  * Detect host devices. By convention, /dev/cdrom[N] is always
780  * recognized as a host CDROM.
781  */
782 static BlockDriver *find_hdev_driver(const char *filename)
783 {
784     int score_max = 0, score;
785     BlockDriver *drv = NULL, *d;
786 
787     QLIST_FOREACH(d, &bdrv_drivers, list) {
788         if (d->bdrv_probe_device) {
789             score = d->bdrv_probe_device(filename);
790             if (score > score_max) {
791                 score_max = score;
792                 drv = d;
793             }
794         }
795     }
796 
797     return drv;
798 }
799 
800 static BlockDriver *bdrv_do_find_protocol(const char *protocol)
801 {
802     BlockDriver *drv1;
803 
804     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
805         if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
806             return drv1;
807         }
808     }
809 
810     return NULL;
811 }
812 
813 BlockDriver *bdrv_find_protocol(const char *filename,
814                                 bool allow_protocol_prefix,
815                                 Error **errp)
816 {
817     BlockDriver *drv1;
818     char protocol[128];
819     int len;
820     const char *p;
821     int i;
822 
823     /* TODO Drivers without bdrv_file_open must be specified explicitly */
824 
825     /*
826      * XXX(hch): we really should not let host device detection
827      * override an explicit protocol specification, but moving this
828      * later breaks access to device names with colons in them.
829      * Thanks to the brain-dead persistent naming schemes on udev-
830      * based Linux systems those actually are quite common.
831      */
832     drv1 = find_hdev_driver(filename);
833     if (drv1) {
834         return drv1;
835     }
836 
837     if (!path_has_protocol(filename) || !allow_protocol_prefix) {
838         return &bdrv_file;
839     }
840 
841     p = strchr(filename, ':');
842     assert(p != NULL);
843     len = p - filename;
844     if (len > sizeof(protocol) - 1)
845         len = sizeof(protocol) - 1;
846     memcpy(protocol, filename, len);
847     protocol[len] = '\0';
848 
849     drv1 = bdrv_do_find_protocol(protocol);
850     if (drv1) {
851         return drv1;
852     }
853 
854     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
855         if (block_driver_modules[i].protocol_name &&
856             !strcmp(block_driver_modules[i].protocol_name, protocol)) {
857             block_module_load_one(block_driver_modules[i].library_name);
858             break;
859         }
860     }
861 
862     drv1 = bdrv_do_find_protocol(protocol);
863     if (!drv1) {
864         error_setg(errp, "Unknown protocol '%s'", protocol);
865     }
866     return drv1;
867 }
868 
869 /*
870  * Guess image format by probing its contents.
871  * This is not a good idea when your image is raw (CVE-2008-2004), but
872  * we do it anyway for backward compatibility.
873  *
874  * @buf         contains the image's first @buf_size bytes.
875  * @buf_size    is the buffer size in bytes (generally BLOCK_PROBE_BUF_SIZE,
876  *              but can be smaller if the image file is smaller)
877  * @filename    is its filename.
878  *
879  * For all block drivers, call the bdrv_probe() method to get its
880  * probing score.
881  * Return the first block driver with the highest probing score.
882  */
883 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
884                             const char *filename)
885 {
886     int score_max = 0, score;
887     BlockDriver *drv = NULL, *d;
888 
889     QLIST_FOREACH(d, &bdrv_drivers, list) {
890         if (d->bdrv_probe) {
891             score = d->bdrv_probe(buf, buf_size, filename);
892             if (score > score_max) {
893                 score_max = score;
894                 drv = d;
895             }
896         }
897     }
898 
899     return drv;
900 }
901 
902 static int find_image_format(BlockBackend *file, const char *filename,
903                              BlockDriver **pdrv, Error **errp)
904 {
905     BlockDriver *drv;
906     uint8_t buf[BLOCK_PROBE_BUF_SIZE];
907     int ret = 0;
908 
909     /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
910     if (blk_is_sg(file) || !blk_is_inserted(file) || blk_getlength(file) == 0) {
911         *pdrv = &bdrv_raw;
912         return ret;
913     }
914 
915     ret = blk_pread(file, 0, buf, sizeof(buf));
916     if (ret < 0) {
917         error_setg_errno(errp, -ret, "Could not read image for determining its "
918                          "format");
919         *pdrv = NULL;
920         return ret;
921     }
922 
923     drv = bdrv_probe_all(buf, ret, filename);
924     if (!drv) {
925         error_setg(errp, "Could not determine image format: No compatible "
926                    "driver found");
927         ret = -ENOENT;
928     }
929     *pdrv = drv;
930     return ret;
931 }
932 
933 /**
934  * Set the current 'total_sectors' value
935  * Return 0 on success, -errno on error.
936  */
937 int refresh_total_sectors(BlockDriverState *bs, int64_t hint)
938 {
939     BlockDriver *drv = bs->drv;
940 
941     if (!drv) {
942         return -ENOMEDIUM;
943     }
944 
945     /* Do not attempt drv->bdrv_getlength() on scsi-generic devices */
946     if (bdrv_is_sg(bs))
947         return 0;
948 
949     /* query actual device if possible, otherwise just trust the hint */
950     if (drv->bdrv_getlength) {
951         int64_t length = drv->bdrv_getlength(bs);
952         if (length < 0) {
953             return length;
954         }
955         hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
956     }
957 
958     bs->total_sectors = hint;
959     return 0;
960 }
961 
962 /**
963  * Combines a QDict of new block driver @options with any missing options taken
964  * from @old_options, so that leaving out an option defaults to its old value.
965  */
966 static void bdrv_join_options(BlockDriverState *bs, QDict *options,
967                               QDict *old_options)
968 {
969     if (bs->drv && bs->drv->bdrv_join_options) {
970         bs->drv->bdrv_join_options(options, old_options);
971     } else {
972         qdict_join(options, old_options, false);
973     }
974 }
975 
976 static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
977                                                             int open_flags,
978                                                             Error **errp)
979 {
980     Error *local_err = NULL;
981     char *value = qemu_opt_get_del(opts, "detect-zeroes");
982     BlockdevDetectZeroesOptions detect_zeroes =
983         qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
984                         BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
985     g_free(value);
986     if (local_err) {
987         error_propagate(errp, local_err);
988         return detect_zeroes;
989     }
990 
991     if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
992         !(open_flags & BDRV_O_UNMAP))
993     {
994         error_setg(errp, "setting detect-zeroes to unmap is not allowed "
995                    "without setting discard operation to unmap");
996     }
997 
998     return detect_zeroes;
999 }
1000 
1001 /**
1002  * Set open flags for aio engine
1003  *
1004  * Return 0 on success, -1 if the engine specified is invalid
1005  */
1006 int bdrv_parse_aio(const char *mode, int *flags)
1007 {
1008     if (!strcmp(mode, "threads")) {
1009         /* do nothing, default */
1010     } else if (!strcmp(mode, "native")) {
1011         *flags |= BDRV_O_NATIVE_AIO;
1012 #ifdef CONFIG_LINUX_IO_URING
1013     } else if (!strcmp(mode, "io_uring")) {
1014         *flags |= BDRV_O_IO_URING;
1015 #endif
1016     } else {
1017         return -1;
1018     }
1019 
1020     return 0;
1021 }
1022 
1023 /**
1024  * Set open flags for a given discard mode
1025  *
1026  * Return 0 on success, -1 if the discard mode was invalid.
1027  */
1028 int bdrv_parse_discard_flags(const char *mode, int *flags)
1029 {
1030     *flags &= ~BDRV_O_UNMAP;
1031 
1032     if (!strcmp(mode, "off") || !strcmp(mode, "ignore")) {
1033         /* do nothing */
1034     } else if (!strcmp(mode, "on") || !strcmp(mode, "unmap")) {
1035         *flags |= BDRV_O_UNMAP;
1036     } else {
1037         return -1;
1038     }
1039 
1040     return 0;
1041 }
1042 
1043 /**
1044  * Set open flags for a given cache mode
1045  *
1046  * Return 0 on success, -1 if the cache mode was invalid.
1047  */
1048 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough)
1049 {
1050     *flags &= ~BDRV_O_CACHE_MASK;
1051 
1052     if (!strcmp(mode, "off") || !strcmp(mode, "none")) {
1053         *writethrough = false;
1054         *flags |= BDRV_O_NOCACHE;
1055     } else if (!strcmp(mode, "directsync")) {
1056         *writethrough = true;
1057         *flags |= BDRV_O_NOCACHE;
1058     } else if (!strcmp(mode, "writeback")) {
1059         *writethrough = false;
1060     } else if (!strcmp(mode, "unsafe")) {
1061         *writethrough = false;
1062         *flags |= BDRV_O_NO_FLUSH;
1063     } else if (!strcmp(mode, "writethrough")) {
1064         *writethrough = true;
1065     } else {
1066         return -1;
1067     }
1068 
1069     return 0;
1070 }
1071 
1072 static char *bdrv_child_get_parent_desc(BdrvChild *c)
1073 {
1074     BlockDriverState *parent = c->opaque;
1075     return g_strdup(bdrv_get_device_or_node_name(parent));
1076 }
1077 
1078 static void bdrv_child_cb_drained_begin(BdrvChild *child)
1079 {
1080     BlockDriverState *bs = child->opaque;
1081     bdrv_do_drained_begin_quiesce(bs, NULL, false);
1082 }
1083 
1084 static bool bdrv_child_cb_drained_poll(BdrvChild *child)
1085 {
1086     BlockDriverState *bs = child->opaque;
1087     return bdrv_drain_poll(bs, false, NULL, false);
1088 }
1089 
1090 static void bdrv_child_cb_drained_end(BdrvChild *child,
1091                                       int *drained_end_counter)
1092 {
1093     BlockDriverState *bs = child->opaque;
1094     bdrv_drained_end_no_poll(bs, drained_end_counter);
1095 }
1096 
1097 static int bdrv_child_cb_inactivate(BdrvChild *child)
1098 {
1099     BlockDriverState *bs = child->opaque;
1100     assert(bs->open_flags & BDRV_O_INACTIVE);
1101     return 0;
1102 }
1103 
1104 static bool bdrv_child_cb_can_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1105                                           GSList **ignore, Error **errp)
1106 {
1107     BlockDriverState *bs = child->opaque;
1108     return bdrv_can_set_aio_context(bs, ctx, ignore, errp);
1109 }
1110 
1111 static void bdrv_child_cb_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1112                                       GSList **ignore)
1113 {
1114     BlockDriverState *bs = child->opaque;
1115     return bdrv_set_aio_context_ignore(bs, ctx, ignore);
1116 }
1117 
1118 /*
1119  * Returns the options and flags that a temporary snapshot should get, based on
1120  * the originally requested flags (the originally requested image will have
1121  * flags like a backing file)
1122  */
1123 static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
1124                                        int parent_flags, QDict *parent_options)
1125 {
1126     *child_flags = (parent_flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
1127 
1128     /* For temporary files, unconditional cache=unsafe is fine */
1129     qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
1130     qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
1131 
1132     /* Copy the read-only and discard options from the parent */
1133     qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1134     qdict_copy_default(child_options, parent_options, BDRV_OPT_DISCARD);
1135 
1136     /* aio=native doesn't work for cache.direct=off, so disable it for the
1137      * temporary snapshot */
1138     *child_flags &= ~BDRV_O_NATIVE_AIO;
1139 }
1140 
1141 static void bdrv_backing_attach(BdrvChild *c)
1142 {
1143     BlockDriverState *parent = c->opaque;
1144     BlockDriverState *backing_hd = c->bs;
1145 
1146     assert(!parent->backing_blocker);
1147     error_setg(&parent->backing_blocker,
1148                "node is used as backing hd of '%s'",
1149                bdrv_get_device_or_node_name(parent));
1150 
1151     bdrv_refresh_filename(backing_hd);
1152 
1153     parent->open_flags &= ~BDRV_O_NO_BACKING;
1154     pstrcpy(parent->backing_file, sizeof(parent->backing_file),
1155             backing_hd->filename);
1156     pstrcpy(parent->backing_format, sizeof(parent->backing_format),
1157             backing_hd->drv ? backing_hd->drv->format_name : "");
1158 
1159     bdrv_op_block_all(backing_hd, parent->backing_blocker);
1160     /* Otherwise we won't be able to commit or stream */
1161     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
1162                     parent->backing_blocker);
1163     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
1164                     parent->backing_blocker);
1165     /*
1166      * We do backup in 3 ways:
1167      * 1. drive backup
1168      *    The target bs is new opened, and the source is top BDS
1169      * 2. blockdev backup
1170      *    Both the source and the target are top BDSes.
1171      * 3. internal backup(used for block replication)
1172      *    Both the source and the target are backing file
1173      *
1174      * In case 1 and 2, neither the source nor the target is the backing file.
1175      * In case 3, we will block the top BDS, so there is only one block job
1176      * for the top BDS and its backing chain.
1177      */
1178     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
1179                     parent->backing_blocker);
1180     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
1181                     parent->backing_blocker);
1182 }
1183 
1184 static void bdrv_backing_detach(BdrvChild *c)
1185 {
1186     BlockDriverState *parent = c->opaque;
1187 
1188     assert(parent->backing_blocker);
1189     bdrv_op_unblock_all(c->bs, parent->backing_blocker);
1190     error_free(parent->backing_blocker);
1191     parent->backing_blocker = NULL;
1192 }
1193 
1194 static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
1195                                         const char *filename, Error **errp)
1196 {
1197     BlockDriverState *parent = c->opaque;
1198     bool read_only = bdrv_is_read_only(parent);
1199     int ret;
1200 
1201     if (read_only) {
1202         ret = bdrv_reopen_set_read_only(parent, false, errp);
1203         if (ret < 0) {
1204             return ret;
1205         }
1206     }
1207 
1208     ret = bdrv_change_backing_file(parent, filename,
1209                                    base->drv ? base->drv->format_name : "");
1210     if (ret < 0) {
1211         error_setg_errno(errp, -ret, "Could not update backing file link");
1212     }
1213 
1214     if (read_only) {
1215         bdrv_reopen_set_read_only(parent, true, NULL);
1216     }
1217 
1218     return ret;
1219 }
1220 
1221 /*
1222  * Returns the options and flags that a generic child of a BDS should
1223  * get, based on the given options and flags for the parent BDS.
1224  */
1225 static void bdrv_inherited_options(BdrvChildRole role, bool parent_is_format,
1226                                    int *child_flags, QDict *child_options,
1227                                    int parent_flags, QDict *parent_options)
1228 {
1229     int flags = parent_flags;
1230 
1231     /*
1232      * First, decide whether to set, clear, or leave BDRV_O_PROTOCOL.
1233      * Generally, the question to answer is: Should this child be
1234      * format-probed by default?
1235      */
1236 
1237     /*
1238      * Pure and non-filtered data children of non-format nodes should
1239      * be probed by default (even when the node itself has BDRV_O_PROTOCOL
1240      * set).  This only affects a very limited set of drivers (namely
1241      * quorum and blkverify when this comment was written).
1242      * Force-clear BDRV_O_PROTOCOL then.
1243      */
1244     if (!parent_is_format &&
1245         (role & BDRV_CHILD_DATA) &&
1246         !(role & (BDRV_CHILD_METADATA | BDRV_CHILD_FILTERED)))
1247     {
1248         flags &= ~BDRV_O_PROTOCOL;
1249     }
1250 
1251     /*
1252      * All children of format nodes (except for COW children) and all
1253      * metadata children in general should never be format-probed.
1254      * Force-set BDRV_O_PROTOCOL then.
1255      */
1256     if ((parent_is_format && !(role & BDRV_CHILD_COW)) ||
1257         (role & BDRV_CHILD_METADATA))
1258     {
1259         flags |= BDRV_O_PROTOCOL;
1260     }
1261 
1262     /*
1263      * If the cache mode isn't explicitly set, inherit direct and no-flush from
1264      * the parent.
1265      */
1266     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1267     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1268     qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1269 
1270     if (role & BDRV_CHILD_COW) {
1271         /* backing files are opened read-only by default */
1272         qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
1273         qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
1274     } else {
1275         /* Inherit the read-only option from the parent if it's not set */
1276         qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1277         qdict_copy_default(child_options, parent_options,
1278                            BDRV_OPT_AUTO_READ_ONLY);
1279     }
1280 
1281     /*
1282      * bdrv_co_pdiscard() respects unmap policy for the parent, so we
1283      * can default to enable it on lower layers regardless of the
1284      * parent option.
1285      */
1286     qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
1287 
1288     /* Clear flags that only apply to the top layer */
1289     flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);
1290 
1291     if (role & BDRV_CHILD_METADATA) {
1292         flags &= ~BDRV_O_NO_IO;
1293     }
1294     if (role & BDRV_CHILD_COW) {
1295         flags &= ~BDRV_O_TEMPORARY;
1296     }
1297 
1298     *child_flags = flags;
1299 }
1300 
1301 static void bdrv_child_cb_attach(BdrvChild *child)
1302 {
1303     BlockDriverState *bs = child->opaque;
1304 
1305     if (child->role & BDRV_CHILD_COW) {
1306         bdrv_backing_attach(child);
1307     }
1308 
1309     bdrv_apply_subtree_drain(child, bs);
1310 }
1311 
1312 static void bdrv_child_cb_detach(BdrvChild *child)
1313 {
1314     BlockDriverState *bs = child->opaque;
1315 
1316     if (child->role & BDRV_CHILD_COW) {
1317         bdrv_backing_detach(child);
1318     }
1319 
1320     bdrv_unapply_subtree_drain(child, bs);
1321 }
1322 
1323 static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
1324                                          const char *filename, Error **errp)
1325 {
1326     if (c->role & BDRV_CHILD_COW) {
1327         return bdrv_backing_update_filename(c, base, filename, errp);
1328     }
1329     return 0;
1330 }
1331 
1332 const BdrvChildClass child_of_bds = {
1333     .parent_is_bds   = true,
1334     .get_parent_desc = bdrv_child_get_parent_desc,
1335     .inherit_options = bdrv_inherited_options,
1336     .drained_begin   = bdrv_child_cb_drained_begin,
1337     .drained_poll    = bdrv_child_cb_drained_poll,
1338     .drained_end     = bdrv_child_cb_drained_end,
1339     .attach          = bdrv_child_cb_attach,
1340     .detach          = bdrv_child_cb_detach,
1341     .inactivate      = bdrv_child_cb_inactivate,
1342     .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
1343     .set_aio_ctx     = bdrv_child_cb_set_aio_ctx,
1344     .update_filename = bdrv_child_cb_update_filename,
1345 };
1346 
1347 static int bdrv_open_flags(BlockDriverState *bs, int flags)
1348 {
1349     int open_flags = flags;
1350 
1351     /*
1352      * Clear flags that are internal to the block layer before opening the
1353      * image.
1354      */
1355     open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_PROTOCOL);
1356 
1357     return open_flags;
1358 }
1359 
1360 static void update_flags_from_options(int *flags, QemuOpts *opts)
1361 {
1362     *flags &= ~(BDRV_O_CACHE_MASK | BDRV_O_RDWR | BDRV_O_AUTO_RDONLY);
1363 
1364     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
1365         *flags |= BDRV_O_NO_FLUSH;
1366     }
1367 
1368     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
1369         *flags |= BDRV_O_NOCACHE;
1370     }
1371 
1372     if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
1373         *flags |= BDRV_O_RDWR;
1374     }
1375 
1376     if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
1377         *flags |= BDRV_O_AUTO_RDONLY;
1378     }
1379 }
1380 
1381 static void update_options_from_flags(QDict *options, int flags)
1382 {
1383     if (!qdict_haskey(options, BDRV_OPT_CACHE_DIRECT)) {
1384         qdict_put_bool(options, BDRV_OPT_CACHE_DIRECT, flags & BDRV_O_NOCACHE);
1385     }
1386     if (!qdict_haskey(options, BDRV_OPT_CACHE_NO_FLUSH)) {
1387         qdict_put_bool(options, BDRV_OPT_CACHE_NO_FLUSH,
1388                        flags & BDRV_O_NO_FLUSH);
1389     }
1390     if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
1391         qdict_put_bool(options, BDRV_OPT_READ_ONLY, !(flags & BDRV_O_RDWR));
1392     }
1393     if (!qdict_haskey(options, BDRV_OPT_AUTO_READ_ONLY)) {
1394         qdict_put_bool(options, BDRV_OPT_AUTO_READ_ONLY,
1395                        flags & BDRV_O_AUTO_RDONLY);
1396     }
1397 }
1398 
1399 static void bdrv_assign_node_name(BlockDriverState *bs,
1400                                   const char *node_name,
1401                                   Error **errp)
1402 {
1403     char *gen_node_name = NULL;
1404 
1405     if (!node_name) {
1406         node_name = gen_node_name = id_generate(ID_BLOCK);
1407     } else if (!id_wellformed(node_name)) {
1408         /*
1409          * Check for empty string or invalid characters, but not if it is
1410          * generated (generated names use characters not available to the user)
1411          */
1412         error_setg(errp, "Invalid node name");
1413         return;
1414     }
1415 
1416     /* takes care of avoiding namespaces collisions */
1417     if (blk_by_name(node_name)) {
1418         error_setg(errp, "node-name=%s is conflicting with a device id",
1419                    node_name);
1420         goto out;
1421     }
1422 
1423     /* takes care of avoiding duplicates node names */
1424     if (bdrv_find_node(node_name)) {
1425         error_setg(errp, "Duplicate node name");
1426         goto out;
1427     }
1428 
1429     /* Make sure that the node name isn't truncated */
1430     if (strlen(node_name) >= sizeof(bs->node_name)) {
1431         error_setg(errp, "Node name too long");
1432         goto out;
1433     }
1434 
1435     /* copy node name into the bs and insert it into the graph list */
1436     pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
1437     QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
1438 out:
1439     g_free(gen_node_name);
1440 }
1441 
1442 static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
1443                             const char *node_name, QDict *options,
1444                             int open_flags, Error **errp)
1445 {
1446     Error *local_err = NULL;
1447     int i, ret;
1448 
1449     bdrv_assign_node_name(bs, node_name, &local_err);
1450     if (local_err) {
1451         error_propagate(errp, local_err);
1452         return -EINVAL;
1453     }
1454 
1455     bs->drv = drv;
1456     bs->read_only = !(bs->open_flags & BDRV_O_RDWR);
1457     bs->opaque = g_malloc0(drv->instance_size);
1458 
1459     if (drv->bdrv_file_open) {
1460         assert(!drv->bdrv_needs_filename || bs->filename[0]);
1461         ret = drv->bdrv_file_open(bs, options, open_flags, &local_err);
1462     } else if (drv->bdrv_open) {
1463         ret = drv->bdrv_open(bs, options, open_flags, &local_err);
1464     } else {
1465         ret = 0;
1466     }
1467 
1468     if (ret < 0) {
1469         if (local_err) {
1470             error_propagate(errp, local_err);
1471         } else if (bs->filename[0]) {
1472             error_setg_errno(errp, -ret, "Could not open '%s'", bs->filename);
1473         } else {
1474             error_setg_errno(errp, -ret, "Could not open image");
1475         }
1476         goto open_failed;
1477     }
1478 
1479     ret = refresh_total_sectors(bs, bs->total_sectors);
1480     if (ret < 0) {
1481         error_setg_errno(errp, -ret, "Could not refresh total sector count");
1482         return ret;
1483     }
1484 
1485     bdrv_refresh_limits(bs, &local_err);
1486     if (local_err) {
1487         error_propagate(errp, local_err);
1488         return -EINVAL;
1489     }
1490 
1491     assert(bdrv_opt_mem_align(bs) != 0);
1492     assert(bdrv_min_mem_align(bs) != 0);
1493     assert(is_power_of_2(bs->bl.request_alignment));
1494 
1495     for (i = 0; i < bs->quiesce_counter; i++) {
1496         if (drv->bdrv_co_drain_begin) {
1497             drv->bdrv_co_drain_begin(bs);
1498         }
1499     }
1500 
1501     return 0;
1502 open_failed:
1503     bs->drv = NULL;
1504     if (bs->file != NULL) {
1505         bdrv_unref_child(bs, bs->file);
1506         bs->file = NULL;
1507     }
1508     g_free(bs->opaque);
1509     bs->opaque = NULL;
1510     return ret;
1511 }
1512 
1513 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
1514                                        int flags, Error **errp)
1515 {
1516     BlockDriverState *bs;
1517     int ret;
1518 
1519     bs = bdrv_new();
1520     bs->open_flags = flags;
1521     bs->explicit_options = qdict_new();
1522     bs->options = qdict_new();
1523     bs->opaque = NULL;
1524 
1525     update_options_from_flags(bs->options, flags);
1526 
1527     ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
1528     if (ret < 0) {
1529         qobject_unref(bs->explicit_options);
1530         bs->explicit_options = NULL;
1531         qobject_unref(bs->options);
1532         bs->options = NULL;
1533         bdrv_unref(bs);
1534         return NULL;
1535     }
1536 
1537     return bs;
1538 }
1539 
1540 QemuOptsList bdrv_runtime_opts = {
1541     .name = "bdrv_common",
1542     .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
1543     .desc = {
1544         {
1545             .name = "node-name",
1546             .type = QEMU_OPT_STRING,
1547             .help = "Node name of the block device node",
1548         },
1549         {
1550             .name = "driver",
1551             .type = QEMU_OPT_STRING,
1552             .help = "Block driver to use for the node",
1553         },
1554         {
1555             .name = BDRV_OPT_CACHE_DIRECT,
1556             .type = QEMU_OPT_BOOL,
1557             .help = "Bypass software writeback cache on the host",
1558         },
1559         {
1560             .name = BDRV_OPT_CACHE_NO_FLUSH,
1561             .type = QEMU_OPT_BOOL,
1562             .help = "Ignore flush requests",
1563         },
1564         {
1565             .name = BDRV_OPT_READ_ONLY,
1566             .type = QEMU_OPT_BOOL,
1567             .help = "Node is opened in read-only mode",
1568         },
1569         {
1570             .name = BDRV_OPT_AUTO_READ_ONLY,
1571             .type = QEMU_OPT_BOOL,
1572             .help = "Node can become read-only if opening read-write fails",
1573         },
1574         {
1575             .name = "detect-zeroes",
1576             .type = QEMU_OPT_STRING,
1577             .help = "try to optimize zero writes (off, on, unmap)",
1578         },
1579         {
1580             .name = BDRV_OPT_DISCARD,
1581             .type = QEMU_OPT_STRING,
1582             .help = "discard operation (ignore/off, unmap/on)",
1583         },
1584         {
1585             .name = BDRV_OPT_FORCE_SHARE,
1586             .type = QEMU_OPT_BOOL,
1587             .help = "always accept other writers (default: off)",
1588         },
1589         { /* end of list */ }
1590     },
1591 };
1592 
1593 QemuOptsList bdrv_create_opts_simple = {
1594     .name = "simple-create-opts",
1595     .head = QTAILQ_HEAD_INITIALIZER(bdrv_create_opts_simple.head),
1596     .desc = {
1597         {
1598             .name = BLOCK_OPT_SIZE,
1599             .type = QEMU_OPT_SIZE,
1600             .help = "Virtual disk size"
1601         },
1602         {
1603             .name = BLOCK_OPT_PREALLOC,
1604             .type = QEMU_OPT_STRING,
1605             .help = "Preallocation mode (allowed values: off)"
1606         },
1607         { /* end of list */ }
1608     }
1609 };
1610 
1611 /*
1612  * Common part for opening disk images and files
1613  *
1614  * Removes all processed options from *options.
1615  */
1616 static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
1617                             QDict *options, Error **errp)
1618 {
1619     int ret, open_flags;
1620     const char *filename;
1621     const char *driver_name = NULL;
1622     const char *node_name = NULL;
1623     const char *discard;
1624     QemuOpts *opts;
1625     BlockDriver *drv;
1626     Error *local_err = NULL;
1627 
1628     assert(bs->file == NULL);
1629     assert(options != NULL && bs->options != options);
1630 
1631     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
1632     if (!qemu_opts_absorb_qdict(opts, options, &local_err)) {
1633         error_propagate(errp, local_err);
1634         ret = -EINVAL;
1635         goto fail_opts;
1636     }
1637 
1638     update_flags_from_options(&bs->open_flags, opts);
1639 
1640     driver_name = qemu_opt_get(opts, "driver");
1641     drv = bdrv_find_format(driver_name);
1642     assert(drv != NULL);
1643 
1644     bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
1645 
1646     if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
1647         error_setg(errp,
1648                    BDRV_OPT_FORCE_SHARE
1649                    "=on can only be used with read-only images");
1650         ret = -EINVAL;
1651         goto fail_opts;
1652     }
1653 
1654     if (file != NULL) {
1655         bdrv_refresh_filename(blk_bs(file));
1656         filename = blk_bs(file)->filename;
1657     } else {
1658         /*
1659          * Caution: while qdict_get_try_str() is fine, getting
1660          * non-string types would require more care.  When @options
1661          * come from -blockdev or blockdev_add, its members are typed
1662          * according to the QAPI schema, but when they come from
1663          * -drive, they're all QString.
1664          */
1665         filename = qdict_get_try_str(options, "filename");
1666     }
1667 
1668     if (drv->bdrv_needs_filename && (!filename || !filename[0])) {
1669         error_setg(errp, "The '%s' block driver requires a file name",
1670                    drv->format_name);
1671         ret = -EINVAL;
1672         goto fail_opts;
1673     }
1674 
1675     trace_bdrv_open_common(bs, filename ?: "", bs->open_flags,
1676                            drv->format_name);
1677 
1678     bs->read_only = !(bs->open_flags & BDRV_O_RDWR);
1679 
1680     if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, bs->read_only)) {
1681         if (!bs->read_only && bdrv_is_whitelisted(drv, true)) {
1682             ret = bdrv_apply_auto_read_only(bs, NULL, NULL);
1683         } else {
1684             ret = -ENOTSUP;
1685         }
1686         if (ret < 0) {
1687             error_setg(errp,
1688                        !bs->read_only && bdrv_is_whitelisted(drv, true)
1689                        ? "Driver '%s' can only be used for read-only devices"
1690                        : "Driver '%s' is not whitelisted",
1691                        drv->format_name);
1692             goto fail_opts;
1693         }
1694     }
1695 
1696     /* bdrv_new() and bdrv_close() make it so */
1697     assert(atomic_read(&bs->copy_on_read) == 0);
1698 
1699     if (bs->open_flags & BDRV_O_COPY_ON_READ) {
1700         if (!bs->read_only) {
1701             bdrv_enable_copy_on_read(bs);
1702         } else {
1703             error_setg(errp, "Can't use copy-on-read on read-only device");
1704             ret = -EINVAL;
1705             goto fail_opts;
1706         }
1707     }
1708 
1709     discard = qemu_opt_get(opts, BDRV_OPT_DISCARD);
1710     if (discard != NULL) {
1711         if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
1712             error_setg(errp, "Invalid discard option");
1713             ret = -EINVAL;
1714             goto fail_opts;
1715         }
1716     }
1717 
1718     bs->detect_zeroes =
1719         bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
1720     if (local_err) {
1721         error_propagate(errp, local_err);
1722         ret = -EINVAL;
1723         goto fail_opts;
1724     }
1725 
1726     if (filename != NULL) {
1727         pstrcpy(bs->filename, sizeof(bs->filename), filename);
1728     } else {
1729         bs->filename[0] = '\0';
1730     }
1731     pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), bs->filename);
1732 
1733     /* Open the image, either directly or using a protocol */
1734     open_flags = bdrv_open_flags(bs, bs->open_flags);
1735     node_name = qemu_opt_get(opts, "node-name");
1736 
1737     assert(!drv->bdrv_file_open || file == NULL);
1738     ret = bdrv_open_driver(bs, drv, node_name, options, open_flags, errp);
1739     if (ret < 0) {
1740         goto fail_opts;
1741     }
1742 
1743     qemu_opts_del(opts);
1744     return 0;
1745 
1746 fail_opts:
1747     qemu_opts_del(opts);
1748     return ret;
1749 }
1750 
1751 static QDict *parse_json_filename(const char *filename, Error **errp)
1752 {
1753     QObject *options_obj;
1754     QDict *options;
1755     int ret;
1756 
1757     ret = strstart(filename, "json:", &filename);
1758     assert(ret);
1759 
1760     options_obj = qobject_from_json(filename, errp);
1761     if (!options_obj) {
1762         error_prepend(errp, "Could not parse the JSON options: ");
1763         return NULL;
1764     }
1765 
1766     options = qobject_to(QDict, options_obj);
1767     if (!options) {
1768         qobject_unref(options_obj);
1769         error_setg(errp, "Invalid JSON object given");
1770         return NULL;
1771     }
1772 
1773     qdict_flatten(options);
1774 
1775     return options;
1776 }
1777 
1778 static void parse_json_protocol(QDict *options, const char **pfilename,
1779                                 Error **errp)
1780 {
1781     QDict *json_options;
1782     Error *local_err = NULL;
1783 
1784     /* Parse json: pseudo-protocol */
1785     if (!*pfilename || !g_str_has_prefix(*pfilename, "json:")) {
1786         return;
1787     }
1788 
1789     json_options = parse_json_filename(*pfilename, &local_err);
1790     if (local_err) {
1791         error_propagate(errp, local_err);
1792         return;
1793     }
1794 
1795     /* Options given in the filename have lower priority than options
1796      * specified directly */
1797     qdict_join(options, json_options, false);
1798     qobject_unref(json_options);
1799     *pfilename = NULL;
1800 }
1801 
1802 /*
1803  * Fills in default options for opening images and converts the legacy
1804  * filename/flags pair to option QDict entries.
1805  * The BDRV_O_PROTOCOL flag in *flags will be set or cleared accordingly if a
1806  * block driver has been specified explicitly.
1807  */
1808 static int bdrv_fill_options(QDict **options, const char *filename,
1809                              int *flags, Error **errp)
1810 {
1811     const char *drvname;
1812     bool protocol = *flags & BDRV_O_PROTOCOL;
1813     bool parse_filename = false;
1814     BlockDriver *drv = NULL;
1815     Error *local_err = NULL;
1816 
1817     /*
1818      * Caution: while qdict_get_try_str() is fine, getting non-string
1819      * types would require more care.  When @options come from
1820      * -blockdev or blockdev_add, its members are typed according to
1821      * the QAPI schema, but when they come from -drive, they're all
1822      * QString.
1823      */
1824     drvname = qdict_get_try_str(*options, "driver");
1825     if (drvname) {
1826         drv = bdrv_find_format(drvname);
1827         if (!drv) {
1828             error_setg(errp, "Unknown driver '%s'", drvname);
1829             return -ENOENT;
1830         }
1831         /* If the user has explicitly specified the driver, this choice should
1832          * override the BDRV_O_PROTOCOL flag */
1833         protocol = drv->bdrv_file_open;
1834     }
1835 
1836     if (protocol) {
1837         *flags |= BDRV_O_PROTOCOL;
1838     } else {
1839         *flags &= ~BDRV_O_PROTOCOL;
1840     }
1841 
1842     /* Translate cache options from flags into options */
1843     update_options_from_flags(*options, *flags);
1844 
1845     /* Fetch the file name from the options QDict if necessary */
1846     if (protocol && filename) {
1847         if (!qdict_haskey(*options, "filename")) {
1848             qdict_put_str(*options, "filename", filename);
1849             parse_filename = true;
1850         } else {
1851             error_setg(errp, "Can't specify 'file' and 'filename' options at "
1852                              "the same time");
1853             return -EINVAL;
1854         }
1855     }
1856 
1857     /* Find the right block driver */
1858     /* See cautionary note on accessing @options above */
1859     filename = qdict_get_try_str(*options, "filename");
1860 
1861     if (!drvname && protocol) {
1862         if (filename) {
1863             drv = bdrv_find_protocol(filename, parse_filename, errp);
1864             if (!drv) {
1865                 return -EINVAL;
1866             }
1867 
1868             drvname = drv->format_name;
1869             qdict_put_str(*options, "driver", drvname);
1870         } else {
1871             error_setg(errp, "Must specify either driver or file");
1872             return -EINVAL;
1873         }
1874     }
1875 
1876     assert(drv || !protocol);
1877 
1878     /* Driver-specific filename parsing */
1879     if (drv && drv->bdrv_parse_filename && parse_filename) {
1880         drv->bdrv_parse_filename(filename, *options, &local_err);
1881         if (local_err) {
1882             error_propagate(errp, local_err);
1883             return -EINVAL;
1884         }
1885 
1886         if (!drv->bdrv_needs_filename) {
1887             qdict_del(*options, "filename");
1888         }
1889     }
1890 
1891     return 0;
1892 }
1893 
1894 static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
1895                                  uint64_t perm, uint64_t shared,
1896                                  GSList *ignore_children,
1897                                  bool *tighten_restrictions, Error **errp);
1898 static void bdrv_child_abort_perm_update(BdrvChild *c);
1899 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared);
1900 
1901 typedef struct BlockReopenQueueEntry {
1902      bool prepared;
1903      bool perms_checked;
1904      BDRVReopenState state;
1905      QTAILQ_ENTRY(BlockReopenQueueEntry) entry;
1906 } BlockReopenQueueEntry;
1907 
1908 /*
1909  * Return the flags that @bs will have after the reopens in @q have
1910  * successfully completed. If @q is NULL (or @bs is not contained in @q),
1911  * return the current flags.
1912  */
1913 static int bdrv_reopen_get_flags(BlockReopenQueue *q, BlockDriverState *bs)
1914 {
1915     BlockReopenQueueEntry *entry;
1916 
1917     if (q != NULL) {
1918         QTAILQ_FOREACH(entry, q, entry) {
1919             if (entry->state.bs == bs) {
1920                 return entry->state.flags;
1921             }
1922         }
1923     }
1924 
1925     return bs->open_flags;
1926 }
1927 
1928 /* Returns whether the image file can be written to after the reopen queue @q
1929  * has been successfully applied, or right now if @q is NULL. */
1930 static bool bdrv_is_writable_after_reopen(BlockDriverState *bs,
1931                                           BlockReopenQueue *q)
1932 {
1933     int flags = bdrv_reopen_get_flags(q, bs);
1934 
1935     return (flags & (BDRV_O_RDWR | BDRV_O_INACTIVE)) == BDRV_O_RDWR;
1936 }
1937 
1938 /*
1939  * Return whether the BDS can be written to.  This is not necessarily
1940  * the same as !bdrv_is_read_only(bs), as inactivated images may not
1941  * be written to but do not count as read-only images.
1942  */
1943 bool bdrv_is_writable(BlockDriverState *bs)
1944 {
1945     return bdrv_is_writable_after_reopen(bs, NULL);
1946 }
1947 
1948 static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
1949                             BdrvChild *c, BdrvChildRole role,
1950                             BlockReopenQueue *reopen_queue,
1951                             uint64_t parent_perm, uint64_t parent_shared,
1952                             uint64_t *nperm, uint64_t *nshared)
1953 {
1954     assert(bs->drv && bs->drv->bdrv_child_perm);
1955     bs->drv->bdrv_child_perm(bs, c, role, reopen_queue,
1956                              parent_perm, parent_shared,
1957                              nperm, nshared);
1958     /* TODO Take force_share from reopen_queue */
1959     if (child_bs && child_bs->force_share) {
1960         *nshared = BLK_PERM_ALL;
1961     }
1962 }
1963 
1964 /*
1965  * Check whether permissions on this node can be changed in a way that
1966  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
1967  * permissions of all its parents. This involves checking whether all necessary
1968  * permission changes to child nodes can be performed.
1969  *
1970  * Will set *tighten_restrictions to true if and only if new permissions have to
1971  * be taken or currently shared permissions are to be unshared.  Otherwise,
1972  * errors are not fatal as long as the caller accepts that the restrictions
1973  * remain tighter than they need to be.  The caller still has to abort the
1974  * transaction.
1975  * @tighten_restrictions cannot be used together with @q: When reopening, we may
1976  * encounter fatal errors even though no restrictions are to be tightened.  For
1977  * example, changing a node from RW to RO will fail if the WRITE permission is
1978  * to be kept.
1979  *
1980  * A call to this function must always be followed by a call to bdrv_set_perm()
1981  * or bdrv_abort_perm_update().
1982  */
1983 static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
1984                            uint64_t cumulative_perms,
1985                            uint64_t cumulative_shared_perms,
1986                            GSList *ignore_children,
1987                            bool *tighten_restrictions, Error **errp)
1988 {
1989     BlockDriver *drv = bs->drv;
1990     BdrvChild *c;
1991     int ret;
1992 
1993     assert(!q || !tighten_restrictions);
1994 
1995     if (tighten_restrictions) {
1996         uint64_t current_perms, current_shared;
1997         uint64_t added_perms, removed_shared_perms;
1998 
1999         bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
2000 
2001         added_perms = cumulative_perms & ~current_perms;
2002         removed_shared_perms = current_shared & ~cumulative_shared_perms;
2003 
2004         *tighten_restrictions = added_perms || removed_shared_perms;
2005     }
2006 
2007     /* Write permissions never work with read-only images */
2008     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2009         !bdrv_is_writable_after_reopen(bs, q))
2010     {
2011         if (!bdrv_is_writable_after_reopen(bs, NULL)) {
2012             error_setg(errp, "Block node is read-only");
2013         } else {
2014             uint64_t current_perms, current_shared;
2015             bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
2016             if (current_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
2017                 error_setg(errp, "Cannot make block node read-only, there is "
2018                            "a writer on it");
2019             } else {
2020                 error_setg(errp, "Cannot make block node read-only and create "
2021                            "a writer on it");
2022             }
2023         }
2024 
2025         return -EPERM;
2026     }
2027 
2028     /* Check this node */
2029     if (!drv) {
2030         return 0;
2031     }
2032 
2033     if (drv->bdrv_check_perm) {
2034         return drv->bdrv_check_perm(bs, cumulative_perms,
2035                                     cumulative_shared_perms, errp);
2036     }
2037 
2038     /* Drivers that never have children can omit .bdrv_child_perm() */
2039     if (!drv->bdrv_child_perm) {
2040         assert(QLIST_EMPTY(&bs->children));
2041         return 0;
2042     }
2043 
2044     /* Check all children */
2045     QLIST_FOREACH(c, &bs->children, next) {
2046         uint64_t cur_perm, cur_shared;
2047         bool child_tighten_restr;
2048 
2049         bdrv_child_perm(bs, c->bs, c, c->role, q,
2050                         cumulative_perms, cumulative_shared_perms,
2051                         &cur_perm, &cur_shared);
2052         ret = bdrv_child_check_perm(c, q, cur_perm, cur_shared, ignore_children,
2053                                     tighten_restrictions ? &child_tighten_restr
2054                                                          : NULL,
2055                                     errp);
2056         if (tighten_restrictions) {
2057             *tighten_restrictions |= child_tighten_restr;
2058         }
2059         if (ret < 0) {
2060             return ret;
2061         }
2062     }
2063 
2064     return 0;
2065 }
2066 
2067 /*
2068  * Notifies drivers that after a previous bdrv_check_perm() call, the
2069  * permission update is not performed and any preparations made for it (e.g.
2070  * taken file locks) need to be undone.
2071  *
2072  * This function recursively notifies all child nodes.
2073  */
2074 static void bdrv_abort_perm_update(BlockDriverState *bs)
2075 {
2076     BlockDriver *drv = bs->drv;
2077     BdrvChild *c;
2078 
2079     if (!drv) {
2080         return;
2081     }
2082 
2083     if (drv->bdrv_abort_perm_update) {
2084         drv->bdrv_abort_perm_update(bs);
2085     }
2086 
2087     QLIST_FOREACH(c, &bs->children, next) {
2088         bdrv_child_abort_perm_update(c);
2089     }
2090 }
2091 
2092 static void bdrv_set_perm(BlockDriverState *bs, uint64_t cumulative_perms,
2093                           uint64_t cumulative_shared_perms)
2094 {
2095     BlockDriver *drv = bs->drv;
2096     BdrvChild *c;
2097 
2098     if (!drv) {
2099         return;
2100     }
2101 
2102     /* Update this node */
2103     if (drv->bdrv_set_perm) {
2104         drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
2105     }
2106 
2107     /* Drivers that never have children can omit .bdrv_child_perm() */
2108     if (!drv->bdrv_child_perm) {
2109         assert(QLIST_EMPTY(&bs->children));
2110         return;
2111     }
2112 
2113     /* Update all children */
2114     QLIST_FOREACH(c, &bs->children, next) {
2115         uint64_t cur_perm, cur_shared;
2116         bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2117                         cumulative_perms, cumulative_shared_perms,
2118                         &cur_perm, &cur_shared);
2119         bdrv_child_set_perm(c, cur_perm, cur_shared);
2120     }
2121 }
2122 
2123 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
2124                               uint64_t *shared_perm)
2125 {
2126     BdrvChild *c;
2127     uint64_t cumulative_perms = 0;
2128     uint64_t cumulative_shared_perms = BLK_PERM_ALL;
2129 
2130     QLIST_FOREACH(c, &bs->parents, next_parent) {
2131         cumulative_perms |= c->perm;
2132         cumulative_shared_perms &= c->shared_perm;
2133     }
2134 
2135     *perm = cumulative_perms;
2136     *shared_perm = cumulative_shared_perms;
2137 }
2138 
2139 static char *bdrv_child_user_desc(BdrvChild *c)
2140 {
2141     if (c->klass->get_parent_desc) {
2142         return c->klass->get_parent_desc(c);
2143     }
2144 
2145     return g_strdup("another user");
2146 }
2147 
2148 char *bdrv_perm_names(uint64_t perm)
2149 {
2150     struct perm_name {
2151         uint64_t perm;
2152         const char *name;
2153     } permissions[] = {
2154         { BLK_PERM_CONSISTENT_READ, "consistent read" },
2155         { BLK_PERM_WRITE,           "write" },
2156         { BLK_PERM_WRITE_UNCHANGED, "write unchanged" },
2157         { BLK_PERM_RESIZE,          "resize" },
2158         { BLK_PERM_GRAPH_MOD,       "change children" },
2159         { 0, NULL }
2160     };
2161 
2162     GString *result = g_string_sized_new(30);
2163     struct perm_name *p;
2164 
2165     for (p = permissions; p->name; p++) {
2166         if (perm & p->perm) {
2167             if (result->len > 0) {
2168                 g_string_append(result, ", ");
2169             }
2170             g_string_append(result, p->name);
2171         }
2172     }
2173 
2174     return g_string_free(result, FALSE);
2175 }
2176 
2177 /*
2178  * Checks whether a new reference to @bs can be added if the new user requires
2179  * @new_used_perm/@new_shared_perm as its permissions. If @ignore_children is
2180  * set, the BdrvChild objects in this list are ignored in the calculations;
2181  * this allows checking permission updates for an existing reference.
2182  *
2183  * See bdrv_check_perm() for the semantics of @tighten_restrictions.
2184  *
2185  * Needs to be followed by a call to either bdrv_set_perm() or
2186  * bdrv_abort_perm_update(). */
2187 static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
2188                                   uint64_t new_used_perm,
2189                                   uint64_t new_shared_perm,
2190                                   GSList *ignore_children,
2191                                   bool *tighten_restrictions,
2192                                   Error **errp)
2193 {
2194     BdrvChild *c;
2195     uint64_t cumulative_perms = new_used_perm;
2196     uint64_t cumulative_shared_perms = new_shared_perm;
2197 
2198     assert(!q || !tighten_restrictions);
2199 
2200     /* There is no reason why anyone couldn't tolerate write_unchanged */
2201     assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
2202 
2203     QLIST_FOREACH(c, &bs->parents, next_parent) {
2204         if (g_slist_find(ignore_children, c)) {
2205             continue;
2206         }
2207 
2208         if ((new_used_perm & c->shared_perm) != new_used_perm) {
2209             char *user = bdrv_child_user_desc(c);
2210             char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
2211 
2212             if (tighten_restrictions) {
2213                 *tighten_restrictions = true;
2214             }
2215 
2216             error_setg(errp, "Conflicts with use by %s as '%s', which does not "
2217                              "allow '%s' on %s",
2218                        user, c->name, perm_names, bdrv_get_node_name(c->bs));
2219             g_free(user);
2220             g_free(perm_names);
2221             return -EPERM;
2222         }
2223 
2224         if ((c->perm & new_shared_perm) != c->perm) {
2225             char *user = bdrv_child_user_desc(c);
2226             char *perm_names = bdrv_perm_names(c->perm & ~new_shared_perm);
2227 
2228             if (tighten_restrictions) {
2229                 *tighten_restrictions = true;
2230             }
2231 
2232             error_setg(errp, "Conflicts with use by %s as '%s', which uses "
2233                              "'%s' on %s",
2234                        user, c->name, perm_names, bdrv_get_node_name(c->bs));
2235             g_free(user);
2236             g_free(perm_names);
2237             return -EPERM;
2238         }
2239 
2240         cumulative_perms |= c->perm;
2241         cumulative_shared_perms &= c->shared_perm;
2242     }
2243 
2244     return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
2245                            ignore_children, tighten_restrictions, errp);
2246 }
2247 
2248 /* Needs to be followed by a call to either bdrv_child_set_perm() or
2249  * bdrv_child_abort_perm_update(). */
2250 static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
2251                                  uint64_t perm, uint64_t shared,
2252                                  GSList *ignore_children,
2253                                  bool *tighten_restrictions, Error **errp)
2254 {
2255     int ret;
2256 
2257     ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
2258     ret = bdrv_check_update_perm(c->bs, q, perm, shared, ignore_children,
2259                                  tighten_restrictions, errp);
2260     g_slist_free(ignore_children);
2261 
2262     if (ret < 0) {
2263         return ret;
2264     }
2265 
2266     if (!c->has_backup_perm) {
2267         c->has_backup_perm = true;
2268         c->backup_perm = c->perm;
2269         c->backup_shared_perm = c->shared_perm;
2270     }
2271     /*
2272      * Note: it's OK if c->has_backup_perm was already set, as we can find the
2273      * same child twice during check_perm procedure
2274      */
2275 
2276     c->perm = perm;
2277     c->shared_perm = shared;
2278 
2279     return 0;
2280 }
2281 
2282 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared)
2283 {
2284     uint64_t cumulative_perms, cumulative_shared_perms;
2285 
2286     c->has_backup_perm = false;
2287 
2288     c->perm = perm;
2289     c->shared_perm = shared;
2290 
2291     bdrv_get_cumulative_perm(c->bs, &cumulative_perms,
2292                              &cumulative_shared_perms);
2293     bdrv_set_perm(c->bs, cumulative_perms, cumulative_shared_perms);
2294 }
2295 
2296 static void bdrv_child_abort_perm_update(BdrvChild *c)
2297 {
2298     if (c->has_backup_perm) {
2299         c->perm = c->backup_perm;
2300         c->shared_perm = c->backup_shared_perm;
2301         c->has_backup_perm = false;
2302     }
2303 
2304     bdrv_abort_perm_update(c->bs);
2305 }
2306 
2307 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
2308                             Error **errp)
2309 {
2310     Error *local_err = NULL;
2311     int ret;
2312     bool tighten_restrictions;
2313 
2314     ret = bdrv_child_check_perm(c, NULL, perm, shared, NULL,
2315                                 &tighten_restrictions, &local_err);
2316     if (ret < 0) {
2317         bdrv_child_abort_perm_update(c);
2318         if (tighten_restrictions) {
2319             error_propagate(errp, local_err);
2320         } else {
2321             /*
2322              * Our caller may intend to only loosen restrictions and
2323              * does not expect this function to fail.  Errors are not
2324              * fatal in such a case, so we can just hide them from our
2325              * caller.
2326              */
2327             error_free(local_err);
2328             ret = 0;
2329         }
2330         return ret;
2331     }
2332 
2333     bdrv_child_set_perm(c, perm, shared);
2334 
2335     return 0;
2336 }
2337 
2338 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
2339 {
2340     uint64_t parent_perms, parent_shared;
2341     uint64_t perms, shared;
2342 
2343     bdrv_get_cumulative_perm(bs, &parent_perms, &parent_shared);
2344     bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2345                     parent_perms, parent_shared, &perms, &shared);
2346 
2347     return bdrv_child_try_set_perm(c, perms, shared, errp);
2348 }
2349 
2350 /*
2351  * Default implementation for .bdrv_child_perm() for block filters:
2352  * Forward CONSISTENT_READ, WRITE, WRITE_UNCHANGED, and RESIZE to the
2353  * filtered child.
2354  */
2355 static void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
2356                                       BdrvChildRole role,
2357                                       BlockReopenQueue *reopen_queue,
2358                                       uint64_t perm, uint64_t shared,
2359                                       uint64_t *nperm, uint64_t *nshared)
2360 {
2361     *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
2362     *nshared = (shared & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
2363 }
2364 
2365 static void bdrv_default_perms_for_cow(BlockDriverState *bs, BdrvChild *c,
2366                                        BdrvChildRole role,
2367                                        BlockReopenQueue *reopen_queue,
2368                                        uint64_t perm, uint64_t shared,
2369                                        uint64_t *nperm, uint64_t *nshared)
2370 {
2371     assert(role & BDRV_CHILD_COW);
2372 
2373     /*
2374      * We want consistent read from backing files if the parent needs it.
2375      * No other operations are performed on backing files.
2376      */
2377     perm &= BLK_PERM_CONSISTENT_READ;
2378 
2379     /*
2380      * If the parent can deal with changing data, we're okay with a
2381      * writable and resizable backing file.
2382      * TODO Require !(perm & BLK_PERM_CONSISTENT_READ), too?
2383      */
2384     if (shared & BLK_PERM_WRITE) {
2385         shared = BLK_PERM_WRITE | BLK_PERM_RESIZE;
2386     } else {
2387         shared = 0;
2388     }
2389 
2390     shared |= BLK_PERM_CONSISTENT_READ | BLK_PERM_GRAPH_MOD |
2391               BLK_PERM_WRITE_UNCHANGED;
2392 
2393     if (bs->open_flags & BDRV_O_INACTIVE) {
2394         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2395     }
2396 
2397     *nperm = perm;
2398     *nshared = shared;
2399 }
2400 
2401 static void bdrv_default_perms_for_storage(BlockDriverState *bs, BdrvChild *c,
2402                                            BdrvChildRole role,
2403                                            BlockReopenQueue *reopen_queue,
2404                                            uint64_t perm, uint64_t shared,
2405                                            uint64_t *nperm, uint64_t *nshared)
2406 {
2407     int flags;
2408 
2409     assert(role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA));
2410 
2411     flags = bdrv_reopen_get_flags(reopen_queue, bs);
2412 
2413     /*
2414      * Apart from the modifications below, the same permissions are
2415      * forwarded and left alone as for filters
2416      */
2417     bdrv_filter_default_perms(bs, c, role, reopen_queue,
2418                               perm, shared, &perm, &shared);
2419 
2420     if (role & BDRV_CHILD_METADATA) {
2421         /* Format drivers may touch metadata even if the guest doesn't write */
2422         if (bdrv_is_writable_after_reopen(bs, reopen_queue)) {
2423             perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2424         }
2425 
2426         /*
2427          * bs->file always needs to be consistent because of the
2428          * metadata. We can never allow other users to resize or write
2429          * to it.
2430          */
2431         if (!(flags & BDRV_O_NO_IO)) {
2432             perm |= BLK_PERM_CONSISTENT_READ;
2433         }
2434         shared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
2435     }
2436 
2437     if (role & BDRV_CHILD_DATA) {
2438         /*
2439          * Technically, everything in this block is a subset of the
2440          * BDRV_CHILD_METADATA path taken above, and so this could
2441          * be an "else if" branch.  However, that is not obvious, and
2442          * this function is not performance critical, therefore we let
2443          * this be an independent "if".
2444          */
2445 
2446         /*
2447          * We cannot allow other users to resize the file because the
2448          * format driver might have some assumptions about the size
2449          * (e.g. because it is stored in metadata, or because the file
2450          * is split into fixed-size data files).
2451          */
2452         shared &= ~BLK_PERM_RESIZE;
2453 
2454         /*
2455          * WRITE_UNCHANGED often cannot be performed as such on the
2456          * data file.  For example, the qcow2 driver may still need to
2457          * write copied clusters on copy-on-read.
2458          */
2459         if (perm & BLK_PERM_WRITE_UNCHANGED) {
2460             perm |= BLK_PERM_WRITE;
2461         }
2462 
2463         /*
2464          * If the data file is written to, the format driver may
2465          * expect to be able to resize it by writing beyond the EOF.
2466          */
2467         if (perm & BLK_PERM_WRITE) {
2468             perm |= BLK_PERM_RESIZE;
2469         }
2470     }
2471 
2472     if (bs->open_flags & BDRV_O_INACTIVE) {
2473         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2474     }
2475 
2476     *nperm = perm;
2477     *nshared = shared;
2478 }
2479 
2480 void bdrv_default_perms(BlockDriverState *bs, BdrvChild *c,
2481                         BdrvChildRole role, BlockReopenQueue *reopen_queue,
2482                         uint64_t perm, uint64_t shared,
2483                         uint64_t *nperm, uint64_t *nshared)
2484 {
2485     if (role & BDRV_CHILD_FILTERED) {
2486         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
2487                          BDRV_CHILD_COW)));
2488         bdrv_filter_default_perms(bs, c, role, reopen_queue,
2489                                   perm, shared, nperm, nshared);
2490     } else if (role & BDRV_CHILD_COW) {
2491         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA)));
2492         bdrv_default_perms_for_cow(bs, c, role, reopen_queue,
2493                                    perm, shared, nperm, nshared);
2494     } else if (role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA)) {
2495         bdrv_default_perms_for_storage(bs, c, role, reopen_queue,
2496                                        perm, shared, nperm, nshared);
2497     } else {
2498         g_assert_not_reached();
2499     }
2500 }
2501 
2502 uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
2503 {
2504     static const uint64_t permissions[] = {
2505         [BLOCK_PERMISSION_CONSISTENT_READ]  = BLK_PERM_CONSISTENT_READ,
2506         [BLOCK_PERMISSION_WRITE]            = BLK_PERM_WRITE,
2507         [BLOCK_PERMISSION_WRITE_UNCHANGED]  = BLK_PERM_WRITE_UNCHANGED,
2508         [BLOCK_PERMISSION_RESIZE]           = BLK_PERM_RESIZE,
2509         [BLOCK_PERMISSION_GRAPH_MOD]        = BLK_PERM_GRAPH_MOD,
2510     };
2511 
2512     QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
2513     QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
2514 
2515     assert(qapi_perm < BLOCK_PERMISSION__MAX);
2516 
2517     return permissions[qapi_perm];
2518 }
2519 
2520 static void bdrv_replace_child_noperm(BdrvChild *child,
2521                                       BlockDriverState *new_bs)
2522 {
2523     BlockDriverState *old_bs = child->bs;
2524     int new_bs_quiesce_counter;
2525     int drain_saldo;
2526 
2527     assert(!child->frozen);
2528 
2529     if (old_bs && new_bs) {
2530         assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
2531     }
2532 
2533     new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
2534     drain_saldo = new_bs_quiesce_counter - child->parent_quiesce_counter;
2535 
2536     /*
2537      * If the new child node is drained but the old one was not, flush
2538      * all outstanding requests to the old child node.
2539      */
2540     while (drain_saldo > 0 && child->klass->drained_begin) {
2541         bdrv_parent_drained_begin_single(child, true);
2542         drain_saldo--;
2543     }
2544 
2545     if (old_bs) {
2546         /* Detach first so that the recursive drain sections coming from @child
2547          * are already gone and we only end the drain sections that came from
2548          * elsewhere. */
2549         if (child->klass->detach) {
2550             child->klass->detach(child);
2551         }
2552         QLIST_REMOVE(child, next_parent);
2553     }
2554 
2555     child->bs = new_bs;
2556 
2557     if (new_bs) {
2558         QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
2559 
2560         /*
2561          * Detaching the old node may have led to the new node's
2562          * quiesce_counter having been decreased.  Not a problem, we
2563          * just need to recognize this here and then invoke
2564          * drained_end appropriately more often.
2565          */
2566         assert(new_bs->quiesce_counter <= new_bs_quiesce_counter);
2567         drain_saldo += new_bs->quiesce_counter - new_bs_quiesce_counter;
2568 
2569         /* Attach only after starting new drained sections, so that recursive
2570          * drain sections coming from @child don't get an extra .drained_begin
2571          * callback. */
2572         if (child->klass->attach) {
2573             child->klass->attach(child);
2574         }
2575     }
2576 
2577     /*
2578      * If the old child node was drained but the new one is not, allow
2579      * requests to come in only after the new node has been attached.
2580      */
2581     while (drain_saldo < 0 && child->klass->drained_end) {
2582         bdrv_parent_drained_end_single(child);
2583         drain_saldo++;
2584     }
2585 }
2586 
2587 /*
2588  * Updates @child to change its reference to point to @new_bs, including
2589  * checking and applying the necessary permisson updates both to the old node
2590  * and to @new_bs.
2591  *
2592  * NULL is passed as @new_bs for removing the reference before freeing @child.
2593  *
2594  * If @new_bs is not NULL, bdrv_check_perm() must be called beforehand, as this
2595  * function uses bdrv_set_perm() to update the permissions according to the new
2596  * reference that @new_bs gets.
2597  */
2598 static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
2599 {
2600     BlockDriverState *old_bs = child->bs;
2601     uint64_t perm, shared_perm;
2602 
2603     bdrv_replace_child_noperm(child, new_bs);
2604 
2605     /*
2606      * Start with the new node's permissions.  If @new_bs is a (direct
2607      * or indirect) child of @old_bs, we must complete the permission
2608      * update on @new_bs before we loosen the restrictions on @old_bs.
2609      * Otherwise, bdrv_check_perm() on @old_bs would re-initiate
2610      * updating the permissions of @new_bs, and thus not purely loosen
2611      * restrictions.
2612      */
2613     if (new_bs) {
2614         bdrv_get_cumulative_perm(new_bs, &perm, &shared_perm);
2615         bdrv_set_perm(new_bs, perm, shared_perm);
2616     }
2617 
2618     if (old_bs) {
2619         /* Update permissions for old node. This is guaranteed to succeed
2620          * because we're just taking a parent away, so we're loosening
2621          * restrictions. */
2622         bool tighten_restrictions;
2623         int ret;
2624 
2625         bdrv_get_cumulative_perm(old_bs, &perm, &shared_perm);
2626         ret = bdrv_check_perm(old_bs, NULL, perm, shared_perm, NULL,
2627                               &tighten_restrictions, NULL);
2628         assert(tighten_restrictions == false);
2629         if (ret < 0) {
2630             /* We only tried to loosen restrictions, so errors are not fatal */
2631             bdrv_abort_perm_update(old_bs);
2632         } else {
2633             bdrv_set_perm(old_bs, perm, shared_perm);
2634         }
2635 
2636         /* When the parent requiring a non-default AioContext is removed, the
2637          * node moves back to the main AioContext */
2638         bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
2639     }
2640 }
2641 
2642 /*
2643  * This function steals the reference to child_bs from the caller.
2644  * That reference is later dropped by bdrv_root_unref_child().
2645  *
2646  * On failure NULL is returned, errp is set and the reference to
2647  * child_bs is also dropped.
2648  *
2649  * The caller must hold the AioContext lock @child_bs, but not that of @ctx
2650  * (unless @child_bs is already in @ctx).
2651  */
2652 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
2653                                   const char *child_name,
2654                                   const BdrvChildClass *child_class,
2655                                   BdrvChildRole child_role,
2656                                   AioContext *ctx,
2657                                   uint64_t perm, uint64_t shared_perm,
2658                                   void *opaque, Error **errp)
2659 {
2660     BdrvChild *child;
2661     Error *local_err = NULL;
2662     int ret;
2663 
2664     ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, NULL,
2665                                  errp);
2666     if (ret < 0) {
2667         bdrv_abort_perm_update(child_bs);
2668         bdrv_unref(child_bs);
2669         return NULL;
2670     }
2671 
2672     child = g_new(BdrvChild, 1);
2673     *child = (BdrvChild) {
2674         .bs             = NULL,
2675         .name           = g_strdup(child_name),
2676         .klass          = child_class,
2677         .role           = child_role,
2678         .perm           = perm,
2679         .shared_perm    = shared_perm,
2680         .opaque         = opaque,
2681     };
2682 
2683     /* If the AioContexts don't match, first try to move the subtree of
2684      * child_bs into the AioContext of the new parent. If this doesn't work,
2685      * try moving the parent into the AioContext of child_bs instead. */
2686     if (bdrv_get_aio_context(child_bs) != ctx) {
2687         ret = bdrv_try_set_aio_context(child_bs, ctx, &local_err);
2688         if (ret < 0 && child_class->can_set_aio_ctx) {
2689             GSList *ignore = g_slist_prepend(NULL, child);
2690             ctx = bdrv_get_aio_context(child_bs);
2691             if (child_class->can_set_aio_ctx(child, ctx, &ignore, NULL)) {
2692                 error_free(local_err);
2693                 ret = 0;
2694                 g_slist_free(ignore);
2695                 ignore = g_slist_prepend(NULL, child);
2696                 child_class->set_aio_ctx(child, ctx, &ignore);
2697             }
2698             g_slist_free(ignore);
2699         }
2700         if (ret < 0) {
2701             error_propagate(errp, local_err);
2702             g_free(child);
2703             bdrv_abort_perm_update(child_bs);
2704             bdrv_unref(child_bs);
2705             return NULL;
2706         }
2707     }
2708 
2709     /* This performs the matching bdrv_set_perm() for the above check. */
2710     bdrv_replace_child(child, child_bs);
2711 
2712     return child;
2713 }
2714 
2715 /*
2716  * This function transfers the reference to child_bs from the caller
2717  * to parent_bs. That reference is later dropped by parent_bs on
2718  * bdrv_close() or if someone calls bdrv_unref_child().
2719  *
2720  * On failure NULL is returned, errp is set and the reference to
2721  * child_bs is also dropped.
2722  *
2723  * If @parent_bs and @child_bs are in different AioContexts, the caller must
2724  * hold the AioContext lock for @child_bs, but not for @parent_bs.
2725  */
2726 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
2727                              BlockDriverState *child_bs,
2728                              const char *child_name,
2729                              const BdrvChildClass *child_class,
2730                              BdrvChildRole child_role,
2731                              Error **errp)
2732 {
2733     BdrvChild *child;
2734     uint64_t perm, shared_perm;
2735 
2736     bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
2737 
2738     assert(parent_bs->drv);
2739     bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
2740                     perm, shared_perm, &perm, &shared_perm);
2741 
2742     child = bdrv_root_attach_child(child_bs, child_name, child_class,
2743                                    child_role, bdrv_get_aio_context(parent_bs),
2744                                    perm, shared_perm, parent_bs, errp);
2745     if (child == NULL) {
2746         return NULL;
2747     }
2748 
2749     QLIST_INSERT_HEAD(&parent_bs->children, child, next);
2750     return child;
2751 }
2752 
2753 static void bdrv_detach_child(BdrvChild *child)
2754 {
2755     QLIST_SAFE_REMOVE(child, next);
2756 
2757     bdrv_replace_child(child, NULL);
2758 
2759     g_free(child->name);
2760     g_free(child);
2761 }
2762 
2763 void bdrv_root_unref_child(BdrvChild *child)
2764 {
2765     BlockDriverState *child_bs;
2766 
2767     child_bs = child->bs;
2768     bdrv_detach_child(child);
2769     bdrv_unref(child_bs);
2770 }
2771 
2772 /**
2773  * Clear all inherits_from pointers from children and grandchildren of
2774  * @root that point to @root, where necessary.
2775  */
2776 static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
2777 {
2778     BdrvChild *c;
2779 
2780     if (child->bs->inherits_from == root) {
2781         /*
2782          * Remove inherits_from only when the last reference between root and
2783          * child->bs goes away.
2784          */
2785         QLIST_FOREACH(c, &root->children, next) {
2786             if (c != child && c->bs == child->bs) {
2787                 break;
2788             }
2789         }
2790         if (c == NULL) {
2791             child->bs->inherits_from = NULL;
2792         }
2793     }
2794 
2795     QLIST_FOREACH(c, &child->bs->children, next) {
2796         bdrv_unset_inherits_from(root, c);
2797     }
2798 }
2799 
2800 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
2801 {
2802     if (child == NULL) {
2803         return;
2804     }
2805 
2806     bdrv_unset_inherits_from(parent, child);
2807     bdrv_root_unref_child(child);
2808 }
2809 
2810 
2811 static void bdrv_parent_cb_change_media(BlockDriverState *bs, bool load)
2812 {
2813     BdrvChild *c;
2814     QLIST_FOREACH(c, &bs->parents, next_parent) {
2815         if (c->klass->change_media) {
2816             c->klass->change_media(c, load);
2817         }
2818     }
2819 }
2820 
2821 /* Return true if you can reach parent going through child->inherits_from
2822  * recursively. If parent or child are NULL, return false */
2823 static bool bdrv_inherits_from_recursive(BlockDriverState *child,
2824                                          BlockDriverState *parent)
2825 {
2826     while (child && child != parent) {
2827         child = child->inherits_from;
2828     }
2829 
2830     return child != NULL;
2831 }
2832 
2833 /*
2834  * Return the BdrvChildRole for @bs's backing child.  bs->backing is
2835  * mostly used for COW backing children (role = COW), but also for
2836  * filtered children (role = FILTERED | PRIMARY).
2837  */
2838 static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
2839 {
2840     if (bs->drv && bs->drv->is_filter) {
2841         return BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
2842     } else {
2843         return BDRV_CHILD_COW;
2844     }
2845 }
2846 
2847 /*
2848  * Sets the backing file link of a BDS. A new reference is created; callers
2849  * which don't need their own reference any more must call bdrv_unref().
2850  */
2851 void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
2852                          Error **errp)
2853 {
2854     bool update_inherits_from = bdrv_chain_contains(bs, backing_hd) &&
2855         bdrv_inherits_from_recursive(backing_hd, bs);
2856 
2857     if (bdrv_is_backing_chain_frozen(bs, backing_bs(bs), errp)) {
2858         return;
2859     }
2860 
2861     if (backing_hd) {
2862         bdrv_ref(backing_hd);
2863     }
2864 
2865     if (bs->backing) {
2866         bdrv_unref_child(bs, bs->backing);
2867         bs->backing = NULL;
2868     }
2869 
2870     if (!backing_hd) {
2871         goto out;
2872     }
2873 
2874     bs->backing = bdrv_attach_child(bs, backing_hd, "backing", &child_of_bds,
2875                                     bdrv_backing_role(bs), errp);
2876     /* If backing_hd was already part of bs's backing chain, and
2877      * inherits_from pointed recursively to bs then let's update it to
2878      * point directly to bs (else it will become NULL). */
2879     if (bs->backing && update_inherits_from) {
2880         backing_hd->inherits_from = bs;
2881     }
2882 
2883 out:
2884     bdrv_refresh_limits(bs, NULL);
2885 }
2886 
2887 /*
2888  * Opens the backing file for a BlockDriverState if not yet open
2889  *
2890  * bdref_key specifies the key for the image's BlockdevRef in the options QDict.
2891  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
2892  * itself, all options starting with "${bdref_key}." are considered part of the
2893  * BlockdevRef.
2894  *
2895  * TODO Can this be unified with bdrv_open_image()?
2896  */
2897 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
2898                            const char *bdref_key, Error **errp)
2899 {
2900     char *backing_filename = NULL;
2901     char *bdref_key_dot;
2902     const char *reference = NULL;
2903     int ret = 0;
2904     bool implicit_backing = false;
2905     BlockDriverState *backing_hd;
2906     QDict *options;
2907     QDict *tmp_parent_options = NULL;
2908     Error *local_err = NULL;
2909 
2910     if (bs->backing != NULL) {
2911         goto free_exit;
2912     }
2913 
2914     /* NULL means an empty set of options */
2915     if (parent_options == NULL) {
2916         tmp_parent_options = qdict_new();
2917         parent_options = tmp_parent_options;
2918     }
2919 
2920     bs->open_flags &= ~BDRV_O_NO_BACKING;
2921 
2922     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
2923     qdict_extract_subqdict(parent_options, &options, bdref_key_dot);
2924     g_free(bdref_key_dot);
2925 
2926     /*
2927      * Caution: while qdict_get_try_str() is fine, getting non-string
2928      * types would require more care.  When @parent_options come from
2929      * -blockdev or blockdev_add, its members are typed according to
2930      * the QAPI schema, but when they come from -drive, they're all
2931      * QString.
2932      */
2933     reference = qdict_get_try_str(parent_options, bdref_key);
2934     if (reference || qdict_haskey(options, "file.filename")) {
2935         /* keep backing_filename NULL */
2936     } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
2937         qobject_unref(options);
2938         goto free_exit;
2939     } else {
2940         if (qdict_size(options) == 0) {
2941             /* If the user specifies options that do not modify the
2942              * backing file's behavior, we might still consider it the
2943              * implicit backing file.  But it's easier this way, and
2944              * just specifying some of the backing BDS's options is
2945              * only possible with -drive anyway (otherwise the QAPI
2946              * schema forces the user to specify everything). */
2947             implicit_backing = !strcmp(bs->auto_backing_file, bs->backing_file);
2948         }
2949 
2950         backing_filename = bdrv_get_full_backing_filename(bs, &local_err);
2951         if (local_err) {
2952             ret = -EINVAL;
2953             error_propagate(errp, local_err);
2954             qobject_unref(options);
2955             goto free_exit;
2956         }
2957     }
2958 
2959     if (!bs->drv || !bs->drv->supports_backing) {
2960         ret = -EINVAL;
2961         error_setg(errp, "Driver doesn't support backing files");
2962         qobject_unref(options);
2963         goto free_exit;
2964     }
2965 
2966     if (!reference &&
2967         bs->backing_format[0] != '\0' && !qdict_haskey(options, "driver")) {
2968         qdict_put_str(options, "driver", bs->backing_format);
2969     }
2970 
2971     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
2972                                    &child_of_bds, bdrv_backing_role(bs), errp);
2973     if (!backing_hd) {
2974         bs->open_flags |= BDRV_O_NO_BACKING;
2975         error_prepend(errp, "Could not open backing file: ");
2976         ret = -EINVAL;
2977         goto free_exit;
2978     }
2979 
2980     if (implicit_backing) {
2981         bdrv_refresh_filename(backing_hd);
2982         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2983                 backing_hd->filename);
2984     }
2985 
2986     /* Hook up the backing file link; drop our reference, bs owns the
2987      * backing_hd reference now */
2988     bdrv_set_backing_hd(bs, backing_hd, &local_err);
2989     bdrv_unref(backing_hd);
2990     if (local_err) {
2991         error_propagate(errp, local_err);
2992         ret = -EINVAL;
2993         goto free_exit;
2994     }
2995 
2996     qdict_del(parent_options, bdref_key);
2997 
2998 free_exit:
2999     g_free(backing_filename);
3000     qobject_unref(tmp_parent_options);
3001     return ret;
3002 }
3003 
3004 static BlockDriverState *
3005 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
3006                    BlockDriverState *parent, const BdrvChildClass *child_class,
3007                    BdrvChildRole child_role, bool allow_none, Error **errp)
3008 {
3009     BlockDriverState *bs = NULL;
3010     QDict *image_options;
3011     char *bdref_key_dot;
3012     const char *reference;
3013 
3014     assert(child_class != NULL);
3015 
3016     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3017     qdict_extract_subqdict(options, &image_options, bdref_key_dot);
3018     g_free(bdref_key_dot);
3019 
3020     /*
3021      * Caution: while qdict_get_try_str() is fine, getting non-string
3022      * types would require more care.  When @options come from
3023      * -blockdev or blockdev_add, its members are typed according to
3024      * the QAPI schema, but when they come from -drive, they're all
3025      * QString.
3026      */
3027     reference = qdict_get_try_str(options, bdref_key);
3028     if (!filename && !reference && !qdict_size(image_options)) {
3029         if (!allow_none) {
3030             error_setg(errp, "A block device must be specified for \"%s\"",
3031                        bdref_key);
3032         }
3033         qobject_unref(image_options);
3034         goto done;
3035     }
3036 
3037     bs = bdrv_open_inherit(filename, reference, image_options, 0,
3038                            parent, child_class, child_role, errp);
3039     if (!bs) {
3040         goto done;
3041     }
3042 
3043 done:
3044     qdict_del(options, bdref_key);
3045     return bs;
3046 }
3047 
3048 /*
3049  * Opens a disk image whose options are given as BlockdevRef in another block
3050  * device's options.
3051  *
3052  * If allow_none is true, no image will be opened if filename is false and no
3053  * BlockdevRef is given. NULL will be returned, but errp remains unset.
3054  *
3055  * bdrev_key specifies the key for the image's BlockdevRef in the options QDict.
3056  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3057  * itself, all options starting with "${bdref_key}." are considered part of the
3058  * BlockdevRef.
3059  *
3060  * The BlockdevRef will be removed from the options QDict.
3061  */
3062 BdrvChild *bdrv_open_child(const char *filename,
3063                            QDict *options, const char *bdref_key,
3064                            BlockDriverState *parent,
3065                            const BdrvChildClass *child_class,
3066                            BdrvChildRole child_role,
3067                            bool allow_none, Error **errp)
3068 {
3069     BlockDriverState *bs;
3070 
3071     bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
3072                             child_role, allow_none, errp);
3073     if (bs == NULL) {
3074         return NULL;
3075     }
3076 
3077     return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
3078                              errp);
3079 }
3080 
3081 /*
3082  * TODO Future callers may need to specify parent/child_class in order for
3083  * option inheritance to work. Existing callers use it for the root node.
3084  */
3085 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
3086 {
3087     BlockDriverState *bs = NULL;
3088     QObject *obj = NULL;
3089     QDict *qdict = NULL;
3090     const char *reference = NULL;
3091     Visitor *v = NULL;
3092 
3093     if (ref->type == QTYPE_QSTRING) {
3094         reference = ref->u.reference;
3095     } else {
3096         BlockdevOptions *options = &ref->u.definition;
3097         assert(ref->type == QTYPE_QDICT);
3098 
3099         v = qobject_output_visitor_new(&obj);
3100         visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3101         visit_complete(v, &obj);
3102 
3103         qdict = qobject_to(QDict, obj);
3104         qdict_flatten(qdict);
3105 
3106         /* bdrv_open_inherit() defaults to the values in bdrv_flags (for
3107          * compatibility with other callers) rather than what we want as the
3108          * real defaults. Apply the defaults here instead. */
3109         qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
3110         qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
3111         qdict_set_default_str(qdict, BDRV_OPT_READ_ONLY, "off");
3112         qdict_set_default_str(qdict, BDRV_OPT_AUTO_READ_ONLY, "off");
3113 
3114     }
3115 
3116     bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, errp);
3117     obj = NULL;
3118     qobject_unref(obj);
3119     visit_free(v);
3120     return bs;
3121 }
3122 
3123 static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
3124                                                    int flags,
3125                                                    QDict *snapshot_options,
3126                                                    Error **errp)
3127 {
3128     /* TODO: extra byte is a hack to ensure MAX_PATH space on Windows. */
3129     char *tmp_filename = g_malloc0(PATH_MAX + 1);
3130     int64_t total_size;
3131     QemuOpts *opts = NULL;
3132     BlockDriverState *bs_snapshot = NULL;
3133     Error *local_err = NULL;
3134     int ret;
3135 
3136     /* if snapshot, we create a temporary backing file and open it
3137        instead of opening 'filename' directly */
3138 
3139     /* Get the required size from the image */
3140     total_size = bdrv_getlength(bs);
3141     if (total_size < 0) {
3142         error_setg_errno(errp, -total_size, "Could not get image size");
3143         goto out;
3144     }
3145 
3146     /* Create the temporary image */
3147     ret = get_tmp_filename(tmp_filename, PATH_MAX + 1);
3148     if (ret < 0) {
3149         error_setg_errno(errp, -ret, "Could not get temporary filename");
3150         goto out;
3151     }
3152 
3153     opts = qemu_opts_create(bdrv_qcow2.create_opts, NULL, 0,
3154                             &error_abort);
3155     qemu_opt_set_number(opts, BLOCK_OPT_SIZE, total_size, &error_abort);
3156     ret = bdrv_create(&bdrv_qcow2, tmp_filename, opts, errp);
3157     qemu_opts_del(opts);
3158     if (ret < 0) {
3159         error_prepend(errp, "Could not create temporary overlay '%s': ",
3160                       tmp_filename);
3161         goto out;
3162     }
3163 
3164     /* Prepare options QDict for the temporary file */
3165     qdict_put_str(snapshot_options, "file.driver", "file");
3166     qdict_put_str(snapshot_options, "file.filename", tmp_filename);
3167     qdict_put_str(snapshot_options, "driver", "qcow2");
3168 
3169     bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
3170     snapshot_options = NULL;
3171     if (!bs_snapshot) {
3172         goto out;
3173     }
3174 
3175     /* bdrv_append() consumes a strong reference to bs_snapshot
3176      * (i.e. it will call bdrv_unref() on it) even on error, so in
3177      * order to be able to return one, we have to increase
3178      * bs_snapshot's refcount here */
3179     bdrv_ref(bs_snapshot);
3180     bdrv_append(bs_snapshot, bs, &local_err);
3181     if (local_err) {
3182         error_propagate(errp, local_err);
3183         bs_snapshot = NULL;
3184         goto out;
3185     }
3186 
3187 out:
3188     qobject_unref(snapshot_options);
3189     g_free(tmp_filename);
3190     return bs_snapshot;
3191 }
3192 
3193 /*
3194  * Opens a disk image (raw, qcow2, vmdk, ...)
3195  *
3196  * options is a QDict of options to pass to the block drivers, or NULL for an
3197  * empty set of options. The reference to the QDict belongs to the block layer
3198  * after the call (even on failure), so if the caller intends to reuse the
3199  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
3200  *
3201  * If *pbs is NULL, a new BDS will be created with a pointer to it stored there.
3202  * If it is not NULL, the referenced BDS will be reused.
3203  *
3204  * The reference parameter may be used to specify an existing block device which
3205  * should be opened. If specified, neither options nor a filename may be given,
3206  * nor can an existing BDS be reused (that is, *pbs has to be NULL).
3207  */
3208 static BlockDriverState *bdrv_open_inherit(const char *filename,
3209                                            const char *reference,
3210                                            QDict *options, int flags,
3211                                            BlockDriverState *parent,
3212                                            const BdrvChildClass *child_class,
3213                                            BdrvChildRole child_role,
3214                                            Error **errp)
3215 {
3216     int ret;
3217     BlockBackend *file = NULL;
3218     BlockDriverState *bs;
3219     BlockDriver *drv = NULL;
3220     BdrvChild *child;
3221     const char *drvname;
3222     const char *backing;
3223     Error *local_err = NULL;
3224     QDict *snapshot_options = NULL;
3225     int snapshot_flags = 0;
3226 
3227     assert(!child_class || !flags);
3228     assert(!child_class == !parent);
3229 
3230     if (reference) {
3231         bool options_non_empty = options ? qdict_size(options) : false;
3232         qobject_unref(options);
3233 
3234         if (filename || options_non_empty) {
3235             error_setg(errp, "Cannot reference an existing block device with "
3236                        "additional options or a new filename");
3237             return NULL;
3238         }
3239 
3240         bs = bdrv_lookup_bs(reference, reference, errp);
3241         if (!bs) {
3242             return NULL;
3243         }
3244 
3245         bdrv_ref(bs);
3246         return bs;
3247     }
3248 
3249     bs = bdrv_new();
3250 
3251     /* NULL means an empty set of options */
3252     if (options == NULL) {
3253         options = qdict_new();
3254     }
3255 
3256     /* json: syntax counts as explicit options, as if in the QDict */
3257     parse_json_protocol(options, &filename, &local_err);
3258     if (local_err) {
3259         goto fail;
3260     }
3261 
3262     bs->explicit_options = qdict_clone_shallow(options);
3263 
3264     if (child_class) {
3265         bool parent_is_format;
3266 
3267         if (parent->drv) {
3268             parent_is_format = parent->drv->is_format;
3269         } else {
3270             /*
3271              * parent->drv is not set yet because this node is opened for
3272              * (potential) format probing.  That means that @parent is going
3273              * to be a format node.
3274              */
3275             parent_is_format = true;
3276         }
3277 
3278         bs->inherits_from = parent;
3279         child_class->inherit_options(child_role, parent_is_format,
3280                                      &flags, options,
3281                                      parent->open_flags, parent->options);
3282     }
3283 
3284     ret = bdrv_fill_options(&options, filename, &flags, &local_err);
3285     if (ret < 0) {
3286         goto fail;
3287     }
3288 
3289     /*
3290      * Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
3291      * Caution: getting a boolean member of @options requires care.
3292      * When @options come from -blockdev or blockdev_add, members are
3293      * typed according to the QAPI schema, but when they come from
3294      * -drive, they're all QString.
3295      */
3296     if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
3297         !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
3298         flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
3299     } else {
3300         flags &= ~BDRV_O_RDWR;
3301     }
3302 
3303     if (flags & BDRV_O_SNAPSHOT) {
3304         snapshot_options = qdict_new();
3305         bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
3306                                    flags, options);
3307         /* Let bdrv_backing_options() override "read-only" */
3308         qdict_del(options, BDRV_OPT_READ_ONLY);
3309         bdrv_inherited_options(BDRV_CHILD_COW, true,
3310                                &flags, options, flags, options);
3311     }
3312 
3313     bs->open_flags = flags;
3314     bs->options = options;
3315     options = qdict_clone_shallow(options);
3316 
3317     /* Find the right image format driver */
3318     /* See cautionary note on accessing @options above */
3319     drvname = qdict_get_try_str(options, "driver");
3320     if (drvname) {
3321         drv = bdrv_find_format(drvname);
3322         if (!drv) {
3323             error_setg(errp, "Unknown driver: '%s'", drvname);
3324             goto fail;
3325         }
3326     }
3327 
3328     assert(drvname || !(flags & BDRV_O_PROTOCOL));
3329 
3330     /* See cautionary note on accessing @options above */
3331     backing = qdict_get_try_str(options, "backing");
3332     if (qobject_to(QNull, qdict_get(options, "backing")) != NULL ||
3333         (backing && *backing == '\0'))
3334     {
3335         if (backing) {
3336             warn_report("Use of \"backing\": \"\" is deprecated; "
3337                         "use \"backing\": null instead");
3338         }
3339         flags |= BDRV_O_NO_BACKING;
3340         qdict_del(bs->explicit_options, "backing");
3341         qdict_del(bs->options, "backing");
3342         qdict_del(options, "backing");
3343     }
3344 
3345     /* Open image file without format layer. This BlockBackend is only used for
3346      * probing, the block drivers will do their own bdrv_open_child() for the
3347      * same BDS, which is why we put the node name back into options. */
3348     if ((flags & BDRV_O_PROTOCOL) == 0) {
3349         BlockDriverState *file_bs;
3350 
3351         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
3352                                      &child_of_bds, BDRV_CHILD_IMAGE,
3353                                      true, &local_err);
3354         if (local_err) {
3355             goto fail;
3356         }
3357         if (file_bs != NULL) {
3358             /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
3359              * looking at the header to guess the image format. This works even
3360              * in cases where a guest would not see a consistent state. */
3361             file = blk_new(bdrv_get_aio_context(file_bs), 0, BLK_PERM_ALL);
3362             blk_insert_bs(file, file_bs, &local_err);
3363             bdrv_unref(file_bs);
3364             if (local_err) {
3365                 goto fail;
3366             }
3367 
3368             qdict_put_str(options, "file", bdrv_get_node_name(file_bs));
3369         }
3370     }
3371 
3372     /* Image format probing */
3373     bs->probed = !drv;
3374     if (!drv && file) {
3375         ret = find_image_format(file, filename, &drv, &local_err);
3376         if (ret < 0) {
3377             goto fail;
3378         }
3379         /*
3380          * This option update would logically belong in bdrv_fill_options(),
3381          * but we first need to open bs->file for the probing to work, while
3382          * opening bs->file already requires the (mostly) final set of options
3383          * so that cache mode etc. can be inherited.
3384          *
3385          * Adding the driver later is somewhat ugly, but it's not an option
3386          * that would ever be inherited, so it's correct. We just need to make
3387          * sure to update both bs->options (which has the full effective
3388          * options for bs) and options (which has file.* already removed).
3389          */
3390         qdict_put_str(bs->options, "driver", drv->format_name);
3391         qdict_put_str(options, "driver", drv->format_name);
3392     } else if (!drv) {
3393         error_setg(errp, "Must specify either driver or file");
3394         goto fail;
3395     }
3396 
3397     /* BDRV_O_PROTOCOL must be set iff a protocol BDS is about to be created */
3398     assert(!!(flags & BDRV_O_PROTOCOL) == !!drv->bdrv_file_open);
3399     /* file must be NULL if a protocol BDS is about to be created
3400      * (the inverse results in an error message from bdrv_open_common()) */
3401     assert(!(flags & BDRV_O_PROTOCOL) || !file);
3402 
3403     /* Open the image */
3404     ret = bdrv_open_common(bs, file, options, &local_err);
3405     if (ret < 0) {
3406         goto fail;
3407     }
3408 
3409     if (file) {
3410         blk_unref(file);
3411         file = NULL;
3412     }
3413 
3414     /* If there is a backing file, use it */
3415     if ((flags & BDRV_O_NO_BACKING) == 0) {
3416         ret = bdrv_open_backing_file(bs, options, "backing", &local_err);
3417         if (ret < 0) {
3418             goto close_and_fail;
3419         }
3420     }
3421 
3422     /* Remove all children options and references
3423      * from bs->options and bs->explicit_options */
3424     QLIST_FOREACH(child, &bs->children, next) {
3425         char *child_key_dot;
3426         child_key_dot = g_strdup_printf("%s.", child->name);
3427         qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
3428         qdict_extract_subqdict(bs->options, NULL, child_key_dot);
3429         qdict_del(bs->explicit_options, child->name);
3430         qdict_del(bs->options, child->name);
3431         g_free(child_key_dot);
3432     }
3433 
3434     /* Check if any unknown options were used */
3435     if (qdict_size(options) != 0) {
3436         const QDictEntry *entry = qdict_first(options);
3437         if (flags & BDRV_O_PROTOCOL) {
3438             error_setg(errp, "Block protocol '%s' doesn't support the option "
3439                        "'%s'", drv->format_name, entry->key);
3440         } else {
3441             error_setg(errp,
3442                        "Block format '%s' does not support the option '%s'",
3443                        drv->format_name, entry->key);
3444         }
3445 
3446         goto close_and_fail;
3447     }
3448 
3449     bdrv_parent_cb_change_media(bs, true);
3450 
3451     qobject_unref(options);
3452     options = NULL;
3453 
3454     /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
3455      * temporary snapshot afterwards. */
3456     if (snapshot_flags) {
3457         BlockDriverState *snapshot_bs;
3458         snapshot_bs = bdrv_append_temp_snapshot(bs, snapshot_flags,
3459                                                 snapshot_options, &local_err);
3460         snapshot_options = NULL;
3461         if (local_err) {
3462             goto close_and_fail;
3463         }
3464         /* We are not going to return bs but the overlay on top of it
3465          * (snapshot_bs); thus, we have to drop the strong reference to bs
3466          * (which we obtained by calling bdrv_new()). bs will not be deleted,
3467          * though, because the overlay still has a reference to it. */
3468         bdrv_unref(bs);
3469         bs = snapshot_bs;
3470     }
3471 
3472     return bs;
3473 
3474 fail:
3475     blk_unref(file);
3476     qobject_unref(snapshot_options);
3477     qobject_unref(bs->explicit_options);
3478     qobject_unref(bs->options);
3479     qobject_unref(options);
3480     bs->options = NULL;
3481     bs->explicit_options = NULL;
3482     bdrv_unref(bs);
3483     error_propagate(errp, local_err);
3484     return NULL;
3485 
3486 close_and_fail:
3487     bdrv_unref(bs);
3488     qobject_unref(snapshot_options);
3489     qobject_unref(options);
3490     error_propagate(errp, local_err);
3491     return NULL;
3492 }
3493 
3494 BlockDriverState *bdrv_open(const char *filename, const char *reference,
3495                             QDict *options, int flags, Error **errp)
3496 {
3497     return bdrv_open_inherit(filename, reference, options, flags, NULL,
3498                              NULL, 0, errp);
3499 }
3500 
3501 /* Return true if the NULL-terminated @list contains @str */
3502 static bool is_str_in_list(const char *str, const char *const *list)
3503 {
3504     if (str && list) {
3505         int i;
3506         for (i = 0; list[i] != NULL; i++) {
3507             if (!strcmp(str, list[i])) {
3508                 return true;
3509             }
3510         }
3511     }
3512     return false;
3513 }
3514 
3515 /*
3516  * Check that every option set in @bs->options is also set in
3517  * @new_opts.
3518  *
3519  * Options listed in the common_options list and in
3520  * @bs->drv->mutable_opts are skipped.
3521  *
3522  * Return 0 on success, otherwise return -EINVAL and set @errp.
3523  */
3524 static int bdrv_reset_options_allowed(BlockDriverState *bs,
3525                                       const QDict *new_opts, Error **errp)
3526 {
3527     const QDictEntry *e;
3528     /* These options are common to all block drivers and are handled
3529      * in bdrv_reopen_prepare() so they can be left out of @new_opts */
3530     const char *const common_options[] = {
3531         "node-name", "discard", "cache.direct", "cache.no-flush",
3532         "read-only", "auto-read-only", "detect-zeroes", NULL
3533     };
3534 
3535     for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
3536         if (!qdict_haskey(new_opts, e->key) &&
3537             !is_str_in_list(e->key, common_options) &&
3538             !is_str_in_list(e->key, bs->drv->mutable_opts)) {
3539             error_setg(errp, "Option '%s' cannot be reset "
3540                        "to its default value", e->key);
3541             return -EINVAL;
3542         }
3543     }
3544 
3545     return 0;
3546 }
3547 
3548 /*
3549  * Returns true if @child can be reached recursively from @bs
3550  */
3551 static bool bdrv_recurse_has_child(BlockDriverState *bs,
3552                                    BlockDriverState *child)
3553 {
3554     BdrvChild *c;
3555 
3556     if (bs == child) {
3557         return true;
3558     }
3559 
3560     QLIST_FOREACH(c, &bs->children, next) {
3561         if (bdrv_recurse_has_child(c->bs, child)) {
3562             return true;
3563         }
3564     }
3565 
3566     return false;
3567 }
3568 
3569 /*
3570  * Adds a BlockDriverState to a simple queue for an atomic, transactional
3571  * reopen of multiple devices.
3572  *
3573  * bs_queue can either be an existing BlockReopenQueue that has had QTAILQ_INIT
3574  * already performed, or alternatively may be NULL a new BlockReopenQueue will
3575  * be created and initialized. This newly created BlockReopenQueue should be
3576  * passed back in for subsequent calls that are intended to be of the same
3577  * atomic 'set'.
3578  *
3579  * bs is the BlockDriverState to add to the reopen queue.
3580  *
3581  * options contains the changed options for the associated bs
3582  * (the BlockReopenQueue takes ownership)
3583  *
3584  * flags contains the open flags for the associated bs
3585  *
3586  * returns a pointer to bs_queue, which is either the newly allocated
3587  * bs_queue, or the existing bs_queue being used.
3588  *
3589  * bs must be drained between bdrv_reopen_queue() and bdrv_reopen_multiple().
3590  */
3591 static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
3592                                                  BlockDriverState *bs,
3593                                                  QDict *options,
3594                                                  const BdrvChildClass *klass,
3595                                                  BdrvChildRole role,
3596                                                  bool parent_is_format,
3597                                                  QDict *parent_options,
3598                                                  int parent_flags,
3599                                                  bool keep_old_opts)
3600 {
3601     assert(bs != NULL);
3602 
3603     BlockReopenQueueEntry *bs_entry;
3604     BdrvChild *child;
3605     QDict *old_options, *explicit_options, *options_copy;
3606     int flags;
3607     QemuOpts *opts;
3608 
3609     /* Make sure that the caller remembered to use a drained section. This is
3610      * important to avoid graph changes between the recursive queuing here and
3611      * bdrv_reopen_multiple(). */
3612     assert(bs->quiesce_counter > 0);
3613 
3614     if (bs_queue == NULL) {
3615         bs_queue = g_new0(BlockReopenQueue, 1);
3616         QTAILQ_INIT(bs_queue);
3617     }
3618 
3619     if (!options) {
3620         options = qdict_new();
3621     }
3622 
3623     /* Check if this BlockDriverState is already in the queue */
3624     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3625         if (bs == bs_entry->state.bs) {
3626             break;
3627         }
3628     }
3629 
3630     /*
3631      * Precedence of options:
3632      * 1. Explicitly passed in options (highest)
3633      * 2. Retained from explicitly set options of bs
3634      * 3. Inherited from parent node
3635      * 4. Retained from effective options of bs
3636      */
3637 
3638     /* Old explicitly set values (don't overwrite by inherited value) */
3639     if (bs_entry || keep_old_opts) {
3640         old_options = qdict_clone_shallow(bs_entry ?
3641                                           bs_entry->state.explicit_options :
3642                                           bs->explicit_options);
3643         bdrv_join_options(bs, options, old_options);
3644         qobject_unref(old_options);
3645     }
3646 
3647     explicit_options = qdict_clone_shallow(options);
3648 
3649     /* Inherit from parent node */
3650     if (parent_options) {
3651         flags = 0;
3652         klass->inherit_options(role, parent_is_format, &flags, options,
3653                                parent_flags, parent_options);
3654     } else {
3655         flags = bdrv_get_flags(bs);
3656     }
3657 
3658     if (keep_old_opts) {
3659         /* Old values are used for options that aren't set yet */
3660         old_options = qdict_clone_shallow(bs->options);
3661         bdrv_join_options(bs, options, old_options);
3662         qobject_unref(old_options);
3663     }
3664 
3665     /* We have the final set of options so let's update the flags */
3666     options_copy = qdict_clone_shallow(options);
3667     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
3668     qemu_opts_absorb_qdict(opts, options_copy, NULL);
3669     update_flags_from_options(&flags, opts);
3670     qemu_opts_del(opts);
3671     qobject_unref(options_copy);
3672 
3673     /* bdrv_open_inherit() sets and clears some additional flags internally */
3674     flags &= ~BDRV_O_PROTOCOL;
3675     if (flags & BDRV_O_RDWR) {
3676         flags |= BDRV_O_ALLOW_RDWR;
3677     }
3678 
3679     if (!bs_entry) {
3680         bs_entry = g_new0(BlockReopenQueueEntry, 1);
3681         QTAILQ_INSERT_TAIL(bs_queue, bs_entry, entry);
3682     } else {
3683         qobject_unref(bs_entry->state.options);
3684         qobject_unref(bs_entry->state.explicit_options);
3685     }
3686 
3687     bs_entry->state.bs = bs;
3688     bs_entry->state.options = options;
3689     bs_entry->state.explicit_options = explicit_options;
3690     bs_entry->state.flags = flags;
3691 
3692     /* This needs to be overwritten in bdrv_reopen_prepare() */
3693     bs_entry->state.perm = UINT64_MAX;
3694     bs_entry->state.shared_perm = 0;
3695 
3696     /*
3697      * If keep_old_opts is false then it means that unspecified
3698      * options must be reset to their original value. We don't allow
3699      * resetting 'backing' but we need to know if the option is
3700      * missing in order to decide if we have to return an error.
3701      */
3702     if (!keep_old_opts) {
3703         bs_entry->state.backing_missing =
3704             !qdict_haskey(options, "backing") &&
3705             !qdict_haskey(options, "backing.driver");
3706     }
3707 
3708     QLIST_FOREACH(child, &bs->children, next) {
3709         QDict *new_child_options = NULL;
3710         bool child_keep_old = keep_old_opts;
3711 
3712         /* reopen can only change the options of block devices that were
3713          * implicitly created and inherited options. For other (referenced)
3714          * block devices, a syntax like "backing.foo" results in an error. */
3715         if (child->bs->inherits_from != bs) {
3716             continue;
3717         }
3718 
3719         /* Check if the options contain a child reference */
3720         if (qdict_haskey(options, child->name)) {
3721             const char *childref = qdict_get_try_str(options, child->name);
3722             /*
3723              * The current child must not be reopened if the child
3724              * reference is null or points to a different node.
3725              */
3726             if (g_strcmp0(childref, child->bs->node_name)) {
3727                 continue;
3728             }
3729             /*
3730              * If the child reference points to the current child then
3731              * reopen it with its existing set of options (note that
3732              * it can still inherit new options from the parent).
3733              */
3734             child_keep_old = true;
3735         } else {
3736             /* Extract child options ("child-name.*") */
3737             char *child_key_dot = g_strdup_printf("%s.", child->name);
3738             qdict_extract_subqdict(explicit_options, NULL, child_key_dot);
3739             qdict_extract_subqdict(options, &new_child_options, child_key_dot);
3740             g_free(child_key_dot);
3741         }
3742 
3743         bdrv_reopen_queue_child(bs_queue, child->bs, new_child_options,
3744                                 child->klass, child->role, bs->drv->is_format,
3745                                 options, flags, child_keep_old);
3746     }
3747 
3748     return bs_queue;
3749 }
3750 
3751 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
3752                                     BlockDriverState *bs,
3753                                     QDict *options, bool keep_old_opts)
3754 {
3755     return bdrv_reopen_queue_child(bs_queue, bs, options, NULL, 0, false,
3756                                    NULL, 0, keep_old_opts);
3757 }
3758 
3759 /*
3760  * Reopen multiple BlockDriverStates atomically & transactionally.
3761  *
3762  * The queue passed in (bs_queue) must have been built up previous
3763  * via bdrv_reopen_queue().
3764  *
3765  * Reopens all BDS specified in the queue, with the appropriate
3766  * flags.  All devices are prepared for reopen, and failure of any
3767  * device will cause all device changes to be abandoned, and intermediate
3768  * data cleaned up.
3769  *
3770  * If all devices prepare successfully, then the changes are committed
3771  * to all devices.
3772  *
3773  * All affected nodes must be drained between bdrv_reopen_queue() and
3774  * bdrv_reopen_multiple().
3775  */
3776 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
3777 {
3778     int ret = -1;
3779     BlockReopenQueueEntry *bs_entry, *next;
3780 
3781     assert(bs_queue != NULL);
3782 
3783     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3784         assert(bs_entry->state.bs->quiesce_counter > 0);
3785         if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, errp)) {
3786             goto cleanup;
3787         }
3788         bs_entry->prepared = true;
3789     }
3790 
3791     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3792         BDRVReopenState *state = &bs_entry->state;
3793         ret = bdrv_check_perm(state->bs, bs_queue, state->perm,
3794                               state->shared_perm, NULL, NULL, errp);
3795         if (ret < 0) {
3796             goto cleanup_perm;
3797         }
3798         /* Check if new_backing_bs would accept the new permissions */
3799         if (state->replace_backing_bs && state->new_backing_bs) {
3800             uint64_t nperm, nshared;
3801             bdrv_child_perm(state->bs, state->new_backing_bs,
3802                             NULL, bdrv_backing_role(state->bs),
3803                             bs_queue, state->perm, state->shared_perm,
3804                             &nperm, &nshared);
3805             ret = bdrv_check_update_perm(state->new_backing_bs, NULL,
3806                                          nperm, nshared, NULL, NULL, errp);
3807             if (ret < 0) {
3808                 goto cleanup_perm;
3809             }
3810         }
3811         bs_entry->perms_checked = true;
3812     }
3813 
3814     /*
3815      * If we reach this point, we have success and just need to apply the
3816      * changes.
3817      *
3818      * Reverse order is used to comfort qcow2 driver: on commit it need to write
3819      * IN_USE flag to the image, to mark bitmaps in the image as invalid. But
3820      * children are usually goes after parents in reopen-queue, so go from last
3821      * to first element.
3822      */
3823     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
3824         bdrv_reopen_commit(&bs_entry->state);
3825     }
3826 
3827     ret = 0;
3828 cleanup_perm:
3829     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
3830         BDRVReopenState *state = &bs_entry->state;
3831 
3832         if (!bs_entry->perms_checked) {
3833             continue;
3834         }
3835 
3836         if (ret == 0) {
3837             bdrv_set_perm(state->bs, state->perm, state->shared_perm);
3838         } else {
3839             bdrv_abort_perm_update(state->bs);
3840             if (state->replace_backing_bs && state->new_backing_bs) {
3841                 bdrv_abort_perm_update(state->new_backing_bs);
3842             }
3843         }
3844     }
3845 
3846     if (ret == 0) {
3847         QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
3848             BlockDriverState *bs = bs_entry->state.bs;
3849 
3850             if (bs->drv->bdrv_reopen_commit_post)
3851                 bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
3852         }
3853     }
3854 cleanup:
3855     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
3856         if (ret) {
3857             if (bs_entry->prepared) {
3858                 bdrv_reopen_abort(&bs_entry->state);
3859             }
3860             qobject_unref(bs_entry->state.explicit_options);
3861             qobject_unref(bs_entry->state.options);
3862         }
3863         if (bs_entry->state.new_backing_bs) {
3864             bdrv_unref(bs_entry->state.new_backing_bs);
3865         }
3866         g_free(bs_entry);
3867     }
3868     g_free(bs_queue);
3869 
3870     return ret;
3871 }
3872 
3873 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
3874                               Error **errp)
3875 {
3876     int ret;
3877     BlockReopenQueue *queue;
3878     QDict *opts = qdict_new();
3879 
3880     qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
3881 
3882     bdrv_subtree_drained_begin(bs);
3883     queue = bdrv_reopen_queue(NULL, bs, opts, true);
3884     ret = bdrv_reopen_multiple(queue, errp);
3885     bdrv_subtree_drained_end(bs);
3886 
3887     return ret;
3888 }
3889 
3890 static BlockReopenQueueEntry *find_parent_in_reopen_queue(BlockReopenQueue *q,
3891                                                           BdrvChild *c)
3892 {
3893     BlockReopenQueueEntry *entry;
3894 
3895     QTAILQ_FOREACH(entry, q, entry) {
3896         BlockDriverState *bs = entry->state.bs;
3897         BdrvChild *child;
3898 
3899         QLIST_FOREACH(child, &bs->children, next) {
3900             if (child == c) {
3901                 return entry;
3902             }
3903         }
3904     }
3905 
3906     return NULL;
3907 }
3908 
3909 static void bdrv_reopen_perm(BlockReopenQueue *q, BlockDriverState *bs,
3910                              uint64_t *perm, uint64_t *shared)
3911 {
3912     BdrvChild *c;
3913     BlockReopenQueueEntry *parent;
3914     uint64_t cumulative_perms = 0;
3915     uint64_t cumulative_shared_perms = BLK_PERM_ALL;
3916 
3917     QLIST_FOREACH(c, &bs->parents, next_parent) {
3918         parent = find_parent_in_reopen_queue(q, c);
3919         if (!parent) {
3920             cumulative_perms |= c->perm;
3921             cumulative_shared_perms &= c->shared_perm;
3922         } else {
3923             uint64_t nperm, nshared;
3924 
3925             bdrv_child_perm(parent->state.bs, bs, c, c->role, q,
3926                             parent->state.perm, parent->state.shared_perm,
3927                             &nperm, &nshared);
3928 
3929             cumulative_perms |= nperm;
3930             cumulative_shared_perms &= nshared;
3931         }
3932     }
3933     *perm = cumulative_perms;
3934     *shared = cumulative_shared_perms;
3935 }
3936 
3937 static bool bdrv_reopen_can_attach(BlockDriverState *parent,
3938                                    BdrvChild *child,
3939                                    BlockDriverState *new_child,
3940                                    Error **errp)
3941 {
3942     AioContext *parent_ctx = bdrv_get_aio_context(parent);
3943     AioContext *child_ctx = bdrv_get_aio_context(new_child);
3944     GSList *ignore;
3945     bool ret;
3946 
3947     ignore = g_slist_prepend(NULL, child);
3948     ret = bdrv_can_set_aio_context(new_child, parent_ctx, &ignore, NULL);
3949     g_slist_free(ignore);
3950     if (ret) {
3951         return ret;
3952     }
3953 
3954     ignore = g_slist_prepend(NULL, child);
3955     ret = bdrv_can_set_aio_context(parent, child_ctx, &ignore, errp);
3956     g_slist_free(ignore);
3957     return ret;
3958 }
3959 
3960 /*
3961  * Take a BDRVReopenState and check if the value of 'backing' in the
3962  * reopen_state->options QDict is valid or not.
3963  *
3964  * If 'backing' is missing from the QDict then return 0.
3965  *
3966  * If 'backing' contains the node name of the backing file of
3967  * reopen_state->bs then return 0.
3968  *
3969  * If 'backing' contains a different node name (or is null) then check
3970  * whether the current backing file can be replaced with the new one.
3971  * If that's the case then reopen_state->replace_backing_bs is set to
3972  * true and reopen_state->new_backing_bs contains a pointer to the new
3973  * backing BlockDriverState (or NULL).
3974  *
3975  * Return 0 on success, otherwise return < 0 and set @errp.
3976  */
3977 static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
3978                                      Error **errp)
3979 {
3980     BlockDriverState *bs = reopen_state->bs;
3981     BlockDriverState *overlay_bs, *new_backing_bs;
3982     QObject *value;
3983     const char *str;
3984 
3985     value = qdict_get(reopen_state->options, "backing");
3986     if (value == NULL) {
3987         return 0;
3988     }
3989 
3990     switch (qobject_type(value)) {
3991     case QTYPE_QNULL:
3992         new_backing_bs = NULL;
3993         break;
3994     case QTYPE_QSTRING:
3995         str = qobject_get_try_str(value);
3996         new_backing_bs = bdrv_lookup_bs(NULL, str, errp);
3997         if (new_backing_bs == NULL) {
3998             return -EINVAL;
3999         } else if (bdrv_recurse_has_child(new_backing_bs, bs)) {
4000             error_setg(errp, "Making '%s' a backing file of '%s' "
4001                        "would create a cycle", str, bs->node_name);
4002             return -EINVAL;
4003         }
4004         break;
4005     default:
4006         /* 'backing' does not allow any other data type */
4007         g_assert_not_reached();
4008     }
4009 
4010     /*
4011      * Check AioContext compatibility so that the bdrv_set_backing_hd() call in
4012      * bdrv_reopen_commit() won't fail.
4013      */
4014     if (new_backing_bs) {
4015         if (!bdrv_reopen_can_attach(bs, bs->backing, new_backing_bs, errp)) {
4016             return -EINVAL;
4017         }
4018     }
4019 
4020     /*
4021      * Find the "actual" backing file by skipping all links that point
4022      * to an implicit node, if any (e.g. a commit filter node).
4023      */
4024     overlay_bs = bs;
4025     while (backing_bs(overlay_bs) && backing_bs(overlay_bs)->implicit) {
4026         overlay_bs = backing_bs(overlay_bs);
4027     }
4028 
4029     /* If we want to replace the backing file we need some extra checks */
4030     if (new_backing_bs != backing_bs(overlay_bs)) {
4031         /* Check for implicit nodes between bs and its backing file */
4032         if (bs != overlay_bs) {
4033             error_setg(errp, "Cannot change backing link if '%s' has "
4034                        "an implicit backing file", bs->node_name);
4035             return -EPERM;
4036         }
4037         /* Check if the backing link that we want to replace is frozen */
4038         if (bdrv_is_backing_chain_frozen(overlay_bs, backing_bs(overlay_bs),
4039                                          errp)) {
4040             return -EPERM;
4041         }
4042         reopen_state->replace_backing_bs = true;
4043         if (new_backing_bs) {
4044             bdrv_ref(new_backing_bs);
4045             reopen_state->new_backing_bs = new_backing_bs;
4046         }
4047     }
4048 
4049     return 0;
4050 }
4051 
4052 /*
4053  * Prepares a BlockDriverState for reopen. All changes are staged in the
4054  * 'opaque' field of the BDRVReopenState, which is used and allocated by
4055  * the block driver layer .bdrv_reopen_prepare()
4056  *
4057  * bs is the BlockDriverState to reopen
4058  * flags are the new open flags
4059  * queue is the reopen queue
4060  *
4061  * Returns 0 on success, non-zero on error.  On error errp will be set
4062  * as well.
4063  *
4064  * On failure, bdrv_reopen_abort() will be called to clean up any data.
4065  * It is the responsibility of the caller to then call the abort() or
4066  * commit() for any other BDS that have been left in a prepare() state
4067  *
4068  */
4069 int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
4070                         Error **errp)
4071 {
4072     int ret = -1;
4073     int old_flags;
4074     Error *local_err = NULL;
4075     BlockDriver *drv;
4076     QemuOpts *opts;
4077     QDict *orig_reopen_opts;
4078     char *discard = NULL;
4079     bool read_only;
4080     bool drv_prepared = false;
4081 
4082     assert(reopen_state != NULL);
4083     assert(reopen_state->bs->drv != NULL);
4084     drv = reopen_state->bs->drv;
4085 
4086     /* This function and each driver's bdrv_reopen_prepare() remove
4087      * entries from reopen_state->options as they are processed, so
4088      * we need to make a copy of the original QDict. */
4089     orig_reopen_opts = qdict_clone_shallow(reopen_state->options);
4090 
4091     /* Process generic block layer options */
4092     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
4093     if (!qemu_opts_absorb_qdict(opts, reopen_state->options, &local_err)) {
4094         error_propagate(errp, local_err);
4095         ret = -EINVAL;
4096         goto error;
4097     }
4098 
4099     /* This was already called in bdrv_reopen_queue_child() so the flags
4100      * are up-to-date. This time we simply want to remove the options from
4101      * QemuOpts in order to indicate that they have been processed. */
4102     old_flags = reopen_state->flags;
4103     update_flags_from_options(&reopen_state->flags, opts);
4104     assert(old_flags == reopen_state->flags);
4105 
4106     discard = qemu_opt_get_del(opts, BDRV_OPT_DISCARD);
4107     if (discard != NULL) {
4108         if (bdrv_parse_discard_flags(discard, &reopen_state->flags) != 0) {
4109             error_setg(errp, "Invalid discard option");
4110             ret = -EINVAL;
4111             goto error;
4112         }
4113     }
4114 
4115     reopen_state->detect_zeroes =
4116         bdrv_parse_detect_zeroes(opts, reopen_state->flags, &local_err);
4117     if (local_err) {
4118         error_propagate(errp, local_err);
4119         ret = -EINVAL;
4120         goto error;
4121     }
4122 
4123     /* All other options (including node-name and driver) must be unchanged.
4124      * Put them back into the QDict, so that they are checked at the end
4125      * of this function. */
4126     qemu_opts_to_qdict(opts, reopen_state->options);
4127 
4128     /* If we are to stay read-only, do not allow permission change
4129      * to r/w. Attempting to set to r/w may fail if either BDRV_O_ALLOW_RDWR is
4130      * not set, or if the BDS still has copy_on_read enabled */
4131     read_only = !(reopen_state->flags & BDRV_O_RDWR);
4132     ret = bdrv_can_set_read_only(reopen_state->bs, read_only, true, &local_err);
4133     if (local_err) {
4134         error_propagate(errp, local_err);
4135         goto error;
4136     }
4137 
4138     /* Calculate required permissions after reopening */
4139     bdrv_reopen_perm(queue, reopen_state->bs,
4140                      &reopen_state->perm, &reopen_state->shared_perm);
4141 
4142     ret = bdrv_flush(reopen_state->bs);
4143     if (ret) {
4144         error_setg_errno(errp, -ret, "Error flushing drive");
4145         goto error;
4146     }
4147 
4148     if (drv->bdrv_reopen_prepare) {
4149         /*
4150          * If a driver-specific option is missing, it means that we
4151          * should reset it to its default value.
4152          * But not all options allow that, so we need to check it first.
4153          */
4154         ret = bdrv_reset_options_allowed(reopen_state->bs,
4155                                          reopen_state->options, errp);
4156         if (ret) {
4157             goto error;
4158         }
4159 
4160         ret = drv->bdrv_reopen_prepare(reopen_state, queue, &local_err);
4161         if (ret) {
4162             if (local_err != NULL) {
4163                 error_propagate(errp, local_err);
4164             } else {
4165                 bdrv_refresh_filename(reopen_state->bs);
4166                 error_setg(errp, "failed while preparing to reopen image '%s'",
4167                            reopen_state->bs->filename);
4168             }
4169             goto error;
4170         }
4171     } else {
4172         /* It is currently mandatory to have a bdrv_reopen_prepare()
4173          * handler for each supported drv. */
4174         error_setg(errp, "Block format '%s' used by node '%s' "
4175                    "does not support reopening files", drv->format_name,
4176                    bdrv_get_device_or_node_name(reopen_state->bs));
4177         ret = -1;
4178         goto error;
4179     }
4180 
4181     drv_prepared = true;
4182 
4183     /*
4184      * We must provide the 'backing' option if the BDS has a backing
4185      * file or if the image file has a backing file name as part of
4186      * its metadata. Otherwise the 'backing' option can be omitted.
4187      */
4188     if (drv->supports_backing && reopen_state->backing_missing &&
4189         (backing_bs(reopen_state->bs) || reopen_state->bs->backing_file[0])) {
4190         error_setg(errp, "backing is missing for '%s'",
4191                    reopen_state->bs->node_name);
4192         ret = -EINVAL;
4193         goto error;
4194     }
4195 
4196     /*
4197      * Allow changing the 'backing' option. The new value can be
4198      * either a reference to an existing node (using its node name)
4199      * or NULL to simply detach the current backing file.
4200      */
4201     ret = bdrv_reopen_parse_backing(reopen_state, errp);
4202     if (ret < 0) {
4203         goto error;
4204     }
4205     qdict_del(reopen_state->options, "backing");
4206 
4207     /* Options that are not handled are only okay if they are unchanged
4208      * compared to the old state. It is expected that some options are only
4209      * used for the initial open, but not reopen (e.g. filename) */
4210     if (qdict_size(reopen_state->options)) {
4211         const QDictEntry *entry = qdict_first(reopen_state->options);
4212 
4213         do {
4214             QObject *new = entry->value;
4215             QObject *old = qdict_get(reopen_state->bs->options, entry->key);
4216 
4217             /* Allow child references (child_name=node_name) as long as they
4218              * point to the current child (i.e. everything stays the same). */
4219             if (qobject_type(new) == QTYPE_QSTRING) {
4220                 BdrvChild *child;
4221                 QLIST_FOREACH(child, &reopen_state->bs->children, next) {
4222                     if (!strcmp(child->name, entry->key)) {
4223                         break;
4224                     }
4225                 }
4226 
4227                 if (child) {
4228                     const char *str = qobject_get_try_str(new);
4229                     if (!strcmp(child->bs->node_name, str)) {
4230                         continue; /* Found child with this name, skip option */
4231                     }
4232                 }
4233             }
4234 
4235             /*
4236              * TODO: When using -drive to specify blockdev options, all values
4237              * will be strings; however, when using -blockdev, blockdev-add or
4238              * filenames using the json:{} pseudo-protocol, they will be
4239              * correctly typed.
4240              * In contrast, reopening options are (currently) always strings
4241              * (because you can only specify them through qemu-io; all other
4242              * callers do not specify any options).
4243              * Therefore, when using anything other than -drive to create a BDS,
4244              * this cannot detect non-string options as unchanged, because
4245              * qobject_is_equal() always returns false for objects of different
4246              * type.  In the future, this should be remedied by correctly typing
4247              * all options.  For now, this is not too big of an issue because
4248              * the user can simply omit options which cannot be changed anyway,
4249              * so they will stay unchanged.
4250              */
4251             if (!qobject_is_equal(new, old)) {
4252                 error_setg(errp, "Cannot change the option '%s'", entry->key);
4253                 ret = -EINVAL;
4254                 goto error;
4255             }
4256         } while ((entry = qdict_next(reopen_state->options, entry)));
4257     }
4258 
4259     ret = 0;
4260 
4261     /* Restore the original reopen_state->options QDict */
4262     qobject_unref(reopen_state->options);
4263     reopen_state->options = qobject_ref(orig_reopen_opts);
4264 
4265 error:
4266     if (ret < 0 && drv_prepared) {
4267         /* drv->bdrv_reopen_prepare() has succeeded, so we need to
4268          * call drv->bdrv_reopen_abort() before signaling an error
4269          * (bdrv_reopen_multiple() will not call bdrv_reopen_abort()
4270          * when the respective bdrv_reopen_prepare() has failed) */
4271         if (drv->bdrv_reopen_abort) {
4272             drv->bdrv_reopen_abort(reopen_state);
4273         }
4274     }
4275     qemu_opts_del(opts);
4276     qobject_unref(orig_reopen_opts);
4277     g_free(discard);
4278     return ret;
4279 }
4280 
4281 /*
4282  * Takes the staged changes for the reopen from bdrv_reopen_prepare(), and
4283  * makes them final by swapping the staging BlockDriverState contents into
4284  * the active BlockDriverState contents.
4285  */
4286 void bdrv_reopen_commit(BDRVReopenState *reopen_state)
4287 {
4288     BlockDriver *drv;
4289     BlockDriverState *bs;
4290     BdrvChild *child;
4291 
4292     assert(reopen_state != NULL);
4293     bs = reopen_state->bs;
4294     drv = bs->drv;
4295     assert(drv != NULL);
4296 
4297     /* If there are any driver level actions to take */
4298     if (drv->bdrv_reopen_commit) {
4299         drv->bdrv_reopen_commit(reopen_state);
4300     }
4301 
4302     /* set BDS specific flags now */
4303     qobject_unref(bs->explicit_options);
4304     qobject_unref(bs->options);
4305 
4306     bs->explicit_options   = reopen_state->explicit_options;
4307     bs->options            = reopen_state->options;
4308     bs->open_flags         = reopen_state->flags;
4309     bs->read_only = !(reopen_state->flags & BDRV_O_RDWR);
4310     bs->detect_zeroes      = reopen_state->detect_zeroes;
4311 
4312     if (reopen_state->replace_backing_bs) {
4313         qdict_del(bs->explicit_options, "backing");
4314         qdict_del(bs->options, "backing");
4315     }
4316 
4317     /* Remove child references from bs->options and bs->explicit_options.
4318      * Child options were already removed in bdrv_reopen_queue_child() */
4319     QLIST_FOREACH(child, &bs->children, next) {
4320         qdict_del(bs->explicit_options, child->name);
4321         qdict_del(bs->options, child->name);
4322     }
4323 
4324     /*
4325      * Change the backing file if a new one was specified. We do this
4326      * after updating bs->options, so bdrv_refresh_filename() (called
4327      * from bdrv_set_backing_hd()) has the new values.
4328      */
4329     if (reopen_state->replace_backing_bs) {
4330         BlockDriverState *old_backing_bs = backing_bs(bs);
4331         assert(!old_backing_bs || !old_backing_bs->implicit);
4332         /* Abort the permission update on the backing bs we're detaching */
4333         if (old_backing_bs) {
4334             bdrv_abort_perm_update(old_backing_bs);
4335         }
4336         bdrv_set_backing_hd(bs, reopen_state->new_backing_bs, &error_abort);
4337     }
4338 
4339     bdrv_refresh_limits(bs, NULL);
4340 }
4341 
4342 /*
4343  * Abort the reopen, and delete and free the staged changes in
4344  * reopen_state
4345  */
4346 void bdrv_reopen_abort(BDRVReopenState *reopen_state)
4347 {
4348     BlockDriver *drv;
4349 
4350     assert(reopen_state != NULL);
4351     drv = reopen_state->bs->drv;
4352     assert(drv != NULL);
4353 
4354     if (drv->bdrv_reopen_abort) {
4355         drv->bdrv_reopen_abort(reopen_state);
4356     }
4357 }
4358 
4359 
4360 static void bdrv_close(BlockDriverState *bs)
4361 {
4362     BdrvAioNotifier *ban, *ban_next;
4363     BdrvChild *child, *next;
4364 
4365     assert(!bs->refcnt);
4366 
4367     bdrv_drained_begin(bs); /* complete I/O */
4368     bdrv_flush(bs);
4369     bdrv_drain(bs); /* in case flush left pending I/O */
4370 
4371     if (bs->drv) {
4372         if (bs->drv->bdrv_close) {
4373             bs->drv->bdrv_close(bs);
4374         }
4375         bs->drv = NULL;
4376     }
4377 
4378     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
4379         bdrv_unref_child(bs, child);
4380     }
4381 
4382     bs->backing = NULL;
4383     bs->file = NULL;
4384     g_free(bs->opaque);
4385     bs->opaque = NULL;
4386     atomic_set(&bs->copy_on_read, 0);
4387     bs->backing_file[0] = '\0';
4388     bs->backing_format[0] = '\0';
4389     bs->total_sectors = 0;
4390     bs->encrypted = false;
4391     bs->sg = false;
4392     qobject_unref(bs->options);
4393     qobject_unref(bs->explicit_options);
4394     bs->options = NULL;
4395     bs->explicit_options = NULL;
4396     qobject_unref(bs->full_open_options);
4397     bs->full_open_options = NULL;
4398 
4399     bdrv_release_named_dirty_bitmaps(bs);
4400     assert(QLIST_EMPTY(&bs->dirty_bitmaps));
4401 
4402     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
4403         g_free(ban);
4404     }
4405     QLIST_INIT(&bs->aio_notifiers);
4406     bdrv_drained_end(bs);
4407 }
4408 
4409 void bdrv_close_all(void)
4410 {
4411     assert(job_next(NULL) == NULL);
4412     nbd_export_close_all();
4413 
4414     /* Drop references from requests still in flight, such as canceled block
4415      * jobs whose AIO context has not been polled yet */
4416     bdrv_drain_all();
4417 
4418     blk_remove_all_bs();
4419     blockdev_close_all_bdrv_states();
4420 
4421     assert(QTAILQ_EMPTY(&all_bdrv_states));
4422 }
4423 
4424 static bool should_update_child(BdrvChild *c, BlockDriverState *to)
4425 {
4426     GQueue *queue;
4427     GHashTable *found;
4428     bool ret;
4429 
4430     if (c->klass->stay_at_node) {
4431         return false;
4432     }
4433 
4434     /* If the child @c belongs to the BDS @to, replacing the current
4435      * c->bs by @to would mean to create a loop.
4436      *
4437      * Such a case occurs when appending a BDS to a backing chain.
4438      * For instance, imagine the following chain:
4439      *
4440      *   guest device -> node A -> further backing chain...
4441      *
4442      * Now we create a new BDS B which we want to put on top of this
4443      * chain, so we first attach A as its backing node:
4444      *
4445      *                   node B
4446      *                     |
4447      *                     v
4448      *   guest device -> node A -> further backing chain...
4449      *
4450      * Finally we want to replace A by B.  When doing that, we want to
4451      * replace all pointers to A by pointers to B -- except for the
4452      * pointer from B because (1) that would create a loop, and (2)
4453      * that pointer should simply stay intact:
4454      *
4455      *   guest device -> node B
4456      *                     |
4457      *                     v
4458      *                   node A -> further backing chain...
4459      *
4460      * In general, when replacing a node A (c->bs) by a node B (@to),
4461      * if A is a child of B, that means we cannot replace A by B there
4462      * because that would create a loop.  Silently detaching A from B
4463      * is also not really an option.  So overall just leaving A in
4464      * place there is the most sensible choice.
4465      *
4466      * We would also create a loop in any cases where @c is only
4467      * indirectly referenced by @to. Prevent this by returning false
4468      * if @c is found (by breadth-first search) anywhere in the whole
4469      * subtree of @to.
4470      */
4471 
4472     ret = true;
4473     found = g_hash_table_new(NULL, NULL);
4474     g_hash_table_add(found, to);
4475     queue = g_queue_new();
4476     g_queue_push_tail(queue, to);
4477 
4478     while (!g_queue_is_empty(queue)) {
4479         BlockDriverState *v = g_queue_pop_head(queue);
4480         BdrvChild *c2;
4481 
4482         QLIST_FOREACH(c2, &v->children, next) {
4483             if (c2 == c) {
4484                 ret = false;
4485                 break;
4486             }
4487 
4488             if (g_hash_table_contains(found, c2->bs)) {
4489                 continue;
4490             }
4491 
4492             g_queue_push_tail(queue, c2->bs);
4493             g_hash_table_add(found, c2->bs);
4494         }
4495     }
4496 
4497     g_queue_free(queue);
4498     g_hash_table_destroy(found);
4499 
4500     return ret;
4501 }
4502 
4503 void bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
4504                        Error **errp)
4505 {
4506     BdrvChild *c, *next;
4507     GSList *list = NULL, *p;
4508     uint64_t perm = 0, shared = BLK_PERM_ALL;
4509     int ret;
4510 
4511     /* Make sure that @from doesn't go away until we have successfully attached
4512      * all of its parents to @to. */
4513     bdrv_ref(from);
4514 
4515     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
4516     assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
4517     bdrv_drained_begin(from);
4518 
4519     /* Put all parents into @list and calculate their cumulative permissions */
4520     QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
4521         assert(c->bs == from);
4522         if (!should_update_child(c, to)) {
4523             continue;
4524         }
4525         if (c->frozen) {
4526             error_setg(errp, "Cannot change '%s' link to '%s'",
4527                        c->name, from->node_name);
4528             goto out;
4529         }
4530         list = g_slist_prepend(list, c);
4531         perm |= c->perm;
4532         shared &= c->shared_perm;
4533     }
4534 
4535     /* Check whether the required permissions can be granted on @to, ignoring
4536      * all BdrvChild in @list so that they can't block themselves. */
4537     ret = bdrv_check_update_perm(to, NULL, perm, shared, list, NULL, errp);
4538     if (ret < 0) {
4539         bdrv_abort_perm_update(to);
4540         goto out;
4541     }
4542 
4543     /* Now actually perform the change. We performed the permission check for
4544      * all elements of @list at once, so set the permissions all at once at the
4545      * very end. */
4546     for (p = list; p != NULL; p = p->next) {
4547         c = p->data;
4548 
4549         bdrv_ref(to);
4550         bdrv_replace_child_noperm(c, to);
4551         bdrv_unref(from);
4552     }
4553 
4554     bdrv_get_cumulative_perm(to, &perm, &shared);
4555     bdrv_set_perm(to, perm, shared);
4556 
4557 out:
4558     g_slist_free(list);
4559     bdrv_drained_end(from);
4560     bdrv_unref(from);
4561 }
4562 
4563 /*
4564  * Add new bs contents at the top of an image chain while the chain is
4565  * live, while keeping required fields on the top layer.
4566  *
4567  * This will modify the BlockDriverState fields, and swap contents
4568  * between bs_new and bs_top. Both bs_new and bs_top are modified.
4569  *
4570  * bs_new must not be attached to a BlockBackend.
4571  *
4572  * This function does not create any image files.
4573  *
4574  * bdrv_append() takes ownership of a bs_new reference and unrefs it because
4575  * that's what the callers commonly need. bs_new will be referenced by the old
4576  * parents of bs_top after bdrv_append() returns. If the caller needs to keep a
4577  * reference of its own, it must call bdrv_ref().
4578  */
4579 void bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
4580                  Error **errp)
4581 {
4582     Error *local_err = NULL;
4583 
4584     bdrv_set_backing_hd(bs_new, bs_top, &local_err);
4585     if (local_err) {
4586         error_propagate(errp, local_err);
4587         goto out;
4588     }
4589 
4590     bdrv_replace_node(bs_top, bs_new, &local_err);
4591     if (local_err) {
4592         error_propagate(errp, local_err);
4593         bdrv_set_backing_hd(bs_new, NULL, &error_abort);
4594         goto out;
4595     }
4596 
4597     /* bs_new is now referenced by its new parents, we don't need the
4598      * additional reference any more. */
4599 out:
4600     bdrv_unref(bs_new);
4601 }
4602 
4603 static void bdrv_delete(BlockDriverState *bs)
4604 {
4605     assert(bdrv_op_blocker_is_empty(bs));
4606     assert(!bs->refcnt);
4607 
4608     /* remove from list, if necessary */
4609     if (bs->node_name[0] != '\0') {
4610         QTAILQ_REMOVE(&graph_bdrv_states, bs, node_list);
4611     }
4612     QTAILQ_REMOVE(&all_bdrv_states, bs, bs_list);
4613 
4614     bdrv_close(bs);
4615 
4616     g_free(bs);
4617 }
4618 
4619 /*
4620  * Run consistency checks on an image
4621  *
4622  * Returns 0 if the check could be completed (it doesn't mean that the image is
4623  * free of errors) or -errno when an internal error occurred. The results of the
4624  * check are stored in res.
4625  */
4626 static int coroutine_fn bdrv_co_check(BlockDriverState *bs,
4627                                       BdrvCheckResult *res, BdrvCheckMode fix)
4628 {
4629     if (bs->drv == NULL) {
4630         return -ENOMEDIUM;
4631     }
4632     if (bs->drv->bdrv_co_check == NULL) {
4633         return -ENOTSUP;
4634     }
4635 
4636     memset(res, 0, sizeof(*res));
4637     return bs->drv->bdrv_co_check(bs, res, fix);
4638 }
4639 
4640 typedef struct CheckCo {
4641     BlockDriverState *bs;
4642     BdrvCheckResult *res;
4643     BdrvCheckMode fix;
4644     int ret;
4645 } CheckCo;
4646 
4647 static void coroutine_fn bdrv_check_co_entry(void *opaque)
4648 {
4649     CheckCo *cco = opaque;
4650     cco->ret = bdrv_co_check(cco->bs, cco->res, cco->fix);
4651     aio_wait_kick();
4652 }
4653 
4654 int bdrv_check(BlockDriverState *bs,
4655                BdrvCheckResult *res, BdrvCheckMode fix)
4656 {
4657     Coroutine *co;
4658     CheckCo cco = {
4659         .bs = bs,
4660         .res = res,
4661         .ret = -EINPROGRESS,
4662         .fix = fix,
4663     };
4664 
4665     if (qemu_in_coroutine()) {
4666         /* Fast-path if already in coroutine context */
4667         bdrv_check_co_entry(&cco);
4668     } else {
4669         co = qemu_coroutine_create(bdrv_check_co_entry, &cco);
4670         bdrv_coroutine_enter(bs, co);
4671         BDRV_POLL_WHILE(bs, cco.ret == -EINPROGRESS);
4672     }
4673 
4674     return cco.ret;
4675 }
4676 
4677 /*
4678  * Return values:
4679  * 0        - success
4680  * -EINVAL  - backing format specified, but no file
4681  * -ENOSPC  - can't update the backing file because no space is left in the
4682  *            image file header
4683  * -ENOTSUP - format driver doesn't support changing the backing file
4684  */
4685 int bdrv_change_backing_file(BlockDriverState *bs,
4686     const char *backing_file, const char *backing_fmt)
4687 {
4688     BlockDriver *drv = bs->drv;
4689     int ret;
4690 
4691     if (!drv) {
4692         return -ENOMEDIUM;
4693     }
4694 
4695     /* Backing file format doesn't make sense without a backing file */
4696     if (backing_fmt && !backing_file) {
4697         return -EINVAL;
4698     }
4699 
4700     if (drv->bdrv_change_backing_file != NULL) {
4701         ret = drv->bdrv_change_backing_file(bs, backing_file, backing_fmt);
4702     } else {
4703         ret = -ENOTSUP;
4704     }
4705 
4706     if (ret == 0) {
4707         pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
4708         pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
4709         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
4710                 backing_file ?: "");
4711     }
4712     return ret;
4713 }
4714 
4715 /*
4716  * Finds the image layer in the chain that has 'bs' as its backing file.
4717  *
4718  * active is the current topmost image.
4719  *
4720  * Returns NULL if bs is not found in active's image chain,
4721  * or if active == bs.
4722  *
4723  * Returns the bottommost base image if bs == NULL.
4724  */
4725 BlockDriverState *bdrv_find_overlay(BlockDriverState *active,
4726                                     BlockDriverState *bs)
4727 {
4728     while (active && bs != backing_bs(active)) {
4729         active = backing_bs(active);
4730     }
4731 
4732     return active;
4733 }
4734 
4735 /* Given a BDS, searches for the base layer. */
4736 BlockDriverState *bdrv_find_base(BlockDriverState *bs)
4737 {
4738     return bdrv_find_overlay(bs, NULL);
4739 }
4740 
4741 /*
4742  * Return true if at least one of the backing links between @bs and
4743  * @base is frozen. @errp is set if that's the case.
4744  * @base must be reachable from @bs, or NULL.
4745  */
4746 bool bdrv_is_backing_chain_frozen(BlockDriverState *bs, BlockDriverState *base,
4747                                   Error **errp)
4748 {
4749     BlockDriverState *i;
4750 
4751     for (i = bs; i != base; i = backing_bs(i)) {
4752         if (i->backing && i->backing->frozen) {
4753             error_setg(errp, "Cannot change '%s' link from '%s' to '%s'",
4754                        i->backing->name, i->node_name,
4755                        backing_bs(i)->node_name);
4756             return true;
4757         }
4758     }
4759 
4760     return false;
4761 }
4762 
4763 /*
4764  * Freeze all backing links between @bs and @base.
4765  * If any of the links is already frozen the operation is aborted and
4766  * none of the links are modified.
4767  * @base must be reachable from @bs, or NULL.
4768  * Returns 0 on success. On failure returns < 0 and sets @errp.
4769  */
4770 int bdrv_freeze_backing_chain(BlockDriverState *bs, BlockDriverState *base,
4771                               Error **errp)
4772 {
4773     BlockDriverState *i;
4774 
4775     if (bdrv_is_backing_chain_frozen(bs, base, errp)) {
4776         return -EPERM;
4777     }
4778 
4779     for (i = bs; i != base; i = backing_bs(i)) {
4780         if (i->backing && backing_bs(i)->never_freeze) {
4781             error_setg(errp, "Cannot freeze '%s' link to '%s'",
4782                        i->backing->name, backing_bs(i)->node_name);
4783             return -EPERM;
4784         }
4785     }
4786 
4787     for (i = bs; i != base; i = backing_bs(i)) {
4788         if (i->backing) {
4789             i->backing->frozen = true;
4790         }
4791     }
4792 
4793     return 0;
4794 }
4795 
4796 /*
4797  * Unfreeze all backing links between @bs and @base. The caller must
4798  * ensure that all links are frozen before using this function.
4799  * @base must be reachable from @bs, or NULL.
4800  */
4801 void bdrv_unfreeze_backing_chain(BlockDriverState *bs, BlockDriverState *base)
4802 {
4803     BlockDriverState *i;
4804 
4805     for (i = bs; i != base; i = backing_bs(i)) {
4806         if (i->backing) {
4807             assert(i->backing->frozen);
4808             i->backing->frozen = false;
4809         }
4810     }
4811 }
4812 
4813 /*
4814  * Drops images above 'base' up to and including 'top', and sets the image
4815  * above 'top' to have base as its backing file.
4816  *
4817  * Requires that the overlay to 'top' is opened r/w, so that the backing file
4818  * information in 'bs' can be properly updated.
4819  *
4820  * E.g., this will convert the following chain:
4821  * bottom <- base <- intermediate <- top <- active
4822  *
4823  * to
4824  *
4825  * bottom <- base <- active
4826  *
4827  * It is allowed for bottom==base, in which case it converts:
4828  *
4829  * base <- intermediate <- top <- active
4830  *
4831  * to
4832  *
4833  * base <- active
4834  *
4835  * If backing_file_str is non-NULL, it will be used when modifying top's
4836  * overlay image metadata.
4837  *
4838  * Error conditions:
4839  *  if active == top, that is considered an error
4840  *
4841  */
4842 int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
4843                            const char *backing_file_str)
4844 {
4845     BlockDriverState *explicit_top = top;
4846     bool update_inherits_from;
4847     BdrvChild *c, *next;
4848     Error *local_err = NULL;
4849     int ret = -EIO;
4850 
4851     bdrv_ref(top);
4852     bdrv_subtree_drained_begin(top);
4853 
4854     if (!top->drv || !base->drv) {
4855         goto exit;
4856     }
4857 
4858     /* Make sure that base is in the backing chain of top */
4859     if (!bdrv_chain_contains(top, base)) {
4860         goto exit;
4861     }
4862 
4863     /* This function changes all links that point to top and makes
4864      * them point to base. Check that none of them is frozen. */
4865     QLIST_FOREACH(c, &top->parents, next_parent) {
4866         if (c->frozen) {
4867             goto exit;
4868         }
4869     }
4870 
4871     /* If 'base' recursively inherits from 'top' then we should set
4872      * base->inherits_from to top->inherits_from after 'top' and all
4873      * other intermediate nodes have been dropped.
4874      * If 'top' is an implicit node (e.g. "commit_top") we should skip
4875      * it because no one inherits from it. We use explicit_top for that. */
4876     while (explicit_top && explicit_top->implicit) {
4877         explicit_top = backing_bs(explicit_top);
4878     }
4879     update_inherits_from = bdrv_inherits_from_recursive(base, explicit_top);
4880 
4881     /* success - we can delete the intermediate states, and link top->base */
4882     /* TODO Check graph modification op blockers (BLK_PERM_GRAPH_MOD) once
4883      * we've figured out how they should work. */
4884     if (!backing_file_str) {
4885         bdrv_refresh_filename(base);
4886         backing_file_str = base->filename;
4887     }
4888 
4889     QLIST_FOREACH_SAFE(c, &top->parents, next_parent, next) {
4890         /* Check whether we are allowed to switch c from top to base */
4891         GSList *ignore_children = g_slist_prepend(NULL, c);
4892         ret = bdrv_check_update_perm(base, NULL, c->perm, c->shared_perm,
4893                                      ignore_children, NULL, &local_err);
4894         g_slist_free(ignore_children);
4895         if (ret < 0) {
4896             error_report_err(local_err);
4897             goto exit;
4898         }
4899 
4900         /* If so, update the backing file path in the image file */
4901         if (c->klass->update_filename) {
4902             ret = c->klass->update_filename(c, base, backing_file_str,
4903                                             &local_err);
4904             if (ret < 0) {
4905                 bdrv_abort_perm_update(base);
4906                 error_report_err(local_err);
4907                 goto exit;
4908             }
4909         }
4910 
4911         /* Do the actual switch in the in-memory graph.
4912          * Completes bdrv_check_update_perm() transaction internally. */
4913         bdrv_ref(base);
4914         bdrv_replace_child(c, base);
4915         bdrv_unref(top);
4916     }
4917 
4918     if (update_inherits_from) {
4919         base->inherits_from = explicit_top->inherits_from;
4920     }
4921 
4922     ret = 0;
4923 exit:
4924     bdrv_subtree_drained_end(top);
4925     bdrv_unref(top);
4926     return ret;
4927 }
4928 
4929 /**
4930  * Length of a allocated file in bytes. Sparse files are counted by actual
4931  * allocated space. Return < 0 if error or unknown.
4932  */
4933 int64_t bdrv_get_allocated_file_size(BlockDriverState *bs)
4934 {
4935     BlockDriver *drv = bs->drv;
4936     if (!drv) {
4937         return -ENOMEDIUM;
4938     }
4939     if (drv->bdrv_get_allocated_file_size) {
4940         return drv->bdrv_get_allocated_file_size(bs);
4941     }
4942     if (bs->file) {
4943         return bdrv_get_allocated_file_size(bs->file->bs);
4944     }
4945     return -ENOTSUP;
4946 }
4947 
4948 /*
4949  * bdrv_measure:
4950  * @drv: Format driver
4951  * @opts: Creation options for new image
4952  * @in_bs: Existing image containing data for new image (may be NULL)
4953  * @errp: Error object
4954  * Returns: A #BlockMeasureInfo (free using qapi_free_BlockMeasureInfo())
4955  *          or NULL on error
4956  *
4957  * Calculate file size required to create a new image.
4958  *
4959  * If @in_bs is given then space for allocated clusters and zero clusters
4960  * from that image are included in the calculation.  If @opts contains a
4961  * backing file that is shared by @in_bs then backing clusters may be omitted
4962  * from the calculation.
4963  *
4964  * If @in_bs is NULL then the calculation includes no allocated clusters
4965  * unless a preallocation option is given in @opts.
4966  *
4967  * Note that @in_bs may use a different BlockDriver from @drv.
4968  *
4969  * If an error occurs the @errp pointer is set.
4970  */
4971 BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
4972                                BlockDriverState *in_bs, Error **errp)
4973 {
4974     if (!drv->bdrv_measure) {
4975         error_setg(errp, "Block driver '%s' does not support size measurement",
4976                    drv->format_name);
4977         return NULL;
4978     }
4979 
4980     return drv->bdrv_measure(opts, in_bs, errp);
4981 }
4982 
4983 /**
4984  * Return number of sectors on success, -errno on error.
4985  */
4986 int64_t bdrv_nb_sectors(BlockDriverState *bs)
4987 {
4988     BlockDriver *drv = bs->drv;
4989 
4990     if (!drv)
4991         return -ENOMEDIUM;
4992 
4993     if (drv->has_variable_length) {
4994         int ret = refresh_total_sectors(bs, bs->total_sectors);
4995         if (ret < 0) {
4996             return ret;
4997         }
4998     }
4999     return bs->total_sectors;
5000 }
5001 
5002 /**
5003  * Return length in bytes on success, -errno on error.
5004  * The length is always a multiple of BDRV_SECTOR_SIZE.
5005  */
5006 int64_t bdrv_getlength(BlockDriverState *bs)
5007 {
5008     int64_t ret = bdrv_nb_sectors(bs);
5009 
5010     ret = ret > INT64_MAX / BDRV_SECTOR_SIZE ? -EFBIG : ret;
5011     return ret < 0 ? ret : ret * BDRV_SECTOR_SIZE;
5012 }
5013 
5014 /* return 0 as number of sectors if no device present or error */
5015 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr)
5016 {
5017     int64_t nb_sectors = bdrv_nb_sectors(bs);
5018 
5019     *nb_sectors_ptr = nb_sectors < 0 ? 0 : nb_sectors;
5020 }
5021 
5022 bool bdrv_is_sg(BlockDriverState *bs)
5023 {
5024     return bs->sg;
5025 }
5026 
5027 bool bdrv_is_encrypted(BlockDriverState *bs)
5028 {
5029     if (bs->backing && bs->backing->bs->encrypted) {
5030         return true;
5031     }
5032     return bs->encrypted;
5033 }
5034 
5035 const char *bdrv_get_format_name(BlockDriverState *bs)
5036 {
5037     return bs->drv ? bs->drv->format_name : NULL;
5038 }
5039 
5040 static int qsort_strcmp(const void *a, const void *b)
5041 {
5042     return strcmp(*(char *const *)a, *(char *const *)b);
5043 }
5044 
5045 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
5046                          void *opaque, bool read_only)
5047 {
5048     BlockDriver *drv;
5049     int count = 0;
5050     int i;
5051     const char **formats = NULL;
5052 
5053     QLIST_FOREACH(drv, &bdrv_drivers, list) {
5054         if (drv->format_name) {
5055             bool found = false;
5056             int i = count;
5057 
5058             if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, read_only)) {
5059                 continue;
5060             }
5061 
5062             while (formats && i && !found) {
5063                 found = !strcmp(formats[--i], drv->format_name);
5064             }
5065 
5066             if (!found) {
5067                 formats = g_renew(const char *, formats, count + 1);
5068                 formats[count++] = drv->format_name;
5069             }
5070         }
5071     }
5072 
5073     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); i++) {
5074         const char *format_name = block_driver_modules[i].format_name;
5075 
5076         if (format_name) {
5077             bool found = false;
5078             int j = count;
5079 
5080             if (use_bdrv_whitelist &&
5081                 !bdrv_format_is_whitelisted(format_name, read_only)) {
5082                 continue;
5083             }
5084 
5085             while (formats && j && !found) {
5086                 found = !strcmp(formats[--j], format_name);
5087             }
5088 
5089             if (!found) {
5090                 formats = g_renew(const char *, formats, count + 1);
5091                 formats[count++] = format_name;
5092             }
5093         }
5094     }
5095 
5096     qsort(formats, count, sizeof(formats[0]), qsort_strcmp);
5097 
5098     for (i = 0; i < count; i++) {
5099         it(opaque, formats[i]);
5100     }
5101 
5102     g_free(formats);
5103 }
5104 
5105 /* This function is to find a node in the bs graph */
5106 BlockDriverState *bdrv_find_node(const char *node_name)
5107 {
5108     BlockDriverState *bs;
5109 
5110     assert(node_name);
5111 
5112     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
5113         if (!strcmp(node_name, bs->node_name)) {
5114             return bs;
5115         }
5116     }
5117     return NULL;
5118 }
5119 
5120 /* Put this QMP function here so it can access the static graph_bdrv_states. */
5121 BlockDeviceInfoList *bdrv_named_nodes_list(bool flat,
5122                                            Error **errp)
5123 {
5124     BlockDeviceInfoList *list, *entry;
5125     BlockDriverState *bs;
5126 
5127     list = NULL;
5128     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
5129         BlockDeviceInfo *info = bdrv_block_device_info(NULL, bs, flat, errp);
5130         if (!info) {
5131             qapi_free_BlockDeviceInfoList(list);
5132             return NULL;
5133         }
5134         entry = g_malloc0(sizeof(*entry));
5135         entry->value = info;
5136         entry->next = list;
5137         list = entry;
5138     }
5139 
5140     return list;
5141 }
5142 
5143 #define QAPI_LIST_ADD(list, element) do { \
5144     typeof(list) _tmp = g_new(typeof(*(list)), 1); \
5145     _tmp->value = (element); \
5146     _tmp->next = (list); \
5147     (list) = _tmp; \
5148 } while (0)
5149 
5150 typedef struct XDbgBlockGraphConstructor {
5151     XDbgBlockGraph *graph;
5152     GHashTable *graph_nodes;
5153 } XDbgBlockGraphConstructor;
5154 
5155 static XDbgBlockGraphConstructor *xdbg_graph_new(void)
5156 {
5157     XDbgBlockGraphConstructor *gr = g_new(XDbgBlockGraphConstructor, 1);
5158 
5159     gr->graph = g_new0(XDbgBlockGraph, 1);
5160     gr->graph_nodes = g_hash_table_new(NULL, NULL);
5161 
5162     return gr;
5163 }
5164 
5165 static XDbgBlockGraph *xdbg_graph_finalize(XDbgBlockGraphConstructor *gr)
5166 {
5167     XDbgBlockGraph *graph = gr->graph;
5168 
5169     g_hash_table_destroy(gr->graph_nodes);
5170     g_free(gr);
5171 
5172     return graph;
5173 }
5174 
5175 static uintptr_t xdbg_graph_node_num(XDbgBlockGraphConstructor *gr, void *node)
5176 {
5177     uintptr_t ret = (uintptr_t)g_hash_table_lookup(gr->graph_nodes, node);
5178 
5179     if (ret != 0) {
5180         return ret;
5181     }
5182 
5183     /*
5184      * Start counting from 1, not 0, because 0 interferes with not-found (NULL)
5185      * answer of g_hash_table_lookup.
5186      */
5187     ret = g_hash_table_size(gr->graph_nodes) + 1;
5188     g_hash_table_insert(gr->graph_nodes, node, (void *)ret);
5189 
5190     return ret;
5191 }
5192 
5193 static void xdbg_graph_add_node(XDbgBlockGraphConstructor *gr, void *node,
5194                                 XDbgBlockGraphNodeType type, const char *name)
5195 {
5196     XDbgBlockGraphNode *n;
5197 
5198     n = g_new0(XDbgBlockGraphNode, 1);
5199 
5200     n->id = xdbg_graph_node_num(gr, node);
5201     n->type = type;
5202     n->name = g_strdup(name);
5203 
5204     QAPI_LIST_ADD(gr->graph->nodes, n);
5205 }
5206 
5207 static void xdbg_graph_add_edge(XDbgBlockGraphConstructor *gr, void *parent,
5208                                 const BdrvChild *child)
5209 {
5210     BlockPermission qapi_perm;
5211     XDbgBlockGraphEdge *edge;
5212 
5213     edge = g_new0(XDbgBlockGraphEdge, 1);
5214 
5215     edge->parent = xdbg_graph_node_num(gr, parent);
5216     edge->child = xdbg_graph_node_num(gr, child->bs);
5217     edge->name = g_strdup(child->name);
5218 
5219     for (qapi_perm = 0; qapi_perm < BLOCK_PERMISSION__MAX; qapi_perm++) {
5220         uint64_t flag = bdrv_qapi_perm_to_blk_perm(qapi_perm);
5221 
5222         if (flag & child->perm) {
5223             QAPI_LIST_ADD(edge->perm, qapi_perm);
5224         }
5225         if (flag & child->shared_perm) {
5226             QAPI_LIST_ADD(edge->shared_perm, qapi_perm);
5227         }
5228     }
5229 
5230     QAPI_LIST_ADD(gr->graph->edges, edge);
5231 }
5232 
5233 
5234 XDbgBlockGraph *bdrv_get_xdbg_block_graph(Error **errp)
5235 {
5236     BlockBackend *blk;
5237     BlockJob *job;
5238     BlockDriverState *bs;
5239     BdrvChild *child;
5240     XDbgBlockGraphConstructor *gr = xdbg_graph_new();
5241 
5242     for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
5243         char *allocated_name = NULL;
5244         const char *name = blk_name(blk);
5245 
5246         if (!*name) {
5247             name = allocated_name = blk_get_attached_dev_id(blk);
5248         }
5249         xdbg_graph_add_node(gr, blk, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_BACKEND,
5250                            name);
5251         g_free(allocated_name);
5252         if (blk_root(blk)) {
5253             xdbg_graph_add_edge(gr, blk, blk_root(blk));
5254         }
5255     }
5256 
5257     for (job = block_job_next(NULL); job; job = block_job_next(job)) {
5258         GSList *el;
5259 
5260         xdbg_graph_add_node(gr, job, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_JOB,
5261                            job->job.id);
5262         for (el = job->nodes; el; el = el->next) {
5263             xdbg_graph_add_edge(gr, job, (BdrvChild *)el->data);
5264         }
5265     }
5266 
5267     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
5268         xdbg_graph_add_node(gr, bs, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_DRIVER,
5269                            bs->node_name);
5270         QLIST_FOREACH(child, &bs->children, next) {
5271             xdbg_graph_add_edge(gr, bs, child);
5272         }
5273     }
5274 
5275     return xdbg_graph_finalize(gr);
5276 }
5277 
5278 BlockDriverState *bdrv_lookup_bs(const char *device,
5279                                  const char *node_name,
5280                                  Error **errp)
5281 {
5282     BlockBackend *blk;
5283     BlockDriverState *bs;
5284 
5285     if (device) {
5286         blk = blk_by_name(device);
5287 
5288         if (blk) {
5289             bs = blk_bs(blk);
5290             if (!bs) {
5291                 error_setg(errp, "Device '%s' has no medium", device);
5292             }
5293 
5294             return bs;
5295         }
5296     }
5297 
5298     if (node_name) {
5299         bs = bdrv_find_node(node_name);
5300 
5301         if (bs) {
5302             return bs;
5303         }
5304     }
5305 
5306     error_setg(errp, "Cannot find device=%s nor node_name=%s",
5307                      device ? device : "",
5308                      node_name ? node_name : "");
5309     return NULL;
5310 }
5311 
5312 /* If 'base' is in the same chain as 'top', return true. Otherwise,
5313  * return false.  If either argument is NULL, return false. */
5314 bool bdrv_chain_contains(BlockDriverState *top, BlockDriverState *base)
5315 {
5316     while (top && top != base) {
5317         top = backing_bs(top);
5318     }
5319 
5320     return top != NULL;
5321 }
5322 
5323 BlockDriverState *bdrv_next_node(BlockDriverState *bs)
5324 {
5325     if (!bs) {
5326         return QTAILQ_FIRST(&graph_bdrv_states);
5327     }
5328     return QTAILQ_NEXT(bs, node_list);
5329 }
5330 
5331 BlockDriverState *bdrv_next_all_states(BlockDriverState *bs)
5332 {
5333     if (!bs) {
5334         return QTAILQ_FIRST(&all_bdrv_states);
5335     }
5336     return QTAILQ_NEXT(bs, bs_list);
5337 }
5338 
5339 const char *bdrv_get_node_name(const BlockDriverState *bs)
5340 {
5341     return bs->node_name;
5342 }
5343 
5344 const char *bdrv_get_parent_name(const BlockDriverState *bs)
5345 {
5346     BdrvChild *c;
5347     const char *name;
5348 
5349     /* If multiple parents have a name, just pick the first one. */
5350     QLIST_FOREACH(c, &bs->parents, next_parent) {
5351         if (c->klass->get_name) {
5352             name = c->klass->get_name(c);
5353             if (name && *name) {
5354                 return name;
5355             }
5356         }
5357     }
5358 
5359     return NULL;
5360 }
5361 
5362 /* TODO check what callers really want: bs->node_name or blk_name() */
5363 const char *bdrv_get_device_name(const BlockDriverState *bs)
5364 {
5365     return bdrv_get_parent_name(bs) ?: "";
5366 }
5367 
5368 /* This can be used to identify nodes that might not have a device
5369  * name associated. Since node and device names live in the same
5370  * namespace, the result is unambiguous. The exception is if both are
5371  * absent, then this returns an empty (non-null) string. */
5372 const char *bdrv_get_device_or_node_name(const BlockDriverState *bs)
5373 {
5374     return bdrv_get_parent_name(bs) ?: bs->node_name;
5375 }
5376 
5377 int bdrv_get_flags(BlockDriverState *bs)
5378 {
5379     return bs->open_flags;
5380 }
5381 
5382 int bdrv_has_zero_init_1(BlockDriverState *bs)
5383 {
5384     return 1;
5385 }
5386 
5387 int bdrv_has_zero_init(BlockDriverState *bs)
5388 {
5389     if (!bs->drv) {
5390         return 0;
5391     }
5392 
5393     /* If BS is a copy on write image, it is initialized to
5394        the contents of the base image, which may not be zeroes.  */
5395     if (bs->backing) {
5396         return 0;
5397     }
5398     if (bs->drv->bdrv_has_zero_init) {
5399         return bs->drv->bdrv_has_zero_init(bs);
5400     }
5401     if (bs->file && bs->drv->is_filter) {
5402         return bdrv_has_zero_init(bs->file->bs);
5403     }
5404 
5405     /* safe default */
5406     return 0;
5407 }
5408 
5409 bool bdrv_can_write_zeroes_with_unmap(BlockDriverState *bs)
5410 {
5411     if (!(bs->open_flags & BDRV_O_UNMAP)) {
5412         return false;
5413     }
5414 
5415     return bs->supported_zero_flags & BDRV_REQ_MAY_UNMAP;
5416 }
5417 
5418 void bdrv_get_backing_filename(BlockDriverState *bs,
5419                                char *filename, int filename_size)
5420 {
5421     pstrcpy(filename, filename_size, bs->backing_file);
5422 }
5423 
5424 int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
5425 {
5426     BlockDriver *drv = bs->drv;
5427     /* if bs->drv == NULL, bs is closed, so there's nothing to do here */
5428     if (!drv) {
5429         return -ENOMEDIUM;
5430     }
5431     if (!drv->bdrv_get_info) {
5432         if (bs->file && drv->is_filter) {
5433             return bdrv_get_info(bs->file->bs, bdi);
5434         }
5435         return -ENOTSUP;
5436     }
5437     memset(bdi, 0, sizeof(*bdi));
5438     return drv->bdrv_get_info(bs, bdi);
5439 }
5440 
5441 ImageInfoSpecific *bdrv_get_specific_info(BlockDriverState *bs,
5442                                           Error **errp)
5443 {
5444     BlockDriver *drv = bs->drv;
5445     if (drv && drv->bdrv_get_specific_info) {
5446         return drv->bdrv_get_specific_info(bs, errp);
5447     }
5448     return NULL;
5449 }
5450 
5451 BlockStatsSpecific *bdrv_get_specific_stats(BlockDriverState *bs)
5452 {
5453     BlockDriver *drv = bs->drv;
5454     if (!drv || !drv->bdrv_get_specific_stats) {
5455         return NULL;
5456     }
5457     return drv->bdrv_get_specific_stats(bs);
5458 }
5459 
5460 void bdrv_debug_event(BlockDriverState *bs, BlkdebugEvent event)
5461 {
5462     if (!bs || !bs->drv || !bs->drv->bdrv_debug_event) {
5463         return;
5464     }
5465 
5466     bs->drv->bdrv_debug_event(bs, event);
5467 }
5468 
5469 static BlockDriverState *bdrv_find_debug_node(BlockDriverState *bs)
5470 {
5471     while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {
5472         if (bs->file) {
5473             bs = bs->file->bs;
5474             continue;
5475         }
5476 
5477         if (bs->drv->is_filter && bs->backing) {
5478             bs = bs->backing->bs;
5479             continue;
5480         }
5481 
5482         break;
5483     }
5484 
5485     if (bs && bs->drv && bs->drv->bdrv_debug_breakpoint) {
5486         assert(bs->drv->bdrv_debug_remove_breakpoint);
5487         return bs;
5488     }
5489 
5490     return NULL;
5491 }
5492 
5493 int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
5494                           const char *tag)
5495 {
5496     bs = bdrv_find_debug_node(bs);
5497     if (bs) {
5498         return bs->drv->bdrv_debug_breakpoint(bs, event, tag);
5499     }
5500 
5501     return -ENOTSUP;
5502 }
5503 
5504 int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag)
5505 {
5506     bs = bdrv_find_debug_node(bs);
5507     if (bs) {
5508         return bs->drv->bdrv_debug_remove_breakpoint(bs, tag);
5509     }
5510 
5511     return -ENOTSUP;
5512 }
5513 
5514 int bdrv_debug_resume(BlockDriverState *bs, const char *tag)
5515 {
5516     while (bs && (!bs->drv || !bs->drv->bdrv_debug_resume)) {
5517         bs = bs->file ? bs->file->bs : NULL;
5518     }
5519 
5520     if (bs && bs->drv && bs->drv->bdrv_debug_resume) {
5521         return bs->drv->bdrv_debug_resume(bs, tag);
5522     }
5523 
5524     return -ENOTSUP;
5525 }
5526 
5527 bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)
5528 {
5529     while (bs && bs->drv && !bs->drv->bdrv_debug_is_suspended) {
5530         bs = bs->file ? bs->file->bs : NULL;
5531     }
5532 
5533     if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {
5534         return bs->drv->bdrv_debug_is_suspended(bs, tag);
5535     }
5536 
5537     return false;
5538 }
5539 
5540 /* backing_file can either be relative, or absolute, or a protocol.  If it is
5541  * relative, it must be relative to the chain.  So, passing in bs->filename
5542  * from a BDS as backing_file should not be done, as that may be relative to
5543  * the CWD rather than the chain. */
5544 BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
5545         const char *backing_file)
5546 {
5547     char *filename_full = NULL;
5548     char *backing_file_full = NULL;
5549     char *filename_tmp = NULL;
5550     int is_protocol = 0;
5551     BlockDriverState *curr_bs = NULL;
5552     BlockDriverState *retval = NULL;
5553 
5554     if (!bs || !bs->drv || !backing_file) {
5555         return NULL;
5556     }
5557 
5558     filename_full     = g_malloc(PATH_MAX);
5559     backing_file_full = g_malloc(PATH_MAX);
5560 
5561     is_protocol = path_has_protocol(backing_file);
5562 
5563     for (curr_bs = bs; curr_bs->backing; curr_bs = curr_bs->backing->bs) {
5564 
5565         /* If either of the filename paths is actually a protocol, then
5566          * compare unmodified paths; otherwise make paths relative */
5567         if (is_protocol || path_has_protocol(curr_bs->backing_file)) {
5568             char *backing_file_full_ret;
5569 
5570             if (strcmp(backing_file, curr_bs->backing_file) == 0) {
5571                 retval = curr_bs->backing->bs;
5572                 break;
5573             }
5574             /* Also check against the full backing filename for the image */
5575             backing_file_full_ret = bdrv_get_full_backing_filename(curr_bs,
5576                                                                    NULL);
5577             if (backing_file_full_ret) {
5578                 bool equal = strcmp(backing_file, backing_file_full_ret) == 0;
5579                 g_free(backing_file_full_ret);
5580                 if (equal) {
5581                     retval = curr_bs->backing->bs;
5582                     break;
5583                 }
5584             }
5585         } else {
5586             /* If not an absolute filename path, make it relative to the current
5587              * image's filename path */
5588             filename_tmp = bdrv_make_absolute_filename(curr_bs, backing_file,
5589                                                        NULL);
5590             /* We are going to compare canonicalized absolute pathnames */
5591             if (!filename_tmp || !realpath(filename_tmp, filename_full)) {
5592                 g_free(filename_tmp);
5593                 continue;
5594             }
5595             g_free(filename_tmp);
5596 
5597             /* We need to make sure the backing filename we are comparing against
5598              * is relative to the current image filename (or absolute) */
5599             filename_tmp = bdrv_get_full_backing_filename(curr_bs, NULL);
5600             if (!filename_tmp || !realpath(filename_tmp, backing_file_full)) {
5601                 g_free(filename_tmp);
5602                 continue;
5603             }
5604             g_free(filename_tmp);
5605 
5606             if (strcmp(backing_file_full, filename_full) == 0) {
5607                 retval = curr_bs->backing->bs;
5608                 break;
5609             }
5610         }
5611     }
5612 
5613     g_free(filename_full);
5614     g_free(backing_file_full);
5615     return retval;
5616 }
5617 
5618 void bdrv_init(void)
5619 {
5620     module_call_init(MODULE_INIT_BLOCK);
5621 }
5622 
5623 void bdrv_init_with_whitelist(void)
5624 {
5625     use_bdrv_whitelist = 1;
5626     bdrv_init();
5627 }
5628 
5629 static void coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs,
5630                                                   Error **errp)
5631 {
5632     BdrvChild *child, *parent;
5633     uint64_t perm, shared_perm;
5634     Error *local_err = NULL;
5635     int ret;
5636     BdrvDirtyBitmap *bm;
5637 
5638     if (!bs->drv)  {
5639         return;
5640     }
5641 
5642     QLIST_FOREACH(child, &bs->children, next) {
5643         bdrv_co_invalidate_cache(child->bs, &local_err);
5644         if (local_err) {
5645             error_propagate(errp, local_err);
5646             return;
5647         }
5648     }
5649 
5650     /*
5651      * Update permissions, they may differ for inactive nodes.
5652      *
5653      * Note that the required permissions of inactive images are always a
5654      * subset of the permissions required after activating the image. This
5655      * allows us to just get the permissions upfront without restricting
5656      * drv->bdrv_invalidate_cache().
5657      *
5658      * It also means that in error cases, we don't have to try and revert to
5659      * the old permissions (which is an operation that could fail, too). We can
5660      * just keep the extended permissions for the next time that an activation
5661      * of the image is tried.
5662      */
5663     if (bs->open_flags & BDRV_O_INACTIVE) {
5664         bs->open_flags &= ~BDRV_O_INACTIVE;
5665         bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
5666         ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, NULL, &local_err);
5667         if (ret < 0) {
5668             bs->open_flags |= BDRV_O_INACTIVE;
5669             error_propagate(errp, local_err);
5670             return;
5671         }
5672         bdrv_set_perm(bs, perm, shared_perm);
5673 
5674         if (bs->drv->bdrv_co_invalidate_cache) {
5675             bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
5676             if (local_err) {
5677                 bs->open_flags |= BDRV_O_INACTIVE;
5678                 error_propagate(errp, local_err);
5679                 return;
5680             }
5681         }
5682 
5683         FOR_EACH_DIRTY_BITMAP(bs, bm) {
5684             bdrv_dirty_bitmap_skip_store(bm, false);
5685         }
5686 
5687         ret = refresh_total_sectors(bs, bs->total_sectors);
5688         if (ret < 0) {
5689             bs->open_flags |= BDRV_O_INACTIVE;
5690             error_setg_errno(errp, -ret, "Could not refresh total sector count");
5691             return;
5692         }
5693     }
5694 
5695     QLIST_FOREACH(parent, &bs->parents, next_parent) {
5696         if (parent->klass->activate) {
5697             parent->klass->activate(parent, &local_err);
5698             if (local_err) {
5699                 bs->open_flags |= BDRV_O_INACTIVE;
5700                 error_propagate(errp, local_err);
5701                 return;
5702             }
5703         }
5704     }
5705 }
5706 
5707 typedef struct InvalidateCacheCo {
5708     BlockDriverState *bs;
5709     Error **errp;
5710     bool done;
5711 } InvalidateCacheCo;
5712 
5713 static void coroutine_fn bdrv_invalidate_cache_co_entry(void *opaque)
5714 {
5715     InvalidateCacheCo *ico = opaque;
5716     bdrv_co_invalidate_cache(ico->bs, ico->errp);
5717     ico->done = true;
5718     aio_wait_kick();
5719 }
5720 
5721 void bdrv_invalidate_cache(BlockDriverState *bs, Error **errp)
5722 {
5723     Coroutine *co;
5724     InvalidateCacheCo ico = {
5725         .bs = bs,
5726         .done = false,
5727         .errp = errp
5728     };
5729 
5730     if (qemu_in_coroutine()) {
5731         /* Fast-path if already in coroutine context */
5732         bdrv_invalidate_cache_co_entry(&ico);
5733     } else {
5734         co = qemu_coroutine_create(bdrv_invalidate_cache_co_entry, &ico);
5735         bdrv_coroutine_enter(bs, co);
5736         BDRV_POLL_WHILE(bs, !ico.done);
5737     }
5738 }
5739 
5740 void bdrv_invalidate_cache_all(Error **errp)
5741 {
5742     BlockDriverState *bs;
5743     Error *local_err = NULL;
5744     BdrvNextIterator it;
5745 
5746     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
5747         AioContext *aio_context = bdrv_get_aio_context(bs);
5748 
5749         aio_context_acquire(aio_context);
5750         bdrv_invalidate_cache(bs, &local_err);
5751         aio_context_release(aio_context);
5752         if (local_err) {
5753             error_propagate(errp, local_err);
5754             bdrv_next_cleanup(&it);
5755             return;
5756         }
5757     }
5758 }
5759 
5760 static bool bdrv_has_bds_parent(BlockDriverState *bs, bool only_active)
5761 {
5762     BdrvChild *parent;
5763 
5764     QLIST_FOREACH(parent, &bs->parents, next_parent) {
5765         if (parent->klass->parent_is_bds) {
5766             BlockDriverState *parent_bs = parent->opaque;
5767             if (!only_active || !(parent_bs->open_flags & BDRV_O_INACTIVE)) {
5768                 return true;
5769             }
5770         }
5771     }
5772 
5773     return false;
5774 }
5775 
5776 static int bdrv_inactivate_recurse(BlockDriverState *bs)
5777 {
5778     BdrvChild *child, *parent;
5779     bool tighten_restrictions;
5780     uint64_t perm, shared_perm;
5781     int ret;
5782 
5783     if (!bs->drv) {
5784         return -ENOMEDIUM;
5785     }
5786 
5787     /* Make sure that we don't inactivate a child before its parent.
5788      * It will be covered by recursion from the yet active parent. */
5789     if (bdrv_has_bds_parent(bs, true)) {
5790         return 0;
5791     }
5792 
5793     assert(!(bs->open_flags & BDRV_O_INACTIVE));
5794 
5795     /* Inactivate this node */
5796     if (bs->drv->bdrv_inactivate) {
5797         ret = bs->drv->bdrv_inactivate(bs);
5798         if (ret < 0) {
5799             return ret;
5800         }
5801     }
5802 
5803     QLIST_FOREACH(parent, &bs->parents, next_parent) {
5804         if (parent->klass->inactivate) {
5805             ret = parent->klass->inactivate(parent);
5806             if (ret < 0) {
5807                 return ret;
5808             }
5809         }
5810     }
5811 
5812     bs->open_flags |= BDRV_O_INACTIVE;
5813 
5814     /* Update permissions, they may differ for inactive nodes */
5815     bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
5816     ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL,
5817                           &tighten_restrictions, NULL);
5818     assert(tighten_restrictions == false);
5819     if (ret < 0) {
5820         /* We only tried to loosen restrictions, so errors are not fatal */
5821         bdrv_abort_perm_update(bs);
5822     } else {
5823         bdrv_set_perm(bs, perm, shared_perm);
5824     }
5825 
5826 
5827     /* Recursively inactivate children */
5828     QLIST_FOREACH(child, &bs->children, next) {
5829         ret = bdrv_inactivate_recurse(child->bs);
5830         if (ret < 0) {
5831             return ret;
5832         }
5833     }
5834 
5835     return 0;
5836 }
5837 
5838 int bdrv_inactivate_all(void)
5839 {
5840     BlockDriverState *bs = NULL;
5841     BdrvNextIterator it;
5842     int ret = 0;
5843     GSList *aio_ctxs = NULL, *ctx;
5844 
5845     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
5846         AioContext *aio_context = bdrv_get_aio_context(bs);
5847 
5848         if (!g_slist_find(aio_ctxs, aio_context)) {
5849             aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
5850             aio_context_acquire(aio_context);
5851         }
5852     }
5853 
5854     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
5855         /* Nodes with BDS parents are covered by recursion from the last
5856          * parent that gets inactivated. Don't inactivate them a second
5857          * time if that has already happened. */
5858         if (bdrv_has_bds_parent(bs, false)) {
5859             continue;
5860         }
5861         ret = bdrv_inactivate_recurse(bs);
5862         if (ret < 0) {
5863             bdrv_next_cleanup(&it);
5864             goto out;
5865         }
5866     }
5867 
5868 out:
5869     for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
5870         AioContext *aio_context = ctx->data;
5871         aio_context_release(aio_context);
5872     }
5873     g_slist_free(aio_ctxs);
5874 
5875     return ret;
5876 }
5877 
5878 /**************************************************************/
5879 /* removable device support */
5880 
5881 /**
5882  * Return TRUE if the media is present
5883  */
5884 bool bdrv_is_inserted(BlockDriverState *bs)
5885 {
5886     BlockDriver *drv = bs->drv;
5887     BdrvChild *child;
5888 
5889     if (!drv) {
5890         return false;
5891     }
5892     if (drv->bdrv_is_inserted) {
5893         return drv->bdrv_is_inserted(bs);
5894     }
5895     QLIST_FOREACH(child, &bs->children, next) {
5896         if (!bdrv_is_inserted(child->bs)) {
5897             return false;
5898         }
5899     }
5900     return true;
5901 }
5902 
5903 /**
5904  * If eject_flag is TRUE, eject the media. Otherwise, close the tray
5905  */
5906 void bdrv_eject(BlockDriverState *bs, bool eject_flag)
5907 {
5908     BlockDriver *drv = bs->drv;
5909 
5910     if (drv && drv->bdrv_eject) {
5911         drv->bdrv_eject(bs, eject_flag);
5912     }
5913 }
5914 
5915 /**
5916  * Lock or unlock the media (if it is locked, the user won't be able
5917  * to eject it manually).
5918  */
5919 void bdrv_lock_medium(BlockDriverState *bs, bool locked)
5920 {
5921     BlockDriver *drv = bs->drv;
5922 
5923     trace_bdrv_lock_medium(bs, locked);
5924 
5925     if (drv && drv->bdrv_lock_medium) {
5926         drv->bdrv_lock_medium(bs, locked);
5927     }
5928 }
5929 
5930 /* Get a reference to bs */
5931 void bdrv_ref(BlockDriverState *bs)
5932 {
5933     bs->refcnt++;
5934 }
5935 
5936 /* Release a previously grabbed reference to bs.
5937  * If after releasing, reference count is zero, the BlockDriverState is
5938  * deleted. */
5939 void bdrv_unref(BlockDriverState *bs)
5940 {
5941     if (!bs) {
5942         return;
5943     }
5944     assert(bs->refcnt > 0);
5945     if (--bs->refcnt == 0) {
5946         bdrv_delete(bs);
5947     }
5948 }
5949 
5950 struct BdrvOpBlocker {
5951     Error *reason;
5952     QLIST_ENTRY(BdrvOpBlocker) list;
5953 };
5954 
5955 bool bdrv_op_is_blocked(BlockDriverState *bs, BlockOpType op, Error **errp)
5956 {
5957     BdrvOpBlocker *blocker;
5958     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
5959     if (!QLIST_EMPTY(&bs->op_blockers[op])) {
5960         blocker = QLIST_FIRST(&bs->op_blockers[op]);
5961         error_propagate_prepend(errp, error_copy(blocker->reason),
5962                                 "Node '%s' is busy: ",
5963                                 bdrv_get_device_or_node_name(bs));
5964         return true;
5965     }
5966     return false;
5967 }
5968 
5969 void bdrv_op_block(BlockDriverState *bs, BlockOpType op, Error *reason)
5970 {
5971     BdrvOpBlocker *blocker;
5972     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
5973 
5974     blocker = g_new0(BdrvOpBlocker, 1);
5975     blocker->reason = reason;
5976     QLIST_INSERT_HEAD(&bs->op_blockers[op], blocker, list);
5977 }
5978 
5979 void bdrv_op_unblock(BlockDriverState *bs, BlockOpType op, Error *reason)
5980 {
5981     BdrvOpBlocker *blocker, *next;
5982     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
5983     QLIST_FOREACH_SAFE(blocker, &bs->op_blockers[op], list, next) {
5984         if (blocker->reason == reason) {
5985             QLIST_REMOVE(blocker, list);
5986             g_free(blocker);
5987         }
5988     }
5989 }
5990 
5991 void bdrv_op_block_all(BlockDriverState *bs, Error *reason)
5992 {
5993     int i;
5994     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
5995         bdrv_op_block(bs, i, reason);
5996     }
5997 }
5998 
5999 void bdrv_op_unblock_all(BlockDriverState *bs, Error *reason)
6000 {
6001     int i;
6002     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
6003         bdrv_op_unblock(bs, i, reason);
6004     }
6005 }
6006 
6007 bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
6008 {
6009     int i;
6010 
6011     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
6012         if (!QLIST_EMPTY(&bs->op_blockers[i])) {
6013             return false;
6014         }
6015     }
6016     return true;
6017 }
6018 
6019 void bdrv_img_create(const char *filename, const char *fmt,
6020                      const char *base_filename, const char *base_fmt,
6021                      char *options, uint64_t img_size, int flags, bool quiet,
6022                      Error **errp)
6023 {
6024     QemuOptsList *create_opts = NULL;
6025     QemuOpts *opts = NULL;
6026     const char *backing_fmt, *backing_file;
6027     int64_t size;
6028     BlockDriver *drv, *proto_drv;
6029     Error *local_err = NULL;
6030     int ret = 0;
6031 
6032     /* Find driver and parse its options */
6033     drv = bdrv_find_format(fmt);
6034     if (!drv) {
6035         error_setg(errp, "Unknown file format '%s'", fmt);
6036         return;
6037     }
6038 
6039     proto_drv = bdrv_find_protocol(filename, true, errp);
6040     if (!proto_drv) {
6041         return;
6042     }
6043 
6044     if (!drv->create_opts) {
6045         error_setg(errp, "Format driver '%s' does not support image creation",
6046                    drv->format_name);
6047         return;
6048     }
6049 
6050     if (!proto_drv->create_opts) {
6051         error_setg(errp, "Protocol driver '%s' does not support image creation",
6052                    proto_drv->format_name);
6053         return;
6054     }
6055 
6056     /* Create parameter list */
6057     create_opts = qemu_opts_append(create_opts, drv->create_opts);
6058     create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
6059 
6060     opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
6061 
6062     /* Parse -o options */
6063     if (options) {
6064         if (!qemu_opts_do_parse(opts, options, NULL, &local_err)) {
6065             goto out;
6066         }
6067     }
6068 
6069     if (!qemu_opt_get(opts, BLOCK_OPT_SIZE)) {
6070         qemu_opt_set_number(opts, BLOCK_OPT_SIZE, img_size, &error_abort);
6071     } else if (img_size != UINT64_C(-1)) {
6072         error_setg(errp, "The image size must be specified only once");
6073         goto out;
6074     }
6075 
6076     if (base_filename) {
6077         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, base_filename,
6078                           NULL)) {
6079             error_setg(errp, "Backing file not supported for file format '%s'",
6080                        fmt);
6081             goto out;
6082         }
6083     }
6084 
6085     if (base_fmt) {
6086         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, base_fmt, NULL)) {
6087             error_setg(errp, "Backing file format not supported for file "
6088                              "format '%s'", fmt);
6089             goto out;
6090         }
6091     }
6092 
6093     backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
6094     if (backing_file) {
6095         if (!strcmp(filename, backing_file)) {
6096             error_setg(errp, "Error: Trying to create an image with the "
6097                              "same filename as the backing file");
6098             goto out;
6099         }
6100     }
6101 
6102     backing_fmt = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
6103 
6104     /* The size for the image must always be specified, unless we have a backing
6105      * file and we have not been forbidden from opening it. */
6106     size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, img_size);
6107     if (backing_file && !(flags & BDRV_O_NO_BACKING)) {
6108         BlockDriverState *bs;
6109         char *full_backing;
6110         int back_flags;
6111         QDict *backing_options = NULL;
6112 
6113         full_backing =
6114             bdrv_get_full_backing_filename_from_filename(filename, backing_file,
6115                                                          &local_err);
6116         if (local_err) {
6117             goto out;
6118         }
6119         assert(full_backing);
6120 
6121         /* backing files always opened read-only */
6122         back_flags = flags;
6123         back_flags &= ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
6124 
6125         backing_options = qdict_new();
6126         if (backing_fmt) {
6127             qdict_put_str(backing_options, "driver", backing_fmt);
6128         }
6129         qdict_put_bool(backing_options, BDRV_OPT_FORCE_SHARE, true);
6130 
6131         bs = bdrv_open(full_backing, NULL, backing_options, back_flags,
6132                        &local_err);
6133         g_free(full_backing);
6134         if (!bs && size != -1) {
6135             /* Couldn't open BS, but we have a size, so it's nonfatal */
6136             warn_reportf_err(local_err,
6137                             "Could not verify backing image. "
6138                             "This may become an error in future versions.\n");
6139             local_err = NULL;
6140         } else if (!bs) {
6141             /* Couldn't open bs, do not have size */
6142             error_append_hint(&local_err,
6143                               "Could not open backing image to determine size.\n");
6144             goto out;
6145         } else {
6146             if (size == -1) {
6147                 /* Opened BS, have no size */
6148                 size = bdrv_getlength(bs);
6149                 if (size < 0) {
6150                     error_setg_errno(errp, -size, "Could not get size of '%s'",
6151                                      backing_file);
6152                     bdrv_unref(bs);
6153                     goto out;
6154                 }
6155                 qemu_opt_set_number(opts, BLOCK_OPT_SIZE, size, &error_abort);
6156             }
6157             bdrv_unref(bs);
6158         }
6159     } /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
6160 
6161     if (size == -1) {
6162         error_setg(errp, "Image creation needs a size parameter");
6163         goto out;
6164     }
6165 
6166     if (!quiet) {
6167         printf("Formatting '%s', fmt=%s ", filename, fmt);
6168         qemu_opts_print(opts, " ");
6169         puts("");
6170     }
6171 
6172     ret = bdrv_create(drv, filename, opts, &local_err);
6173 
6174     if (ret == -EFBIG) {
6175         /* This is generally a better message than whatever the driver would
6176          * deliver (especially because of the cluster_size_hint), since that
6177          * is most probably not much different from "image too large". */
6178         const char *cluster_size_hint = "";
6179         if (qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, 0)) {
6180             cluster_size_hint = " (try using a larger cluster size)";
6181         }
6182         error_setg(errp, "The image size is too large for file format '%s'"
6183                    "%s", fmt, cluster_size_hint);
6184         error_free(local_err);
6185         local_err = NULL;
6186     }
6187 
6188 out:
6189     qemu_opts_del(opts);
6190     qemu_opts_free(create_opts);
6191     error_propagate(errp, local_err);
6192 }
6193 
6194 AioContext *bdrv_get_aio_context(BlockDriverState *bs)
6195 {
6196     return bs ? bs->aio_context : qemu_get_aio_context();
6197 }
6198 
6199 void bdrv_coroutine_enter(BlockDriverState *bs, Coroutine *co)
6200 {
6201     aio_co_enter(bdrv_get_aio_context(bs), co);
6202 }
6203 
6204 static void bdrv_do_remove_aio_context_notifier(BdrvAioNotifier *ban)
6205 {
6206     QLIST_REMOVE(ban, list);
6207     g_free(ban);
6208 }
6209 
6210 static void bdrv_detach_aio_context(BlockDriverState *bs)
6211 {
6212     BdrvAioNotifier *baf, *baf_tmp;
6213 
6214     assert(!bs->walking_aio_notifiers);
6215     bs->walking_aio_notifiers = true;
6216     QLIST_FOREACH_SAFE(baf, &bs->aio_notifiers, list, baf_tmp) {
6217         if (baf->deleted) {
6218             bdrv_do_remove_aio_context_notifier(baf);
6219         } else {
6220             baf->detach_aio_context(baf->opaque);
6221         }
6222     }
6223     /* Never mind iterating again to check for ->deleted.  bdrv_close() will
6224      * remove remaining aio notifiers if we aren't called again.
6225      */
6226     bs->walking_aio_notifiers = false;
6227 
6228     if (bs->drv && bs->drv->bdrv_detach_aio_context) {
6229         bs->drv->bdrv_detach_aio_context(bs);
6230     }
6231 
6232     if (bs->quiesce_counter) {
6233         aio_enable_external(bs->aio_context);
6234     }
6235     bs->aio_context = NULL;
6236 }
6237 
6238 static void bdrv_attach_aio_context(BlockDriverState *bs,
6239                                     AioContext *new_context)
6240 {
6241     BdrvAioNotifier *ban, *ban_tmp;
6242 
6243     if (bs->quiesce_counter) {
6244         aio_disable_external(new_context);
6245     }
6246 
6247     bs->aio_context = new_context;
6248 
6249     if (bs->drv && bs->drv->bdrv_attach_aio_context) {
6250         bs->drv->bdrv_attach_aio_context(bs, new_context);
6251     }
6252 
6253     assert(!bs->walking_aio_notifiers);
6254     bs->walking_aio_notifiers = true;
6255     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_tmp) {
6256         if (ban->deleted) {
6257             bdrv_do_remove_aio_context_notifier(ban);
6258         } else {
6259             ban->attached_aio_context(new_context, ban->opaque);
6260         }
6261     }
6262     bs->walking_aio_notifiers = false;
6263 }
6264 
6265 /*
6266  * Changes the AioContext used for fd handlers, timers, and BHs by this
6267  * BlockDriverState and all its children and parents.
6268  *
6269  * Must be called from the main AioContext.
6270  *
6271  * The caller must own the AioContext lock for the old AioContext of bs, but it
6272  * must not own the AioContext lock for new_context (unless new_context is the
6273  * same as the current context of bs).
6274  *
6275  * @ignore will accumulate all visited BdrvChild object. The caller is
6276  * responsible for freeing the list afterwards.
6277  */
6278 void bdrv_set_aio_context_ignore(BlockDriverState *bs,
6279                                  AioContext *new_context, GSList **ignore)
6280 {
6281     AioContext *old_context = bdrv_get_aio_context(bs);
6282     BdrvChild *child;
6283 
6284     g_assert(qemu_get_current_aio_context() == qemu_get_aio_context());
6285 
6286     if (old_context == new_context) {
6287         return;
6288     }
6289 
6290     bdrv_drained_begin(bs);
6291 
6292     QLIST_FOREACH(child, &bs->children, next) {
6293         if (g_slist_find(*ignore, child)) {
6294             continue;
6295         }
6296         *ignore = g_slist_prepend(*ignore, child);
6297         bdrv_set_aio_context_ignore(child->bs, new_context, ignore);
6298     }
6299     QLIST_FOREACH(child, &bs->parents, next_parent) {
6300         if (g_slist_find(*ignore, child)) {
6301             continue;
6302         }
6303         assert(child->klass->set_aio_ctx);
6304         *ignore = g_slist_prepend(*ignore, child);
6305         child->klass->set_aio_ctx(child, new_context, ignore);
6306     }
6307 
6308     bdrv_detach_aio_context(bs);
6309 
6310     /* Acquire the new context, if necessary */
6311     if (qemu_get_aio_context() != new_context) {
6312         aio_context_acquire(new_context);
6313     }
6314 
6315     bdrv_attach_aio_context(bs, new_context);
6316 
6317     /*
6318      * If this function was recursively called from
6319      * bdrv_set_aio_context_ignore(), there may be nodes in the
6320      * subtree that have not yet been moved to the new AioContext.
6321      * Release the old one so bdrv_drained_end() can poll them.
6322      */
6323     if (qemu_get_aio_context() != old_context) {
6324         aio_context_release(old_context);
6325     }
6326 
6327     bdrv_drained_end(bs);
6328 
6329     if (qemu_get_aio_context() != old_context) {
6330         aio_context_acquire(old_context);
6331     }
6332     if (qemu_get_aio_context() != new_context) {
6333         aio_context_release(new_context);
6334     }
6335 }
6336 
6337 static bool bdrv_parent_can_set_aio_context(BdrvChild *c, AioContext *ctx,
6338                                             GSList **ignore, Error **errp)
6339 {
6340     if (g_slist_find(*ignore, c)) {
6341         return true;
6342     }
6343     *ignore = g_slist_prepend(*ignore, c);
6344 
6345     /*
6346      * A BdrvChildClass that doesn't handle AioContext changes cannot
6347      * tolerate any AioContext changes
6348      */
6349     if (!c->klass->can_set_aio_ctx) {
6350         char *user = bdrv_child_user_desc(c);
6351         error_setg(errp, "Changing iothreads is not supported by %s", user);
6352         g_free(user);
6353         return false;
6354     }
6355     if (!c->klass->can_set_aio_ctx(c, ctx, ignore, errp)) {
6356         assert(!errp || *errp);
6357         return false;
6358     }
6359     return true;
6360 }
6361 
6362 bool bdrv_child_can_set_aio_context(BdrvChild *c, AioContext *ctx,
6363                                     GSList **ignore, Error **errp)
6364 {
6365     if (g_slist_find(*ignore, c)) {
6366         return true;
6367     }
6368     *ignore = g_slist_prepend(*ignore, c);
6369     return bdrv_can_set_aio_context(c->bs, ctx, ignore, errp);
6370 }
6371 
6372 /* @ignore will accumulate all visited BdrvChild object. The caller is
6373  * responsible for freeing the list afterwards. */
6374 bool bdrv_can_set_aio_context(BlockDriverState *bs, AioContext *ctx,
6375                               GSList **ignore, Error **errp)
6376 {
6377     BdrvChild *c;
6378 
6379     if (bdrv_get_aio_context(bs) == ctx) {
6380         return true;
6381     }
6382 
6383     QLIST_FOREACH(c, &bs->parents, next_parent) {
6384         if (!bdrv_parent_can_set_aio_context(c, ctx, ignore, errp)) {
6385             return false;
6386         }
6387     }
6388     QLIST_FOREACH(c, &bs->children, next) {
6389         if (!bdrv_child_can_set_aio_context(c, ctx, ignore, errp)) {
6390             return false;
6391         }
6392     }
6393 
6394     return true;
6395 }
6396 
6397 int bdrv_child_try_set_aio_context(BlockDriverState *bs, AioContext *ctx,
6398                                    BdrvChild *ignore_child, Error **errp)
6399 {
6400     GSList *ignore;
6401     bool ret;
6402 
6403     ignore = ignore_child ? g_slist_prepend(NULL, ignore_child) : NULL;
6404     ret = bdrv_can_set_aio_context(bs, ctx, &ignore, errp);
6405     g_slist_free(ignore);
6406 
6407     if (!ret) {
6408         return -EPERM;
6409     }
6410 
6411     ignore = ignore_child ? g_slist_prepend(NULL, ignore_child) : NULL;
6412     bdrv_set_aio_context_ignore(bs, ctx, &ignore);
6413     g_slist_free(ignore);
6414 
6415     return 0;
6416 }
6417 
6418 int bdrv_try_set_aio_context(BlockDriverState *bs, AioContext *ctx,
6419                              Error **errp)
6420 {
6421     return bdrv_child_try_set_aio_context(bs, ctx, NULL, errp);
6422 }
6423 
6424 void bdrv_add_aio_context_notifier(BlockDriverState *bs,
6425         void (*attached_aio_context)(AioContext *new_context, void *opaque),
6426         void (*detach_aio_context)(void *opaque), void *opaque)
6427 {
6428     BdrvAioNotifier *ban = g_new(BdrvAioNotifier, 1);
6429     *ban = (BdrvAioNotifier){
6430         .attached_aio_context = attached_aio_context,
6431         .detach_aio_context   = detach_aio_context,
6432         .opaque               = opaque
6433     };
6434 
6435     QLIST_INSERT_HEAD(&bs->aio_notifiers, ban, list);
6436 }
6437 
6438 void bdrv_remove_aio_context_notifier(BlockDriverState *bs,
6439                                       void (*attached_aio_context)(AioContext *,
6440                                                                    void *),
6441                                       void (*detach_aio_context)(void *),
6442                                       void *opaque)
6443 {
6444     BdrvAioNotifier *ban, *ban_next;
6445 
6446     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
6447         if (ban->attached_aio_context == attached_aio_context &&
6448             ban->detach_aio_context   == detach_aio_context   &&
6449             ban->opaque               == opaque               &&
6450             ban->deleted              == false)
6451         {
6452             if (bs->walking_aio_notifiers) {
6453                 ban->deleted = true;
6454             } else {
6455                 bdrv_do_remove_aio_context_notifier(ban);
6456             }
6457             return;
6458         }
6459     }
6460 
6461     abort();
6462 }
6463 
6464 int bdrv_amend_options(BlockDriverState *bs, QemuOpts *opts,
6465                        BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
6466                        bool force,
6467                        Error **errp)
6468 {
6469     if (!bs->drv) {
6470         error_setg(errp, "Node is ejected");
6471         return -ENOMEDIUM;
6472     }
6473     if (!bs->drv->bdrv_amend_options) {
6474         error_setg(errp, "Block driver '%s' does not support option amendment",
6475                    bs->drv->format_name);
6476         return -ENOTSUP;
6477     }
6478     return bs->drv->bdrv_amend_options(bs, opts, status_cb,
6479                                        cb_opaque, force, errp);
6480 }
6481 
6482 /*
6483  * This function checks whether the given @to_replace is allowed to be
6484  * replaced by a node that always shows the same data as @bs.  This is
6485  * used for example to verify whether the mirror job can replace
6486  * @to_replace by the target mirrored from @bs.
6487  * To be replaceable, @bs and @to_replace may either be guaranteed to
6488  * always show the same data (because they are only connected through
6489  * filters), or some driver may allow replacing one of its children
6490  * because it can guarantee that this child's data is not visible at
6491  * all (for example, for dissenting quorum children that have no other
6492  * parents).
6493  */
6494 bool bdrv_recurse_can_replace(BlockDriverState *bs,
6495                               BlockDriverState *to_replace)
6496 {
6497     if (!bs || !bs->drv) {
6498         return false;
6499     }
6500 
6501     if (bs == to_replace) {
6502         return true;
6503     }
6504 
6505     /* See what the driver can do */
6506     if (bs->drv->bdrv_recurse_can_replace) {
6507         return bs->drv->bdrv_recurse_can_replace(bs, to_replace);
6508     }
6509 
6510     /* For filters without an own implementation, we can recurse on our own */
6511     if (bs->drv->is_filter) {
6512         BdrvChild *child = bs->file ?: bs->backing;
6513         return bdrv_recurse_can_replace(child->bs, to_replace);
6514     }
6515 
6516     /* Safe default */
6517     return false;
6518 }
6519 
6520 /*
6521  * Check whether the given @node_name can be replaced by a node that
6522  * has the same data as @parent_bs.  If so, return @node_name's BDS;
6523  * NULL otherwise.
6524  *
6525  * @node_name must be a (recursive) *child of @parent_bs (or this
6526  * function will return NULL).
6527  *
6528  * The result (whether the node can be replaced or not) is only valid
6529  * for as long as no graph or permission changes occur.
6530  */
6531 BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
6532                                         const char *node_name, Error **errp)
6533 {
6534     BlockDriverState *to_replace_bs = bdrv_find_node(node_name);
6535     AioContext *aio_context;
6536 
6537     if (!to_replace_bs) {
6538         error_setg(errp, "Node name '%s' not found", node_name);
6539         return NULL;
6540     }
6541 
6542     aio_context = bdrv_get_aio_context(to_replace_bs);
6543     aio_context_acquire(aio_context);
6544 
6545     if (bdrv_op_is_blocked(to_replace_bs, BLOCK_OP_TYPE_REPLACE, errp)) {
6546         to_replace_bs = NULL;
6547         goto out;
6548     }
6549 
6550     /* We don't want arbitrary node of the BDS chain to be replaced only the top
6551      * most non filter in order to prevent data corruption.
6552      * Another benefit is that this tests exclude backing files which are
6553      * blocked by the backing blockers.
6554      */
6555     if (!bdrv_recurse_can_replace(parent_bs, to_replace_bs)) {
6556         error_setg(errp, "Cannot replace '%s' by a node mirrored from '%s', "
6557                    "because it cannot be guaranteed that doing so would not "
6558                    "lead to an abrupt change of visible data",
6559                    node_name, parent_bs->node_name);
6560         to_replace_bs = NULL;
6561         goto out;
6562     }
6563 
6564 out:
6565     aio_context_release(aio_context);
6566     return to_replace_bs;
6567 }
6568 
6569 /**
6570  * Iterates through the list of runtime option keys that are said to
6571  * be "strong" for a BDS.  An option is called "strong" if it changes
6572  * a BDS's data.  For example, the null block driver's "size" and
6573  * "read-zeroes" options are strong, but its "latency-ns" option is
6574  * not.
6575  *
6576  * If a key returned by this function ends with a dot, all options
6577  * starting with that prefix are strong.
6578  */
6579 static const char *const *strong_options(BlockDriverState *bs,
6580                                          const char *const *curopt)
6581 {
6582     static const char *const global_options[] = {
6583         "driver", "filename", NULL
6584     };
6585 
6586     if (!curopt) {
6587         return &global_options[0];
6588     }
6589 
6590     curopt++;
6591     if (curopt == &global_options[ARRAY_SIZE(global_options) - 1] && bs->drv) {
6592         curopt = bs->drv->strong_runtime_opts;
6593     }
6594 
6595     return (curopt && *curopt) ? curopt : NULL;
6596 }
6597 
6598 /**
6599  * Copies all strong runtime options from bs->options to the given
6600  * QDict.  The set of strong option keys is determined by invoking
6601  * strong_options().
6602  *
6603  * Returns true iff any strong option was present in bs->options (and
6604  * thus copied to the target QDict) with the exception of "filename"
6605  * and "driver".  The caller is expected to use this value to decide
6606  * whether the existence of strong options prevents the generation of
6607  * a plain filename.
6608  */
6609 static bool append_strong_runtime_options(QDict *d, BlockDriverState *bs)
6610 {
6611     bool found_any = false;
6612     const char *const *option_name = NULL;
6613 
6614     if (!bs->drv) {
6615         return false;
6616     }
6617 
6618     while ((option_name = strong_options(bs, option_name))) {
6619         bool option_given = false;
6620 
6621         assert(strlen(*option_name) > 0);
6622         if ((*option_name)[strlen(*option_name) - 1] != '.') {
6623             QObject *entry = qdict_get(bs->options, *option_name);
6624             if (!entry) {
6625                 continue;
6626             }
6627 
6628             qdict_put_obj(d, *option_name, qobject_ref(entry));
6629             option_given = true;
6630         } else {
6631             const QDictEntry *entry;
6632             for (entry = qdict_first(bs->options); entry;
6633                  entry = qdict_next(bs->options, entry))
6634             {
6635                 if (strstart(qdict_entry_key(entry), *option_name, NULL)) {
6636                     qdict_put_obj(d, qdict_entry_key(entry),
6637                                   qobject_ref(qdict_entry_value(entry)));
6638                     option_given = true;
6639                 }
6640             }
6641         }
6642 
6643         /* While "driver" and "filename" need to be included in a JSON filename,
6644          * their existence does not prohibit generation of a plain filename. */
6645         if (!found_any && option_given &&
6646             strcmp(*option_name, "driver") && strcmp(*option_name, "filename"))
6647         {
6648             found_any = true;
6649         }
6650     }
6651 
6652     if (!qdict_haskey(d, "driver")) {
6653         /* Drivers created with bdrv_new_open_driver() may not have a
6654          * @driver option.  Add it here. */
6655         qdict_put_str(d, "driver", bs->drv->format_name);
6656     }
6657 
6658     return found_any;
6659 }
6660 
6661 /* Note: This function may return false positives; it may return true
6662  * even if opening the backing file specified by bs's image header
6663  * would result in exactly bs->backing. */
6664 static bool bdrv_backing_overridden(BlockDriverState *bs)
6665 {
6666     if (bs->backing) {
6667         return strcmp(bs->auto_backing_file,
6668                       bs->backing->bs->filename);
6669     } else {
6670         /* No backing BDS, so if the image header reports any backing
6671          * file, it must have been suppressed */
6672         return bs->auto_backing_file[0] != '\0';
6673     }
6674 }
6675 
6676 /* Updates the following BDS fields:
6677  *  - exact_filename: A filename which may be used for opening a block device
6678  *                    which (mostly) equals the given BDS (even without any
6679  *                    other options; so reading and writing must return the same
6680  *                    results, but caching etc. may be different)
6681  *  - full_open_options: Options which, when given when opening a block device
6682  *                       (without a filename), result in a BDS (mostly)
6683  *                       equalling the given one
6684  *  - filename: If exact_filename is set, it is copied here. Otherwise,
6685  *              full_open_options is converted to a JSON object, prefixed with
6686  *              "json:" (for use through the JSON pseudo protocol) and put here.
6687  */
6688 void bdrv_refresh_filename(BlockDriverState *bs)
6689 {
6690     BlockDriver *drv = bs->drv;
6691     BdrvChild *child;
6692     QDict *opts;
6693     bool backing_overridden;
6694     bool generate_json_filename; /* Whether our default implementation should
6695                                     fill exact_filename (false) or not (true) */
6696 
6697     if (!drv) {
6698         return;
6699     }
6700 
6701     /* This BDS's file name may depend on any of its children's file names, so
6702      * refresh those first */
6703     QLIST_FOREACH(child, &bs->children, next) {
6704         bdrv_refresh_filename(child->bs);
6705     }
6706 
6707     if (bs->implicit) {
6708         /* For implicit nodes, just copy everything from the single child */
6709         child = QLIST_FIRST(&bs->children);
6710         assert(QLIST_NEXT(child, next) == NULL);
6711 
6712         pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
6713                 child->bs->exact_filename);
6714         pstrcpy(bs->filename, sizeof(bs->filename), child->bs->filename);
6715 
6716         qobject_unref(bs->full_open_options);
6717         bs->full_open_options = qobject_ref(child->bs->full_open_options);
6718 
6719         return;
6720     }
6721 
6722     backing_overridden = bdrv_backing_overridden(bs);
6723 
6724     if (bs->open_flags & BDRV_O_NO_IO) {
6725         /* Without I/O, the backing file does not change anything.
6726          * Therefore, in such a case (primarily qemu-img), we can
6727          * pretend the backing file has not been overridden even if
6728          * it technically has been. */
6729         backing_overridden = false;
6730     }
6731 
6732     /* Gather the options QDict */
6733     opts = qdict_new();
6734     generate_json_filename = append_strong_runtime_options(opts, bs);
6735     generate_json_filename |= backing_overridden;
6736 
6737     if (drv->bdrv_gather_child_options) {
6738         /* Some block drivers may not want to present all of their children's
6739          * options, or name them differently from BdrvChild.name */
6740         drv->bdrv_gather_child_options(bs, opts, backing_overridden);
6741     } else {
6742         QLIST_FOREACH(child, &bs->children, next) {
6743             if (child == bs->backing && !backing_overridden) {
6744                 /* We can skip the backing BDS if it has not been overridden */
6745                 continue;
6746             }
6747 
6748             qdict_put(opts, child->name,
6749                       qobject_ref(child->bs->full_open_options));
6750         }
6751 
6752         if (backing_overridden && !bs->backing) {
6753             /* Force no backing file */
6754             qdict_put_null(opts, "backing");
6755         }
6756     }
6757 
6758     qobject_unref(bs->full_open_options);
6759     bs->full_open_options = opts;
6760 
6761     if (drv->bdrv_refresh_filename) {
6762         /* Obsolete information is of no use here, so drop the old file name
6763          * information before refreshing it */
6764         bs->exact_filename[0] = '\0';
6765 
6766         drv->bdrv_refresh_filename(bs);
6767     } else if (bs->file) {
6768         /* Try to reconstruct valid information from the underlying file */
6769 
6770         bs->exact_filename[0] = '\0';
6771 
6772         /*
6773          * We can use the underlying file's filename if:
6774          * - it has a filename,
6775          * - the file is a protocol BDS, and
6776          * - opening that file (as this BDS's format) will automatically create
6777          *   the BDS tree we have right now, that is:
6778          *   - the user did not significantly change this BDS's behavior with
6779          *     some explicit (strong) options
6780          *   - no non-file child of this BDS has been overridden by the user
6781          *   Both of these conditions are represented by generate_json_filename.
6782          */
6783         if (bs->file->bs->exact_filename[0] &&
6784             bs->file->bs->drv->bdrv_file_open &&
6785             !generate_json_filename)
6786         {
6787             strcpy(bs->exact_filename, bs->file->bs->exact_filename);
6788         }
6789     }
6790 
6791     if (bs->exact_filename[0]) {
6792         pstrcpy(bs->filename, sizeof(bs->filename), bs->exact_filename);
6793     } else {
6794         QString *json = qobject_to_json(QOBJECT(bs->full_open_options));
6795         if (snprintf(bs->filename, sizeof(bs->filename), "json:%s",
6796                      qstring_get_str(json)) >= sizeof(bs->filename)) {
6797             /* Give user a hint if we truncated things. */
6798             strcpy(bs->filename + sizeof(bs->filename) - 4, "...");
6799         }
6800         qobject_unref(json);
6801     }
6802 }
6803 
6804 char *bdrv_dirname(BlockDriverState *bs, Error **errp)
6805 {
6806     BlockDriver *drv = bs->drv;
6807 
6808     if (!drv) {
6809         error_setg(errp, "Node '%s' is ejected", bs->node_name);
6810         return NULL;
6811     }
6812 
6813     if (drv->bdrv_dirname) {
6814         return drv->bdrv_dirname(bs, errp);
6815     }
6816 
6817     if (bs->file) {
6818         return bdrv_dirname(bs->file->bs, errp);
6819     }
6820 
6821     bdrv_refresh_filename(bs);
6822     if (bs->exact_filename[0] != '\0') {
6823         return path_combine(bs->exact_filename, "");
6824     }
6825 
6826     error_setg(errp, "Cannot generate a base directory for %s nodes",
6827                drv->format_name);
6828     return NULL;
6829 }
6830 
6831 /*
6832  * Hot add/remove a BDS's child. So the user can take a child offline when
6833  * it is broken and take a new child online
6834  */
6835 void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
6836                     Error **errp)
6837 {
6838 
6839     if (!parent_bs->drv || !parent_bs->drv->bdrv_add_child) {
6840         error_setg(errp, "The node %s does not support adding a child",
6841                    bdrv_get_device_or_node_name(parent_bs));
6842         return;
6843     }
6844 
6845     if (!QLIST_EMPTY(&child_bs->parents)) {
6846         error_setg(errp, "The node %s already has a parent",
6847                    child_bs->node_name);
6848         return;
6849     }
6850 
6851     parent_bs->drv->bdrv_add_child(parent_bs, child_bs, errp);
6852 }
6853 
6854 void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)
6855 {
6856     BdrvChild *tmp;
6857 
6858     if (!parent_bs->drv || !parent_bs->drv->bdrv_del_child) {
6859         error_setg(errp, "The node %s does not support removing a child",
6860                    bdrv_get_device_or_node_name(parent_bs));
6861         return;
6862     }
6863 
6864     QLIST_FOREACH(tmp, &parent_bs->children, next) {
6865         if (tmp == child) {
6866             break;
6867         }
6868     }
6869 
6870     if (!tmp) {
6871         error_setg(errp, "The node %s does not have a child named %s",
6872                    bdrv_get_device_or_node_name(parent_bs),
6873                    bdrv_get_device_or_node_name(child->bs));
6874         return;
6875     }
6876 
6877     parent_bs->drv->bdrv_del_child(parent_bs, child, errp);
6878 }
6879 
6880 int bdrv_make_empty(BdrvChild *c, Error **errp)
6881 {
6882     BlockDriver *drv = c->bs->drv;
6883     int ret;
6884 
6885     assert(c->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED));
6886 
6887     if (!drv->bdrv_make_empty) {
6888         error_setg(errp, "%s does not support emptying nodes",
6889                    drv->format_name);
6890         return -ENOTSUP;
6891     }
6892 
6893     ret = drv->bdrv_make_empty(c->bs);
6894     if (ret < 0) {
6895         error_setg_errno(errp, -ret, "Failed to empty %s",
6896                          c->bs->filename);
6897         return ret;
6898     }
6899 
6900     return 0;
6901 }
6902