xref: /openbmc/qemu/block.c (revision 64c9a921)
1 /*
2  * QEMU System Emulator block driver
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23  */
24 
25 #include "qemu/osdep.h"
26 #include "block/trace.h"
27 #include "block/block_int.h"
28 #include "block/blockjob.h"
29 #include "block/fuse.h"
30 #include "block/nbd.h"
31 #include "block/qdict.h"
32 #include "qemu/error-report.h"
33 #include "block/module_block.h"
34 #include "qemu/main-loop.h"
35 #include "qemu/module.h"
36 #include "qapi/error.h"
37 #include "qapi/qmp/qdict.h"
38 #include "qapi/qmp/qjson.h"
39 #include "qapi/qmp/qnull.h"
40 #include "qapi/qmp/qstring.h"
41 #include "qapi/qobject-output-visitor.h"
42 #include "qapi/qapi-visit-block-core.h"
43 #include "sysemu/block-backend.h"
44 #include "sysemu/sysemu.h"
45 #include "qemu/notify.h"
46 #include "qemu/option.h"
47 #include "qemu/coroutine.h"
48 #include "block/qapi.h"
49 #include "qemu/timer.h"
50 #include "qemu/cutils.h"
51 #include "qemu/id.h"
52 #include "block/coroutines.h"
53 
54 #ifdef CONFIG_BSD
55 #include <sys/ioctl.h>
56 #include <sys/queue.h>
57 #ifndef __DragonFly__
58 #include <sys/disk.h>
59 #endif
60 #endif
61 
62 #ifdef _WIN32
63 #include <windows.h>
64 #endif
65 
66 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
67 
68 static QTAILQ_HEAD(, BlockDriverState) graph_bdrv_states =
69     QTAILQ_HEAD_INITIALIZER(graph_bdrv_states);
70 
71 static QTAILQ_HEAD(, BlockDriverState) all_bdrv_states =
72     QTAILQ_HEAD_INITIALIZER(all_bdrv_states);
73 
74 static QLIST_HEAD(, BlockDriver) bdrv_drivers =
75     QLIST_HEAD_INITIALIZER(bdrv_drivers);
76 
77 static BlockDriverState *bdrv_open_inherit(const char *filename,
78                                            const char *reference,
79                                            QDict *options, int flags,
80                                            BlockDriverState *parent,
81                                            const BdrvChildClass *child_class,
82                                            BdrvChildRole child_role,
83                                            Error **errp);
84 
85 /* If non-zero, use only whitelisted block drivers */
86 static int use_bdrv_whitelist;
87 
88 #ifdef _WIN32
89 static int is_windows_drive_prefix(const char *filename)
90 {
91     return (((filename[0] >= 'a' && filename[0] <= 'z') ||
92              (filename[0] >= 'A' && filename[0] <= 'Z')) &&
93             filename[1] == ':');
94 }
95 
96 int is_windows_drive(const char *filename)
97 {
98     if (is_windows_drive_prefix(filename) &&
99         filename[2] == '\0')
100         return 1;
101     if (strstart(filename, "\\\\.\\", NULL) ||
102         strstart(filename, "//./", NULL))
103         return 1;
104     return 0;
105 }
106 #endif
107 
108 size_t bdrv_opt_mem_align(BlockDriverState *bs)
109 {
110     if (!bs || !bs->drv) {
111         /* page size or 4k (hdd sector size) should be on the safe side */
112         return MAX(4096, qemu_real_host_page_size);
113     }
114 
115     return bs->bl.opt_mem_alignment;
116 }
117 
118 size_t bdrv_min_mem_align(BlockDriverState *bs)
119 {
120     if (!bs || !bs->drv) {
121         /* page size or 4k (hdd sector size) should be on the safe side */
122         return MAX(4096, qemu_real_host_page_size);
123     }
124 
125     return bs->bl.min_mem_alignment;
126 }
127 
128 /* check if the path starts with "<protocol>:" */
129 int path_has_protocol(const char *path)
130 {
131     const char *p;
132 
133 #ifdef _WIN32
134     if (is_windows_drive(path) ||
135         is_windows_drive_prefix(path)) {
136         return 0;
137     }
138     p = path + strcspn(path, ":/\\");
139 #else
140     p = path + strcspn(path, ":/");
141 #endif
142 
143     return *p == ':';
144 }
145 
146 int path_is_absolute(const char *path)
147 {
148 #ifdef _WIN32
149     /* specific case for names like: "\\.\d:" */
150     if (is_windows_drive(path) || is_windows_drive_prefix(path)) {
151         return 1;
152     }
153     return (*path == '/' || *path == '\\');
154 #else
155     return (*path == '/');
156 #endif
157 }
158 
159 /* if filename is absolute, just return its duplicate. Otherwise, build a
160    path to it by considering it is relative to base_path. URL are
161    supported. */
162 char *path_combine(const char *base_path, const char *filename)
163 {
164     const char *protocol_stripped = NULL;
165     const char *p, *p1;
166     char *result;
167     int len;
168 
169     if (path_is_absolute(filename)) {
170         return g_strdup(filename);
171     }
172 
173     if (path_has_protocol(base_path)) {
174         protocol_stripped = strchr(base_path, ':');
175         if (protocol_stripped) {
176             protocol_stripped++;
177         }
178     }
179     p = protocol_stripped ?: base_path;
180 
181     p1 = strrchr(base_path, '/');
182 #ifdef _WIN32
183     {
184         const char *p2;
185         p2 = strrchr(base_path, '\\');
186         if (!p1 || p2 > p1) {
187             p1 = p2;
188         }
189     }
190 #endif
191     if (p1) {
192         p1++;
193     } else {
194         p1 = base_path;
195     }
196     if (p1 > p) {
197         p = p1;
198     }
199     len = p - base_path;
200 
201     result = g_malloc(len + strlen(filename) + 1);
202     memcpy(result, base_path, len);
203     strcpy(result + len, filename);
204 
205     return result;
206 }
207 
208 /*
209  * Helper function for bdrv_parse_filename() implementations to remove optional
210  * protocol prefixes (especially "file:") from a filename and for putting the
211  * stripped filename into the options QDict if there is such a prefix.
212  */
213 void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
214                                       QDict *options)
215 {
216     if (strstart(filename, prefix, &filename)) {
217         /* Stripping the explicit protocol prefix may result in a protocol
218          * prefix being (wrongly) detected (if the filename contains a colon) */
219         if (path_has_protocol(filename)) {
220             GString *fat_filename;
221 
222             /* This means there is some colon before the first slash; therefore,
223              * this cannot be an absolute path */
224             assert(!path_is_absolute(filename));
225 
226             /* And we can thus fix the protocol detection issue by prefixing it
227              * by "./" */
228             fat_filename = g_string_new("./");
229             g_string_append(fat_filename, filename);
230 
231             assert(!path_has_protocol(fat_filename->str));
232 
233             qdict_put(options, "filename",
234                       qstring_from_gstring(fat_filename));
235         } else {
236             /* If no protocol prefix was detected, we can use the shortened
237              * filename as-is */
238             qdict_put_str(options, "filename", filename);
239         }
240     }
241 }
242 
243 
244 /* Returns whether the image file is opened as read-only. Note that this can
245  * return false and writing to the image file is still not possible because the
246  * image is inactivated. */
247 bool bdrv_is_read_only(BlockDriverState *bs)
248 {
249     return bs->read_only;
250 }
251 
252 int bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
253                            bool ignore_allow_rdw, Error **errp)
254 {
255     /* Do not set read_only if copy_on_read is enabled */
256     if (bs->copy_on_read && read_only) {
257         error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
258                    bdrv_get_device_or_node_name(bs));
259         return -EINVAL;
260     }
261 
262     /* Do not clear read_only if it is prohibited */
263     if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
264         !ignore_allow_rdw)
265     {
266         error_setg(errp, "Node '%s' is read only",
267                    bdrv_get_device_or_node_name(bs));
268         return -EPERM;
269     }
270 
271     return 0;
272 }
273 
274 /*
275  * Called by a driver that can only provide a read-only image.
276  *
277  * Returns 0 if the node is already read-only or it could switch the node to
278  * read-only because BDRV_O_AUTO_RDONLY is set.
279  *
280  * Returns -EACCES if the node is read-write and BDRV_O_AUTO_RDONLY is not set
281  * or bdrv_can_set_read_only() forbids making the node read-only. If @errmsg
282  * is not NULL, it is used as the error message for the Error object.
283  */
284 int bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
285                               Error **errp)
286 {
287     int ret = 0;
288 
289     if (!(bs->open_flags & BDRV_O_RDWR)) {
290         return 0;
291     }
292     if (!(bs->open_flags & BDRV_O_AUTO_RDONLY)) {
293         goto fail;
294     }
295 
296     ret = bdrv_can_set_read_only(bs, true, false, NULL);
297     if (ret < 0) {
298         goto fail;
299     }
300 
301     bs->read_only = true;
302     bs->open_flags &= ~BDRV_O_RDWR;
303 
304     return 0;
305 
306 fail:
307     error_setg(errp, "%s", errmsg ?: "Image is read-only");
308     return -EACCES;
309 }
310 
311 /*
312  * If @backing is empty, this function returns NULL without setting
313  * @errp.  In all other cases, NULL will only be returned with @errp
314  * set.
315  *
316  * Therefore, a return value of NULL without @errp set means that
317  * there is no backing file; if @errp is set, there is one but its
318  * absolute filename cannot be generated.
319  */
320 char *bdrv_get_full_backing_filename_from_filename(const char *backed,
321                                                    const char *backing,
322                                                    Error **errp)
323 {
324     if (backing[0] == '\0') {
325         return NULL;
326     } else if (path_has_protocol(backing) || path_is_absolute(backing)) {
327         return g_strdup(backing);
328     } else if (backed[0] == '\0' || strstart(backed, "json:", NULL)) {
329         error_setg(errp, "Cannot use relative backing file names for '%s'",
330                    backed);
331         return NULL;
332     } else {
333         return path_combine(backed, backing);
334     }
335 }
336 
337 /*
338  * If @filename is empty or NULL, this function returns NULL without
339  * setting @errp.  In all other cases, NULL will only be returned with
340  * @errp set.
341  */
342 static char *bdrv_make_absolute_filename(BlockDriverState *relative_to,
343                                          const char *filename, Error **errp)
344 {
345     char *dir, *full_name;
346 
347     if (!filename || filename[0] == '\0') {
348         return NULL;
349     } else if (path_has_protocol(filename) || path_is_absolute(filename)) {
350         return g_strdup(filename);
351     }
352 
353     dir = bdrv_dirname(relative_to, errp);
354     if (!dir) {
355         return NULL;
356     }
357 
358     full_name = g_strconcat(dir, filename, NULL);
359     g_free(dir);
360     return full_name;
361 }
362 
363 char *bdrv_get_full_backing_filename(BlockDriverState *bs, Error **errp)
364 {
365     return bdrv_make_absolute_filename(bs, bs->backing_file, errp);
366 }
367 
368 void bdrv_register(BlockDriver *bdrv)
369 {
370     assert(bdrv->format_name);
371     QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
372 }
373 
374 BlockDriverState *bdrv_new(void)
375 {
376     BlockDriverState *bs;
377     int i;
378 
379     bs = g_new0(BlockDriverState, 1);
380     QLIST_INIT(&bs->dirty_bitmaps);
381     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
382         QLIST_INIT(&bs->op_blockers[i]);
383     }
384     notifier_with_return_list_init(&bs->before_write_notifiers);
385     qemu_co_mutex_init(&bs->reqs_lock);
386     qemu_mutex_init(&bs->dirty_bitmap_mutex);
387     bs->refcnt = 1;
388     bs->aio_context = qemu_get_aio_context();
389 
390     qemu_co_queue_init(&bs->flush_queue);
391 
392     for (i = 0; i < bdrv_drain_all_count; i++) {
393         bdrv_drained_begin(bs);
394     }
395 
396     QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);
397 
398     return bs;
399 }
400 
401 static BlockDriver *bdrv_do_find_format(const char *format_name)
402 {
403     BlockDriver *drv1;
404 
405     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
406         if (!strcmp(drv1->format_name, format_name)) {
407             return drv1;
408         }
409     }
410 
411     return NULL;
412 }
413 
414 BlockDriver *bdrv_find_format(const char *format_name)
415 {
416     BlockDriver *drv1;
417     int i;
418 
419     drv1 = bdrv_do_find_format(format_name);
420     if (drv1) {
421         return drv1;
422     }
423 
424     /* The driver isn't registered, maybe we need to load a module */
425     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
426         if (!strcmp(block_driver_modules[i].format_name, format_name)) {
427             block_module_load_one(block_driver_modules[i].library_name);
428             break;
429         }
430     }
431 
432     return bdrv_do_find_format(format_name);
433 }
434 
435 static int bdrv_format_is_whitelisted(const char *format_name, bool read_only)
436 {
437     static const char *whitelist_rw[] = {
438         CONFIG_BDRV_RW_WHITELIST
439         NULL
440     };
441     static const char *whitelist_ro[] = {
442         CONFIG_BDRV_RO_WHITELIST
443         NULL
444     };
445     const char **p;
446 
447     if (!whitelist_rw[0] && !whitelist_ro[0]) {
448         return 1;               /* no whitelist, anything goes */
449     }
450 
451     for (p = whitelist_rw; *p; p++) {
452         if (!strcmp(format_name, *p)) {
453             return 1;
454         }
455     }
456     if (read_only) {
457         for (p = whitelist_ro; *p; p++) {
458             if (!strcmp(format_name, *p)) {
459                 return 1;
460             }
461         }
462     }
463     return 0;
464 }
465 
466 int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
467 {
468     return bdrv_format_is_whitelisted(drv->format_name, read_only);
469 }
470 
471 bool bdrv_uses_whitelist(void)
472 {
473     return use_bdrv_whitelist;
474 }
475 
476 typedef struct CreateCo {
477     BlockDriver *drv;
478     char *filename;
479     QemuOpts *opts;
480     int ret;
481     Error *err;
482 } CreateCo;
483 
484 static void coroutine_fn bdrv_create_co_entry(void *opaque)
485 {
486     Error *local_err = NULL;
487     int ret;
488 
489     CreateCo *cco = opaque;
490     assert(cco->drv);
491 
492     ret = cco->drv->bdrv_co_create_opts(cco->drv,
493                                         cco->filename, cco->opts, &local_err);
494     error_propagate(&cco->err, local_err);
495     cco->ret = ret;
496 }
497 
498 int bdrv_create(BlockDriver *drv, const char* filename,
499                 QemuOpts *opts, Error **errp)
500 {
501     int ret;
502 
503     Coroutine *co;
504     CreateCo cco = {
505         .drv = drv,
506         .filename = g_strdup(filename),
507         .opts = opts,
508         .ret = NOT_DONE,
509         .err = NULL,
510     };
511 
512     if (!drv->bdrv_co_create_opts) {
513         error_setg(errp, "Driver '%s' does not support image creation", drv->format_name);
514         ret = -ENOTSUP;
515         goto out;
516     }
517 
518     if (qemu_in_coroutine()) {
519         /* Fast-path if already in coroutine context */
520         bdrv_create_co_entry(&cco);
521     } else {
522         co = qemu_coroutine_create(bdrv_create_co_entry, &cco);
523         qemu_coroutine_enter(co);
524         while (cco.ret == NOT_DONE) {
525             aio_poll(qemu_get_aio_context(), true);
526         }
527     }
528 
529     ret = cco.ret;
530     if (ret < 0) {
531         if (cco.err) {
532             error_propagate(errp, cco.err);
533         } else {
534             error_setg_errno(errp, -ret, "Could not create image");
535         }
536     }
537 
538 out:
539     g_free(cco.filename);
540     return ret;
541 }
542 
543 /**
544  * Helper function for bdrv_create_file_fallback(): Resize @blk to at
545  * least the given @minimum_size.
546  *
547  * On success, return @blk's actual length.
548  * Otherwise, return -errno.
549  */
550 static int64_t create_file_fallback_truncate(BlockBackend *blk,
551                                              int64_t minimum_size, Error **errp)
552 {
553     Error *local_err = NULL;
554     int64_t size;
555     int ret;
556 
557     ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
558                        &local_err);
559     if (ret < 0 && ret != -ENOTSUP) {
560         error_propagate(errp, local_err);
561         return ret;
562     }
563 
564     size = blk_getlength(blk);
565     if (size < 0) {
566         error_free(local_err);
567         error_setg_errno(errp, -size,
568                          "Failed to inquire the new image file's length");
569         return size;
570     }
571 
572     if (size < minimum_size) {
573         /* Need to grow the image, but we failed to do that */
574         error_propagate(errp, local_err);
575         return -ENOTSUP;
576     }
577 
578     error_free(local_err);
579     local_err = NULL;
580 
581     return size;
582 }
583 
584 /**
585  * Helper function for bdrv_create_file_fallback(): Zero the first
586  * sector to remove any potentially pre-existing image header.
587  */
588 static int create_file_fallback_zero_first_sector(BlockBackend *blk,
589                                                   int64_t current_size,
590                                                   Error **errp)
591 {
592     int64_t bytes_to_clear;
593     int ret;
594 
595     bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
596     if (bytes_to_clear) {
597         ret = blk_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
598         if (ret < 0) {
599             error_setg_errno(errp, -ret,
600                              "Failed to clear the new image's first sector");
601             return ret;
602         }
603     }
604 
605     return 0;
606 }
607 
608 /**
609  * Simple implementation of bdrv_co_create_opts for protocol drivers
610  * which only support creation via opening a file
611  * (usually existing raw storage device)
612  */
613 int coroutine_fn bdrv_co_create_opts_simple(BlockDriver *drv,
614                                             const char *filename,
615                                             QemuOpts *opts,
616                                             Error **errp)
617 {
618     BlockBackend *blk;
619     QDict *options;
620     int64_t size = 0;
621     char *buf = NULL;
622     PreallocMode prealloc;
623     Error *local_err = NULL;
624     int ret;
625 
626     size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
627     buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
628     prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
629                                PREALLOC_MODE_OFF, &local_err);
630     g_free(buf);
631     if (local_err) {
632         error_propagate(errp, local_err);
633         return -EINVAL;
634     }
635 
636     if (prealloc != PREALLOC_MODE_OFF) {
637         error_setg(errp, "Unsupported preallocation mode '%s'",
638                    PreallocMode_str(prealloc));
639         return -ENOTSUP;
640     }
641 
642     options = qdict_new();
643     qdict_put_str(options, "driver", drv->format_name);
644 
645     blk = blk_new_open(filename, NULL, options,
646                        BDRV_O_RDWR | BDRV_O_RESIZE, errp);
647     if (!blk) {
648         error_prepend(errp, "Protocol driver '%s' does not support image "
649                       "creation, and opening the image failed: ",
650                       drv->format_name);
651         return -EINVAL;
652     }
653 
654     size = create_file_fallback_truncate(blk, size, errp);
655     if (size < 0) {
656         ret = size;
657         goto out;
658     }
659 
660     ret = create_file_fallback_zero_first_sector(blk, size, errp);
661     if (ret < 0) {
662         goto out;
663     }
664 
665     ret = 0;
666 out:
667     blk_unref(blk);
668     return ret;
669 }
670 
671 int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp)
672 {
673     BlockDriver *drv;
674 
675     drv = bdrv_find_protocol(filename, true, errp);
676     if (drv == NULL) {
677         return -ENOENT;
678     }
679 
680     return bdrv_create(drv, filename, opts, errp);
681 }
682 
683 int coroutine_fn bdrv_co_delete_file(BlockDriverState *bs, Error **errp)
684 {
685     Error *local_err = NULL;
686     int ret;
687 
688     assert(bs != NULL);
689 
690     if (!bs->drv) {
691         error_setg(errp, "Block node '%s' is not opened", bs->filename);
692         return -ENOMEDIUM;
693     }
694 
695     if (!bs->drv->bdrv_co_delete_file) {
696         error_setg(errp, "Driver '%s' does not support image deletion",
697                    bs->drv->format_name);
698         return -ENOTSUP;
699     }
700 
701     ret = bs->drv->bdrv_co_delete_file(bs, &local_err);
702     if (ret < 0) {
703         error_propagate(errp, local_err);
704     }
705 
706     return ret;
707 }
708 
709 /**
710  * Try to get @bs's logical and physical block size.
711  * On success, store them in @bsz struct and return 0.
712  * On failure return -errno.
713  * @bs must not be empty.
714  */
715 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
716 {
717     BlockDriver *drv = bs->drv;
718     BlockDriverState *filtered = bdrv_filter_bs(bs);
719 
720     if (drv && drv->bdrv_probe_blocksizes) {
721         return drv->bdrv_probe_blocksizes(bs, bsz);
722     } else if (filtered) {
723         return bdrv_probe_blocksizes(filtered, bsz);
724     }
725 
726     return -ENOTSUP;
727 }
728 
729 /**
730  * Try to get @bs's geometry (cyls, heads, sectors).
731  * On success, store them in @geo struct and return 0.
732  * On failure return -errno.
733  * @bs must not be empty.
734  */
735 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
736 {
737     BlockDriver *drv = bs->drv;
738     BlockDriverState *filtered = bdrv_filter_bs(bs);
739 
740     if (drv && drv->bdrv_probe_geometry) {
741         return drv->bdrv_probe_geometry(bs, geo);
742     } else if (filtered) {
743         return bdrv_probe_geometry(filtered, geo);
744     }
745 
746     return -ENOTSUP;
747 }
748 
749 /*
750  * Create a uniquely-named empty temporary file.
751  * Return 0 upon success, otherwise a negative errno value.
752  */
753 int get_tmp_filename(char *filename, int size)
754 {
755 #ifdef _WIN32
756     char temp_dir[MAX_PATH];
757     /* GetTempFileName requires that its output buffer (4th param)
758        have length MAX_PATH or greater.  */
759     assert(size >= MAX_PATH);
760     return (GetTempPath(MAX_PATH, temp_dir)
761             && GetTempFileName(temp_dir, "qem", 0, filename)
762             ? 0 : -GetLastError());
763 #else
764     int fd;
765     const char *tmpdir;
766     tmpdir = getenv("TMPDIR");
767     if (!tmpdir) {
768         tmpdir = "/var/tmp";
769     }
770     if (snprintf(filename, size, "%s/vl.XXXXXX", tmpdir) >= size) {
771         return -EOVERFLOW;
772     }
773     fd = mkstemp(filename);
774     if (fd < 0) {
775         return -errno;
776     }
777     if (close(fd) != 0) {
778         unlink(filename);
779         return -errno;
780     }
781     return 0;
782 #endif
783 }
784 
785 /*
786  * Detect host devices. By convention, /dev/cdrom[N] is always
787  * recognized as a host CDROM.
788  */
789 static BlockDriver *find_hdev_driver(const char *filename)
790 {
791     int score_max = 0, score;
792     BlockDriver *drv = NULL, *d;
793 
794     QLIST_FOREACH(d, &bdrv_drivers, list) {
795         if (d->bdrv_probe_device) {
796             score = d->bdrv_probe_device(filename);
797             if (score > score_max) {
798                 score_max = score;
799                 drv = d;
800             }
801         }
802     }
803 
804     return drv;
805 }
806 
807 static BlockDriver *bdrv_do_find_protocol(const char *protocol)
808 {
809     BlockDriver *drv1;
810 
811     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
812         if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
813             return drv1;
814         }
815     }
816 
817     return NULL;
818 }
819 
820 BlockDriver *bdrv_find_protocol(const char *filename,
821                                 bool allow_protocol_prefix,
822                                 Error **errp)
823 {
824     BlockDriver *drv1;
825     char protocol[128];
826     int len;
827     const char *p;
828     int i;
829 
830     /* TODO Drivers without bdrv_file_open must be specified explicitly */
831 
832     /*
833      * XXX(hch): we really should not let host device detection
834      * override an explicit protocol specification, but moving this
835      * later breaks access to device names with colons in them.
836      * Thanks to the brain-dead persistent naming schemes on udev-
837      * based Linux systems those actually are quite common.
838      */
839     drv1 = find_hdev_driver(filename);
840     if (drv1) {
841         return drv1;
842     }
843 
844     if (!path_has_protocol(filename) || !allow_protocol_prefix) {
845         return &bdrv_file;
846     }
847 
848     p = strchr(filename, ':');
849     assert(p != NULL);
850     len = p - filename;
851     if (len > sizeof(protocol) - 1)
852         len = sizeof(protocol) - 1;
853     memcpy(protocol, filename, len);
854     protocol[len] = '\0';
855 
856     drv1 = bdrv_do_find_protocol(protocol);
857     if (drv1) {
858         return drv1;
859     }
860 
861     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
862         if (block_driver_modules[i].protocol_name &&
863             !strcmp(block_driver_modules[i].protocol_name, protocol)) {
864             block_module_load_one(block_driver_modules[i].library_name);
865             break;
866         }
867     }
868 
869     drv1 = bdrv_do_find_protocol(protocol);
870     if (!drv1) {
871         error_setg(errp, "Unknown protocol '%s'", protocol);
872     }
873     return drv1;
874 }
875 
876 /*
877  * Guess image format by probing its contents.
878  * This is not a good idea when your image is raw (CVE-2008-2004), but
879  * we do it anyway for backward compatibility.
880  *
881  * @buf         contains the image's first @buf_size bytes.
882  * @buf_size    is the buffer size in bytes (generally BLOCK_PROBE_BUF_SIZE,
883  *              but can be smaller if the image file is smaller)
884  * @filename    is its filename.
885  *
886  * For all block drivers, call the bdrv_probe() method to get its
887  * probing score.
888  * Return the first block driver with the highest probing score.
889  */
890 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
891                             const char *filename)
892 {
893     int score_max = 0, score;
894     BlockDriver *drv = NULL, *d;
895 
896     QLIST_FOREACH(d, &bdrv_drivers, list) {
897         if (d->bdrv_probe) {
898             score = d->bdrv_probe(buf, buf_size, filename);
899             if (score > score_max) {
900                 score_max = score;
901                 drv = d;
902             }
903         }
904     }
905 
906     return drv;
907 }
908 
909 static int find_image_format(BlockBackend *file, const char *filename,
910                              BlockDriver **pdrv, Error **errp)
911 {
912     BlockDriver *drv;
913     uint8_t buf[BLOCK_PROBE_BUF_SIZE];
914     int ret = 0;
915 
916     /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
917     if (blk_is_sg(file) || !blk_is_inserted(file) || blk_getlength(file) == 0) {
918         *pdrv = &bdrv_raw;
919         return ret;
920     }
921 
922     ret = blk_pread(file, 0, buf, sizeof(buf));
923     if (ret < 0) {
924         error_setg_errno(errp, -ret, "Could not read image for determining its "
925                          "format");
926         *pdrv = NULL;
927         return ret;
928     }
929 
930     drv = bdrv_probe_all(buf, ret, filename);
931     if (!drv) {
932         error_setg(errp, "Could not determine image format: No compatible "
933                    "driver found");
934         ret = -ENOENT;
935     }
936     *pdrv = drv;
937     return ret;
938 }
939 
940 /**
941  * Set the current 'total_sectors' value
942  * Return 0 on success, -errno on error.
943  */
944 int refresh_total_sectors(BlockDriverState *bs, int64_t hint)
945 {
946     BlockDriver *drv = bs->drv;
947 
948     if (!drv) {
949         return -ENOMEDIUM;
950     }
951 
952     /* Do not attempt drv->bdrv_getlength() on scsi-generic devices */
953     if (bdrv_is_sg(bs))
954         return 0;
955 
956     /* query actual device if possible, otherwise just trust the hint */
957     if (drv->bdrv_getlength) {
958         int64_t length = drv->bdrv_getlength(bs);
959         if (length < 0) {
960             return length;
961         }
962         hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
963     }
964 
965     bs->total_sectors = hint;
966 
967     if (bs->total_sectors * BDRV_SECTOR_SIZE > BDRV_MAX_LENGTH) {
968         return -EFBIG;
969     }
970 
971     return 0;
972 }
973 
974 /**
975  * Combines a QDict of new block driver @options with any missing options taken
976  * from @old_options, so that leaving out an option defaults to its old value.
977  */
978 static void bdrv_join_options(BlockDriverState *bs, QDict *options,
979                               QDict *old_options)
980 {
981     if (bs->drv && bs->drv->bdrv_join_options) {
982         bs->drv->bdrv_join_options(options, old_options);
983     } else {
984         qdict_join(options, old_options, false);
985     }
986 }
987 
988 static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
989                                                             int open_flags,
990                                                             Error **errp)
991 {
992     Error *local_err = NULL;
993     char *value = qemu_opt_get_del(opts, "detect-zeroes");
994     BlockdevDetectZeroesOptions detect_zeroes =
995         qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
996                         BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
997     g_free(value);
998     if (local_err) {
999         error_propagate(errp, local_err);
1000         return detect_zeroes;
1001     }
1002 
1003     if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
1004         !(open_flags & BDRV_O_UNMAP))
1005     {
1006         error_setg(errp, "setting detect-zeroes to unmap is not allowed "
1007                    "without setting discard operation to unmap");
1008     }
1009 
1010     return detect_zeroes;
1011 }
1012 
1013 /**
1014  * Set open flags for aio engine
1015  *
1016  * Return 0 on success, -1 if the engine specified is invalid
1017  */
1018 int bdrv_parse_aio(const char *mode, int *flags)
1019 {
1020     if (!strcmp(mode, "threads")) {
1021         /* do nothing, default */
1022     } else if (!strcmp(mode, "native")) {
1023         *flags |= BDRV_O_NATIVE_AIO;
1024 #ifdef CONFIG_LINUX_IO_URING
1025     } else if (!strcmp(mode, "io_uring")) {
1026         *flags |= BDRV_O_IO_URING;
1027 #endif
1028     } else {
1029         return -1;
1030     }
1031 
1032     return 0;
1033 }
1034 
1035 /**
1036  * Set open flags for a given discard mode
1037  *
1038  * Return 0 on success, -1 if the discard mode was invalid.
1039  */
1040 int bdrv_parse_discard_flags(const char *mode, int *flags)
1041 {
1042     *flags &= ~BDRV_O_UNMAP;
1043 
1044     if (!strcmp(mode, "off") || !strcmp(mode, "ignore")) {
1045         /* do nothing */
1046     } else if (!strcmp(mode, "on") || !strcmp(mode, "unmap")) {
1047         *flags |= BDRV_O_UNMAP;
1048     } else {
1049         return -1;
1050     }
1051 
1052     return 0;
1053 }
1054 
1055 /**
1056  * Set open flags for a given cache mode
1057  *
1058  * Return 0 on success, -1 if the cache mode was invalid.
1059  */
1060 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough)
1061 {
1062     *flags &= ~BDRV_O_CACHE_MASK;
1063 
1064     if (!strcmp(mode, "off") || !strcmp(mode, "none")) {
1065         *writethrough = false;
1066         *flags |= BDRV_O_NOCACHE;
1067     } else if (!strcmp(mode, "directsync")) {
1068         *writethrough = true;
1069         *flags |= BDRV_O_NOCACHE;
1070     } else if (!strcmp(mode, "writeback")) {
1071         *writethrough = false;
1072     } else if (!strcmp(mode, "unsafe")) {
1073         *writethrough = false;
1074         *flags |= BDRV_O_NO_FLUSH;
1075     } else if (!strcmp(mode, "writethrough")) {
1076         *writethrough = true;
1077     } else {
1078         return -1;
1079     }
1080 
1081     return 0;
1082 }
1083 
1084 static char *bdrv_child_get_parent_desc(BdrvChild *c)
1085 {
1086     BlockDriverState *parent = c->opaque;
1087     return g_strdup(bdrv_get_device_or_node_name(parent));
1088 }
1089 
1090 static void bdrv_child_cb_drained_begin(BdrvChild *child)
1091 {
1092     BlockDriverState *bs = child->opaque;
1093     bdrv_do_drained_begin_quiesce(bs, NULL, false);
1094 }
1095 
1096 static bool bdrv_child_cb_drained_poll(BdrvChild *child)
1097 {
1098     BlockDriverState *bs = child->opaque;
1099     return bdrv_drain_poll(bs, false, NULL, false);
1100 }
1101 
1102 static void bdrv_child_cb_drained_end(BdrvChild *child,
1103                                       int *drained_end_counter)
1104 {
1105     BlockDriverState *bs = child->opaque;
1106     bdrv_drained_end_no_poll(bs, drained_end_counter);
1107 }
1108 
1109 static int bdrv_child_cb_inactivate(BdrvChild *child)
1110 {
1111     BlockDriverState *bs = child->opaque;
1112     assert(bs->open_flags & BDRV_O_INACTIVE);
1113     return 0;
1114 }
1115 
1116 static bool bdrv_child_cb_can_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1117                                           GSList **ignore, Error **errp)
1118 {
1119     BlockDriverState *bs = child->opaque;
1120     return bdrv_can_set_aio_context(bs, ctx, ignore, errp);
1121 }
1122 
1123 static void bdrv_child_cb_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1124                                       GSList **ignore)
1125 {
1126     BlockDriverState *bs = child->opaque;
1127     return bdrv_set_aio_context_ignore(bs, ctx, ignore);
1128 }
1129 
1130 /*
1131  * Returns the options and flags that a temporary snapshot should get, based on
1132  * the originally requested flags (the originally requested image will have
1133  * flags like a backing file)
1134  */
1135 static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
1136                                        int parent_flags, QDict *parent_options)
1137 {
1138     *child_flags = (parent_flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
1139 
1140     /* For temporary files, unconditional cache=unsafe is fine */
1141     qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
1142     qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
1143 
1144     /* Copy the read-only and discard options from the parent */
1145     qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1146     qdict_copy_default(child_options, parent_options, BDRV_OPT_DISCARD);
1147 
1148     /* aio=native doesn't work for cache.direct=off, so disable it for the
1149      * temporary snapshot */
1150     *child_flags &= ~BDRV_O_NATIVE_AIO;
1151 }
1152 
1153 static void bdrv_backing_attach(BdrvChild *c)
1154 {
1155     BlockDriverState *parent = c->opaque;
1156     BlockDriverState *backing_hd = c->bs;
1157 
1158     assert(!parent->backing_blocker);
1159     error_setg(&parent->backing_blocker,
1160                "node is used as backing hd of '%s'",
1161                bdrv_get_device_or_node_name(parent));
1162 
1163     bdrv_refresh_filename(backing_hd);
1164 
1165     parent->open_flags &= ~BDRV_O_NO_BACKING;
1166 
1167     bdrv_op_block_all(backing_hd, parent->backing_blocker);
1168     /* Otherwise we won't be able to commit or stream */
1169     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
1170                     parent->backing_blocker);
1171     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
1172                     parent->backing_blocker);
1173     /*
1174      * We do backup in 3 ways:
1175      * 1. drive backup
1176      *    The target bs is new opened, and the source is top BDS
1177      * 2. blockdev backup
1178      *    Both the source and the target are top BDSes.
1179      * 3. internal backup(used for block replication)
1180      *    Both the source and the target are backing file
1181      *
1182      * In case 1 and 2, neither the source nor the target is the backing file.
1183      * In case 3, we will block the top BDS, so there is only one block job
1184      * for the top BDS and its backing chain.
1185      */
1186     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
1187                     parent->backing_blocker);
1188     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
1189                     parent->backing_blocker);
1190 }
1191 
1192 static void bdrv_backing_detach(BdrvChild *c)
1193 {
1194     BlockDriverState *parent = c->opaque;
1195 
1196     assert(parent->backing_blocker);
1197     bdrv_op_unblock_all(c->bs, parent->backing_blocker);
1198     error_free(parent->backing_blocker);
1199     parent->backing_blocker = NULL;
1200 }
1201 
1202 static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
1203                                         const char *filename, Error **errp)
1204 {
1205     BlockDriverState *parent = c->opaque;
1206     bool read_only = bdrv_is_read_only(parent);
1207     int ret;
1208 
1209     if (read_only) {
1210         ret = bdrv_reopen_set_read_only(parent, false, errp);
1211         if (ret < 0) {
1212             return ret;
1213         }
1214     }
1215 
1216     ret = bdrv_change_backing_file(parent, filename,
1217                                    base->drv ? base->drv->format_name : "",
1218                                    false);
1219     if (ret < 0) {
1220         error_setg_errno(errp, -ret, "Could not update backing file link");
1221     }
1222 
1223     if (read_only) {
1224         bdrv_reopen_set_read_only(parent, true, NULL);
1225     }
1226 
1227     return ret;
1228 }
1229 
1230 /*
1231  * Returns the options and flags that a generic child of a BDS should
1232  * get, based on the given options and flags for the parent BDS.
1233  */
1234 static void bdrv_inherited_options(BdrvChildRole role, bool parent_is_format,
1235                                    int *child_flags, QDict *child_options,
1236                                    int parent_flags, QDict *parent_options)
1237 {
1238     int flags = parent_flags;
1239 
1240     /*
1241      * First, decide whether to set, clear, or leave BDRV_O_PROTOCOL.
1242      * Generally, the question to answer is: Should this child be
1243      * format-probed by default?
1244      */
1245 
1246     /*
1247      * Pure and non-filtered data children of non-format nodes should
1248      * be probed by default (even when the node itself has BDRV_O_PROTOCOL
1249      * set).  This only affects a very limited set of drivers (namely
1250      * quorum and blkverify when this comment was written).
1251      * Force-clear BDRV_O_PROTOCOL then.
1252      */
1253     if (!parent_is_format &&
1254         (role & BDRV_CHILD_DATA) &&
1255         !(role & (BDRV_CHILD_METADATA | BDRV_CHILD_FILTERED)))
1256     {
1257         flags &= ~BDRV_O_PROTOCOL;
1258     }
1259 
1260     /*
1261      * All children of format nodes (except for COW children) and all
1262      * metadata children in general should never be format-probed.
1263      * Force-set BDRV_O_PROTOCOL then.
1264      */
1265     if ((parent_is_format && !(role & BDRV_CHILD_COW)) ||
1266         (role & BDRV_CHILD_METADATA))
1267     {
1268         flags |= BDRV_O_PROTOCOL;
1269     }
1270 
1271     /*
1272      * If the cache mode isn't explicitly set, inherit direct and no-flush from
1273      * the parent.
1274      */
1275     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1276     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1277     qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1278 
1279     if (role & BDRV_CHILD_COW) {
1280         /* backing files are opened read-only by default */
1281         qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
1282         qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
1283     } else {
1284         /* Inherit the read-only option from the parent if it's not set */
1285         qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1286         qdict_copy_default(child_options, parent_options,
1287                            BDRV_OPT_AUTO_READ_ONLY);
1288     }
1289 
1290     /*
1291      * bdrv_co_pdiscard() respects unmap policy for the parent, so we
1292      * can default to enable it on lower layers regardless of the
1293      * parent option.
1294      */
1295     qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
1296 
1297     /* Clear flags that only apply to the top layer */
1298     flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);
1299 
1300     if (role & BDRV_CHILD_METADATA) {
1301         flags &= ~BDRV_O_NO_IO;
1302     }
1303     if (role & BDRV_CHILD_COW) {
1304         flags &= ~BDRV_O_TEMPORARY;
1305     }
1306 
1307     *child_flags = flags;
1308 }
1309 
1310 static void bdrv_child_cb_attach(BdrvChild *child)
1311 {
1312     BlockDriverState *bs = child->opaque;
1313 
1314     if (child->role & BDRV_CHILD_COW) {
1315         bdrv_backing_attach(child);
1316     }
1317 
1318     bdrv_apply_subtree_drain(child, bs);
1319 }
1320 
1321 static void bdrv_child_cb_detach(BdrvChild *child)
1322 {
1323     BlockDriverState *bs = child->opaque;
1324 
1325     if (child->role & BDRV_CHILD_COW) {
1326         bdrv_backing_detach(child);
1327     }
1328 
1329     bdrv_unapply_subtree_drain(child, bs);
1330 }
1331 
1332 static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
1333                                          const char *filename, Error **errp)
1334 {
1335     if (c->role & BDRV_CHILD_COW) {
1336         return bdrv_backing_update_filename(c, base, filename, errp);
1337     }
1338     return 0;
1339 }
1340 
1341 const BdrvChildClass child_of_bds = {
1342     .parent_is_bds   = true,
1343     .get_parent_desc = bdrv_child_get_parent_desc,
1344     .inherit_options = bdrv_inherited_options,
1345     .drained_begin   = bdrv_child_cb_drained_begin,
1346     .drained_poll    = bdrv_child_cb_drained_poll,
1347     .drained_end     = bdrv_child_cb_drained_end,
1348     .attach          = bdrv_child_cb_attach,
1349     .detach          = bdrv_child_cb_detach,
1350     .inactivate      = bdrv_child_cb_inactivate,
1351     .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
1352     .set_aio_ctx     = bdrv_child_cb_set_aio_ctx,
1353     .update_filename = bdrv_child_cb_update_filename,
1354 };
1355 
1356 static int bdrv_open_flags(BlockDriverState *bs, int flags)
1357 {
1358     int open_flags = flags;
1359 
1360     /*
1361      * Clear flags that are internal to the block layer before opening the
1362      * image.
1363      */
1364     open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_PROTOCOL);
1365 
1366     return open_flags;
1367 }
1368 
1369 static void update_flags_from_options(int *flags, QemuOpts *opts)
1370 {
1371     *flags &= ~(BDRV_O_CACHE_MASK | BDRV_O_RDWR | BDRV_O_AUTO_RDONLY);
1372 
1373     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
1374         *flags |= BDRV_O_NO_FLUSH;
1375     }
1376 
1377     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
1378         *flags |= BDRV_O_NOCACHE;
1379     }
1380 
1381     if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
1382         *flags |= BDRV_O_RDWR;
1383     }
1384 
1385     if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
1386         *flags |= BDRV_O_AUTO_RDONLY;
1387     }
1388 }
1389 
1390 static void update_options_from_flags(QDict *options, int flags)
1391 {
1392     if (!qdict_haskey(options, BDRV_OPT_CACHE_DIRECT)) {
1393         qdict_put_bool(options, BDRV_OPT_CACHE_DIRECT, flags & BDRV_O_NOCACHE);
1394     }
1395     if (!qdict_haskey(options, BDRV_OPT_CACHE_NO_FLUSH)) {
1396         qdict_put_bool(options, BDRV_OPT_CACHE_NO_FLUSH,
1397                        flags & BDRV_O_NO_FLUSH);
1398     }
1399     if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
1400         qdict_put_bool(options, BDRV_OPT_READ_ONLY, !(flags & BDRV_O_RDWR));
1401     }
1402     if (!qdict_haskey(options, BDRV_OPT_AUTO_READ_ONLY)) {
1403         qdict_put_bool(options, BDRV_OPT_AUTO_READ_ONLY,
1404                        flags & BDRV_O_AUTO_RDONLY);
1405     }
1406 }
1407 
1408 static void bdrv_assign_node_name(BlockDriverState *bs,
1409                                   const char *node_name,
1410                                   Error **errp)
1411 {
1412     char *gen_node_name = NULL;
1413 
1414     if (!node_name) {
1415         node_name = gen_node_name = id_generate(ID_BLOCK);
1416     } else if (!id_wellformed(node_name)) {
1417         /*
1418          * Check for empty string or invalid characters, but not if it is
1419          * generated (generated names use characters not available to the user)
1420          */
1421         error_setg(errp, "Invalid node name");
1422         return;
1423     }
1424 
1425     /* takes care of avoiding namespaces collisions */
1426     if (blk_by_name(node_name)) {
1427         error_setg(errp, "node-name=%s is conflicting with a device id",
1428                    node_name);
1429         goto out;
1430     }
1431 
1432     /* takes care of avoiding duplicates node names */
1433     if (bdrv_find_node(node_name)) {
1434         error_setg(errp, "Duplicate node name");
1435         goto out;
1436     }
1437 
1438     /* Make sure that the node name isn't truncated */
1439     if (strlen(node_name) >= sizeof(bs->node_name)) {
1440         error_setg(errp, "Node name too long");
1441         goto out;
1442     }
1443 
1444     /* copy node name into the bs and insert it into the graph list */
1445     pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
1446     QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
1447 out:
1448     g_free(gen_node_name);
1449 }
1450 
1451 static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
1452                             const char *node_name, QDict *options,
1453                             int open_flags, Error **errp)
1454 {
1455     Error *local_err = NULL;
1456     int i, ret;
1457 
1458     bdrv_assign_node_name(bs, node_name, &local_err);
1459     if (local_err) {
1460         error_propagate(errp, local_err);
1461         return -EINVAL;
1462     }
1463 
1464     bs->drv = drv;
1465     bs->read_only = !(bs->open_flags & BDRV_O_RDWR);
1466     bs->opaque = g_malloc0(drv->instance_size);
1467 
1468     if (drv->bdrv_file_open) {
1469         assert(!drv->bdrv_needs_filename || bs->filename[0]);
1470         ret = drv->bdrv_file_open(bs, options, open_flags, &local_err);
1471     } else if (drv->bdrv_open) {
1472         ret = drv->bdrv_open(bs, options, open_flags, &local_err);
1473     } else {
1474         ret = 0;
1475     }
1476 
1477     if (ret < 0) {
1478         if (local_err) {
1479             error_propagate(errp, local_err);
1480         } else if (bs->filename[0]) {
1481             error_setg_errno(errp, -ret, "Could not open '%s'", bs->filename);
1482         } else {
1483             error_setg_errno(errp, -ret, "Could not open image");
1484         }
1485         goto open_failed;
1486     }
1487 
1488     ret = refresh_total_sectors(bs, bs->total_sectors);
1489     if (ret < 0) {
1490         error_setg_errno(errp, -ret, "Could not refresh total sector count");
1491         return ret;
1492     }
1493 
1494     bdrv_refresh_limits(bs, &local_err);
1495     if (local_err) {
1496         error_propagate(errp, local_err);
1497         return -EINVAL;
1498     }
1499 
1500     assert(bdrv_opt_mem_align(bs) != 0);
1501     assert(bdrv_min_mem_align(bs) != 0);
1502     assert(is_power_of_2(bs->bl.request_alignment));
1503 
1504     for (i = 0; i < bs->quiesce_counter; i++) {
1505         if (drv->bdrv_co_drain_begin) {
1506             drv->bdrv_co_drain_begin(bs);
1507         }
1508     }
1509 
1510     return 0;
1511 open_failed:
1512     bs->drv = NULL;
1513     if (bs->file != NULL) {
1514         bdrv_unref_child(bs, bs->file);
1515         bs->file = NULL;
1516     }
1517     g_free(bs->opaque);
1518     bs->opaque = NULL;
1519     return ret;
1520 }
1521 
1522 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
1523                                        int flags, Error **errp)
1524 {
1525     BlockDriverState *bs;
1526     int ret;
1527 
1528     bs = bdrv_new();
1529     bs->open_flags = flags;
1530     bs->explicit_options = qdict_new();
1531     bs->options = qdict_new();
1532     bs->opaque = NULL;
1533 
1534     update_options_from_flags(bs->options, flags);
1535 
1536     ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
1537     if (ret < 0) {
1538         qobject_unref(bs->explicit_options);
1539         bs->explicit_options = NULL;
1540         qobject_unref(bs->options);
1541         bs->options = NULL;
1542         bdrv_unref(bs);
1543         return NULL;
1544     }
1545 
1546     return bs;
1547 }
1548 
1549 QemuOptsList bdrv_runtime_opts = {
1550     .name = "bdrv_common",
1551     .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
1552     .desc = {
1553         {
1554             .name = "node-name",
1555             .type = QEMU_OPT_STRING,
1556             .help = "Node name of the block device node",
1557         },
1558         {
1559             .name = "driver",
1560             .type = QEMU_OPT_STRING,
1561             .help = "Block driver to use for the node",
1562         },
1563         {
1564             .name = BDRV_OPT_CACHE_DIRECT,
1565             .type = QEMU_OPT_BOOL,
1566             .help = "Bypass software writeback cache on the host",
1567         },
1568         {
1569             .name = BDRV_OPT_CACHE_NO_FLUSH,
1570             .type = QEMU_OPT_BOOL,
1571             .help = "Ignore flush requests",
1572         },
1573         {
1574             .name = BDRV_OPT_READ_ONLY,
1575             .type = QEMU_OPT_BOOL,
1576             .help = "Node is opened in read-only mode",
1577         },
1578         {
1579             .name = BDRV_OPT_AUTO_READ_ONLY,
1580             .type = QEMU_OPT_BOOL,
1581             .help = "Node can become read-only if opening read-write fails",
1582         },
1583         {
1584             .name = "detect-zeroes",
1585             .type = QEMU_OPT_STRING,
1586             .help = "try to optimize zero writes (off, on, unmap)",
1587         },
1588         {
1589             .name = BDRV_OPT_DISCARD,
1590             .type = QEMU_OPT_STRING,
1591             .help = "discard operation (ignore/off, unmap/on)",
1592         },
1593         {
1594             .name = BDRV_OPT_FORCE_SHARE,
1595             .type = QEMU_OPT_BOOL,
1596             .help = "always accept other writers (default: off)",
1597         },
1598         { /* end of list */ }
1599     },
1600 };
1601 
1602 QemuOptsList bdrv_create_opts_simple = {
1603     .name = "simple-create-opts",
1604     .head = QTAILQ_HEAD_INITIALIZER(bdrv_create_opts_simple.head),
1605     .desc = {
1606         {
1607             .name = BLOCK_OPT_SIZE,
1608             .type = QEMU_OPT_SIZE,
1609             .help = "Virtual disk size"
1610         },
1611         {
1612             .name = BLOCK_OPT_PREALLOC,
1613             .type = QEMU_OPT_STRING,
1614             .help = "Preallocation mode (allowed values: off)"
1615         },
1616         { /* end of list */ }
1617     }
1618 };
1619 
1620 /*
1621  * Common part for opening disk images and files
1622  *
1623  * Removes all processed options from *options.
1624  */
1625 static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
1626                             QDict *options, Error **errp)
1627 {
1628     int ret, open_flags;
1629     const char *filename;
1630     const char *driver_name = NULL;
1631     const char *node_name = NULL;
1632     const char *discard;
1633     QemuOpts *opts;
1634     BlockDriver *drv;
1635     Error *local_err = NULL;
1636 
1637     assert(bs->file == NULL);
1638     assert(options != NULL && bs->options != options);
1639 
1640     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
1641     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1642         ret = -EINVAL;
1643         goto fail_opts;
1644     }
1645 
1646     update_flags_from_options(&bs->open_flags, opts);
1647 
1648     driver_name = qemu_opt_get(opts, "driver");
1649     drv = bdrv_find_format(driver_name);
1650     assert(drv != NULL);
1651 
1652     bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
1653 
1654     if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
1655         error_setg(errp,
1656                    BDRV_OPT_FORCE_SHARE
1657                    "=on can only be used with read-only images");
1658         ret = -EINVAL;
1659         goto fail_opts;
1660     }
1661 
1662     if (file != NULL) {
1663         bdrv_refresh_filename(blk_bs(file));
1664         filename = blk_bs(file)->filename;
1665     } else {
1666         /*
1667          * Caution: while qdict_get_try_str() is fine, getting
1668          * non-string types would require more care.  When @options
1669          * come from -blockdev or blockdev_add, its members are typed
1670          * according to the QAPI schema, but when they come from
1671          * -drive, they're all QString.
1672          */
1673         filename = qdict_get_try_str(options, "filename");
1674     }
1675 
1676     if (drv->bdrv_needs_filename && (!filename || !filename[0])) {
1677         error_setg(errp, "The '%s' block driver requires a file name",
1678                    drv->format_name);
1679         ret = -EINVAL;
1680         goto fail_opts;
1681     }
1682 
1683     trace_bdrv_open_common(bs, filename ?: "", bs->open_flags,
1684                            drv->format_name);
1685 
1686     bs->read_only = !(bs->open_flags & BDRV_O_RDWR);
1687 
1688     if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, bs->read_only)) {
1689         if (!bs->read_only && bdrv_is_whitelisted(drv, true)) {
1690             ret = bdrv_apply_auto_read_only(bs, NULL, NULL);
1691         } else {
1692             ret = -ENOTSUP;
1693         }
1694         if (ret < 0) {
1695             error_setg(errp,
1696                        !bs->read_only && bdrv_is_whitelisted(drv, true)
1697                        ? "Driver '%s' can only be used for read-only devices"
1698                        : "Driver '%s' is not whitelisted",
1699                        drv->format_name);
1700             goto fail_opts;
1701         }
1702     }
1703 
1704     /* bdrv_new() and bdrv_close() make it so */
1705     assert(qatomic_read(&bs->copy_on_read) == 0);
1706 
1707     if (bs->open_flags & BDRV_O_COPY_ON_READ) {
1708         if (!bs->read_only) {
1709             bdrv_enable_copy_on_read(bs);
1710         } else {
1711             error_setg(errp, "Can't use copy-on-read on read-only device");
1712             ret = -EINVAL;
1713             goto fail_opts;
1714         }
1715     }
1716 
1717     discard = qemu_opt_get(opts, BDRV_OPT_DISCARD);
1718     if (discard != NULL) {
1719         if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
1720             error_setg(errp, "Invalid discard option");
1721             ret = -EINVAL;
1722             goto fail_opts;
1723         }
1724     }
1725 
1726     bs->detect_zeroes =
1727         bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
1728     if (local_err) {
1729         error_propagate(errp, local_err);
1730         ret = -EINVAL;
1731         goto fail_opts;
1732     }
1733 
1734     if (filename != NULL) {
1735         pstrcpy(bs->filename, sizeof(bs->filename), filename);
1736     } else {
1737         bs->filename[0] = '\0';
1738     }
1739     pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), bs->filename);
1740 
1741     /* Open the image, either directly or using a protocol */
1742     open_flags = bdrv_open_flags(bs, bs->open_flags);
1743     node_name = qemu_opt_get(opts, "node-name");
1744 
1745     assert(!drv->bdrv_file_open || file == NULL);
1746     ret = bdrv_open_driver(bs, drv, node_name, options, open_flags, errp);
1747     if (ret < 0) {
1748         goto fail_opts;
1749     }
1750 
1751     qemu_opts_del(opts);
1752     return 0;
1753 
1754 fail_opts:
1755     qemu_opts_del(opts);
1756     return ret;
1757 }
1758 
1759 static QDict *parse_json_filename(const char *filename, Error **errp)
1760 {
1761     QObject *options_obj;
1762     QDict *options;
1763     int ret;
1764 
1765     ret = strstart(filename, "json:", &filename);
1766     assert(ret);
1767 
1768     options_obj = qobject_from_json(filename, errp);
1769     if (!options_obj) {
1770         error_prepend(errp, "Could not parse the JSON options: ");
1771         return NULL;
1772     }
1773 
1774     options = qobject_to(QDict, options_obj);
1775     if (!options) {
1776         qobject_unref(options_obj);
1777         error_setg(errp, "Invalid JSON object given");
1778         return NULL;
1779     }
1780 
1781     qdict_flatten(options);
1782 
1783     return options;
1784 }
1785 
1786 static void parse_json_protocol(QDict *options, const char **pfilename,
1787                                 Error **errp)
1788 {
1789     QDict *json_options;
1790     Error *local_err = NULL;
1791 
1792     /* Parse json: pseudo-protocol */
1793     if (!*pfilename || !g_str_has_prefix(*pfilename, "json:")) {
1794         return;
1795     }
1796 
1797     json_options = parse_json_filename(*pfilename, &local_err);
1798     if (local_err) {
1799         error_propagate(errp, local_err);
1800         return;
1801     }
1802 
1803     /* Options given in the filename have lower priority than options
1804      * specified directly */
1805     qdict_join(options, json_options, false);
1806     qobject_unref(json_options);
1807     *pfilename = NULL;
1808 }
1809 
1810 /*
1811  * Fills in default options for opening images and converts the legacy
1812  * filename/flags pair to option QDict entries.
1813  * The BDRV_O_PROTOCOL flag in *flags will be set or cleared accordingly if a
1814  * block driver has been specified explicitly.
1815  */
1816 static int bdrv_fill_options(QDict **options, const char *filename,
1817                              int *flags, Error **errp)
1818 {
1819     const char *drvname;
1820     bool protocol = *flags & BDRV_O_PROTOCOL;
1821     bool parse_filename = false;
1822     BlockDriver *drv = NULL;
1823     Error *local_err = NULL;
1824 
1825     /*
1826      * Caution: while qdict_get_try_str() is fine, getting non-string
1827      * types would require more care.  When @options come from
1828      * -blockdev or blockdev_add, its members are typed according to
1829      * the QAPI schema, but when they come from -drive, they're all
1830      * QString.
1831      */
1832     drvname = qdict_get_try_str(*options, "driver");
1833     if (drvname) {
1834         drv = bdrv_find_format(drvname);
1835         if (!drv) {
1836             error_setg(errp, "Unknown driver '%s'", drvname);
1837             return -ENOENT;
1838         }
1839         /* If the user has explicitly specified the driver, this choice should
1840          * override the BDRV_O_PROTOCOL flag */
1841         protocol = drv->bdrv_file_open;
1842     }
1843 
1844     if (protocol) {
1845         *flags |= BDRV_O_PROTOCOL;
1846     } else {
1847         *flags &= ~BDRV_O_PROTOCOL;
1848     }
1849 
1850     /* Translate cache options from flags into options */
1851     update_options_from_flags(*options, *flags);
1852 
1853     /* Fetch the file name from the options QDict if necessary */
1854     if (protocol && filename) {
1855         if (!qdict_haskey(*options, "filename")) {
1856             qdict_put_str(*options, "filename", filename);
1857             parse_filename = true;
1858         } else {
1859             error_setg(errp, "Can't specify 'file' and 'filename' options at "
1860                              "the same time");
1861             return -EINVAL;
1862         }
1863     }
1864 
1865     /* Find the right block driver */
1866     /* See cautionary note on accessing @options above */
1867     filename = qdict_get_try_str(*options, "filename");
1868 
1869     if (!drvname && protocol) {
1870         if (filename) {
1871             drv = bdrv_find_protocol(filename, parse_filename, errp);
1872             if (!drv) {
1873                 return -EINVAL;
1874             }
1875 
1876             drvname = drv->format_name;
1877             qdict_put_str(*options, "driver", drvname);
1878         } else {
1879             error_setg(errp, "Must specify either driver or file");
1880             return -EINVAL;
1881         }
1882     }
1883 
1884     assert(drv || !protocol);
1885 
1886     /* Driver-specific filename parsing */
1887     if (drv && drv->bdrv_parse_filename && parse_filename) {
1888         drv->bdrv_parse_filename(filename, *options, &local_err);
1889         if (local_err) {
1890             error_propagate(errp, local_err);
1891             return -EINVAL;
1892         }
1893 
1894         if (!drv->bdrv_needs_filename) {
1895             qdict_del(*options, "filename");
1896         }
1897     }
1898 
1899     return 0;
1900 }
1901 
1902 static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
1903                                  uint64_t perm, uint64_t shared,
1904                                  GSList *ignore_children, Error **errp);
1905 static void bdrv_child_abort_perm_update(BdrvChild *c);
1906 static void bdrv_child_set_perm(BdrvChild *c);
1907 
1908 typedef struct BlockReopenQueueEntry {
1909      bool prepared;
1910      bool perms_checked;
1911      BDRVReopenState state;
1912      QTAILQ_ENTRY(BlockReopenQueueEntry) entry;
1913 } BlockReopenQueueEntry;
1914 
1915 /*
1916  * Return the flags that @bs will have after the reopens in @q have
1917  * successfully completed. If @q is NULL (or @bs is not contained in @q),
1918  * return the current flags.
1919  */
1920 static int bdrv_reopen_get_flags(BlockReopenQueue *q, BlockDriverState *bs)
1921 {
1922     BlockReopenQueueEntry *entry;
1923 
1924     if (q != NULL) {
1925         QTAILQ_FOREACH(entry, q, entry) {
1926             if (entry->state.bs == bs) {
1927                 return entry->state.flags;
1928             }
1929         }
1930     }
1931 
1932     return bs->open_flags;
1933 }
1934 
1935 /* Returns whether the image file can be written to after the reopen queue @q
1936  * has been successfully applied, or right now if @q is NULL. */
1937 static bool bdrv_is_writable_after_reopen(BlockDriverState *bs,
1938                                           BlockReopenQueue *q)
1939 {
1940     int flags = bdrv_reopen_get_flags(q, bs);
1941 
1942     return (flags & (BDRV_O_RDWR | BDRV_O_INACTIVE)) == BDRV_O_RDWR;
1943 }
1944 
1945 /*
1946  * Return whether the BDS can be written to.  This is not necessarily
1947  * the same as !bdrv_is_read_only(bs), as inactivated images may not
1948  * be written to but do not count as read-only images.
1949  */
1950 bool bdrv_is_writable(BlockDriverState *bs)
1951 {
1952     return bdrv_is_writable_after_reopen(bs, NULL);
1953 }
1954 
1955 static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
1956                             BdrvChild *c, BdrvChildRole role,
1957                             BlockReopenQueue *reopen_queue,
1958                             uint64_t parent_perm, uint64_t parent_shared,
1959                             uint64_t *nperm, uint64_t *nshared)
1960 {
1961     assert(bs->drv && bs->drv->bdrv_child_perm);
1962     bs->drv->bdrv_child_perm(bs, c, role, reopen_queue,
1963                              parent_perm, parent_shared,
1964                              nperm, nshared);
1965     /* TODO Take force_share from reopen_queue */
1966     if (child_bs && child_bs->force_share) {
1967         *nshared = BLK_PERM_ALL;
1968     }
1969 }
1970 
1971 /*
1972  * Check whether permissions on this node can be changed in a way that
1973  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
1974  * permissions of all its parents. This involves checking whether all necessary
1975  * permission changes to child nodes can be performed.
1976  *
1977  * A call to this function must always be followed by a call to bdrv_set_perm()
1978  * or bdrv_abort_perm_update().
1979  */
1980 static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
1981                            uint64_t cumulative_perms,
1982                            uint64_t cumulative_shared_perms,
1983                            GSList *ignore_children, Error **errp)
1984 {
1985     BlockDriver *drv = bs->drv;
1986     BdrvChild *c;
1987     int ret;
1988 
1989     /* Write permissions never work with read-only images */
1990     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
1991         !bdrv_is_writable_after_reopen(bs, q))
1992     {
1993         if (!bdrv_is_writable_after_reopen(bs, NULL)) {
1994             error_setg(errp, "Block node is read-only");
1995         } else {
1996             uint64_t current_perms, current_shared;
1997             bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
1998             if (current_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
1999                 error_setg(errp, "Cannot make block node read-only, there is "
2000                            "a writer on it");
2001             } else {
2002                 error_setg(errp, "Cannot make block node read-only and create "
2003                            "a writer on it");
2004             }
2005         }
2006 
2007         return -EPERM;
2008     }
2009 
2010     /*
2011      * Unaligned requests will automatically be aligned to bl.request_alignment
2012      * and without RESIZE we can't extend requests to write to space beyond the
2013      * end of the image, so it's required that the image size is aligned.
2014      */
2015     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2016         !(cumulative_perms & BLK_PERM_RESIZE))
2017     {
2018         if ((bs->total_sectors * BDRV_SECTOR_SIZE) % bs->bl.request_alignment) {
2019             error_setg(errp, "Cannot get 'write' permission without 'resize': "
2020                              "Image size is not a multiple of request "
2021                              "alignment");
2022             return -EPERM;
2023         }
2024     }
2025 
2026     /* Check this node */
2027     if (!drv) {
2028         return 0;
2029     }
2030 
2031     if (drv->bdrv_check_perm) {
2032         ret = drv->bdrv_check_perm(bs, cumulative_perms,
2033                                    cumulative_shared_perms, errp);
2034         if (ret < 0) {
2035             return ret;
2036         }
2037     }
2038 
2039     /* Drivers that never have children can omit .bdrv_child_perm() */
2040     if (!drv->bdrv_child_perm) {
2041         assert(QLIST_EMPTY(&bs->children));
2042         return 0;
2043     }
2044 
2045     /* Check all children */
2046     QLIST_FOREACH(c, &bs->children, next) {
2047         uint64_t cur_perm, cur_shared;
2048 
2049         bdrv_child_perm(bs, c->bs, c, c->role, q,
2050                         cumulative_perms, cumulative_shared_perms,
2051                         &cur_perm, &cur_shared);
2052         ret = bdrv_child_check_perm(c, q, cur_perm, cur_shared, ignore_children,
2053                                     errp);
2054         if (ret < 0) {
2055             return ret;
2056         }
2057     }
2058 
2059     return 0;
2060 }
2061 
2062 /*
2063  * Notifies drivers that after a previous bdrv_check_perm() call, the
2064  * permission update is not performed and any preparations made for it (e.g.
2065  * taken file locks) need to be undone.
2066  *
2067  * This function recursively notifies all child nodes.
2068  */
2069 static void bdrv_abort_perm_update(BlockDriverState *bs)
2070 {
2071     BlockDriver *drv = bs->drv;
2072     BdrvChild *c;
2073 
2074     if (!drv) {
2075         return;
2076     }
2077 
2078     if (drv->bdrv_abort_perm_update) {
2079         drv->bdrv_abort_perm_update(bs);
2080     }
2081 
2082     QLIST_FOREACH(c, &bs->children, next) {
2083         bdrv_child_abort_perm_update(c);
2084     }
2085 }
2086 
2087 static void bdrv_set_perm(BlockDriverState *bs)
2088 {
2089     uint64_t cumulative_perms, cumulative_shared_perms;
2090     BlockDriver *drv = bs->drv;
2091     BdrvChild *c;
2092 
2093     if (!drv) {
2094         return;
2095     }
2096 
2097     bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
2098 
2099     /* Update this node */
2100     if (drv->bdrv_set_perm) {
2101         drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
2102     }
2103 
2104     /* Drivers that never have children can omit .bdrv_child_perm() */
2105     if (!drv->bdrv_child_perm) {
2106         assert(QLIST_EMPTY(&bs->children));
2107         return;
2108     }
2109 
2110     /* Update all children */
2111     QLIST_FOREACH(c, &bs->children, next) {
2112         bdrv_child_set_perm(c);
2113     }
2114 }
2115 
2116 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
2117                               uint64_t *shared_perm)
2118 {
2119     BdrvChild *c;
2120     uint64_t cumulative_perms = 0;
2121     uint64_t cumulative_shared_perms = BLK_PERM_ALL;
2122 
2123     QLIST_FOREACH(c, &bs->parents, next_parent) {
2124         cumulative_perms |= c->perm;
2125         cumulative_shared_perms &= c->shared_perm;
2126     }
2127 
2128     *perm = cumulative_perms;
2129     *shared_perm = cumulative_shared_perms;
2130 }
2131 
2132 static char *bdrv_child_user_desc(BdrvChild *c)
2133 {
2134     if (c->klass->get_parent_desc) {
2135         return c->klass->get_parent_desc(c);
2136     }
2137 
2138     return g_strdup("another user");
2139 }
2140 
2141 char *bdrv_perm_names(uint64_t perm)
2142 {
2143     struct perm_name {
2144         uint64_t perm;
2145         const char *name;
2146     } permissions[] = {
2147         { BLK_PERM_CONSISTENT_READ, "consistent read" },
2148         { BLK_PERM_WRITE,           "write" },
2149         { BLK_PERM_WRITE_UNCHANGED, "write unchanged" },
2150         { BLK_PERM_RESIZE,          "resize" },
2151         { BLK_PERM_GRAPH_MOD,       "change children" },
2152         { 0, NULL }
2153     };
2154 
2155     GString *result = g_string_sized_new(30);
2156     struct perm_name *p;
2157 
2158     for (p = permissions; p->name; p++) {
2159         if (perm & p->perm) {
2160             if (result->len > 0) {
2161                 g_string_append(result, ", ");
2162             }
2163             g_string_append(result, p->name);
2164         }
2165     }
2166 
2167     return g_string_free(result, FALSE);
2168 }
2169 
2170 /*
2171  * Checks whether a new reference to @bs can be added if the new user requires
2172  * @new_used_perm/@new_shared_perm as its permissions. If @ignore_children is
2173  * set, the BdrvChild objects in this list are ignored in the calculations;
2174  * this allows checking permission updates for an existing reference.
2175  *
2176  * Needs to be followed by a call to either bdrv_set_perm() or
2177  * bdrv_abort_perm_update(). */
2178 static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
2179                                   uint64_t new_used_perm,
2180                                   uint64_t new_shared_perm,
2181                                   GSList *ignore_children,
2182                                   Error **errp)
2183 {
2184     BdrvChild *c;
2185     uint64_t cumulative_perms = new_used_perm;
2186     uint64_t cumulative_shared_perms = new_shared_perm;
2187 
2188 
2189     /* There is no reason why anyone couldn't tolerate write_unchanged */
2190     assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
2191 
2192     QLIST_FOREACH(c, &bs->parents, next_parent) {
2193         if (g_slist_find(ignore_children, c)) {
2194             continue;
2195         }
2196 
2197         if ((new_used_perm & c->shared_perm) != new_used_perm) {
2198             char *user = bdrv_child_user_desc(c);
2199             char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
2200 
2201             error_setg(errp, "Conflicts with use by %s as '%s', which does not "
2202                              "allow '%s' on %s",
2203                        user, c->name, perm_names, bdrv_get_node_name(c->bs));
2204             g_free(user);
2205             g_free(perm_names);
2206             return -EPERM;
2207         }
2208 
2209         if ((c->perm & new_shared_perm) != c->perm) {
2210             char *user = bdrv_child_user_desc(c);
2211             char *perm_names = bdrv_perm_names(c->perm & ~new_shared_perm);
2212 
2213             error_setg(errp, "Conflicts with use by %s as '%s', which uses "
2214                              "'%s' on %s",
2215                        user, c->name, perm_names, bdrv_get_node_name(c->bs));
2216             g_free(user);
2217             g_free(perm_names);
2218             return -EPERM;
2219         }
2220 
2221         cumulative_perms |= c->perm;
2222         cumulative_shared_perms &= c->shared_perm;
2223     }
2224 
2225     return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
2226                            ignore_children, errp);
2227 }
2228 
2229 /* Needs to be followed by a call to either bdrv_child_set_perm() or
2230  * bdrv_child_abort_perm_update(). */
2231 static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
2232                                  uint64_t perm, uint64_t shared,
2233                                  GSList *ignore_children, Error **errp)
2234 {
2235     int ret;
2236 
2237     ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
2238     ret = bdrv_check_update_perm(c->bs, q, perm, shared, ignore_children, errp);
2239     g_slist_free(ignore_children);
2240 
2241     if (ret < 0) {
2242         return ret;
2243     }
2244 
2245     if (!c->has_backup_perm) {
2246         c->has_backup_perm = true;
2247         c->backup_perm = c->perm;
2248         c->backup_shared_perm = c->shared_perm;
2249     }
2250     /*
2251      * Note: it's OK if c->has_backup_perm was already set, as we can find the
2252      * same child twice during check_perm procedure
2253      */
2254 
2255     c->perm = perm;
2256     c->shared_perm = shared;
2257 
2258     return 0;
2259 }
2260 
2261 static void bdrv_child_set_perm(BdrvChild *c)
2262 {
2263     c->has_backup_perm = false;
2264 
2265     bdrv_set_perm(c->bs);
2266 }
2267 
2268 static void bdrv_child_abort_perm_update(BdrvChild *c)
2269 {
2270     if (c->has_backup_perm) {
2271         c->perm = c->backup_perm;
2272         c->shared_perm = c->backup_shared_perm;
2273         c->has_backup_perm = false;
2274     }
2275 
2276     bdrv_abort_perm_update(c->bs);
2277 }
2278 
2279 static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
2280 {
2281     int ret;
2282     uint64_t perm, shared_perm;
2283 
2284     bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
2285     ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, errp);
2286     if (ret < 0) {
2287         bdrv_abort_perm_update(bs);
2288         return ret;
2289     }
2290     bdrv_set_perm(bs);
2291 
2292     return 0;
2293 }
2294 
2295 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
2296                             Error **errp)
2297 {
2298     Error *local_err = NULL;
2299     int ret;
2300 
2301     ret = bdrv_child_check_perm(c, NULL, perm, shared, NULL, &local_err);
2302     if (ret < 0) {
2303         bdrv_child_abort_perm_update(c);
2304         if ((perm & ~c->perm) || (c->shared_perm & ~shared)) {
2305             /* tighten permissions */
2306             error_propagate(errp, local_err);
2307         } else {
2308             /*
2309              * Our caller may intend to only loosen restrictions and
2310              * does not expect this function to fail.  Errors are not
2311              * fatal in such a case, so we can just hide them from our
2312              * caller.
2313              */
2314             error_free(local_err);
2315             ret = 0;
2316         }
2317         return ret;
2318     }
2319 
2320     bdrv_child_set_perm(c);
2321 
2322     return 0;
2323 }
2324 
2325 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
2326 {
2327     uint64_t parent_perms, parent_shared;
2328     uint64_t perms, shared;
2329 
2330     bdrv_get_cumulative_perm(bs, &parent_perms, &parent_shared);
2331     bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2332                     parent_perms, parent_shared, &perms, &shared);
2333 
2334     return bdrv_child_try_set_perm(c, perms, shared, errp);
2335 }
2336 
2337 /*
2338  * Default implementation for .bdrv_child_perm() for block filters:
2339  * Forward CONSISTENT_READ, WRITE, WRITE_UNCHANGED, and RESIZE to the
2340  * filtered child.
2341  */
2342 static void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
2343                                       BdrvChildRole role,
2344                                       BlockReopenQueue *reopen_queue,
2345                                       uint64_t perm, uint64_t shared,
2346                                       uint64_t *nperm, uint64_t *nshared)
2347 {
2348     *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
2349     *nshared = (shared & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
2350 }
2351 
2352 static void bdrv_default_perms_for_cow(BlockDriverState *bs, BdrvChild *c,
2353                                        BdrvChildRole role,
2354                                        BlockReopenQueue *reopen_queue,
2355                                        uint64_t perm, uint64_t shared,
2356                                        uint64_t *nperm, uint64_t *nshared)
2357 {
2358     assert(role & BDRV_CHILD_COW);
2359 
2360     /*
2361      * We want consistent read from backing files if the parent needs it.
2362      * No other operations are performed on backing files.
2363      */
2364     perm &= BLK_PERM_CONSISTENT_READ;
2365 
2366     /*
2367      * If the parent can deal with changing data, we're okay with a
2368      * writable and resizable backing file.
2369      * TODO Require !(perm & BLK_PERM_CONSISTENT_READ), too?
2370      */
2371     if (shared & BLK_PERM_WRITE) {
2372         shared = BLK_PERM_WRITE | BLK_PERM_RESIZE;
2373     } else {
2374         shared = 0;
2375     }
2376 
2377     shared |= BLK_PERM_CONSISTENT_READ | BLK_PERM_GRAPH_MOD |
2378               BLK_PERM_WRITE_UNCHANGED;
2379 
2380     if (bs->open_flags & BDRV_O_INACTIVE) {
2381         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2382     }
2383 
2384     *nperm = perm;
2385     *nshared = shared;
2386 }
2387 
2388 static void bdrv_default_perms_for_storage(BlockDriverState *bs, BdrvChild *c,
2389                                            BdrvChildRole role,
2390                                            BlockReopenQueue *reopen_queue,
2391                                            uint64_t perm, uint64_t shared,
2392                                            uint64_t *nperm, uint64_t *nshared)
2393 {
2394     int flags;
2395 
2396     assert(role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA));
2397 
2398     flags = bdrv_reopen_get_flags(reopen_queue, bs);
2399 
2400     /*
2401      * Apart from the modifications below, the same permissions are
2402      * forwarded and left alone as for filters
2403      */
2404     bdrv_filter_default_perms(bs, c, role, reopen_queue,
2405                               perm, shared, &perm, &shared);
2406 
2407     if (role & BDRV_CHILD_METADATA) {
2408         /* Format drivers may touch metadata even if the guest doesn't write */
2409         if (bdrv_is_writable_after_reopen(bs, reopen_queue)) {
2410             perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2411         }
2412 
2413         /*
2414          * bs->file always needs to be consistent because of the
2415          * metadata. We can never allow other users to resize or write
2416          * to it.
2417          */
2418         if (!(flags & BDRV_O_NO_IO)) {
2419             perm |= BLK_PERM_CONSISTENT_READ;
2420         }
2421         shared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
2422     }
2423 
2424     if (role & BDRV_CHILD_DATA) {
2425         /*
2426          * Technically, everything in this block is a subset of the
2427          * BDRV_CHILD_METADATA path taken above, and so this could
2428          * be an "else if" branch.  However, that is not obvious, and
2429          * this function is not performance critical, therefore we let
2430          * this be an independent "if".
2431          */
2432 
2433         /*
2434          * We cannot allow other users to resize the file because the
2435          * format driver might have some assumptions about the size
2436          * (e.g. because it is stored in metadata, or because the file
2437          * is split into fixed-size data files).
2438          */
2439         shared &= ~BLK_PERM_RESIZE;
2440 
2441         /*
2442          * WRITE_UNCHANGED often cannot be performed as such on the
2443          * data file.  For example, the qcow2 driver may still need to
2444          * write copied clusters on copy-on-read.
2445          */
2446         if (perm & BLK_PERM_WRITE_UNCHANGED) {
2447             perm |= BLK_PERM_WRITE;
2448         }
2449 
2450         /*
2451          * If the data file is written to, the format driver may
2452          * expect to be able to resize it by writing beyond the EOF.
2453          */
2454         if (perm & BLK_PERM_WRITE) {
2455             perm |= BLK_PERM_RESIZE;
2456         }
2457     }
2458 
2459     if (bs->open_flags & BDRV_O_INACTIVE) {
2460         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2461     }
2462 
2463     *nperm = perm;
2464     *nshared = shared;
2465 }
2466 
2467 void bdrv_default_perms(BlockDriverState *bs, BdrvChild *c,
2468                         BdrvChildRole role, BlockReopenQueue *reopen_queue,
2469                         uint64_t perm, uint64_t shared,
2470                         uint64_t *nperm, uint64_t *nshared)
2471 {
2472     if (role & BDRV_CHILD_FILTERED) {
2473         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
2474                          BDRV_CHILD_COW)));
2475         bdrv_filter_default_perms(bs, c, role, reopen_queue,
2476                                   perm, shared, nperm, nshared);
2477     } else if (role & BDRV_CHILD_COW) {
2478         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA)));
2479         bdrv_default_perms_for_cow(bs, c, role, reopen_queue,
2480                                    perm, shared, nperm, nshared);
2481     } else if (role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA)) {
2482         bdrv_default_perms_for_storage(bs, c, role, reopen_queue,
2483                                        perm, shared, nperm, nshared);
2484     } else {
2485         g_assert_not_reached();
2486     }
2487 }
2488 
2489 uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
2490 {
2491     static const uint64_t permissions[] = {
2492         [BLOCK_PERMISSION_CONSISTENT_READ]  = BLK_PERM_CONSISTENT_READ,
2493         [BLOCK_PERMISSION_WRITE]            = BLK_PERM_WRITE,
2494         [BLOCK_PERMISSION_WRITE_UNCHANGED]  = BLK_PERM_WRITE_UNCHANGED,
2495         [BLOCK_PERMISSION_RESIZE]           = BLK_PERM_RESIZE,
2496         [BLOCK_PERMISSION_GRAPH_MOD]        = BLK_PERM_GRAPH_MOD,
2497     };
2498 
2499     QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
2500     QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
2501 
2502     assert(qapi_perm < BLOCK_PERMISSION__MAX);
2503 
2504     return permissions[qapi_perm];
2505 }
2506 
2507 static void bdrv_replace_child_noperm(BdrvChild *child,
2508                                       BlockDriverState *new_bs)
2509 {
2510     BlockDriverState *old_bs = child->bs;
2511     int new_bs_quiesce_counter;
2512     int drain_saldo;
2513 
2514     assert(!child->frozen);
2515 
2516     if (old_bs && new_bs) {
2517         assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
2518     }
2519 
2520     new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
2521     drain_saldo = new_bs_quiesce_counter - child->parent_quiesce_counter;
2522 
2523     /*
2524      * If the new child node is drained but the old one was not, flush
2525      * all outstanding requests to the old child node.
2526      */
2527     while (drain_saldo > 0 && child->klass->drained_begin) {
2528         bdrv_parent_drained_begin_single(child, true);
2529         drain_saldo--;
2530     }
2531 
2532     if (old_bs) {
2533         /* Detach first so that the recursive drain sections coming from @child
2534          * are already gone and we only end the drain sections that came from
2535          * elsewhere. */
2536         if (child->klass->detach) {
2537             child->klass->detach(child);
2538         }
2539         QLIST_REMOVE(child, next_parent);
2540     }
2541 
2542     child->bs = new_bs;
2543 
2544     if (new_bs) {
2545         QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
2546 
2547         /*
2548          * Detaching the old node may have led to the new node's
2549          * quiesce_counter having been decreased.  Not a problem, we
2550          * just need to recognize this here and then invoke
2551          * drained_end appropriately more often.
2552          */
2553         assert(new_bs->quiesce_counter <= new_bs_quiesce_counter);
2554         drain_saldo += new_bs->quiesce_counter - new_bs_quiesce_counter;
2555 
2556         /* Attach only after starting new drained sections, so that recursive
2557          * drain sections coming from @child don't get an extra .drained_begin
2558          * callback. */
2559         if (child->klass->attach) {
2560             child->klass->attach(child);
2561         }
2562     }
2563 
2564     /*
2565      * If the old child node was drained but the new one is not, allow
2566      * requests to come in only after the new node has been attached.
2567      */
2568     while (drain_saldo < 0 && child->klass->drained_end) {
2569         bdrv_parent_drained_end_single(child);
2570         drain_saldo++;
2571     }
2572 }
2573 
2574 /*
2575  * Updates @child to change its reference to point to @new_bs, including
2576  * checking and applying the necessary permission updates both to the old node
2577  * and to @new_bs.
2578  *
2579  * NULL is passed as @new_bs for removing the reference before freeing @child.
2580  *
2581  * If @new_bs is not NULL, bdrv_check_perm() must be called beforehand, as this
2582  * function uses bdrv_set_perm() to update the permissions according to the new
2583  * reference that @new_bs gets.
2584  *
2585  * Callers must ensure that child->frozen is false.
2586  */
2587 static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
2588 {
2589     BlockDriverState *old_bs = child->bs;
2590 
2591     /* Asserts that child->frozen == false */
2592     bdrv_replace_child_noperm(child, new_bs);
2593 
2594     /*
2595      * Start with the new node's permissions.  If @new_bs is a (direct
2596      * or indirect) child of @old_bs, we must complete the permission
2597      * update on @new_bs before we loosen the restrictions on @old_bs.
2598      * Otherwise, bdrv_check_perm() on @old_bs would re-initiate
2599      * updating the permissions of @new_bs, and thus not purely loosen
2600      * restrictions.
2601      */
2602     if (new_bs) {
2603         bdrv_set_perm(new_bs);
2604     }
2605 
2606     if (old_bs) {
2607         /*
2608          * Update permissions for old node. We're just taking a parent away, so
2609          * we're loosening restrictions. Errors of permission update are not
2610          * fatal in this case, ignore them.
2611          */
2612         bdrv_refresh_perms(old_bs, NULL);
2613 
2614         /* When the parent requiring a non-default AioContext is removed, the
2615          * node moves back to the main AioContext */
2616         bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
2617     }
2618 }
2619 
2620 /*
2621  * This function steals the reference to child_bs from the caller.
2622  * That reference is later dropped by bdrv_root_unref_child().
2623  *
2624  * On failure NULL is returned, errp is set and the reference to
2625  * child_bs is also dropped.
2626  *
2627  * The caller must hold the AioContext lock @child_bs, but not that of @ctx
2628  * (unless @child_bs is already in @ctx).
2629  */
2630 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
2631                                   const char *child_name,
2632                                   const BdrvChildClass *child_class,
2633                                   BdrvChildRole child_role,
2634                                   AioContext *ctx,
2635                                   uint64_t perm, uint64_t shared_perm,
2636                                   void *opaque, Error **errp)
2637 {
2638     BdrvChild *child;
2639     Error *local_err = NULL;
2640     int ret;
2641 
2642     ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, errp);
2643     if (ret < 0) {
2644         bdrv_abort_perm_update(child_bs);
2645         bdrv_unref(child_bs);
2646         return NULL;
2647     }
2648 
2649     child = g_new(BdrvChild, 1);
2650     *child = (BdrvChild) {
2651         .bs             = NULL,
2652         .name           = g_strdup(child_name),
2653         .klass          = child_class,
2654         .role           = child_role,
2655         .perm           = perm,
2656         .shared_perm    = shared_perm,
2657         .opaque         = opaque,
2658     };
2659 
2660     /* If the AioContexts don't match, first try to move the subtree of
2661      * child_bs into the AioContext of the new parent. If this doesn't work,
2662      * try moving the parent into the AioContext of child_bs instead. */
2663     if (bdrv_get_aio_context(child_bs) != ctx) {
2664         ret = bdrv_try_set_aio_context(child_bs, ctx, &local_err);
2665         if (ret < 0 && child_class->can_set_aio_ctx) {
2666             GSList *ignore = g_slist_prepend(NULL, child);
2667             ctx = bdrv_get_aio_context(child_bs);
2668             if (child_class->can_set_aio_ctx(child, ctx, &ignore, NULL)) {
2669                 error_free(local_err);
2670                 ret = 0;
2671                 g_slist_free(ignore);
2672                 ignore = g_slist_prepend(NULL, child);
2673                 child_class->set_aio_ctx(child, ctx, &ignore);
2674             }
2675             g_slist_free(ignore);
2676         }
2677         if (ret < 0) {
2678             error_propagate(errp, local_err);
2679             g_free(child);
2680             bdrv_abort_perm_update(child_bs);
2681             bdrv_unref(child_bs);
2682             return NULL;
2683         }
2684     }
2685 
2686     /* This performs the matching bdrv_set_perm() for the above check. */
2687     bdrv_replace_child(child, child_bs);
2688 
2689     return child;
2690 }
2691 
2692 /*
2693  * This function transfers the reference to child_bs from the caller
2694  * to parent_bs. That reference is later dropped by parent_bs on
2695  * bdrv_close() or if someone calls bdrv_unref_child().
2696  *
2697  * On failure NULL is returned, errp is set and the reference to
2698  * child_bs is also dropped.
2699  *
2700  * If @parent_bs and @child_bs are in different AioContexts, the caller must
2701  * hold the AioContext lock for @child_bs, but not for @parent_bs.
2702  */
2703 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
2704                              BlockDriverState *child_bs,
2705                              const char *child_name,
2706                              const BdrvChildClass *child_class,
2707                              BdrvChildRole child_role,
2708                              Error **errp)
2709 {
2710     BdrvChild *child;
2711     uint64_t perm, shared_perm;
2712 
2713     bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
2714 
2715     assert(parent_bs->drv);
2716     bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
2717                     perm, shared_perm, &perm, &shared_perm);
2718 
2719     child = bdrv_root_attach_child(child_bs, child_name, child_class,
2720                                    child_role, bdrv_get_aio_context(parent_bs),
2721                                    perm, shared_perm, parent_bs, errp);
2722     if (child == NULL) {
2723         return NULL;
2724     }
2725 
2726     QLIST_INSERT_HEAD(&parent_bs->children, child, next);
2727     return child;
2728 }
2729 
2730 static void bdrv_detach_child(BdrvChild *child)
2731 {
2732     QLIST_SAFE_REMOVE(child, next);
2733 
2734     bdrv_replace_child(child, NULL);
2735 
2736     g_free(child->name);
2737     g_free(child);
2738 }
2739 
2740 /* Callers must ensure that child->frozen is false. */
2741 void bdrv_root_unref_child(BdrvChild *child)
2742 {
2743     BlockDriverState *child_bs;
2744 
2745     child_bs = child->bs;
2746     bdrv_detach_child(child);
2747     bdrv_unref(child_bs);
2748 }
2749 
2750 /**
2751  * Clear all inherits_from pointers from children and grandchildren of
2752  * @root that point to @root, where necessary.
2753  */
2754 static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
2755 {
2756     BdrvChild *c;
2757 
2758     if (child->bs->inherits_from == root) {
2759         /*
2760          * Remove inherits_from only when the last reference between root and
2761          * child->bs goes away.
2762          */
2763         QLIST_FOREACH(c, &root->children, next) {
2764             if (c != child && c->bs == child->bs) {
2765                 break;
2766             }
2767         }
2768         if (c == NULL) {
2769             child->bs->inherits_from = NULL;
2770         }
2771     }
2772 
2773     QLIST_FOREACH(c, &child->bs->children, next) {
2774         bdrv_unset_inherits_from(root, c);
2775     }
2776 }
2777 
2778 /* Callers must ensure that child->frozen is false. */
2779 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
2780 {
2781     if (child == NULL) {
2782         return;
2783     }
2784 
2785     bdrv_unset_inherits_from(parent, child);
2786     bdrv_root_unref_child(child);
2787 }
2788 
2789 
2790 static void bdrv_parent_cb_change_media(BlockDriverState *bs, bool load)
2791 {
2792     BdrvChild *c;
2793     QLIST_FOREACH(c, &bs->parents, next_parent) {
2794         if (c->klass->change_media) {
2795             c->klass->change_media(c, load);
2796         }
2797     }
2798 }
2799 
2800 /* Return true if you can reach parent going through child->inherits_from
2801  * recursively. If parent or child are NULL, return false */
2802 static bool bdrv_inherits_from_recursive(BlockDriverState *child,
2803                                          BlockDriverState *parent)
2804 {
2805     while (child && child != parent) {
2806         child = child->inherits_from;
2807     }
2808 
2809     return child != NULL;
2810 }
2811 
2812 /*
2813  * Return the BdrvChildRole for @bs's backing child.  bs->backing is
2814  * mostly used for COW backing children (role = COW), but also for
2815  * filtered children (role = FILTERED | PRIMARY).
2816  */
2817 static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
2818 {
2819     if (bs->drv && bs->drv->is_filter) {
2820         return BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
2821     } else {
2822         return BDRV_CHILD_COW;
2823     }
2824 }
2825 
2826 /*
2827  * Sets the bs->backing link of a BDS. A new reference is created; callers
2828  * which don't need their own reference any more must call bdrv_unref().
2829  */
2830 void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
2831                          Error **errp)
2832 {
2833     bool update_inherits_from = bdrv_chain_contains(bs, backing_hd) &&
2834         bdrv_inherits_from_recursive(backing_hd, bs);
2835 
2836     if (bdrv_is_backing_chain_frozen(bs, child_bs(bs->backing), errp)) {
2837         return;
2838     }
2839 
2840     if (backing_hd) {
2841         bdrv_ref(backing_hd);
2842     }
2843 
2844     if (bs->backing) {
2845         /* Cannot be frozen, we checked that above */
2846         bdrv_unref_child(bs, bs->backing);
2847         bs->backing = NULL;
2848     }
2849 
2850     if (!backing_hd) {
2851         goto out;
2852     }
2853 
2854     bs->backing = bdrv_attach_child(bs, backing_hd, "backing", &child_of_bds,
2855                                     bdrv_backing_role(bs), errp);
2856     /* If backing_hd was already part of bs's backing chain, and
2857      * inherits_from pointed recursively to bs then let's update it to
2858      * point directly to bs (else it will become NULL). */
2859     if (bs->backing && update_inherits_from) {
2860         backing_hd->inherits_from = bs;
2861     }
2862 
2863 out:
2864     bdrv_refresh_limits(bs, NULL);
2865 }
2866 
2867 /*
2868  * Opens the backing file for a BlockDriverState if not yet open
2869  *
2870  * bdref_key specifies the key for the image's BlockdevRef in the options QDict.
2871  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
2872  * itself, all options starting with "${bdref_key}." are considered part of the
2873  * BlockdevRef.
2874  *
2875  * TODO Can this be unified with bdrv_open_image()?
2876  */
2877 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
2878                            const char *bdref_key, Error **errp)
2879 {
2880     char *backing_filename = NULL;
2881     char *bdref_key_dot;
2882     const char *reference = NULL;
2883     int ret = 0;
2884     bool implicit_backing = false;
2885     BlockDriverState *backing_hd;
2886     QDict *options;
2887     QDict *tmp_parent_options = NULL;
2888     Error *local_err = NULL;
2889 
2890     if (bs->backing != NULL) {
2891         goto free_exit;
2892     }
2893 
2894     /* NULL means an empty set of options */
2895     if (parent_options == NULL) {
2896         tmp_parent_options = qdict_new();
2897         parent_options = tmp_parent_options;
2898     }
2899 
2900     bs->open_flags &= ~BDRV_O_NO_BACKING;
2901 
2902     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
2903     qdict_extract_subqdict(parent_options, &options, bdref_key_dot);
2904     g_free(bdref_key_dot);
2905 
2906     /*
2907      * Caution: while qdict_get_try_str() is fine, getting non-string
2908      * types would require more care.  When @parent_options come from
2909      * -blockdev or blockdev_add, its members are typed according to
2910      * the QAPI schema, but when they come from -drive, they're all
2911      * QString.
2912      */
2913     reference = qdict_get_try_str(parent_options, bdref_key);
2914     if (reference || qdict_haskey(options, "file.filename")) {
2915         /* keep backing_filename NULL */
2916     } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
2917         qobject_unref(options);
2918         goto free_exit;
2919     } else {
2920         if (qdict_size(options) == 0) {
2921             /* If the user specifies options that do not modify the
2922              * backing file's behavior, we might still consider it the
2923              * implicit backing file.  But it's easier this way, and
2924              * just specifying some of the backing BDS's options is
2925              * only possible with -drive anyway (otherwise the QAPI
2926              * schema forces the user to specify everything). */
2927             implicit_backing = !strcmp(bs->auto_backing_file, bs->backing_file);
2928         }
2929 
2930         backing_filename = bdrv_get_full_backing_filename(bs, &local_err);
2931         if (local_err) {
2932             ret = -EINVAL;
2933             error_propagate(errp, local_err);
2934             qobject_unref(options);
2935             goto free_exit;
2936         }
2937     }
2938 
2939     if (!bs->drv || !bs->drv->supports_backing) {
2940         ret = -EINVAL;
2941         error_setg(errp, "Driver doesn't support backing files");
2942         qobject_unref(options);
2943         goto free_exit;
2944     }
2945 
2946     if (!reference &&
2947         bs->backing_format[0] != '\0' && !qdict_haskey(options, "driver")) {
2948         qdict_put_str(options, "driver", bs->backing_format);
2949     }
2950 
2951     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
2952                                    &child_of_bds, bdrv_backing_role(bs), errp);
2953     if (!backing_hd) {
2954         bs->open_flags |= BDRV_O_NO_BACKING;
2955         error_prepend(errp, "Could not open backing file: ");
2956         ret = -EINVAL;
2957         goto free_exit;
2958     }
2959 
2960     if (implicit_backing) {
2961         bdrv_refresh_filename(backing_hd);
2962         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2963                 backing_hd->filename);
2964     }
2965 
2966     /* Hook up the backing file link; drop our reference, bs owns the
2967      * backing_hd reference now */
2968     bdrv_set_backing_hd(bs, backing_hd, &local_err);
2969     bdrv_unref(backing_hd);
2970     if (local_err) {
2971         error_propagate(errp, local_err);
2972         ret = -EINVAL;
2973         goto free_exit;
2974     }
2975 
2976     qdict_del(parent_options, bdref_key);
2977 
2978 free_exit:
2979     g_free(backing_filename);
2980     qobject_unref(tmp_parent_options);
2981     return ret;
2982 }
2983 
2984 static BlockDriverState *
2985 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
2986                    BlockDriverState *parent, const BdrvChildClass *child_class,
2987                    BdrvChildRole child_role, bool allow_none, Error **errp)
2988 {
2989     BlockDriverState *bs = NULL;
2990     QDict *image_options;
2991     char *bdref_key_dot;
2992     const char *reference;
2993 
2994     assert(child_class != NULL);
2995 
2996     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
2997     qdict_extract_subqdict(options, &image_options, bdref_key_dot);
2998     g_free(bdref_key_dot);
2999 
3000     /*
3001      * Caution: while qdict_get_try_str() is fine, getting non-string
3002      * types would require more care.  When @options come from
3003      * -blockdev or blockdev_add, its members are typed according to
3004      * the QAPI schema, but when they come from -drive, they're all
3005      * QString.
3006      */
3007     reference = qdict_get_try_str(options, bdref_key);
3008     if (!filename && !reference && !qdict_size(image_options)) {
3009         if (!allow_none) {
3010             error_setg(errp, "A block device must be specified for \"%s\"",
3011                        bdref_key);
3012         }
3013         qobject_unref(image_options);
3014         goto done;
3015     }
3016 
3017     bs = bdrv_open_inherit(filename, reference, image_options, 0,
3018                            parent, child_class, child_role, errp);
3019     if (!bs) {
3020         goto done;
3021     }
3022 
3023 done:
3024     qdict_del(options, bdref_key);
3025     return bs;
3026 }
3027 
3028 /*
3029  * Opens a disk image whose options are given as BlockdevRef in another block
3030  * device's options.
3031  *
3032  * If allow_none is true, no image will be opened if filename is false and no
3033  * BlockdevRef is given. NULL will be returned, but errp remains unset.
3034  *
3035  * bdrev_key specifies the key for the image's BlockdevRef in the options QDict.
3036  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3037  * itself, all options starting with "${bdref_key}." are considered part of the
3038  * BlockdevRef.
3039  *
3040  * The BlockdevRef will be removed from the options QDict.
3041  */
3042 BdrvChild *bdrv_open_child(const char *filename,
3043                            QDict *options, const char *bdref_key,
3044                            BlockDriverState *parent,
3045                            const BdrvChildClass *child_class,
3046                            BdrvChildRole child_role,
3047                            bool allow_none, Error **errp)
3048 {
3049     BlockDriverState *bs;
3050 
3051     bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
3052                             child_role, allow_none, errp);
3053     if (bs == NULL) {
3054         return NULL;
3055     }
3056 
3057     return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
3058                              errp);
3059 }
3060 
3061 /*
3062  * TODO Future callers may need to specify parent/child_class in order for
3063  * option inheritance to work. Existing callers use it for the root node.
3064  */
3065 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
3066 {
3067     BlockDriverState *bs = NULL;
3068     QObject *obj = NULL;
3069     QDict *qdict = NULL;
3070     const char *reference = NULL;
3071     Visitor *v = NULL;
3072 
3073     if (ref->type == QTYPE_QSTRING) {
3074         reference = ref->u.reference;
3075     } else {
3076         BlockdevOptions *options = &ref->u.definition;
3077         assert(ref->type == QTYPE_QDICT);
3078 
3079         v = qobject_output_visitor_new(&obj);
3080         visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3081         visit_complete(v, &obj);
3082 
3083         qdict = qobject_to(QDict, obj);
3084         qdict_flatten(qdict);
3085 
3086         /* bdrv_open_inherit() defaults to the values in bdrv_flags (for
3087          * compatibility with other callers) rather than what we want as the
3088          * real defaults. Apply the defaults here instead. */
3089         qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
3090         qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
3091         qdict_set_default_str(qdict, BDRV_OPT_READ_ONLY, "off");
3092         qdict_set_default_str(qdict, BDRV_OPT_AUTO_READ_ONLY, "off");
3093 
3094     }
3095 
3096     bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, errp);
3097     obj = NULL;
3098     qobject_unref(obj);
3099     visit_free(v);
3100     return bs;
3101 }
3102 
3103 static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
3104                                                    int flags,
3105                                                    QDict *snapshot_options,
3106                                                    Error **errp)
3107 {
3108     /* TODO: extra byte is a hack to ensure MAX_PATH space on Windows. */
3109     char *tmp_filename = g_malloc0(PATH_MAX + 1);
3110     int64_t total_size;
3111     QemuOpts *opts = NULL;
3112     BlockDriverState *bs_snapshot = NULL;
3113     Error *local_err = NULL;
3114     int ret;
3115 
3116     /* if snapshot, we create a temporary backing file and open it
3117        instead of opening 'filename' directly */
3118 
3119     /* Get the required size from the image */
3120     total_size = bdrv_getlength(bs);
3121     if (total_size < 0) {
3122         error_setg_errno(errp, -total_size, "Could not get image size");
3123         goto out;
3124     }
3125 
3126     /* Create the temporary image */
3127     ret = get_tmp_filename(tmp_filename, PATH_MAX + 1);
3128     if (ret < 0) {
3129         error_setg_errno(errp, -ret, "Could not get temporary filename");
3130         goto out;
3131     }
3132 
3133     opts = qemu_opts_create(bdrv_qcow2.create_opts, NULL, 0,
3134                             &error_abort);
3135     qemu_opt_set_number(opts, BLOCK_OPT_SIZE, total_size, &error_abort);
3136     ret = bdrv_create(&bdrv_qcow2, tmp_filename, opts, errp);
3137     qemu_opts_del(opts);
3138     if (ret < 0) {
3139         error_prepend(errp, "Could not create temporary overlay '%s': ",
3140                       tmp_filename);
3141         goto out;
3142     }
3143 
3144     /* Prepare options QDict for the temporary file */
3145     qdict_put_str(snapshot_options, "file.driver", "file");
3146     qdict_put_str(snapshot_options, "file.filename", tmp_filename);
3147     qdict_put_str(snapshot_options, "driver", "qcow2");
3148 
3149     bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
3150     snapshot_options = NULL;
3151     if (!bs_snapshot) {
3152         goto out;
3153     }
3154 
3155     /* bdrv_append() consumes a strong reference to bs_snapshot
3156      * (i.e. it will call bdrv_unref() on it) even on error, so in
3157      * order to be able to return one, we have to increase
3158      * bs_snapshot's refcount here */
3159     bdrv_ref(bs_snapshot);
3160     bdrv_append(bs_snapshot, bs, &local_err);
3161     if (local_err) {
3162         error_propagate(errp, local_err);
3163         bs_snapshot = NULL;
3164         goto out;
3165     }
3166 
3167 out:
3168     qobject_unref(snapshot_options);
3169     g_free(tmp_filename);
3170     return bs_snapshot;
3171 }
3172 
3173 /*
3174  * Opens a disk image (raw, qcow2, vmdk, ...)
3175  *
3176  * options is a QDict of options to pass to the block drivers, or NULL for an
3177  * empty set of options. The reference to the QDict belongs to the block layer
3178  * after the call (even on failure), so if the caller intends to reuse the
3179  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
3180  *
3181  * If *pbs is NULL, a new BDS will be created with a pointer to it stored there.
3182  * If it is not NULL, the referenced BDS will be reused.
3183  *
3184  * The reference parameter may be used to specify an existing block device which
3185  * should be opened. If specified, neither options nor a filename may be given,
3186  * nor can an existing BDS be reused (that is, *pbs has to be NULL).
3187  */
3188 static BlockDriverState *bdrv_open_inherit(const char *filename,
3189                                            const char *reference,
3190                                            QDict *options, int flags,
3191                                            BlockDriverState *parent,
3192                                            const BdrvChildClass *child_class,
3193                                            BdrvChildRole child_role,
3194                                            Error **errp)
3195 {
3196     int ret;
3197     BlockBackend *file = NULL;
3198     BlockDriverState *bs;
3199     BlockDriver *drv = NULL;
3200     BdrvChild *child;
3201     const char *drvname;
3202     const char *backing;
3203     Error *local_err = NULL;
3204     QDict *snapshot_options = NULL;
3205     int snapshot_flags = 0;
3206 
3207     assert(!child_class || !flags);
3208     assert(!child_class == !parent);
3209 
3210     if (reference) {
3211         bool options_non_empty = options ? qdict_size(options) : false;
3212         qobject_unref(options);
3213 
3214         if (filename || options_non_empty) {
3215             error_setg(errp, "Cannot reference an existing block device with "
3216                        "additional options or a new filename");
3217             return NULL;
3218         }
3219 
3220         bs = bdrv_lookup_bs(reference, reference, errp);
3221         if (!bs) {
3222             return NULL;
3223         }
3224 
3225         bdrv_ref(bs);
3226         return bs;
3227     }
3228 
3229     bs = bdrv_new();
3230 
3231     /* NULL means an empty set of options */
3232     if (options == NULL) {
3233         options = qdict_new();
3234     }
3235 
3236     /* json: syntax counts as explicit options, as if in the QDict */
3237     parse_json_protocol(options, &filename, &local_err);
3238     if (local_err) {
3239         goto fail;
3240     }
3241 
3242     bs->explicit_options = qdict_clone_shallow(options);
3243 
3244     if (child_class) {
3245         bool parent_is_format;
3246 
3247         if (parent->drv) {
3248             parent_is_format = parent->drv->is_format;
3249         } else {
3250             /*
3251              * parent->drv is not set yet because this node is opened for
3252              * (potential) format probing.  That means that @parent is going
3253              * to be a format node.
3254              */
3255             parent_is_format = true;
3256         }
3257 
3258         bs->inherits_from = parent;
3259         child_class->inherit_options(child_role, parent_is_format,
3260                                      &flags, options,
3261                                      parent->open_flags, parent->options);
3262     }
3263 
3264     ret = bdrv_fill_options(&options, filename, &flags, &local_err);
3265     if (ret < 0) {
3266         goto fail;
3267     }
3268 
3269     /*
3270      * Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
3271      * Caution: getting a boolean member of @options requires care.
3272      * When @options come from -blockdev or blockdev_add, members are
3273      * typed according to the QAPI schema, but when they come from
3274      * -drive, they're all QString.
3275      */
3276     if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
3277         !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
3278         flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
3279     } else {
3280         flags &= ~BDRV_O_RDWR;
3281     }
3282 
3283     if (flags & BDRV_O_SNAPSHOT) {
3284         snapshot_options = qdict_new();
3285         bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
3286                                    flags, options);
3287         /* Let bdrv_backing_options() override "read-only" */
3288         qdict_del(options, BDRV_OPT_READ_ONLY);
3289         bdrv_inherited_options(BDRV_CHILD_COW, true,
3290                                &flags, options, flags, options);
3291     }
3292 
3293     bs->open_flags = flags;
3294     bs->options = options;
3295     options = qdict_clone_shallow(options);
3296 
3297     /* Find the right image format driver */
3298     /* See cautionary note on accessing @options above */
3299     drvname = qdict_get_try_str(options, "driver");
3300     if (drvname) {
3301         drv = bdrv_find_format(drvname);
3302         if (!drv) {
3303             error_setg(errp, "Unknown driver: '%s'", drvname);
3304             goto fail;
3305         }
3306     }
3307 
3308     assert(drvname || !(flags & BDRV_O_PROTOCOL));
3309 
3310     /* See cautionary note on accessing @options above */
3311     backing = qdict_get_try_str(options, "backing");
3312     if (qobject_to(QNull, qdict_get(options, "backing")) != NULL ||
3313         (backing && *backing == '\0'))
3314     {
3315         if (backing) {
3316             warn_report("Use of \"backing\": \"\" is deprecated; "
3317                         "use \"backing\": null instead");
3318         }
3319         flags |= BDRV_O_NO_BACKING;
3320         qdict_del(bs->explicit_options, "backing");
3321         qdict_del(bs->options, "backing");
3322         qdict_del(options, "backing");
3323     }
3324 
3325     /* Open image file without format layer. This BlockBackend is only used for
3326      * probing, the block drivers will do their own bdrv_open_child() for the
3327      * same BDS, which is why we put the node name back into options. */
3328     if ((flags & BDRV_O_PROTOCOL) == 0) {
3329         BlockDriverState *file_bs;
3330 
3331         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
3332                                      &child_of_bds, BDRV_CHILD_IMAGE,
3333                                      true, &local_err);
3334         if (local_err) {
3335             goto fail;
3336         }
3337         if (file_bs != NULL) {
3338             /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
3339              * looking at the header to guess the image format. This works even
3340              * in cases where a guest would not see a consistent state. */
3341             file = blk_new(bdrv_get_aio_context(file_bs), 0, BLK_PERM_ALL);
3342             blk_insert_bs(file, file_bs, &local_err);
3343             bdrv_unref(file_bs);
3344             if (local_err) {
3345                 goto fail;
3346             }
3347 
3348             qdict_put_str(options, "file", bdrv_get_node_name(file_bs));
3349         }
3350     }
3351 
3352     /* Image format probing */
3353     bs->probed = !drv;
3354     if (!drv && file) {
3355         ret = find_image_format(file, filename, &drv, &local_err);
3356         if (ret < 0) {
3357             goto fail;
3358         }
3359         /*
3360          * This option update would logically belong in bdrv_fill_options(),
3361          * but we first need to open bs->file for the probing to work, while
3362          * opening bs->file already requires the (mostly) final set of options
3363          * so that cache mode etc. can be inherited.
3364          *
3365          * Adding the driver later is somewhat ugly, but it's not an option
3366          * that would ever be inherited, so it's correct. We just need to make
3367          * sure to update both bs->options (which has the full effective
3368          * options for bs) and options (which has file.* already removed).
3369          */
3370         qdict_put_str(bs->options, "driver", drv->format_name);
3371         qdict_put_str(options, "driver", drv->format_name);
3372     } else if (!drv) {
3373         error_setg(errp, "Must specify either driver or file");
3374         goto fail;
3375     }
3376 
3377     /* BDRV_O_PROTOCOL must be set iff a protocol BDS is about to be created */
3378     assert(!!(flags & BDRV_O_PROTOCOL) == !!drv->bdrv_file_open);
3379     /* file must be NULL if a protocol BDS is about to be created
3380      * (the inverse results in an error message from bdrv_open_common()) */
3381     assert(!(flags & BDRV_O_PROTOCOL) || !file);
3382 
3383     /* Open the image */
3384     ret = bdrv_open_common(bs, file, options, &local_err);
3385     if (ret < 0) {
3386         goto fail;
3387     }
3388 
3389     if (file) {
3390         blk_unref(file);
3391         file = NULL;
3392     }
3393 
3394     /* If there is a backing file, use it */
3395     if ((flags & BDRV_O_NO_BACKING) == 0) {
3396         ret = bdrv_open_backing_file(bs, options, "backing", &local_err);
3397         if (ret < 0) {
3398             goto close_and_fail;
3399         }
3400     }
3401 
3402     /* Remove all children options and references
3403      * from bs->options and bs->explicit_options */
3404     QLIST_FOREACH(child, &bs->children, next) {
3405         char *child_key_dot;
3406         child_key_dot = g_strdup_printf("%s.", child->name);
3407         qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
3408         qdict_extract_subqdict(bs->options, NULL, child_key_dot);
3409         qdict_del(bs->explicit_options, child->name);
3410         qdict_del(bs->options, child->name);
3411         g_free(child_key_dot);
3412     }
3413 
3414     /* Check if any unknown options were used */
3415     if (qdict_size(options) != 0) {
3416         const QDictEntry *entry = qdict_first(options);
3417         if (flags & BDRV_O_PROTOCOL) {
3418             error_setg(errp, "Block protocol '%s' doesn't support the option "
3419                        "'%s'", drv->format_name, entry->key);
3420         } else {
3421             error_setg(errp,
3422                        "Block format '%s' does not support the option '%s'",
3423                        drv->format_name, entry->key);
3424         }
3425 
3426         goto close_and_fail;
3427     }
3428 
3429     bdrv_parent_cb_change_media(bs, true);
3430 
3431     qobject_unref(options);
3432     options = NULL;
3433 
3434     /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
3435      * temporary snapshot afterwards. */
3436     if (snapshot_flags) {
3437         BlockDriverState *snapshot_bs;
3438         snapshot_bs = bdrv_append_temp_snapshot(bs, snapshot_flags,
3439                                                 snapshot_options, &local_err);
3440         snapshot_options = NULL;
3441         if (local_err) {
3442             goto close_and_fail;
3443         }
3444         /* We are not going to return bs but the overlay on top of it
3445          * (snapshot_bs); thus, we have to drop the strong reference to bs
3446          * (which we obtained by calling bdrv_new()). bs will not be deleted,
3447          * though, because the overlay still has a reference to it. */
3448         bdrv_unref(bs);
3449         bs = snapshot_bs;
3450     }
3451 
3452     return bs;
3453 
3454 fail:
3455     blk_unref(file);
3456     qobject_unref(snapshot_options);
3457     qobject_unref(bs->explicit_options);
3458     qobject_unref(bs->options);
3459     qobject_unref(options);
3460     bs->options = NULL;
3461     bs->explicit_options = NULL;
3462     bdrv_unref(bs);
3463     error_propagate(errp, local_err);
3464     return NULL;
3465 
3466 close_and_fail:
3467     bdrv_unref(bs);
3468     qobject_unref(snapshot_options);
3469     qobject_unref(options);
3470     error_propagate(errp, local_err);
3471     return NULL;
3472 }
3473 
3474 BlockDriverState *bdrv_open(const char *filename, const char *reference,
3475                             QDict *options, int flags, Error **errp)
3476 {
3477     return bdrv_open_inherit(filename, reference, options, flags, NULL,
3478                              NULL, 0, errp);
3479 }
3480 
3481 /* Return true if the NULL-terminated @list contains @str */
3482 static bool is_str_in_list(const char *str, const char *const *list)
3483 {
3484     if (str && list) {
3485         int i;
3486         for (i = 0; list[i] != NULL; i++) {
3487             if (!strcmp(str, list[i])) {
3488                 return true;
3489             }
3490         }
3491     }
3492     return false;
3493 }
3494 
3495 /*
3496  * Check that every option set in @bs->options is also set in
3497  * @new_opts.
3498  *
3499  * Options listed in the common_options list and in
3500  * @bs->drv->mutable_opts are skipped.
3501  *
3502  * Return 0 on success, otherwise return -EINVAL and set @errp.
3503  */
3504 static int bdrv_reset_options_allowed(BlockDriverState *bs,
3505                                       const QDict *new_opts, Error **errp)
3506 {
3507     const QDictEntry *e;
3508     /* These options are common to all block drivers and are handled
3509      * in bdrv_reopen_prepare() so they can be left out of @new_opts */
3510     const char *const common_options[] = {
3511         "node-name", "discard", "cache.direct", "cache.no-flush",
3512         "read-only", "auto-read-only", "detect-zeroes", NULL
3513     };
3514 
3515     for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
3516         if (!qdict_haskey(new_opts, e->key) &&
3517             !is_str_in_list(e->key, common_options) &&
3518             !is_str_in_list(e->key, bs->drv->mutable_opts)) {
3519             error_setg(errp, "Option '%s' cannot be reset "
3520                        "to its default value", e->key);
3521             return -EINVAL;
3522         }
3523     }
3524 
3525     return 0;
3526 }
3527 
3528 /*
3529  * Returns true if @child can be reached recursively from @bs
3530  */
3531 static bool bdrv_recurse_has_child(BlockDriverState *bs,
3532                                    BlockDriverState *child)
3533 {
3534     BdrvChild *c;
3535 
3536     if (bs == child) {
3537         return true;
3538     }
3539 
3540     QLIST_FOREACH(c, &bs->children, next) {
3541         if (bdrv_recurse_has_child(c->bs, child)) {
3542             return true;
3543         }
3544     }
3545 
3546     return false;
3547 }
3548 
3549 /*
3550  * Adds a BlockDriverState to a simple queue for an atomic, transactional
3551  * reopen of multiple devices.
3552  *
3553  * bs_queue can either be an existing BlockReopenQueue that has had QTAILQ_INIT
3554  * already performed, or alternatively may be NULL a new BlockReopenQueue will
3555  * be created and initialized. This newly created BlockReopenQueue should be
3556  * passed back in for subsequent calls that are intended to be of the same
3557  * atomic 'set'.
3558  *
3559  * bs is the BlockDriverState to add to the reopen queue.
3560  *
3561  * options contains the changed options for the associated bs
3562  * (the BlockReopenQueue takes ownership)
3563  *
3564  * flags contains the open flags for the associated bs
3565  *
3566  * returns a pointer to bs_queue, which is either the newly allocated
3567  * bs_queue, or the existing bs_queue being used.
3568  *
3569  * bs must be drained between bdrv_reopen_queue() and bdrv_reopen_multiple().
3570  */
3571 static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
3572                                                  BlockDriverState *bs,
3573                                                  QDict *options,
3574                                                  const BdrvChildClass *klass,
3575                                                  BdrvChildRole role,
3576                                                  bool parent_is_format,
3577                                                  QDict *parent_options,
3578                                                  int parent_flags,
3579                                                  bool keep_old_opts)
3580 {
3581     assert(bs != NULL);
3582 
3583     BlockReopenQueueEntry *bs_entry;
3584     BdrvChild *child;
3585     QDict *old_options, *explicit_options, *options_copy;
3586     int flags;
3587     QemuOpts *opts;
3588 
3589     /* Make sure that the caller remembered to use a drained section. This is
3590      * important to avoid graph changes between the recursive queuing here and
3591      * bdrv_reopen_multiple(). */
3592     assert(bs->quiesce_counter > 0);
3593 
3594     if (bs_queue == NULL) {
3595         bs_queue = g_new0(BlockReopenQueue, 1);
3596         QTAILQ_INIT(bs_queue);
3597     }
3598 
3599     if (!options) {
3600         options = qdict_new();
3601     }
3602 
3603     /* Check if this BlockDriverState is already in the queue */
3604     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3605         if (bs == bs_entry->state.bs) {
3606             break;
3607         }
3608     }
3609 
3610     /*
3611      * Precedence of options:
3612      * 1. Explicitly passed in options (highest)
3613      * 2. Retained from explicitly set options of bs
3614      * 3. Inherited from parent node
3615      * 4. Retained from effective options of bs
3616      */
3617 
3618     /* Old explicitly set values (don't overwrite by inherited value) */
3619     if (bs_entry || keep_old_opts) {
3620         old_options = qdict_clone_shallow(bs_entry ?
3621                                           bs_entry->state.explicit_options :
3622                                           bs->explicit_options);
3623         bdrv_join_options(bs, options, old_options);
3624         qobject_unref(old_options);
3625     }
3626 
3627     explicit_options = qdict_clone_shallow(options);
3628 
3629     /* Inherit from parent node */
3630     if (parent_options) {
3631         flags = 0;
3632         klass->inherit_options(role, parent_is_format, &flags, options,
3633                                parent_flags, parent_options);
3634     } else {
3635         flags = bdrv_get_flags(bs);
3636     }
3637 
3638     if (keep_old_opts) {
3639         /* Old values are used for options that aren't set yet */
3640         old_options = qdict_clone_shallow(bs->options);
3641         bdrv_join_options(bs, options, old_options);
3642         qobject_unref(old_options);
3643     }
3644 
3645     /* We have the final set of options so let's update the flags */
3646     options_copy = qdict_clone_shallow(options);
3647     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
3648     qemu_opts_absorb_qdict(opts, options_copy, NULL);
3649     update_flags_from_options(&flags, opts);
3650     qemu_opts_del(opts);
3651     qobject_unref(options_copy);
3652 
3653     /* bdrv_open_inherit() sets and clears some additional flags internally */
3654     flags &= ~BDRV_O_PROTOCOL;
3655     if (flags & BDRV_O_RDWR) {
3656         flags |= BDRV_O_ALLOW_RDWR;
3657     }
3658 
3659     if (!bs_entry) {
3660         bs_entry = g_new0(BlockReopenQueueEntry, 1);
3661         QTAILQ_INSERT_TAIL(bs_queue, bs_entry, entry);
3662     } else {
3663         qobject_unref(bs_entry->state.options);
3664         qobject_unref(bs_entry->state.explicit_options);
3665     }
3666 
3667     bs_entry->state.bs = bs;
3668     bs_entry->state.options = options;
3669     bs_entry->state.explicit_options = explicit_options;
3670     bs_entry->state.flags = flags;
3671 
3672     /* This needs to be overwritten in bdrv_reopen_prepare() */
3673     bs_entry->state.perm = UINT64_MAX;
3674     bs_entry->state.shared_perm = 0;
3675 
3676     /*
3677      * If keep_old_opts is false then it means that unspecified
3678      * options must be reset to their original value. We don't allow
3679      * resetting 'backing' but we need to know if the option is
3680      * missing in order to decide if we have to return an error.
3681      */
3682     if (!keep_old_opts) {
3683         bs_entry->state.backing_missing =
3684             !qdict_haskey(options, "backing") &&
3685             !qdict_haskey(options, "backing.driver");
3686     }
3687 
3688     QLIST_FOREACH(child, &bs->children, next) {
3689         QDict *new_child_options = NULL;
3690         bool child_keep_old = keep_old_opts;
3691 
3692         /* reopen can only change the options of block devices that were
3693          * implicitly created and inherited options. For other (referenced)
3694          * block devices, a syntax like "backing.foo" results in an error. */
3695         if (child->bs->inherits_from != bs) {
3696             continue;
3697         }
3698 
3699         /* Check if the options contain a child reference */
3700         if (qdict_haskey(options, child->name)) {
3701             const char *childref = qdict_get_try_str(options, child->name);
3702             /*
3703              * The current child must not be reopened if the child
3704              * reference is null or points to a different node.
3705              */
3706             if (g_strcmp0(childref, child->bs->node_name)) {
3707                 continue;
3708             }
3709             /*
3710              * If the child reference points to the current child then
3711              * reopen it with its existing set of options (note that
3712              * it can still inherit new options from the parent).
3713              */
3714             child_keep_old = true;
3715         } else {
3716             /* Extract child options ("child-name.*") */
3717             char *child_key_dot = g_strdup_printf("%s.", child->name);
3718             qdict_extract_subqdict(explicit_options, NULL, child_key_dot);
3719             qdict_extract_subqdict(options, &new_child_options, child_key_dot);
3720             g_free(child_key_dot);
3721         }
3722 
3723         bdrv_reopen_queue_child(bs_queue, child->bs, new_child_options,
3724                                 child->klass, child->role, bs->drv->is_format,
3725                                 options, flags, child_keep_old);
3726     }
3727 
3728     return bs_queue;
3729 }
3730 
3731 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
3732                                     BlockDriverState *bs,
3733                                     QDict *options, bool keep_old_opts)
3734 {
3735     return bdrv_reopen_queue_child(bs_queue, bs, options, NULL, 0, false,
3736                                    NULL, 0, keep_old_opts);
3737 }
3738 
3739 /*
3740  * Reopen multiple BlockDriverStates atomically & transactionally.
3741  *
3742  * The queue passed in (bs_queue) must have been built up previous
3743  * via bdrv_reopen_queue().
3744  *
3745  * Reopens all BDS specified in the queue, with the appropriate
3746  * flags.  All devices are prepared for reopen, and failure of any
3747  * device will cause all device changes to be abandoned, and intermediate
3748  * data cleaned up.
3749  *
3750  * If all devices prepare successfully, then the changes are committed
3751  * to all devices.
3752  *
3753  * All affected nodes must be drained between bdrv_reopen_queue() and
3754  * bdrv_reopen_multiple().
3755  */
3756 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
3757 {
3758     int ret = -1;
3759     BlockReopenQueueEntry *bs_entry, *next;
3760 
3761     assert(bs_queue != NULL);
3762 
3763     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3764         assert(bs_entry->state.bs->quiesce_counter > 0);
3765         if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, errp)) {
3766             goto cleanup;
3767         }
3768         bs_entry->prepared = true;
3769     }
3770 
3771     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3772         BDRVReopenState *state = &bs_entry->state;
3773         ret = bdrv_check_perm(state->bs, bs_queue, state->perm,
3774                               state->shared_perm, NULL, errp);
3775         if (ret < 0) {
3776             goto cleanup_perm;
3777         }
3778         /* Check if new_backing_bs would accept the new permissions */
3779         if (state->replace_backing_bs && state->new_backing_bs) {
3780             uint64_t nperm, nshared;
3781             bdrv_child_perm(state->bs, state->new_backing_bs,
3782                             NULL, bdrv_backing_role(state->bs),
3783                             bs_queue, state->perm, state->shared_perm,
3784                             &nperm, &nshared);
3785             ret = bdrv_check_update_perm(state->new_backing_bs, NULL,
3786                                          nperm, nshared, NULL, errp);
3787             if (ret < 0) {
3788                 goto cleanup_perm;
3789             }
3790         }
3791         bs_entry->perms_checked = true;
3792     }
3793 
3794     /*
3795      * If we reach this point, we have success and just need to apply the
3796      * changes.
3797      *
3798      * Reverse order is used to comfort qcow2 driver: on commit it need to write
3799      * IN_USE flag to the image, to mark bitmaps in the image as invalid. But
3800      * children are usually goes after parents in reopen-queue, so go from last
3801      * to first element.
3802      */
3803     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
3804         bdrv_reopen_commit(&bs_entry->state);
3805     }
3806 
3807     ret = 0;
3808 cleanup_perm:
3809     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
3810         BDRVReopenState *state = &bs_entry->state;
3811 
3812         if (!bs_entry->perms_checked) {
3813             continue;
3814         }
3815 
3816         if (ret == 0) {
3817             uint64_t perm, shared;
3818 
3819             bdrv_get_cumulative_perm(state->bs, &perm, &shared);
3820             assert(perm == state->perm);
3821             assert(shared == state->shared_perm);
3822 
3823             bdrv_set_perm(state->bs);
3824         } else {
3825             bdrv_abort_perm_update(state->bs);
3826             if (state->replace_backing_bs && state->new_backing_bs) {
3827                 bdrv_abort_perm_update(state->new_backing_bs);
3828             }
3829         }
3830     }
3831 
3832     if (ret == 0) {
3833         QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
3834             BlockDriverState *bs = bs_entry->state.bs;
3835 
3836             if (bs->drv->bdrv_reopen_commit_post)
3837                 bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
3838         }
3839     }
3840 cleanup:
3841     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
3842         if (ret) {
3843             if (bs_entry->prepared) {
3844                 bdrv_reopen_abort(&bs_entry->state);
3845             }
3846             qobject_unref(bs_entry->state.explicit_options);
3847             qobject_unref(bs_entry->state.options);
3848         }
3849         if (bs_entry->state.new_backing_bs) {
3850             bdrv_unref(bs_entry->state.new_backing_bs);
3851         }
3852         g_free(bs_entry);
3853     }
3854     g_free(bs_queue);
3855 
3856     return ret;
3857 }
3858 
3859 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
3860                               Error **errp)
3861 {
3862     int ret;
3863     BlockReopenQueue *queue;
3864     QDict *opts = qdict_new();
3865 
3866     qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
3867 
3868     bdrv_subtree_drained_begin(bs);
3869     queue = bdrv_reopen_queue(NULL, bs, opts, true);
3870     ret = bdrv_reopen_multiple(queue, errp);
3871     bdrv_subtree_drained_end(bs);
3872 
3873     return ret;
3874 }
3875 
3876 static BlockReopenQueueEntry *find_parent_in_reopen_queue(BlockReopenQueue *q,
3877                                                           BdrvChild *c)
3878 {
3879     BlockReopenQueueEntry *entry;
3880 
3881     QTAILQ_FOREACH(entry, q, entry) {
3882         BlockDriverState *bs = entry->state.bs;
3883         BdrvChild *child;
3884 
3885         QLIST_FOREACH(child, &bs->children, next) {
3886             if (child == c) {
3887                 return entry;
3888             }
3889         }
3890     }
3891 
3892     return NULL;
3893 }
3894 
3895 static void bdrv_reopen_perm(BlockReopenQueue *q, BlockDriverState *bs,
3896                              uint64_t *perm, uint64_t *shared)
3897 {
3898     BdrvChild *c;
3899     BlockReopenQueueEntry *parent;
3900     uint64_t cumulative_perms = 0;
3901     uint64_t cumulative_shared_perms = BLK_PERM_ALL;
3902 
3903     QLIST_FOREACH(c, &bs->parents, next_parent) {
3904         parent = find_parent_in_reopen_queue(q, c);
3905         if (!parent) {
3906             cumulative_perms |= c->perm;
3907             cumulative_shared_perms &= c->shared_perm;
3908         } else {
3909             uint64_t nperm, nshared;
3910 
3911             bdrv_child_perm(parent->state.bs, bs, c, c->role, q,
3912                             parent->state.perm, parent->state.shared_perm,
3913                             &nperm, &nshared);
3914 
3915             cumulative_perms |= nperm;
3916             cumulative_shared_perms &= nshared;
3917         }
3918     }
3919     *perm = cumulative_perms;
3920     *shared = cumulative_shared_perms;
3921 }
3922 
3923 static bool bdrv_reopen_can_attach(BlockDriverState *parent,
3924                                    BdrvChild *child,
3925                                    BlockDriverState *new_child,
3926                                    Error **errp)
3927 {
3928     AioContext *parent_ctx = bdrv_get_aio_context(parent);
3929     AioContext *child_ctx = bdrv_get_aio_context(new_child);
3930     GSList *ignore;
3931     bool ret;
3932 
3933     ignore = g_slist_prepend(NULL, child);
3934     ret = bdrv_can_set_aio_context(new_child, parent_ctx, &ignore, NULL);
3935     g_slist_free(ignore);
3936     if (ret) {
3937         return ret;
3938     }
3939 
3940     ignore = g_slist_prepend(NULL, child);
3941     ret = bdrv_can_set_aio_context(parent, child_ctx, &ignore, errp);
3942     g_slist_free(ignore);
3943     return ret;
3944 }
3945 
3946 /*
3947  * Take a BDRVReopenState and check if the value of 'backing' in the
3948  * reopen_state->options QDict is valid or not.
3949  *
3950  * If 'backing' is missing from the QDict then return 0.
3951  *
3952  * If 'backing' contains the node name of the backing file of
3953  * reopen_state->bs then return 0.
3954  *
3955  * If 'backing' contains a different node name (or is null) then check
3956  * whether the current backing file can be replaced with the new one.
3957  * If that's the case then reopen_state->replace_backing_bs is set to
3958  * true and reopen_state->new_backing_bs contains a pointer to the new
3959  * backing BlockDriverState (or NULL).
3960  *
3961  * Return 0 on success, otherwise return < 0 and set @errp.
3962  */
3963 static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
3964                                      Error **errp)
3965 {
3966     BlockDriverState *bs = reopen_state->bs;
3967     BlockDriverState *overlay_bs, *below_bs, *new_backing_bs;
3968     QObject *value;
3969     const char *str;
3970 
3971     value = qdict_get(reopen_state->options, "backing");
3972     if (value == NULL) {
3973         return 0;
3974     }
3975 
3976     switch (qobject_type(value)) {
3977     case QTYPE_QNULL:
3978         new_backing_bs = NULL;
3979         break;
3980     case QTYPE_QSTRING:
3981         str = qstring_get_str(qobject_to(QString, value));
3982         new_backing_bs = bdrv_lookup_bs(NULL, str, errp);
3983         if (new_backing_bs == NULL) {
3984             return -EINVAL;
3985         } else if (bdrv_recurse_has_child(new_backing_bs, bs)) {
3986             error_setg(errp, "Making '%s' a backing file of '%s' "
3987                        "would create a cycle", str, bs->node_name);
3988             return -EINVAL;
3989         }
3990         break;
3991     default:
3992         /* 'backing' does not allow any other data type */
3993         g_assert_not_reached();
3994     }
3995 
3996     /*
3997      * Check AioContext compatibility so that the bdrv_set_backing_hd() call in
3998      * bdrv_reopen_commit() won't fail.
3999      */
4000     if (new_backing_bs) {
4001         if (!bdrv_reopen_can_attach(bs, bs->backing, new_backing_bs, errp)) {
4002             return -EINVAL;
4003         }
4004     }
4005 
4006     /*
4007      * Ensure that @bs can really handle backing files, because we are
4008      * about to give it one (or swap the existing one)
4009      */
4010     if (bs->drv->is_filter) {
4011         /* Filters always have a file or a backing child */
4012         if (!bs->backing) {
4013             error_setg(errp, "'%s' is a %s filter node that does not support a "
4014                        "backing child", bs->node_name, bs->drv->format_name);
4015             return -EINVAL;
4016         }
4017     } else if (!bs->drv->supports_backing) {
4018         error_setg(errp, "Driver '%s' of node '%s' does not support backing "
4019                    "files", bs->drv->format_name, bs->node_name);
4020         return -EINVAL;
4021     }
4022 
4023     /*
4024      * Find the "actual" backing file by skipping all links that point
4025      * to an implicit node, if any (e.g. a commit filter node).
4026      * We cannot use any of the bdrv_skip_*() functions here because
4027      * those return the first explicit node, while we are looking for
4028      * its overlay here.
4029      */
4030     overlay_bs = bs;
4031     for (below_bs = bdrv_filter_or_cow_bs(overlay_bs);
4032          below_bs && below_bs->implicit;
4033          below_bs = bdrv_filter_or_cow_bs(overlay_bs))
4034     {
4035         overlay_bs = below_bs;
4036     }
4037 
4038     /* If we want to replace the backing file we need some extra checks */
4039     if (new_backing_bs != bdrv_filter_or_cow_bs(overlay_bs)) {
4040         /* Check for implicit nodes between bs and its backing file */
4041         if (bs != overlay_bs) {
4042             error_setg(errp, "Cannot change backing link if '%s' has "
4043                        "an implicit backing file", bs->node_name);
4044             return -EPERM;
4045         }
4046         /*
4047          * Check if the backing link that we want to replace is frozen.
4048          * Note that
4049          * bdrv_filter_or_cow_child(overlay_bs) == overlay_bs->backing,
4050          * because we know that overlay_bs == bs, and that @bs
4051          * either is a filter that uses ->backing or a COW format BDS
4052          * with bs->drv->supports_backing == true.
4053          */
4054         if (bdrv_is_backing_chain_frozen(overlay_bs,
4055                                          child_bs(overlay_bs->backing), errp))
4056         {
4057             return -EPERM;
4058         }
4059         reopen_state->replace_backing_bs = true;
4060         if (new_backing_bs) {
4061             bdrv_ref(new_backing_bs);
4062             reopen_state->new_backing_bs = new_backing_bs;
4063         }
4064     }
4065 
4066     return 0;
4067 }
4068 
4069 /*
4070  * Prepares a BlockDriverState for reopen. All changes are staged in the
4071  * 'opaque' field of the BDRVReopenState, which is used and allocated by
4072  * the block driver layer .bdrv_reopen_prepare()
4073  *
4074  * bs is the BlockDriverState to reopen
4075  * flags are the new open flags
4076  * queue is the reopen queue
4077  *
4078  * Returns 0 on success, non-zero on error.  On error errp will be set
4079  * as well.
4080  *
4081  * On failure, bdrv_reopen_abort() will be called to clean up any data.
4082  * It is the responsibility of the caller to then call the abort() or
4083  * commit() for any other BDS that have been left in a prepare() state
4084  *
4085  */
4086 int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
4087                         Error **errp)
4088 {
4089     int ret = -1;
4090     int old_flags;
4091     Error *local_err = NULL;
4092     BlockDriver *drv;
4093     QemuOpts *opts;
4094     QDict *orig_reopen_opts;
4095     char *discard = NULL;
4096     bool read_only;
4097     bool drv_prepared = false;
4098 
4099     assert(reopen_state != NULL);
4100     assert(reopen_state->bs->drv != NULL);
4101     drv = reopen_state->bs->drv;
4102 
4103     /* This function and each driver's bdrv_reopen_prepare() remove
4104      * entries from reopen_state->options as they are processed, so
4105      * we need to make a copy of the original QDict. */
4106     orig_reopen_opts = qdict_clone_shallow(reopen_state->options);
4107 
4108     /* Process generic block layer options */
4109     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
4110     if (!qemu_opts_absorb_qdict(opts, reopen_state->options, errp)) {
4111         ret = -EINVAL;
4112         goto error;
4113     }
4114 
4115     /* This was already called in bdrv_reopen_queue_child() so the flags
4116      * are up-to-date. This time we simply want to remove the options from
4117      * QemuOpts in order to indicate that they have been processed. */
4118     old_flags = reopen_state->flags;
4119     update_flags_from_options(&reopen_state->flags, opts);
4120     assert(old_flags == reopen_state->flags);
4121 
4122     discard = qemu_opt_get_del(opts, BDRV_OPT_DISCARD);
4123     if (discard != NULL) {
4124         if (bdrv_parse_discard_flags(discard, &reopen_state->flags) != 0) {
4125             error_setg(errp, "Invalid discard option");
4126             ret = -EINVAL;
4127             goto error;
4128         }
4129     }
4130 
4131     reopen_state->detect_zeroes =
4132         bdrv_parse_detect_zeroes(opts, reopen_state->flags, &local_err);
4133     if (local_err) {
4134         error_propagate(errp, local_err);
4135         ret = -EINVAL;
4136         goto error;
4137     }
4138 
4139     /* All other options (including node-name and driver) must be unchanged.
4140      * Put them back into the QDict, so that they are checked at the end
4141      * of this function. */
4142     qemu_opts_to_qdict(opts, reopen_state->options);
4143 
4144     /* If we are to stay read-only, do not allow permission change
4145      * to r/w. Attempting to set to r/w may fail if either BDRV_O_ALLOW_RDWR is
4146      * not set, or if the BDS still has copy_on_read enabled */
4147     read_only = !(reopen_state->flags & BDRV_O_RDWR);
4148     ret = bdrv_can_set_read_only(reopen_state->bs, read_only, true, &local_err);
4149     if (local_err) {
4150         error_propagate(errp, local_err);
4151         goto error;
4152     }
4153 
4154     /* Calculate required permissions after reopening */
4155     bdrv_reopen_perm(queue, reopen_state->bs,
4156                      &reopen_state->perm, &reopen_state->shared_perm);
4157 
4158     ret = bdrv_flush(reopen_state->bs);
4159     if (ret) {
4160         error_setg_errno(errp, -ret, "Error flushing drive");
4161         goto error;
4162     }
4163 
4164     if (drv->bdrv_reopen_prepare) {
4165         /*
4166          * If a driver-specific option is missing, it means that we
4167          * should reset it to its default value.
4168          * But not all options allow that, so we need to check it first.
4169          */
4170         ret = bdrv_reset_options_allowed(reopen_state->bs,
4171                                          reopen_state->options, errp);
4172         if (ret) {
4173             goto error;
4174         }
4175 
4176         ret = drv->bdrv_reopen_prepare(reopen_state, queue, &local_err);
4177         if (ret) {
4178             if (local_err != NULL) {
4179                 error_propagate(errp, local_err);
4180             } else {
4181                 bdrv_refresh_filename(reopen_state->bs);
4182                 error_setg(errp, "failed while preparing to reopen image '%s'",
4183                            reopen_state->bs->filename);
4184             }
4185             goto error;
4186         }
4187     } else {
4188         /* It is currently mandatory to have a bdrv_reopen_prepare()
4189          * handler for each supported drv. */
4190         error_setg(errp, "Block format '%s' used by node '%s' "
4191                    "does not support reopening files", drv->format_name,
4192                    bdrv_get_device_or_node_name(reopen_state->bs));
4193         ret = -1;
4194         goto error;
4195     }
4196 
4197     drv_prepared = true;
4198 
4199     /*
4200      * We must provide the 'backing' option if the BDS has a backing
4201      * file or if the image file has a backing file name as part of
4202      * its metadata. Otherwise the 'backing' option can be omitted.
4203      */
4204     if (drv->supports_backing && reopen_state->backing_missing &&
4205         (reopen_state->bs->backing || reopen_state->bs->backing_file[0])) {
4206         error_setg(errp, "backing is missing for '%s'",
4207                    reopen_state->bs->node_name);
4208         ret = -EINVAL;
4209         goto error;
4210     }
4211 
4212     /*
4213      * Allow changing the 'backing' option. The new value can be
4214      * either a reference to an existing node (using its node name)
4215      * or NULL to simply detach the current backing file.
4216      */
4217     ret = bdrv_reopen_parse_backing(reopen_state, errp);
4218     if (ret < 0) {
4219         goto error;
4220     }
4221     qdict_del(reopen_state->options, "backing");
4222 
4223     /* Options that are not handled are only okay if they are unchanged
4224      * compared to the old state. It is expected that some options are only
4225      * used for the initial open, but not reopen (e.g. filename) */
4226     if (qdict_size(reopen_state->options)) {
4227         const QDictEntry *entry = qdict_first(reopen_state->options);
4228 
4229         do {
4230             QObject *new = entry->value;
4231             QObject *old = qdict_get(reopen_state->bs->options, entry->key);
4232 
4233             /* Allow child references (child_name=node_name) as long as they
4234              * point to the current child (i.e. everything stays the same). */
4235             if (qobject_type(new) == QTYPE_QSTRING) {
4236                 BdrvChild *child;
4237                 QLIST_FOREACH(child, &reopen_state->bs->children, next) {
4238                     if (!strcmp(child->name, entry->key)) {
4239                         break;
4240                     }
4241                 }
4242 
4243                 if (child) {
4244                     if (!strcmp(child->bs->node_name,
4245                                 qstring_get_str(qobject_to(QString, new)))) {
4246                         continue; /* Found child with this name, skip option */
4247                     }
4248                 }
4249             }
4250 
4251             /*
4252              * TODO: When using -drive to specify blockdev options, all values
4253              * will be strings; however, when using -blockdev, blockdev-add or
4254              * filenames using the json:{} pseudo-protocol, they will be
4255              * correctly typed.
4256              * In contrast, reopening options are (currently) always strings
4257              * (because you can only specify them through qemu-io; all other
4258              * callers do not specify any options).
4259              * Therefore, when using anything other than -drive to create a BDS,
4260              * this cannot detect non-string options as unchanged, because
4261              * qobject_is_equal() always returns false for objects of different
4262              * type.  In the future, this should be remedied by correctly typing
4263              * all options.  For now, this is not too big of an issue because
4264              * the user can simply omit options which cannot be changed anyway,
4265              * so they will stay unchanged.
4266              */
4267             if (!qobject_is_equal(new, old)) {
4268                 error_setg(errp, "Cannot change the option '%s'", entry->key);
4269                 ret = -EINVAL;
4270                 goto error;
4271             }
4272         } while ((entry = qdict_next(reopen_state->options, entry)));
4273     }
4274 
4275     ret = 0;
4276 
4277     /* Restore the original reopen_state->options QDict */
4278     qobject_unref(reopen_state->options);
4279     reopen_state->options = qobject_ref(orig_reopen_opts);
4280 
4281 error:
4282     if (ret < 0 && drv_prepared) {
4283         /* drv->bdrv_reopen_prepare() has succeeded, so we need to
4284          * call drv->bdrv_reopen_abort() before signaling an error
4285          * (bdrv_reopen_multiple() will not call bdrv_reopen_abort()
4286          * when the respective bdrv_reopen_prepare() has failed) */
4287         if (drv->bdrv_reopen_abort) {
4288             drv->bdrv_reopen_abort(reopen_state);
4289         }
4290     }
4291     qemu_opts_del(opts);
4292     qobject_unref(orig_reopen_opts);
4293     g_free(discard);
4294     return ret;
4295 }
4296 
4297 /*
4298  * Takes the staged changes for the reopen from bdrv_reopen_prepare(), and
4299  * makes them final by swapping the staging BlockDriverState contents into
4300  * the active BlockDriverState contents.
4301  */
4302 void bdrv_reopen_commit(BDRVReopenState *reopen_state)
4303 {
4304     BlockDriver *drv;
4305     BlockDriverState *bs;
4306     BdrvChild *child;
4307 
4308     assert(reopen_state != NULL);
4309     bs = reopen_state->bs;
4310     drv = bs->drv;
4311     assert(drv != NULL);
4312 
4313     /* If there are any driver level actions to take */
4314     if (drv->bdrv_reopen_commit) {
4315         drv->bdrv_reopen_commit(reopen_state);
4316     }
4317 
4318     /* set BDS specific flags now */
4319     qobject_unref(bs->explicit_options);
4320     qobject_unref(bs->options);
4321 
4322     bs->explicit_options   = reopen_state->explicit_options;
4323     bs->options            = reopen_state->options;
4324     bs->open_flags         = reopen_state->flags;
4325     bs->read_only = !(reopen_state->flags & BDRV_O_RDWR);
4326     bs->detect_zeroes      = reopen_state->detect_zeroes;
4327 
4328     if (reopen_state->replace_backing_bs) {
4329         qdict_del(bs->explicit_options, "backing");
4330         qdict_del(bs->options, "backing");
4331     }
4332 
4333     /* Remove child references from bs->options and bs->explicit_options.
4334      * Child options were already removed in bdrv_reopen_queue_child() */
4335     QLIST_FOREACH(child, &bs->children, next) {
4336         qdict_del(bs->explicit_options, child->name);
4337         qdict_del(bs->options, child->name);
4338     }
4339 
4340     /*
4341      * Change the backing file if a new one was specified. We do this
4342      * after updating bs->options, so bdrv_refresh_filename() (called
4343      * from bdrv_set_backing_hd()) has the new values.
4344      */
4345     if (reopen_state->replace_backing_bs) {
4346         BlockDriverState *old_backing_bs = child_bs(bs->backing);
4347         assert(!old_backing_bs || !old_backing_bs->implicit);
4348         /* Abort the permission update on the backing bs we're detaching */
4349         if (old_backing_bs) {
4350             bdrv_abort_perm_update(old_backing_bs);
4351         }
4352         bdrv_set_backing_hd(bs, reopen_state->new_backing_bs, &error_abort);
4353     }
4354 
4355     bdrv_refresh_limits(bs, NULL);
4356 }
4357 
4358 /*
4359  * Abort the reopen, and delete and free the staged changes in
4360  * reopen_state
4361  */
4362 void bdrv_reopen_abort(BDRVReopenState *reopen_state)
4363 {
4364     BlockDriver *drv;
4365 
4366     assert(reopen_state != NULL);
4367     drv = reopen_state->bs->drv;
4368     assert(drv != NULL);
4369 
4370     if (drv->bdrv_reopen_abort) {
4371         drv->bdrv_reopen_abort(reopen_state);
4372     }
4373 }
4374 
4375 
4376 static void bdrv_close(BlockDriverState *bs)
4377 {
4378     BdrvAioNotifier *ban, *ban_next;
4379     BdrvChild *child, *next;
4380 
4381     assert(!bs->refcnt);
4382 
4383     bdrv_drained_begin(bs); /* complete I/O */
4384     bdrv_flush(bs);
4385     bdrv_drain(bs); /* in case flush left pending I/O */
4386 
4387     if (bs->drv) {
4388         if (bs->drv->bdrv_close) {
4389             /* Must unfreeze all children, so bdrv_unref_child() works */
4390             bs->drv->bdrv_close(bs);
4391         }
4392         bs->drv = NULL;
4393     }
4394 
4395     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
4396         bdrv_unref_child(bs, child);
4397     }
4398 
4399     bs->backing = NULL;
4400     bs->file = NULL;
4401     g_free(bs->opaque);
4402     bs->opaque = NULL;
4403     qatomic_set(&bs->copy_on_read, 0);
4404     bs->backing_file[0] = '\0';
4405     bs->backing_format[0] = '\0';
4406     bs->total_sectors = 0;
4407     bs->encrypted = false;
4408     bs->sg = false;
4409     qobject_unref(bs->options);
4410     qobject_unref(bs->explicit_options);
4411     bs->options = NULL;
4412     bs->explicit_options = NULL;
4413     qobject_unref(bs->full_open_options);
4414     bs->full_open_options = NULL;
4415 
4416     bdrv_release_named_dirty_bitmaps(bs);
4417     assert(QLIST_EMPTY(&bs->dirty_bitmaps));
4418 
4419     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
4420         g_free(ban);
4421     }
4422     QLIST_INIT(&bs->aio_notifiers);
4423     bdrv_drained_end(bs);
4424 
4425     /*
4426      * If we're still inside some bdrv_drain_all_begin()/end() sections, end
4427      * them now since this BDS won't exist anymore when bdrv_drain_all_end()
4428      * gets called.
4429      */
4430     if (bs->quiesce_counter) {
4431         bdrv_drain_all_end_quiesce(bs);
4432     }
4433 }
4434 
4435 void bdrv_close_all(void)
4436 {
4437     assert(job_next(NULL) == NULL);
4438 
4439     /* Drop references from requests still in flight, such as canceled block
4440      * jobs whose AIO context has not been polled yet */
4441     bdrv_drain_all();
4442 
4443     blk_remove_all_bs();
4444     blockdev_close_all_bdrv_states();
4445 
4446     assert(QTAILQ_EMPTY(&all_bdrv_states));
4447 }
4448 
4449 static bool should_update_child(BdrvChild *c, BlockDriverState *to)
4450 {
4451     GQueue *queue;
4452     GHashTable *found;
4453     bool ret;
4454 
4455     if (c->klass->stay_at_node) {
4456         return false;
4457     }
4458 
4459     /* If the child @c belongs to the BDS @to, replacing the current
4460      * c->bs by @to would mean to create a loop.
4461      *
4462      * Such a case occurs when appending a BDS to a backing chain.
4463      * For instance, imagine the following chain:
4464      *
4465      *   guest device -> node A -> further backing chain...
4466      *
4467      * Now we create a new BDS B which we want to put on top of this
4468      * chain, so we first attach A as its backing node:
4469      *
4470      *                   node B
4471      *                     |
4472      *                     v
4473      *   guest device -> node A -> further backing chain...
4474      *
4475      * Finally we want to replace A by B.  When doing that, we want to
4476      * replace all pointers to A by pointers to B -- except for the
4477      * pointer from B because (1) that would create a loop, and (2)
4478      * that pointer should simply stay intact:
4479      *
4480      *   guest device -> node B
4481      *                     |
4482      *                     v
4483      *                   node A -> further backing chain...
4484      *
4485      * In general, when replacing a node A (c->bs) by a node B (@to),
4486      * if A is a child of B, that means we cannot replace A by B there
4487      * because that would create a loop.  Silently detaching A from B
4488      * is also not really an option.  So overall just leaving A in
4489      * place there is the most sensible choice.
4490      *
4491      * We would also create a loop in any cases where @c is only
4492      * indirectly referenced by @to. Prevent this by returning false
4493      * if @c is found (by breadth-first search) anywhere in the whole
4494      * subtree of @to.
4495      */
4496 
4497     ret = true;
4498     found = g_hash_table_new(NULL, NULL);
4499     g_hash_table_add(found, to);
4500     queue = g_queue_new();
4501     g_queue_push_tail(queue, to);
4502 
4503     while (!g_queue_is_empty(queue)) {
4504         BlockDriverState *v = g_queue_pop_head(queue);
4505         BdrvChild *c2;
4506 
4507         QLIST_FOREACH(c2, &v->children, next) {
4508             if (c2 == c) {
4509                 ret = false;
4510                 break;
4511             }
4512 
4513             if (g_hash_table_contains(found, c2->bs)) {
4514                 continue;
4515             }
4516 
4517             g_queue_push_tail(queue, c2->bs);
4518             g_hash_table_add(found, c2->bs);
4519         }
4520     }
4521 
4522     g_queue_free(queue);
4523     g_hash_table_destroy(found);
4524 
4525     return ret;
4526 }
4527 
4528 /*
4529  * With auto_skip=true bdrv_replace_node_common skips updating from parents
4530  * if it creates a parent-child relation loop or if parent is block-job.
4531  *
4532  * With auto_skip=false the error is returned if from has a parent which should
4533  * not be updated.
4534  */
4535 static void bdrv_replace_node_common(BlockDriverState *from,
4536                                      BlockDriverState *to,
4537                                      bool auto_skip, Error **errp)
4538 {
4539     BdrvChild *c, *next;
4540     GSList *list = NULL, *p;
4541     uint64_t perm = 0, shared = BLK_PERM_ALL;
4542     int ret;
4543 
4544     /* Make sure that @from doesn't go away until we have successfully attached
4545      * all of its parents to @to. */
4546     bdrv_ref(from);
4547 
4548     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
4549     assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
4550     bdrv_drained_begin(from);
4551 
4552     /* Put all parents into @list and calculate their cumulative permissions */
4553     QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
4554         assert(c->bs == from);
4555         if (!should_update_child(c, to)) {
4556             if (auto_skip) {
4557                 continue;
4558             }
4559             error_setg(errp, "Should not change '%s' link to '%s'",
4560                        c->name, from->node_name);
4561             goto out;
4562         }
4563         if (c->frozen) {
4564             error_setg(errp, "Cannot change '%s' link to '%s'",
4565                        c->name, from->node_name);
4566             goto out;
4567         }
4568         list = g_slist_prepend(list, c);
4569         perm |= c->perm;
4570         shared &= c->shared_perm;
4571     }
4572 
4573     /* Check whether the required permissions can be granted on @to, ignoring
4574      * all BdrvChild in @list so that they can't block themselves. */
4575     ret = bdrv_check_update_perm(to, NULL, perm, shared, list, errp);
4576     if (ret < 0) {
4577         bdrv_abort_perm_update(to);
4578         goto out;
4579     }
4580 
4581     /* Now actually perform the change. We performed the permission check for
4582      * all elements of @list at once, so set the permissions all at once at the
4583      * very end. */
4584     for (p = list; p != NULL; p = p->next) {
4585         c = p->data;
4586 
4587         bdrv_ref(to);
4588         bdrv_replace_child_noperm(c, to);
4589         bdrv_unref(from);
4590     }
4591 
4592     bdrv_set_perm(to);
4593 
4594 out:
4595     g_slist_free(list);
4596     bdrv_drained_end(from);
4597     bdrv_unref(from);
4598 }
4599 
4600 void bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
4601                        Error **errp)
4602 {
4603     return bdrv_replace_node_common(from, to, true, errp);
4604 }
4605 
4606 /*
4607  * Add new bs contents at the top of an image chain while the chain is
4608  * live, while keeping required fields on the top layer.
4609  *
4610  * This will modify the BlockDriverState fields, and swap contents
4611  * between bs_new and bs_top. Both bs_new and bs_top are modified.
4612  *
4613  * bs_new must not be attached to a BlockBackend.
4614  *
4615  * This function does not create any image files.
4616  *
4617  * bdrv_append() takes ownership of a bs_new reference and unrefs it because
4618  * that's what the callers commonly need. bs_new will be referenced by the old
4619  * parents of bs_top after bdrv_append() returns. If the caller needs to keep a
4620  * reference of its own, it must call bdrv_ref().
4621  */
4622 void bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
4623                  Error **errp)
4624 {
4625     Error *local_err = NULL;
4626 
4627     bdrv_set_backing_hd(bs_new, bs_top, &local_err);
4628     if (local_err) {
4629         error_propagate(errp, local_err);
4630         goto out;
4631     }
4632 
4633     bdrv_replace_node(bs_top, bs_new, &local_err);
4634     if (local_err) {
4635         error_propagate(errp, local_err);
4636         bdrv_set_backing_hd(bs_new, NULL, &error_abort);
4637         goto out;
4638     }
4639 
4640     /* bs_new is now referenced by its new parents, we don't need the
4641      * additional reference any more. */
4642 out:
4643     bdrv_unref(bs_new);
4644 }
4645 
4646 static void bdrv_delete(BlockDriverState *bs)
4647 {
4648     assert(bdrv_op_blocker_is_empty(bs));
4649     assert(!bs->refcnt);
4650 
4651     /* remove from list, if necessary */
4652     if (bs->node_name[0] != '\0') {
4653         QTAILQ_REMOVE(&graph_bdrv_states, bs, node_list);
4654     }
4655     QTAILQ_REMOVE(&all_bdrv_states, bs, bs_list);
4656 
4657     bdrv_close(bs);
4658 
4659     g_free(bs);
4660 }
4661 
4662 BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *node_options,
4663                                    int flags, Error **errp)
4664 {
4665     BlockDriverState *new_node_bs;
4666     Error *local_err = NULL;
4667 
4668     new_node_bs = bdrv_open(NULL, NULL, node_options, flags, errp);
4669     if (new_node_bs == NULL) {
4670         error_prepend(errp, "Could not create node: ");
4671         return NULL;
4672     }
4673 
4674     bdrv_drained_begin(bs);
4675     bdrv_replace_node(bs, new_node_bs, &local_err);
4676     bdrv_drained_end(bs);
4677 
4678     if (local_err) {
4679         bdrv_unref(new_node_bs);
4680         error_propagate(errp, local_err);
4681         return NULL;
4682     }
4683 
4684     return new_node_bs;
4685 }
4686 
4687 /*
4688  * Run consistency checks on an image
4689  *
4690  * Returns 0 if the check could be completed (it doesn't mean that the image is
4691  * free of errors) or -errno when an internal error occurred. The results of the
4692  * check are stored in res.
4693  */
4694 int coroutine_fn bdrv_co_check(BlockDriverState *bs,
4695                                BdrvCheckResult *res, BdrvCheckMode fix)
4696 {
4697     if (bs->drv == NULL) {
4698         return -ENOMEDIUM;
4699     }
4700     if (bs->drv->bdrv_co_check == NULL) {
4701         return -ENOTSUP;
4702     }
4703 
4704     memset(res, 0, sizeof(*res));
4705     return bs->drv->bdrv_co_check(bs, res, fix);
4706 }
4707 
4708 /*
4709  * Return values:
4710  * 0        - success
4711  * -EINVAL  - backing format specified, but no file
4712  * -ENOSPC  - can't update the backing file because no space is left in the
4713  *            image file header
4714  * -ENOTSUP - format driver doesn't support changing the backing file
4715  */
4716 int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
4717                              const char *backing_fmt, bool warn)
4718 {
4719     BlockDriver *drv = bs->drv;
4720     int ret;
4721 
4722     if (!drv) {
4723         return -ENOMEDIUM;
4724     }
4725 
4726     /* Backing file format doesn't make sense without a backing file */
4727     if (backing_fmt && !backing_file) {
4728         return -EINVAL;
4729     }
4730 
4731     if (warn && backing_file && !backing_fmt) {
4732         warn_report("Deprecated use of backing file without explicit "
4733                     "backing format, use of this image requires "
4734                     "potentially unsafe format probing");
4735     }
4736 
4737     if (drv->bdrv_change_backing_file != NULL) {
4738         ret = drv->bdrv_change_backing_file(bs, backing_file, backing_fmt);
4739     } else {
4740         ret = -ENOTSUP;
4741     }
4742 
4743     if (ret == 0) {
4744         pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
4745         pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
4746         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
4747                 backing_file ?: "");
4748     }
4749     return ret;
4750 }
4751 
4752 /*
4753  * Finds the first non-filter node above bs in the chain between
4754  * active and bs.  The returned node is either an immediate parent of
4755  * bs, or there are only filter nodes between the two.
4756  *
4757  * Returns NULL if bs is not found in active's image chain,
4758  * or if active == bs.
4759  *
4760  * Returns the bottommost base image if bs == NULL.
4761  */
4762 BlockDriverState *bdrv_find_overlay(BlockDriverState *active,
4763                                     BlockDriverState *bs)
4764 {
4765     bs = bdrv_skip_filters(bs);
4766     active = bdrv_skip_filters(active);
4767 
4768     while (active) {
4769         BlockDriverState *next = bdrv_backing_chain_next(active);
4770         if (bs == next) {
4771             return active;
4772         }
4773         active = next;
4774     }
4775 
4776     return NULL;
4777 }
4778 
4779 /* Given a BDS, searches for the base layer. */
4780 BlockDriverState *bdrv_find_base(BlockDriverState *bs)
4781 {
4782     return bdrv_find_overlay(bs, NULL);
4783 }
4784 
4785 /*
4786  * Return true if at least one of the COW (backing) and filter links
4787  * between @bs and @base is frozen. @errp is set if that's the case.
4788  * @base must be reachable from @bs, or NULL.
4789  */
4790 bool bdrv_is_backing_chain_frozen(BlockDriverState *bs, BlockDriverState *base,
4791                                   Error **errp)
4792 {
4793     BlockDriverState *i;
4794     BdrvChild *child;
4795 
4796     for (i = bs; i != base; i = child_bs(child)) {
4797         child = bdrv_filter_or_cow_child(i);
4798 
4799         if (child && child->frozen) {
4800             error_setg(errp, "Cannot change '%s' link from '%s' to '%s'",
4801                        child->name, i->node_name, child->bs->node_name);
4802             return true;
4803         }
4804     }
4805 
4806     return false;
4807 }
4808 
4809 /*
4810  * Freeze all COW (backing) and filter links between @bs and @base.
4811  * If any of the links is already frozen the operation is aborted and
4812  * none of the links are modified.
4813  * @base must be reachable from @bs, or NULL.
4814  * Returns 0 on success. On failure returns < 0 and sets @errp.
4815  */
4816 int bdrv_freeze_backing_chain(BlockDriverState *bs, BlockDriverState *base,
4817                               Error **errp)
4818 {
4819     BlockDriverState *i;
4820     BdrvChild *child;
4821 
4822     if (bdrv_is_backing_chain_frozen(bs, base, errp)) {
4823         return -EPERM;
4824     }
4825 
4826     for (i = bs; i != base; i = child_bs(child)) {
4827         child = bdrv_filter_or_cow_child(i);
4828         if (child && child->bs->never_freeze) {
4829             error_setg(errp, "Cannot freeze '%s' link to '%s'",
4830                        child->name, child->bs->node_name);
4831             return -EPERM;
4832         }
4833     }
4834 
4835     for (i = bs; i != base; i = child_bs(child)) {
4836         child = bdrv_filter_or_cow_child(i);
4837         if (child) {
4838             child->frozen = true;
4839         }
4840     }
4841 
4842     return 0;
4843 }
4844 
4845 /*
4846  * Unfreeze all COW (backing) and filter links between @bs and @base.
4847  * The caller must ensure that all links are frozen before using this
4848  * function.
4849  * @base must be reachable from @bs, or NULL.
4850  */
4851 void bdrv_unfreeze_backing_chain(BlockDriverState *bs, BlockDriverState *base)
4852 {
4853     BlockDriverState *i;
4854     BdrvChild *child;
4855 
4856     for (i = bs; i != base; i = child_bs(child)) {
4857         child = bdrv_filter_or_cow_child(i);
4858         if (child) {
4859             assert(child->frozen);
4860             child->frozen = false;
4861         }
4862     }
4863 }
4864 
4865 /*
4866  * Drops images above 'base' up to and including 'top', and sets the image
4867  * above 'top' to have base as its backing file.
4868  *
4869  * Requires that the overlay to 'top' is opened r/w, so that the backing file
4870  * information in 'bs' can be properly updated.
4871  *
4872  * E.g., this will convert the following chain:
4873  * bottom <- base <- intermediate <- top <- active
4874  *
4875  * to
4876  *
4877  * bottom <- base <- active
4878  *
4879  * It is allowed for bottom==base, in which case it converts:
4880  *
4881  * base <- intermediate <- top <- active
4882  *
4883  * to
4884  *
4885  * base <- active
4886  *
4887  * If backing_file_str is non-NULL, it will be used when modifying top's
4888  * overlay image metadata.
4889  *
4890  * Error conditions:
4891  *  if active == top, that is considered an error
4892  *
4893  */
4894 int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
4895                            const char *backing_file_str)
4896 {
4897     BlockDriverState *explicit_top = top;
4898     bool update_inherits_from;
4899     BdrvChild *c;
4900     Error *local_err = NULL;
4901     int ret = -EIO;
4902     g_autoptr(GSList) updated_children = NULL;
4903     GSList *p;
4904 
4905     bdrv_ref(top);
4906     bdrv_subtree_drained_begin(top);
4907 
4908     if (!top->drv || !base->drv) {
4909         goto exit;
4910     }
4911 
4912     /* Make sure that base is in the backing chain of top */
4913     if (!bdrv_chain_contains(top, base)) {
4914         goto exit;
4915     }
4916 
4917     /* If 'base' recursively inherits from 'top' then we should set
4918      * base->inherits_from to top->inherits_from after 'top' and all
4919      * other intermediate nodes have been dropped.
4920      * If 'top' is an implicit node (e.g. "commit_top") we should skip
4921      * it because no one inherits from it. We use explicit_top for that. */
4922     explicit_top = bdrv_skip_implicit_filters(explicit_top);
4923     update_inherits_from = bdrv_inherits_from_recursive(base, explicit_top);
4924 
4925     /* success - we can delete the intermediate states, and link top->base */
4926     /* TODO Check graph modification op blockers (BLK_PERM_GRAPH_MOD) once
4927      * we've figured out how they should work. */
4928     if (!backing_file_str) {
4929         bdrv_refresh_filename(base);
4930         backing_file_str = base->filename;
4931     }
4932 
4933     QLIST_FOREACH(c, &top->parents, next_parent) {
4934         updated_children = g_slist_prepend(updated_children, c);
4935     }
4936 
4937     bdrv_replace_node_common(top, base, false, &local_err);
4938     if (local_err) {
4939         error_report_err(local_err);
4940         goto exit;
4941     }
4942 
4943     for (p = updated_children; p; p = p->next) {
4944         c = p->data;
4945 
4946         if (c->klass->update_filename) {
4947             ret = c->klass->update_filename(c, base, backing_file_str,
4948                                             &local_err);
4949             if (ret < 0) {
4950                 /*
4951                  * TODO: Actually, we want to rollback all previous iterations
4952                  * of this loop, and (which is almost impossible) previous
4953                  * bdrv_replace_node()...
4954                  *
4955                  * Note, that c->klass->update_filename may lead to permission
4956                  * update, so it's a bad idea to call it inside permission
4957                  * update transaction of bdrv_replace_node.
4958                  */
4959                 error_report_err(local_err);
4960                 goto exit;
4961             }
4962         }
4963     }
4964 
4965     if (update_inherits_from) {
4966         base->inherits_from = explicit_top->inherits_from;
4967     }
4968 
4969     ret = 0;
4970 exit:
4971     bdrv_subtree_drained_end(top);
4972     bdrv_unref(top);
4973     return ret;
4974 }
4975 
4976 /**
4977  * Implementation of BlockDriver.bdrv_get_allocated_file_size() that
4978  * sums the size of all data-bearing children.  (This excludes backing
4979  * children.)
4980  */
4981 static int64_t bdrv_sum_allocated_file_size(BlockDriverState *bs)
4982 {
4983     BdrvChild *child;
4984     int64_t child_size, sum = 0;
4985 
4986     QLIST_FOREACH(child, &bs->children, next) {
4987         if (child->role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
4988                            BDRV_CHILD_FILTERED))
4989         {
4990             child_size = bdrv_get_allocated_file_size(child->bs);
4991             if (child_size < 0) {
4992                 return child_size;
4993             }
4994             sum += child_size;
4995         }
4996     }
4997 
4998     return sum;
4999 }
5000 
5001 /**
5002  * Length of a allocated file in bytes. Sparse files are counted by actual
5003  * allocated space. Return < 0 if error or unknown.
5004  */
5005 int64_t bdrv_get_allocated_file_size(BlockDriverState *bs)
5006 {
5007     BlockDriver *drv = bs->drv;
5008     if (!drv) {
5009         return -ENOMEDIUM;
5010     }
5011     if (drv->bdrv_get_allocated_file_size) {
5012         return drv->bdrv_get_allocated_file_size(bs);
5013     }
5014 
5015     if (drv->bdrv_file_open) {
5016         /*
5017          * Protocol drivers default to -ENOTSUP (most of their data is
5018          * not stored in any of their children (if they even have any),
5019          * so there is no generic way to figure it out).
5020          */
5021         return -ENOTSUP;
5022     } else if (drv->is_filter) {
5023         /* Filter drivers default to the size of their filtered child */
5024         return bdrv_get_allocated_file_size(bdrv_filter_bs(bs));
5025     } else {
5026         /* Other drivers default to summing their children's sizes */
5027         return bdrv_sum_allocated_file_size(bs);
5028     }
5029 }
5030 
5031 /*
5032  * bdrv_measure:
5033  * @drv: Format driver
5034  * @opts: Creation options for new image
5035  * @in_bs: Existing image containing data for new image (may be NULL)
5036  * @errp: Error object
5037  * Returns: A #BlockMeasureInfo (free using qapi_free_BlockMeasureInfo())
5038  *          or NULL on error
5039  *
5040  * Calculate file size required to create a new image.
5041  *
5042  * If @in_bs is given then space for allocated clusters and zero clusters
5043  * from that image are included in the calculation.  If @opts contains a
5044  * backing file that is shared by @in_bs then backing clusters may be omitted
5045  * from the calculation.
5046  *
5047  * If @in_bs is NULL then the calculation includes no allocated clusters
5048  * unless a preallocation option is given in @opts.
5049  *
5050  * Note that @in_bs may use a different BlockDriver from @drv.
5051  *
5052  * If an error occurs the @errp pointer is set.
5053  */
5054 BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
5055                                BlockDriverState *in_bs, Error **errp)
5056 {
5057     if (!drv->bdrv_measure) {
5058         error_setg(errp, "Block driver '%s' does not support size measurement",
5059                    drv->format_name);
5060         return NULL;
5061     }
5062 
5063     return drv->bdrv_measure(opts, in_bs, errp);
5064 }
5065 
5066 /**
5067  * Return number of sectors on success, -errno on error.
5068  */
5069 int64_t bdrv_nb_sectors(BlockDriverState *bs)
5070 {
5071     BlockDriver *drv = bs->drv;
5072 
5073     if (!drv)
5074         return -ENOMEDIUM;
5075 
5076     if (drv->has_variable_length) {
5077         int ret = refresh_total_sectors(bs, bs->total_sectors);
5078         if (ret < 0) {
5079             return ret;
5080         }
5081     }
5082     return bs->total_sectors;
5083 }
5084 
5085 /**
5086  * Return length in bytes on success, -errno on error.
5087  * The length is always a multiple of BDRV_SECTOR_SIZE.
5088  */
5089 int64_t bdrv_getlength(BlockDriverState *bs)
5090 {
5091     int64_t ret = bdrv_nb_sectors(bs);
5092 
5093     if (ret < 0) {
5094         return ret;
5095     }
5096     if (ret > INT64_MAX / BDRV_SECTOR_SIZE) {
5097         return -EFBIG;
5098     }
5099     return ret * BDRV_SECTOR_SIZE;
5100 }
5101 
5102 /* return 0 as number of sectors if no device present or error */
5103 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr)
5104 {
5105     int64_t nb_sectors = bdrv_nb_sectors(bs);
5106 
5107     *nb_sectors_ptr = nb_sectors < 0 ? 0 : nb_sectors;
5108 }
5109 
5110 bool bdrv_is_sg(BlockDriverState *bs)
5111 {
5112     return bs->sg;
5113 }
5114 
5115 /**
5116  * Return whether the given node supports compressed writes.
5117  */
5118 bool bdrv_supports_compressed_writes(BlockDriverState *bs)
5119 {
5120     BlockDriverState *filtered;
5121 
5122     if (!bs->drv || !block_driver_can_compress(bs->drv)) {
5123         return false;
5124     }
5125 
5126     filtered = bdrv_filter_bs(bs);
5127     if (filtered) {
5128         /*
5129          * Filters can only forward compressed writes, so we have to
5130          * check the child.
5131          */
5132         return bdrv_supports_compressed_writes(filtered);
5133     }
5134 
5135     return true;
5136 }
5137 
5138 const char *bdrv_get_format_name(BlockDriverState *bs)
5139 {
5140     return bs->drv ? bs->drv->format_name : NULL;
5141 }
5142 
5143 static int qsort_strcmp(const void *a, const void *b)
5144 {
5145     return strcmp(*(char *const *)a, *(char *const *)b);
5146 }
5147 
5148 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
5149                          void *opaque, bool read_only)
5150 {
5151     BlockDriver *drv;
5152     int count = 0;
5153     int i;
5154     const char **formats = NULL;
5155 
5156     QLIST_FOREACH(drv, &bdrv_drivers, list) {
5157         if (drv->format_name) {
5158             bool found = false;
5159             int i = count;
5160 
5161             if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, read_only)) {
5162                 continue;
5163             }
5164 
5165             while (formats && i && !found) {
5166                 found = !strcmp(formats[--i], drv->format_name);
5167             }
5168 
5169             if (!found) {
5170                 formats = g_renew(const char *, formats, count + 1);
5171                 formats[count++] = drv->format_name;
5172             }
5173         }
5174     }
5175 
5176     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); i++) {
5177         const char *format_name = block_driver_modules[i].format_name;
5178 
5179         if (format_name) {
5180             bool found = false;
5181             int j = count;
5182 
5183             if (use_bdrv_whitelist &&
5184                 !bdrv_format_is_whitelisted(format_name, read_only)) {
5185                 continue;
5186             }
5187 
5188             while (formats && j && !found) {
5189                 found = !strcmp(formats[--j], format_name);
5190             }
5191 
5192             if (!found) {
5193                 formats = g_renew(const char *, formats, count + 1);
5194                 formats[count++] = format_name;
5195             }
5196         }
5197     }
5198 
5199     qsort(formats, count, sizeof(formats[0]), qsort_strcmp);
5200 
5201     for (i = 0; i < count; i++) {
5202         it(opaque, formats[i]);
5203     }
5204 
5205     g_free(formats);
5206 }
5207 
5208 /* This function is to find a node in the bs graph */
5209 BlockDriverState *bdrv_find_node(const char *node_name)
5210 {
5211     BlockDriverState *bs;
5212 
5213     assert(node_name);
5214 
5215     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
5216         if (!strcmp(node_name, bs->node_name)) {
5217             return bs;
5218         }
5219     }
5220     return NULL;
5221 }
5222 
5223 /* Put this QMP function here so it can access the static graph_bdrv_states. */
5224 BlockDeviceInfoList *bdrv_named_nodes_list(bool flat,
5225                                            Error **errp)
5226 {
5227     BlockDeviceInfoList *list;
5228     BlockDriverState *bs;
5229 
5230     list = NULL;
5231     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
5232         BlockDeviceInfo *info = bdrv_block_device_info(NULL, bs, flat, errp);
5233         if (!info) {
5234             qapi_free_BlockDeviceInfoList(list);
5235             return NULL;
5236         }
5237         QAPI_LIST_PREPEND(list, info);
5238     }
5239 
5240     return list;
5241 }
5242 
5243 typedef struct XDbgBlockGraphConstructor {
5244     XDbgBlockGraph *graph;
5245     GHashTable *graph_nodes;
5246 } XDbgBlockGraphConstructor;
5247 
5248 static XDbgBlockGraphConstructor *xdbg_graph_new(void)
5249 {
5250     XDbgBlockGraphConstructor *gr = g_new(XDbgBlockGraphConstructor, 1);
5251 
5252     gr->graph = g_new0(XDbgBlockGraph, 1);
5253     gr->graph_nodes = g_hash_table_new(NULL, NULL);
5254 
5255     return gr;
5256 }
5257 
5258 static XDbgBlockGraph *xdbg_graph_finalize(XDbgBlockGraphConstructor *gr)
5259 {
5260     XDbgBlockGraph *graph = gr->graph;
5261 
5262     g_hash_table_destroy(gr->graph_nodes);
5263     g_free(gr);
5264 
5265     return graph;
5266 }
5267 
5268 static uintptr_t xdbg_graph_node_num(XDbgBlockGraphConstructor *gr, void *node)
5269 {
5270     uintptr_t ret = (uintptr_t)g_hash_table_lookup(gr->graph_nodes, node);
5271 
5272     if (ret != 0) {
5273         return ret;
5274     }
5275 
5276     /*
5277      * Start counting from 1, not 0, because 0 interferes with not-found (NULL)
5278      * answer of g_hash_table_lookup.
5279      */
5280     ret = g_hash_table_size(gr->graph_nodes) + 1;
5281     g_hash_table_insert(gr->graph_nodes, node, (void *)ret);
5282 
5283     return ret;
5284 }
5285 
5286 static void xdbg_graph_add_node(XDbgBlockGraphConstructor *gr, void *node,
5287                                 XDbgBlockGraphNodeType type, const char *name)
5288 {
5289     XDbgBlockGraphNode *n;
5290 
5291     n = g_new0(XDbgBlockGraphNode, 1);
5292 
5293     n->id = xdbg_graph_node_num(gr, node);
5294     n->type = type;
5295     n->name = g_strdup(name);
5296 
5297     QAPI_LIST_PREPEND(gr->graph->nodes, n);
5298 }
5299 
5300 static void xdbg_graph_add_edge(XDbgBlockGraphConstructor *gr, void *parent,
5301                                 const BdrvChild *child)
5302 {
5303     BlockPermission qapi_perm;
5304     XDbgBlockGraphEdge *edge;
5305 
5306     edge = g_new0(XDbgBlockGraphEdge, 1);
5307 
5308     edge->parent = xdbg_graph_node_num(gr, parent);
5309     edge->child = xdbg_graph_node_num(gr, child->bs);
5310     edge->name = g_strdup(child->name);
5311 
5312     for (qapi_perm = 0; qapi_perm < BLOCK_PERMISSION__MAX; qapi_perm++) {
5313         uint64_t flag = bdrv_qapi_perm_to_blk_perm(qapi_perm);
5314 
5315         if (flag & child->perm) {
5316             QAPI_LIST_PREPEND(edge->perm, qapi_perm);
5317         }
5318         if (flag & child->shared_perm) {
5319             QAPI_LIST_PREPEND(edge->shared_perm, qapi_perm);
5320         }
5321     }
5322 
5323     QAPI_LIST_PREPEND(gr->graph->edges, edge);
5324 }
5325 
5326 
5327 XDbgBlockGraph *bdrv_get_xdbg_block_graph(Error **errp)
5328 {
5329     BlockBackend *blk;
5330     BlockJob *job;
5331     BlockDriverState *bs;
5332     BdrvChild *child;
5333     XDbgBlockGraphConstructor *gr = xdbg_graph_new();
5334 
5335     for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
5336         char *allocated_name = NULL;
5337         const char *name = blk_name(blk);
5338 
5339         if (!*name) {
5340             name = allocated_name = blk_get_attached_dev_id(blk);
5341         }
5342         xdbg_graph_add_node(gr, blk, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_BACKEND,
5343                            name);
5344         g_free(allocated_name);
5345         if (blk_root(blk)) {
5346             xdbg_graph_add_edge(gr, blk, blk_root(blk));
5347         }
5348     }
5349 
5350     for (job = block_job_next(NULL); job; job = block_job_next(job)) {
5351         GSList *el;
5352 
5353         xdbg_graph_add_node(gr, job, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_JOB,
5354                            job->job.id);
5355         for (el = job->nodes; el; el = el->next) {
5356             xdbg_graph_add_edge(gr, job, (BdrvChild *)el->data);
5357         }
5358     }
5359 
5360     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
5361         xdbg_graph_add_node(gr, bs, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_DRIVER,
5362                            bs->node_name);
5363         QLIST_FOREACH(child, &bs->children, next) {
5364             xdbg_graph_add_edge(gr, bs, child);
5365         }
5366     }
5367 
5368     return xdbg_graph_finalize(gr);
5369 }
5370 
5371 BlockDriverState *bdrv_lookup_bs(const char *device,
5372                                  const char *node_name,
5373                                  Error **errp)
5374 {
5375     BlockBackend *blk;
5376     BlockDriverState *bs;
5377 
5378     if (device) {
5379         blk = blk_by_name(device);
5380 
5381         if (blk) {
5382             bs = blk_bs(blk);
5383             if (!bs) {
5384                 error_setg(errp, "Device '%s' has no medium", device);
5385             }
5386 
5387             return bs;
5388         }
5389     }
5390 
5391     if (node_name) {
5392         bs = bdrv_find_node(node_name);
5393 
5394         if (bs) {
5395             return bs;
5396         }
5397     }
5398 
5399     error_setg(errp, "Cannot find device=%s nor node_name=%s",
5400                      device ? device : "",
5401                      node_name ? node_name : "");
5402     return NULL;
5403 }
5404 
5405 /* If 'base' is in the same chain as 'top', return true. Otherwise,
5406  * return false.  If either argument is NULL, return false. */
5407 bool bdrv_chain_contains(BlockDriverState *top, BlockDriverState *base)
5408 {
5409     while (top && top != base) {
5410         top = bdrv_filter_or_cow_bs(top);
5411     }
5412 
5413     return top != NULL;
5414 }
5415 
5416 BlockDriverState *bdrv_next_node(BlockDriverState *bs)
5417 {
5418     if (!bs) {
5419         return QTAILQ_FIRST(&graph_bdrv_states);
5420     }
5421     return QTAILQ_NEXT(bs, node_list);
5422 }
5423 
5424 BlockDriverState *bdrv_next_all_states(BlockDriverState *bs)
5425 {
5426     if (!bs) {
5427         return QTAILQ_FIRST(&all_bdrv_states);
5428     }
5429     return QTAILQ_NEXT(bs, bs_list);
5430 }
5431 
5432 const char *bdrv_get_node_name(const BlockDriverState *bs)
5433 {
5434     return bs->node_name;
5435 }
5436 
5437 const char *bdrv_get_parent_name(const BlockDriverState *bs)
5438 {
5439     BdrvChild *c;
5440     const char *name;
5441 
5442     /* If multiple parents have a name, just pick the first one. */
5443     QLIST_FOREACH(c, &bs->parents, next_parent) {
5444         if (c->klass->get_name) {
5445             name = c->klass->get_name(c);
5446             if (name && *name) {
5447                 return name;
5448             }
5449         }
5450     }
5451 
5452     return NULL;
5453 }
5454 
5455 /* TODO check what callers really want: bs->node_name or blk_name() */
5456 const char *bdrv_get_device_name(const BlockDriverState *bs)
5457 {
5458     return bdrv_get_parent_name(bs) ?: "";
5459 }
5460 
5461 /* This can be used to identify nodes that might not have a device
5462  * name associated. Since node and device names live in the same
5463  * namespace, the result is unambiguous. The exception is if both are
5464  * absent, then this returns an empty (non-null) string. */
5465 const char *bdrv_get_device_or_node_name(const BlockDriverState *bs)
5466 {
5467     return bdrv_get_parent_name(bs) ?: bs->node_name;
5468 }
5469 
5470 int bdrv_get_flags(BlockDriverState *bs)
5471 {
5472     return bs->open_flags;
5473 }
5474 
5475 int bdrv_has_zero_init_1(BlockDriverState *bs)
5476 {
5477     return 1;
5478 }
5479 
5480 int bdrv_has_zero_init(BlockDriverState *bs)
5481 {
5482     BlockDriverState *filtered;
5483 
5484     if (!bs->drv) {
5485         return 0;
5486     }
5487 
5488     /* If BS is a copy on write image, it is initialized to
5489        the contents of the base image, which may not be zeroes.  */
5490     if (bdrv_cow_child(bs)) {
5491         return 0;
5492     }
5493     if (bs->drv->bdrv_has_zero_init) {
5494         return bs->drv->bdrv_has_zero_init(bs);
5495     }
5496 
5497     filtered = bdrv_filter_bs(bs);
5498     if (filtered) {
5499         return bdrv_has_zero_init(filtered);
5500     }
5501 
5502     /* safe default */
5503     return 0;
5504 }
5505 
5506 bool bdrv_can_write_zeroes_with_unmap(BlockDriverState *bs)
5507 {
5508     if (!(bs->open_flags & BDRV_O_UNMAP)) {
5509         return false;
5510     }
5511 
5512     return bs->supported_zero_flags & BDRV_REQ_MAY_UNMAP;
5513 }
5514 
5515 void bdrv_get_backing_filename(BlockDriverState *bs,
5516                                char *filename, int filename_size)
5517 {
5518     pstrcpy(filename, filename_size, bs->backing_file);
5519 }
5520 
5521 int bdrv_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
5522 {
5523     int ret;
5524     BlockDriver *drv = bs->drv;
5525     /* if bs->drv == NULL, bs is closed, so there's nothing to do here */
5526     if (!drv) {
5527         return -ENOMEDIUM;
5528     }
5529     if (!drv->bdrv_get_info) {
5530         BlockDriverState *filtered = bdrv_filter_bs(bs);
5531         if (filtered) {
5532             return bdrv_get_info(filtered, bdi);
5533         }
5534         return -ENOTSUP;
5535     }
5536     memset(bdi, 0, sizeof(*bdi));
5537     ret = drv->bdrv_get_info(bs, bdi);
5538     if (ret < 0) {
5539         return ret;
5540     }
5541 
5542     if (bdi->cluster_size > BDRV_MAX_ALIGNMENT) {
5543         return -EINVAL;
5544     }
5545 
5546     return 0;
5547 }
5548 
5549 ImageInfoSpecific *bdrv_get_specific_info(BlockDriverState *bs,
5550                                           Error **errp)
5551 {
5552     BlockDriver *drv = bs->drv;
5553     if (drv && drv->bdrv_get_specific_info) {
5554         return drv->bdrv_get_specific_info(bs, errp);
5555     }
5556     return NULL;
5557 }
5558 
5559 BlockStatsSpecific *bdrv_get_specific_stats(BlockDriverState *bs)
5560 {
5561     BlockDriver *drv = bs->drv;
5562     if (!drv || !drv->bdrv_get_specific_stats) {
5563         return NULL;
5564     }
5565     return drv->bdrv_get_specific_stats(bs);
5566 }
5567 
5568 void bdrv_debug_event(BlockDriverState *bs, BlkdebugEvent event)
5569 {
5570     if (!bs || !bs->drv || !bs->drv->bdrv_debug_event) {
5571         return;
5572     }
5573 
5574     bs->drv->bdrv_debug_event(bs, event);
5575 }
5576 
5577 static BlockDriverState *bdrv_find_debug_node(BlockDriverState *bs)
5578 {
5579     while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {
5580         bs = bdrv_primary_bs(bs);
5581     }
5582 
5583     if (bs && bs->drv && bs->drv->bdrv_debug_breakpoint) {
5584         assert(bs->drv->bdrv_debug_remove_breakpoint);
5585         return bs;
5586     }
5587 
5588     return NULL;
5589 }
5590 
5591 int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
5592                           const char *tag)
5593 {
5594     bs = bdrv_find_debug_node(bs);
5595     if (bs) {
5596         return bs->drv->bdrv_debug_breakpoint(bs, event, tag);
5597     }
5598 
5599     return -ENOTSUP;
5600 }
5601 
5602 int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag)
5603 {
5604     bs = bdrv_find_debug_node(bs);
5605     if (bs) {
5606         return bs->drv->bdrv_debug_remove_breakpoint(bs, tag);
5607     }
5608 
5609     return -ENOTSUP;
5610 }
5611 
5612 int bdrv_debug_resume(BlockDriverState *bs, const char *tag)
5613 {
5614     while (bs && (!bs->drv || !bs->drv->bdrv_debug_resume)) {
5615         bs = bdrv_primary_bs(bs);
5616     }
5617 
5618     if (bs && bs->drv && bs->drv->bdrv_debug_resume) {
5619         return bs->drv->bdrv_debug_resume(bs, tag);
5620     }
5621 
5622     return -ENOTSUP;
5623 }
5624 
5625 bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)
5626 {
5627     while (bs && bs->drv && !bs->drv->bdrv_debug_is_suspended) {
5628         bs = bdrv_primary_bs(bs);
5629     }
5630 
5631     if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {
5632         return bs->drv->bdrv_debug_is_suspended(bs, tag);
5633     }
5634 
5635     return false;
5636 }
5637 
5638 /* backing_file can either be relative, or absolute, or a protocol.  If it is
5639  * relative, it must be relative to the chain.  So, passing in bs->filename
5640  * from a BDS as backing_file should not be done, as that may be relative to
5641  * the CWD rather than the chain. */
5642 BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
5643         const char *backing_file)
5644 {
5645     char *filename_full = NULL;
5646     char *backing_file_full = NULL;
5647     char *filename_tmp = NULL;
5648     int is_protocol = 0;
5649     bool filenames_refreshed = false;
5650     BlockDriverState *curr_bs = NULL;
5651     BlockDriverState *retval = NULL;
5652     BlockDriverState *bs_below;
5653 
5654     if (!bs || !bs->drv || !backing_file) {
5655         return NULL;
5656     }
5657 
5658     filename_full     = g_malloc(PATH_MAX);
5659     backing_file_full = g_malloc(PATH_MAX);
5660 
5661     is_protocol = path_has_protocol(backing_file);
5662 
5663     /*
5664      * Being largely a legacy function, skip any filters here
5665      * (because filters do not have normal filenames, so they cannot
5666      * match anyway; and allowing json:{} filenames is a bit out of
5667      * scope).
5668      */
5669     for (curr_bs = bdrv_skip_filters(bs);
5670          bdrv_cow_child(curr_bs) != NULL;
5671          curr_bs = bs_below)
5672     {
5673         bs_below = bdrv_backing_chain_next(curr_bs);
5674 
5675         if (bdrv_backing_overridden(curr_bs)) {
5676             /*
5677              * If the backing file was overridden, we can only compare
5678              * directly against the backing node's filename.
5679              */
5680 
5681             if (!filenames_refreshed) {
5682                 /*
5683                  * This will automatically refresh all of the
5684                  * filenames in the rest of the backing chain, so we
5685                  * only need to do this once.
5686                  */
5687                 bdrv_refresh_filename(bs_below);
5688                 filenames_refreshed = true;
5689             }
5690 
5691             if (strcmp(backing_file, bs_below->filename) == 0) {
5692                 retval = bs_below;
5693                 break;
5694             }
5695         } else if (is_protocol || path_has_protocol(curr_bs->backing_file)) {
5696             /*
5697              * If either of the filename paths is actually a protocol, then
5698              * compare unmodified paths; otherwise make paths relative.
5699              */
5700             char *backing_file_full_ret;
5701 
5702             if (strcmp(backing_file, curr_bs->backing_file) == 0) {
5703                 retval = bs_below;
5704                 break;
5705             }
5706             /* Also check against the full backing filename for the image */
5707             backing_file_full_ret = bdrv_get_full_backing_filename(curr_bs,
5708                                                                    NULL);
5709             if (backing_file_full_ret) {
5710                 bool equal = strcmp(backing_file, backing_file_full_ret) == 0;
5711                 g_free(backing_file_full_ret);
5712                 if (equal) {
5713                     retval = bs_below;
5714                     break;
5715                 }
5716             }
5717         } else {
5718             /* If not an absolute filename path, make it relative to the current
5719              * image's filename path */
5720             filename_tmp = bdrv_make_absolute_filename(curr_bs, backing_file,
5721                                                        NULL);
5722             /* We are going to compare canonicalized absolute pathnames */
5723             if (!filename_tmp || !realpath(filename_tmp, filename_full)) {
5724                 g_free(filename_tmp);
5725                 continue;
5726             }
5727             g_free(filename_tmp);
5728 
5729             /* We need to make sure the backing filename we are comparing against
5730              * is relative to the current image filename (or absolute) */
5731             filename_tmp = bdrv_get_full_backing_filename(curr_bs, NULL);
5732             if (!filename_tmp || !realpath(filename_tmp, backing_file_full)) {
5733                 g_free(filename_tmp);
5734                 continue;
5735             }
5736             g_free(filename_tmp);
5737 
5738             if (strcmp(backing_file_full, filename_full) == 0) {
5739                 retval = bs_below;
5740                 break;
5741             }
5742         }
5743     }
5744 
5745     g_free(filename_full);
5746     g_free(backing_file_full);
5747     return retval;
5748 }
5749 
5750 void bdrv_init(void)
5751 {
5752     module_call_init(MODULE_INIT_BLOCK);
5753 }
5754 
5755 void bdrv_init_with_whitelist(void)
5756 {
5757     use_bdrv_whitelist = 1;
5758     bdrv_init();
5759 }
5760 
5761 int coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs, Error **errp)
5762 {
5763     BdrvChild *child, *parent;
5764     Error *local_err = NULL;
5765     int ret;
5766     BdrvDirtyBitmap *bm;
5767 
5768     if (!bs->drv)  {
5769         return -ENOMEDIUM;
5770     }
5771 
5772     QLIST_FOREACH(child, &bs->children, next) {
5773         bdrv_co_invalidate_cache(child->bs, &local_err);
5774         if (local_err) {
5775             error_propagate(errp, local_err);
5776             return -EINVAL;
5777         }
5778     }
5779 
5780     /*
5781      * Update permissions, they may differ for inactive nodes.
5782      *
5783      * Note that the required permissions of inactive images are always a
5784      * subset of the permissions required after activating the image. This
5785      * allows us to just get the permissions upfront without restricting
5786      * drv->bdrv_invalidate_cache().
5787      *
5788      * It also means that in error cases, we don't have to try and revert to
5789      * the old permissions (which is an operation that could fail, too). We can
5790      * just keep the extended permissions for the next time that an activation
5791      * of the image is tried.
5792      */
5793     if (bs->open_flags & BDRV_O_INACTIVE) {
5794         bs->open_flags &= ~BDRV_O_INACTIVE;
5795         ret = bdrv_refresh_perms(bs, errp);
5796         if (ret < 0) {
5797             bs->open_flags |= BDRV_O_INACTIVE;
5798             return ret;
5799         }
5800 
5801         if (bs->drv->bdrv_co_invalidate_cache) {
5802             bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
5803             if (local_err) {
5804                 bs->open_flags |= BDRV_O_INACTIVE;
5805                 error_propagate(errp, local_err);
5806                 return -EINVAL;
5807             }
5808         }
5809 
5810         FOR_EACH_DIRTY_BITMAP(bs, bm) {
5811             bdrv_dirty_bitmap_skip_store(bm, false);
5812         }
5813 
5814         ret = refresh_total_sectors(bs, bs->total_sectors);
5815         if (ret < 0) {
5816             bs->open_flags |= BDRV_O_INACTIVE;
5817             error_setg_errno(errp, -ret, "Could not refresh total sector count");
5818             return ret;
5819         }
5820     }
5821 
5822     QLIST_FOREACH(parent, &bs->parents, next_parent) {
5823         if (parent->klass->activate) {
5824             parent->klass->activate(parent, &local_err);
5825             if (local_err) {
5826                 bs->open_flags |= BDRV_O_INACTIVE;
5827                 error_propagate(errp, local_err);
5828                 return -EINVAL;
5829             }
5830         }
5831     }
5832 
5833     return 0;
5834 }
5835 
5836 void bdrv_invalidate_cache_all(Error **errp)
5837 {
5838     BlockDriverState *bs;
5839     BdrvNextIterator it;
5840 
5841     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
5842         AioContext *aio_context = bdrv_get_aio_context(bs);
5843         int ret;
5844 
5845         aio_context_acquire(aio_context);
5846         ret = bdrv_invalidate_cache(bs, errp);
5847         aio_context_release(aio_context);
5848         if (ret < 0) {
5849             bdrv_next_cleanup(&it);
5850             return;
5851         }
5852     }
5853 }
5854 
5855 static bool bdrv_has_bds_parent(BlockDriverState *bs, bool only_active)
5856 {
5857     BdrvChild *parent;
5858 
5859     QLIST_FOREACH(parent, &bs->parents, next_parent) {
5860         if (parent->klass->parent_is_bds) {
5861             BlockDriverState *parent_bs = parent->opaque;
5862             if (!only_active || !(parent_bs->open_flags & BDRV_O_INACTIVE)) {
5863                 return true;
5864             }
5865         }
5866     }
5867 
5868     return false;
5869 }
5870 
5871 static int bdrv_inactivate_recurse(BlockDriverState *bs)
5872 {
5873     BdrvChild *child, *parent;
5874     int ret;
5875 
5876     if (!bs->drv) {
5877         return -ENOMEDIUM;
5878     }
5879 
5880     /* Make sure that we don't inactivate a child before its parent.
5881      * It will be covered by recursion from the yet active parent. */
5882     if (bdrv_has_bds_parent(bs, true)) {
5883         return 0;
5884     }
5885 
5886     assert(!(bs->open_flags & BDRV_O_INACTIVE));
5887 
5888     /* Inactivate this node */
5889     if (bs->drv->bdrv_inactivate) {
5890         ret = bs->drv->bdrv_inactivate(bs);
5891         if (ret < 0) {
5892             return ret;
5893         }
5894     }
5895 
5896     QLIST_FOREACH(parent, &bs->parents, next_parent) {
5897         if (parent->klass->inactivate) {
5898             ret = parent->klass->inactivate(parent);
5899             if (ret < 0) {
5900                 return ret;
5901             }
5902         }
5903     }
5904 
5905     bs->open_flags |= BDRV_O_INACTIVE;
5906 
5907     /*
5908      * Update permissions, they may differ for inactive nodes.
5909      * We only tried to loosen restrictions, so errors are not fatal, ignore
5910      * them.
5911      */
5912     bdrv_refresh_perms(bs, NULL);
5913 
5914     /* Recursively inactivate children */
5915     QLIST_FOREACH(child, &bs->children, next) {
5916         ret = bdrv_inactivate_recurse(child->bs);
5917         if (ret < 0) {
5918             return ret;
5919         }
5920     }
5921 
5922     return 0;
5923 }
5924 
5925 int bdrv_inactivate_all(void)
5926 {
5927     BlockDriverState *bs = NULL;
5928     BdrvNextIterator it;
5929     int ret = 0;
5930     GSList *aio_ctxs = NULL, *ctx;
5931 
5932     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
5933         AioContext *aio_context = bdrv_get_aio_context(bs);
5934 
5935         if (!g_slist_find(aio_ctxs, aio_context)) {
5936             aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
5937             aio_context_acquire(aio_context);
5938         }
5939     }
5940 
5941     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
5942         /* Nodes with BDS parents are covered by recursion from the last
5943          * parent that gets inactivated. Don't inactivate them a second
5944          * time if that has already happened. */
5945         if (bdrv_has_bds_parent(bs, false)) {
5946             continue;
5947         }
5948         ret = bdrv_inactivate_recurse(bs);
5949         if (ret < 0) {
5950             bdrv_next_cleanup(&it);
5951             goto out;
5952         }
5953     }
5954 
5955 out:
5956     for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
5957         AioContext *aio_context = ctx->data;
5958         aio_context_release(aio_context);
5959     }
5960     g_slist_free(aio_ctxs);
5961 
5962     return ret;
5963 }
5964 
5965 /**************************************************************/
5966 /* removable device support */
5967 
5968 /**
5969  * Return TRUE if the media is present
5970  */
5971 bool bdrv_is_inserted(BlockDriverState *bs)
5972 {
5973     BlockDriver *drv = bs->drv;
5974     BdrvChild *child;
5975 
5976     if (!drv) {
5977         return false;
5978     }
5979     if (drv->bdrv_is_inserted) {
5980         return drv->bdrv_is_inserted(bs);
5981     }
5982     QLIST_FOREACH(child, &bs->children, next) {
5983         if (!bdrv_is_inserted(child->bs)) {
5984             return false;
5985         }
5986     }
5987     return true;
5988 }
5989 
5990 /**
5991  * If eject_flag is TRUE, eject the media. Otherwise, close the tray
5992  */
5993 void bdrv_eject(BlockDriverState *bs, bool eject_flag)
5994 {
5995     BlockDriver *drv = bs->drv;
5996 
5997     if (drv && drv->bdrv_eject) {
5998         drv->bdrv_eject(bs, eject_flag);
5999     }
6000 }
6001 
6002 /**
6003  * Lock or unlock the media (if it is locked, the user won't be able
6004  * to eject it manually).
6005  */
6006 void bdrv_lock_medium(BlockDriverState *bs, bool locked)
6007 {
6008     BlockDriver *drv = bs->drv;
6009 
6010     trace_bdrv_lock_medium(bs, locked);
6011 
6012     if (drv && drv->bdrv_lock_medium) {
6013         drv->bdrv_lock_medium(bs, locked);
6014     }
6015 }
6016 
6017 /* Get a reference to bs */
6018 void bdrv_ref(BlockDriverState *bs)
6019 {
6020     bs->refcnt++;
6021 }
6022 
6023 /* Release a previously grabbed reference to bs.
6024  * If after releasing, reference count is zero, the BlockDriverState is
6025  * deleted. */
6026 void bdrv_unref(BlockDriverState *bs)
6027 {
6028     if (!bs) {
6029         return;
6030     }
6031     assert(bs->refcnt > 0);
6032     if (--bs->refcnt == 0) {
6033         bdrv_delete(bs);
6034     }
6035 }
6036 
6037 struct BdrvOpBlocker {
6038     Error *reason;
6039     QLIST_ENTRY(BdrvOpBlocker) list;
6040 };
6041 
6042 bool bdrv_op_is_blocked(BlockDriverState *bs, BlockOpType op, Error **errp)
6043 {
6044     BdrvOpBlocker *blocker;
6045     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
6046     if (!QLIST_EMPTY(&bs->op_blockers[op])) {
6047         blocker = QLIST_FIRST(&bs->op_blockers[op]);
6048         error_propagate_prepend(errp, error_copy(blocker->reason),
6049                                 "Node '%s' is busy: ",
6050                                 bdrv_get_device_or_node_name(bs));
6051         return true;
6052     }
6053     return false;
6054 }
6055 
6056 void bdrv_op_block(BlockDriverState *bs, BlockOpType op, Error *reason)
6057 {
6058     BdrvOpBlocker *blocker;
6059     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
6060 
6061     blocker = g_new0(BdrvOpBlocker, 1);
6062     blocker->reason = reason;
6063     QLIST_INSERT_HEAD(&bs->op_blockers[op], blocker, list);
6064 }
6065 
6066 void bdrv_op_unblock(BlockDriverState *bs, BlockOpType op, Error *reason)
6067 {
6068     BdrvOpBlocker *blocker, *next;
6069     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
6070     QLIST_FOREACH_SAFE(blocker, &bs->op_blockers[op], list, next) {
6071         if (blocker->reason == reason) {
6072             QLIST_REMOVE(blocker, list);
6073             g_free(blocker);
6074         }
6075     }
6076 }
6077 
6078 void bdrv_op_block_all(BlockDriverState *bs, Error *reason)
6079 {
6080     int i;
6081     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
6082         bdrv_op_block(bs, i, reason);
6083     }
6084 }
6085 
6086 void bdrv_op_unblock_all(BlockDriverState *bs, Error *reason)
6087 {
6088     int i;
6089     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
6090         bdrv_op_unblock(bs, i, reason);
6091     }
6092 }
6093 
6094 bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
6095 {
6096     int i;
6097 
6098     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
6099         if (!QLIST_EMPTY(&bs->op_blockers[i])) {
6100             return false;
6101         }
6102     }
6103     return true;
6104 }
6105 
6106 void bdrv_img_create(const char *filename, const char *fmt,
6107                      const char *base_filename, const char *base_fmt,
6108                      char *options, uint64_t img_size, int flags, bool quiet,
6109                      Error **errp)
6110 {
6111     QemuOptsList *create_opts = NULL;
6112     QemuOpts *opts = NULL;
6113     const char *backing_fmt, *backing_file;
6114     int64_t size;
6115     BlockDriver *drv, *proto_drv;
6116     Error *local_err = NULL;
6117     int ret = 0;
6118 
6119     /* Find driver and parse its options */
6120     drv = bdrv_find_format(fmt);
6121     if (!drv) {
6122         error_setg(errp, "Unknown file format '%s'", fmt);
6123         return;
6124     }
6125 
6126     proto_drv = bdrv_find_protocol(filename, true, errp);
6127     if (!proto_drv) {
6128         return;
6129     }
6130 
6131     if (!drv->create_opts) {
6132         error_setg(errp, "Format driver '%s' does not support image creation",
6133                    drv->format_name);
6134         return;
6135     }
6136 
6137     if (!proto_drv->create_opts) {
6138         error_setg(errp, "Protocol driver '%s' does not support image creation",
6139                    proto_drv->format_name);
6140         return;
6141     }
6142 
6143     /* Create parameter list */
6144     create_opts = qemu_opts_append(create_opts, drv->create_opts);
6145     create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
6146 
6147     opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
6148 
6149     /* Parse -o options */
6150     if (options) {
6151         if (!qemu_opts_do_parse(opts, options, NULL, errp)) {
6152             goto out;
6153         }
6154     }
6155 
6156     if (!qemu_opt_get(opts, BLOCK_OPT_SIZE)) {
6157         qemu_opt_set_number(opts, BLOCK_OPT_SIZE, img_size, &error_abort);
6158     } else if (img_size != UINT64_C(-1)) {
6159         error_setg(errp, "The image size must be specified only once");
6160         goto out;
6161     }
6162 
6163     if (base_filename) {
6164         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, base_filename,
6165                           NULL)) {
6166             error_setg(errp, "Backing file not supported for file format '%s'",
6167                        fmt);
6168             goto out;
6169         }
6170     }
6171 
6172     if (base_fmt) {
6173         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, base_fmt, NULL)) {
6174             error_setg(errp, "Backing file format not supported for file "
6175                              "format '%s'", fmt);
6176             goto out;
6177         }
6178     }
6179 
6180     backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
6181     if (backing_file) {
6182         if (!strcmp(filename, backing_file)) {
6183             error_setg(errp, "Error: Trying to create an image with the "
6184                              "same filename as the backing file");
6185             goto out;
6186         }
6187         if (backing_file[0] == '\0') {
6188             error_setg(errp, "Expected backing file name, got empty string");
6189             goto out;
6190         }
6191     }
6192 
6193     backing_fmt = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
6194 
6195     /* The size for the image must always be specified, unless we have a backing
6196      * file and we have not been forbidden from opening it. */
6197     size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, img_size);
6198     if (backing_file && !(flags & BDRV_O_NO_BACKING)) {
6199         BlockDriverState *bs;
6200         char *full_backing;
6201         int back_flags;
6202         QDict *backing_options = NULL;
6203 
6204         full_backing =
6205             bdrv_get_full_backing_filename_from_filename(filename, backing_file,
6206                                                          &local_err);
6207         if (local_err) {
6208             goto out;
6209         }
6210         assert(full_backing);
6211 
6212         /* backing files always opened read-only */
6213         back_flags = flags;
6214         back_flags &= ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
6215 
6216         backing_options = qdict_new();
6217         if (backing_fmt) {
6218             qdict_put_str(backing_options, "driver", backing_fmt);
6219         }
6220         qdict_put_bool(backing_options, BDRV_OPT_FORCE_SHARE, true);
6221 
6222         bs = bdrv_open(full_backing, NULL, backing_options, back_flags,
6223                        &local_err);
6224         g_free(full_backing);
6225         if (!bs) {
6226             error_append_hint(&local_err, "Could not open backing image.\n");
6227             goto out;
6228         } else {
6229             if (!backing_fmt) {
6230                 warn_report("Deprecated use of backing file without explicit "
6231                             "backing format (detected format of %s)",
6232                             bs->drv->format_name);
6233                 if (bs->drv != &bdrv_raw) {
6234                     /*
6235                      * A probe of raw deserves the most attention:
6236                      * leaving the backing format out of the image
6237                      * will ensure bs->probed is set (ensuring we
6238                      * don't accidentally commit into the backing
6239                      * file), and allow more spots to warn the users
6240                      * to fix their toolchain when opening this image
6241                      * later.  For other images, we can safely record
6242                      * the format that we probed.
6243                      */
6244                     backing_fmt = bs->drv->format_name;
6245                     qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, backing_fmt,
6246                                  NULL);
6247                 }
6248             }
6249             if (size == -1) {
6250                 /* Opened BS, have no size */
6251                 size = bdrv_getlength(bs);
6252                 if (size < 0) {
6253                     error_setg_errno(errp, -size, "Could not get size of '%s'",
6254                                      backing_file);
6255                     bdrv_unref(bs);
6256                     goto out;
6257                 }
6258                 qemu_opt_set_number(opts, BLOCK_OPT_SIZE, size, &error_abort);
6259             }
6260             bdrv_unref(bs);
6261         }
6262         /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
6263     } else if (backing_file && !backing_fmt) {
6264         warn_report("Deprecated use of unopened backing file without "
6265                     "explicit backing format, use of this image requires "
6266                     "potentially unsafe format probing");
6267     }
6268 
6269     if (size == -1) {
6270         error_setg(errp, "Image creation needs a size parameter");
6271         goto out;
6272     }
6273 
6274     if (!quiet) {
6275         printf("Formatting '%s', fmt=%s ", filename, fmt);
6276         qemu_opts_print(opts, " ");
6277         puts("");
6278         fflush(stdout);
6279     }
6280 
6281     ret = bdrv_create(drv, filename, opts, &local_err);
6282 
6283     if (ret == -EFBIG) {
6284         /* This is generally a better message than whatever the driver would
6285          * deliver (especially because of the cluster_size_hint), since that
6286          * is most probably not much different from "image too large". */
6287         const char *cluster_size_hint = "";
6288         if (qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, 0)) {
6289             cluster_size_hint = " (try using a larger cluster size)";
6290         }
6291         error_setg(errp, "The image size is too large for file format '%s'"
6292                    "%s", fmt, cluster_size_hint);
6293         error_free(local_err);
6294         local_err = NULL;
6295     }
6296 
6297 out:
6298     qemu_opts_del(opts);
6299     qemu_opts_free(create_opts);
6300     error_propagate(errp, local_err);
6301 }
6302 
6303 AioContext *bdrv_get_aio_context(BlockDriverState *bs)
6304 {
6305     return bs ? bs->aio_context : qemu_get_aio_context();
6306 }
6307 
6308 AioContext *coroutine_fn bdrv_co_enter(BlockDriverState *bs)
6309 {
6310     Coroutine *self = qemu_coroutine_self();
6311     AioContext *old_ctx = qemu_coroutine_get_aio_context(self);
6312     AioContext *new_ctx;
6313 
6314     /*
6315      * Increase bs->in_flight to ensure that this operation is completed before
6316      * moving the node to a different AioContext. Read new_ctx only afterwards.
6317      */
6318     bdrv_inc_in_flight(bs);
6319 
6320     new_ctx = bdrv_get_aio_context(bs);
6321     aio_co_reschedule_self(new_ctx);
6322     return old_ctx;
6323 }
6324 
6325 void coroutine_fn bdrv_co_leave(BlockDriverState *bs, AioContext *old_ctx)
6326 {
6327     aio_co_reschedule_self(old_ctx);
6328     bdrv_dec_in_flight(bs);
6329 }
6330 
6331 void coroutine_fn bdrv_co_lock(BlockDriverState *bs)
6332 {
6333     AioContext *ctx = bdrv_get_aio_context(bs);
6334 
6335     /* In the main thread, bs->aio_context won't change concurrently */
6336     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
6337 
6338     /*
6339      * We're in coroutine context, so we already hold the lock of the main
6340      * loop AioContext. Don't lock it twice to avoid deadlocks.
6341      */
6342     assert(qemu_in_coroutine());
6343     if (ctx != qemu_get_aio_context()) {
6344         aio_context_acquire(ctx);
6345     }
6346 }
6347 
6348 void coroutine_fn bdrv_co_unlock(BlockDriverState *bs)
6349 {
6350     AioContext *ctx = bdrv_get_aio_context(bs);
6351 
6352     assert(qemu_in_coroutine());
6353     if (ctx != qemu_get_aio_context()) {
6354         aio_context_release(ctx);
6355     }
6356 }
6357 
6358 void bdrv_coroutine_enter(BlockDriverState *bs, Coroutine *co)
6359 {
6360     aio_co_enter(bdrv_get_aio_context(bs), co);
6361 }
6362 
6363 static void bdrv_do_remove_aio_context_notifier(BdrvAioNotifier *ban)
6364 {
6365     QLIST_REMOVE(ban, list);
6366     g_free(ban);
6367 }
6368 
6369 static void bdrv_detach_aio_context(BlockDriverState *bs)
6370 {
6371     BdrvAioNotifier *baf, *baf_tmp;
6372 
6373     assert(!bs->walking_aio_notifiers);
6374     bs->walking_aio_notifiers = true;
6375     QLIST_FOREACH_SAFE(baf, &bs->aio_notifiers, list, baf_tmp) {
6376         if (baf->deleted) {
6377             bdrv_do_remove_aio_context_notifier(baf);
6378         } else {
6379             baf->detach_aio_context(baf->opaque);
6380         }
6381     }
6382     /* Never mind iterating again to check for ->deleted.  bdrv_close() will
6383      * remove remaining aio notifiers if we aren't called again.
6384      */
6385     bs->walking_aio_notifiers = false;
6386 
6387     if (bs->drv && bs->drv->bdrv_detach_aio_context) {
6388         bs->drv->bdrv_detach_aio_context(bs);
6389     }
6390 
6391     if (bs->quiesce_counter) {
6392         aio_enable_external(bs->aio_context);
6393     }
6394     bs->aio_context = NULL;
6395 }
6396 
6397 static void bdrv_attach_aio_context(BlockDriverState *bs,
6398                                     AioContext *new_context)
6399 {
6400     BdrvAioNotifier *ban, *ban_tmp;
6401 
6402     if (bs->quiesce_counter) {
6403         aio_disable_external(new_context);
6404     }
6405 
6406     bs->aio_context = new_context;
6407 
6408     if (bs->drv && bs->drv->bdrv_attach_aio_context) {
6409         bs->drv->bdrv_attach_aio_context(bs, new_context);
6410     }
6411 
6412     assert(!bs->walking_aio_notifiers);
6413     bs->walking_aio_notifiers = true;
6414     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_tmp) {
6415         if (ban->deleted) {
6416             bdrv_do_remove_aio_context_notifier(ban);
6417         } else {
6418             ban->attached_aio_context(new_context, ban->opaque);
6419         }
6420     }
6421     bs->walking_aio_notifiers = false;
6422 }
6423 
6424 /*
6425  * Changes the AioContext used for fd handlers, timers, and BHs by this
6426  * BlockDriverState and all its children and parents.
6427  *
6428  * Must be called from the main AioContext.
6429  *
6430  * The caller must own the AioContext lock for the old AioContext of bs, but it
6431  * must not own the AioContext lock for new_context (unless new_context is the
6432  * same as the current context of bs).
6433  *
6434  * @ignore will accumulate all visited BdrvChild object. The caller is
6435  * responsible for freeing the list afterwards.
6436  */
6437 void bdrv_set_aio_context_ignore(BlockDriverState *bs,
6438                                  AioContext *new_context, GSList **ignore)
6439 {
6440     AioContext *old_context = bdrv_get_aio_context(bs);
6441     GSList *children_to_process = NULL;
6442     GSList *parents_to_process = NULL;
6443     GSList *entry;
6444     BdrvChild *child, *parent;
6445 
6446     g_assert(qemu_get_current_aio_context() == qemu_get_aio_context());
6447 
6448     if (old_context == new_context) {
6449         return;
6450     }
6451 
6452     bdrv_drained_begin(bs);
6453 
6454     QLIST_FOREACH(child, &bs->children, next) {
6455         if (g_slist_find(*ignore, child)) {
6456             continue;
6457         }
6458         *ignore = g_slist_prepend(*ignore, child);
6459         children_to_process = g_slist_prepend(children_to_process, child);
6460     }
6461 
6462     QLIST_FOREACH(parent, &bs->parents, next_parent) {
6463         if (g_slist_find(*ignore, parent)) {
6464             continue;
6465         }
6466         *ignore = g_slist_prepend(*ignore, parent);
6467         parents_to_process = g_slist_prepend(parents_to_process, parent);
6468     }
6469 
6470     for (entry = children_to_process;
6471          entry != NULL;
6472          entry = g_slist_next(entry)) {
6473         child = entry->data;
6474         bdrv_set_aio_context_ignore(child->bs, new_context, ignore);
6475     }
6476     g_slist_free(children_to_process);
6477 
6478     for (entry = parents_to_process;
6479          entry != NULL;
6480          entry = g_slist_next(entry)) {
6481         parent = entry->data;
6482         assert(parent->klass->set_aio_ctx);
6483         parent->klass->set_aio_ctx(parent, new_context, ignore);
6484     }
6485     g_slist_free(parents_to_process);
6486 
6487     bdrv_detach_aio_context(bs);
6488 
6489     /* Acquire the new context, if necessary */
6490     if (qemu_get_aio_context() != new_context) {
6491         aio_context_acquire(new_context);
6492     }
6493 
6494     bdrv_attach_aio_context(bs, new_context);
6495 
6496     /*
6497      * If this function was recursively called from
6498      * bdrv_set_aio_context_ignore(), there may be nodes in the
6499      * subtree that have not yet been moved to the new AioContext.
6500      * Release the old one so bdrv_drained_end() can poll them.
6501      */
6502     if (qemu_get_aio_context() != old_context) {
6503         aio_context_release(old_context);
6504     }
6505 
6506     bdrv_drained_end(bs);
6507 
6508     if (qemu_get_aio_context() != old_context) {
6509         aio_context_acquire(old_context);
6510     }
6511     if (qemu_get_aio_context() != new_context) {
6512         aio_context_release(new_context);
6513     }
6514 }
6515 
6516 static bool bdrv_parent_can_set_aio_context(BdrvChild *c, AioContext *ctx,
6517                                             GSList **ignore, Error **errp)
6518 {
6519     if (g_slist_find(*ignore, c)) {
6520         return true;
6521     }
6522     *ignore = g_slist_prepend(*ignore, c);
6523 
6524     /*
6525      * A BdrvChildClass that doesn't handle AioContext changes cannot
6526      * tolerate any AioContext changes
6527      */
6528     if (!c->klass->can_set_aio_ctx) {
6529         char *user = bdrv_child_user_desc(c);
6530         error_setg(errp, "Changing iothreads is not supported by %s", user);
6531         g_free(user);
6532         return false;
6533     }
6534     if (!c->klass->can_set_aio_ctx(c, ctx, ignore, errp)) {
6535         assert(!errp || *errp);
6536         return false;
6537     }
6538     return true;
6539 }
6540 
6541 bool bdrv_child_can_set_aio_context(BdrvChild *c, AioContext *ctx,
6542                                     GSList **ignore, Error **errp)
6543 {
6544     if (g_slist_find(*ignore, c)) {
6545         return true;
6546     }
6547     *ignore = g_slist_prepend(*ignore, c);
6548     return bdrv_can_set_aio_context(c->bs, ctx, ignore, errp);
6549 }
6550 
6551 /* @ignore will accumulate all visited BdrvChild object. The caller is
6552  * responsible for freeing the list afterwards. */
6553 bool bdrv_can_set_aio_context(BlockDriverState *bs, AioContext *ctx,
6554                               GSList **ignore, Error **errp)
6555 {
6556     BdrvChild *c;
6557 
6558     if (bdrv_get_aio_context(bs) == ctx) {
6559         return true;
6560     }
6561 
6562     QLIST_FOREACH(c, &bs->parents, next_parent) {
6563         if (!bdrv_parent_can_set_aio_context(c, ctx, ignore, errp)) {
6564             return false;
6565         }
6566     }
6567     QLIST_FOREACH(c, &bs->children, next) {
6568         if (!bdrv_child_can_set_aio_context(c, ctx, ignore, errp)) {
6569             return false;
6570         }
6571     }
6572 
6573     return true;
6574 }
6575 
6576 int bdrv_child_try_set_aio_context(BlockDriverState *bs, AioContext *ctx,
6577                                    BdrvChild *ignore_child, Error **errp)
6578 {
6579     GSList *ignore;
6580     bool ret;
6581 
6582     ignore = ignore_child ? g_slist_prepend(NULL, ignore_child) : NULL;
6583     ret = bdrv_can_set_aio_context(bs, ctx, &ignore, errp);
6584     g_slist_free(ignore);
6585 
6586     if (!ret) {
6587         return -EPERM;
6588     }
6589 
6590     ignore = ignore_child ? g_slist_prepend(NULL, ignore_child) : NULL;
6591     bdrv_set_aio_context_ignore(bs, ctx, &ignore);
6592     g_slist_free(ignore);
6593 
6594     return 0;
6595 }
6596 
6597 int bdrv_try_set_aio_context(BlockDriverState *bs, AioContext *ctx,
6598                              Error **errp)
6599 {
6600     return bdrv_child_try_set_aio_context(bs, ctx, NULL, errp);
6601 }
6602 
6603 void bdrv_add_aio_context_notifier(BlockDriverState *bs,
6604         void (*attached_aio_context)(AioContext *new_context, void *opaque),
6605         void (*detach_aio_context)(void *opaque), void *opaque)
6606 {
6607     BdrvAioNotifier *ban = g_new(BdrvAioNotifier, 1);
6608     *ban = (BdrvAioNotifier){
6609         .attached_aio_context = attached_aio_context,
6610         .detach_aio_context   = detach_aio_context,
6611         .opaque               = opaque
6612     };
6613 
6614     QLIST_INSERT_HEAD(&bs->aio_notifiers, ban, list);
6615 }
6616 
6617 void bdrv_remove_aio_context_notifier(BlockDriverState *bs,
6618                                       void (*attached_aio_context)(AioContext *,
6619                                                                    void *),
6620                                       void (*detach_aio_context)(void *),
6621                                       void *opaque)
6622 {
6623     BdrvAioNotifier *ban, *ban_next;
6624 
6625     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
6626         if (ban->attached_aio_context == attached_aio_context &&
6627             ban->detach_aio_context   == detach_aio_context   &&
6628             ban->opaque               == opaque               &&
6629             ban->deleted              == false)
6630         {
6631             if (bs->walking_aio_notifiers) {
6632                 ban->deleted = true;
6633             } else {
6634                 bdrv_do_remove_aio_context_notifier(ban);
6635             }
6636             return;
6637         }
6638     }
6639 
6640     abort();
6641 }
6642 
6643 int bdrv_amend_options(BlockDriverState *bs, QemuOpts *opts,
6644                        BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
6645                        bool force,
6646                        Error **errp)
6647 {
6648     if (!bs->drv) {
6649         error_setg(errp, "Node is ejected");
6650         return -ENOMEDIUM;
6651     }
6652     if (!bs->drv->bdrv_amend_options) {
6653         error_setg(errp, "Block driver '%s' does not support option amendment",
6654                    bs->drv->format_name);
6655         return -ENOTSUP;
6656     }
6657     return bs->drv->bdrv_amend_options(bs, opts, status_cb,
6658                                        cb_opaque, force, errp);
6659 }
6660 
6661 /*
6662  * This function checks whether the given @to_replace is allowed to be
6663  * replaced by a node that always shows the same data as @bs.  This is
6664  * used for example to verify whether the mirror job can replace
6665  * @to_replace by the target mirrored from @bs.
6666  * To be replaceable, @bs and @to_replace may either be guaranteed to
6667  * always show the same data (because they are only connected through
6668  * filters), or some driver may allow replacing one of its children
6669  * because it can guarantee that this child's data is not visible at
6670  * all (for example, for dissenting quorum children that have no other
6671  * parents).
6672  */
6673 bool bdrv_recurse_can_replace(BlockDriverState *bs,
6674                               BlockDriverState *to_replace)
6675 {
6676     BlockDriverState *filtered;
6677 
6678     if (!bs || !bs->drv) {
6679         return false;
6680     }
6681 
6682     if (bs == to_replace) {
6683         return true;
6684     }
6685 
6686     /* See what the driver can do */
6687     if (bs->drv->bdrv_recurse_can_replace) {
6688         return bs->drv->bdrv_recurse_can_replace(bs, to_replace);
6689     }
6690 
6691     /* For filters without an own implementation, we can recurse on our own */
6692     filtered = bdrv_filter_bs(bs);
6693     if (filtered) {
6694         return bdrv_recurse_can_replace(filtered, to_replace);
6695     }
6696 
6697     /* Safe default */
6698     return false;
6699 }
6700 
6701 /*
6702  * Check whether the given @node_name can be replaced by a node that
6703  * has the same data as @parent_bs.  If so, return @node_name's BDS;
6704  * NULL otherwise.
6705  *
6706  * @node_name must be a (recursive) *child of @parent_bs (or this
6707  * function will return NULL).
6708  *
6709  * The result (whether the node can be replaced or not) is only valid
6710  * for as long as no graph or permission changes occur.
6711  */
6712 BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
6713                                         const char *node_name, Error **errp)
6714 {
6715     BlockDriverState *to_replace_bs = bdrv_find_node(node_name);
6716     AioContext *aio_context;
6717 
6718     if (!to_replace_bs) {
6719         error_setg(errp, "Node name '%s' not found", node_name);
6720         return NULL;
6721     }
6722 
6723     aio_context = bdrv_get_aio_context(to_replace_bs);
6724     aio_context_acquire(aio_context);
6725 
6726     if (bdrv_op_is_blocked(to_replace_bs, BLOCK_OP_TYPE_REPLACE, errp)) {
6727         to_replace_bs = NULL;
6728         goto out;
6729     }
6730 
6731     /* We don't want arbitrary node of the BDS chain to be replaced only the top
6732      * most non filter in order to prevent data corruption.
6733      * Another benefit is that this tests exclude backing files which are
6734      * blocked by the backing blockers.
6735      */
6736     if (!bdrv_recurse_can_replace(parent_bs, to_replace_bs)) {
6737         error_setg(errp, "Cannot replace '%s' by a node mirrored from '%s', "
6738                    "because it cannot be guaranteed that doing so would not "
6739                    "lead to an abrupt change of visible data",
6740                    node_name, parent_bs->node_name);
6741         to_replace_bs = NULL;
6742         goto out;
6743     }
6744 
6745 out:
6746     aio_context_release(aio_context);
6747     return to_replace_bs;
6748 }
6749 
6750 /**
6751  * Iterates through the list of runtime option keys that are said to
6752  * be "strong" for a BDS.  An option is called "strong" if it changes
6753  * a BDS's data.  For example, the null block driver's "size" and
6754  * "read-zeroes" options are strong, but its "latency-ns" option is
6755  * not.
6756  *
6757  * If a key returned by this function ends with a dot, all options
6758  * starting with that prefix are strong.
6759  */
6760 static const char *const *strong_options(BlockDriverState *bs,
6761                                          const char *const *curopt)
6762 {
6763     static const char *const global_options[] = {
6764         "driver", "filename", NULL
6765     };
6766 
6767     if (!curopt) {
6768         return &global_options[0];
6769     }
6770 
6771     curopt++;
6772     if (curopt == &global_options[ARRAY_SIZE(global_options) - 1] && bs->drv) {
6773         curopt = bs->drv->strong_runtime_opts;
6774     }
6775 
6776     return (curopt && *curopt) ? curopt : NULL;
6777 }
6778 
6779 /**
6780  * Copies all strong runtime options from bs->options to the given
6781  * QDict.  The set of strong option keys is determined by invoking
6782  * strong_options().
6783  *
6784  * Returns true iff any strong option was present in bs->options (and
6785  * thus copied to the target QDict) with the exception of "filename"
6786  * and "driver".  The caller is expected to use this value to decide
6787  * whether the existence of strong options prevents the generation of
6788  * a plain filename.
6789  */
6790 static bool append_strong_runtime_options(QDict *d, BlockDriverState *bs)
6791 {
6792     bool found_any = false;
6793     const char *const *option_name = NULL;
6794 
6795     if (!bs->drv) {
6796         return false;
6797     }
6798 
6799     while ((option_name = strong_options(bs, option_name))) {
6800         bool option_given = false;
6801 
6802         assert(strlen(*option_name) > 0);
6803         if ((*option_name)[strlen(*option_name) - 1] != '.') {
6804             QObject *entry = qdict_get(bs->options, *option_name);
6805             if (!entry) {
6806                 continue;
6807             }
6808 
6809             qdict_put_obj(d, *option_name, qobject_ref(entry));
6810             option_given = true;
6811         } else {
6812             const QDictEntry *entry;
6813             for (entry = qdict_first(bs->options); entry;
6814                  entry = qdict_next(bs->options, entry))
6815             {
6816                 if (strstart(qdict_entry_key(entry), *option_name, NULL)) {
6817                     qdict_put_obj(d, qdict_entry_key(entry),
6818                                   qobject_ref(qdict_entry_value(entry)));
6819                     option_given = true;
6820                 }
6821             }
6822         }
6823 
6824         /* While "driver" and "filename" need to be included in a JSON filename,
6825          * their existence does not prohibit generation of a plain filename. */
6826         if (!found_any && option_given &&
6827             strcmp(*option_name, "driver") && strcmp(*option_name, "filename"))
6828         {
6829             found_any = true;
6830         }
6831     }
6832 
6833     if (!qdict_haskey(d, "driver")) {
6834         /* Drivers created with bdrv_new_open_driver() may not have a
6835          * @driver option.  Add it here. */
6836         qdict_put_str(d, "driver", bs->drv->format_name);
6837     }
6838 
6839     return found_any;
6840 }
6841 
6842 /* Note: This function may return false positives; it may return true
6843  * even if opening the backing file specified by bs's image header
6844  * would result in exactly bs->backing. */
6845 bool bdrv_backing_overridden(BlockDriverState *bs)
6846 {
6847     if (bs->backing) {
6848         return strcmp(bs->auto_backing_file,
6849                       bs->backing->bs->filename);
6850     } else {
6851         /* No backing BDS, so if the image header reports any backing
6852          * file, it must have been suppressed */
6853         return bs->auto_backing_file[0] != '\0';
6854     }
6855 }
6856 
6857 /* Updates the following BDS fields:
6858  *  - exact_filename: A filename which may be used for opening a block device
6859  *                    which (mostly) equals the given BDS (even without any
6860  *                    other options; so reading and writing must return the same
6861  *                    results, but caching etc. may be different)
6862  *  - full_open_options: Options which, when given when opening a block device
6863  *                       (without a filename), result in a BDS (mostly)
6864  *                       equalling the given one
6865  *  - filename: If exact_filename is set, it is copied here. Otherwise,
6866  *              full_open_options is converted to a JSON object, prefixed with
6867  *              "json:" (for use through the JSON pseudo protocol) and put here.
6868  */
6869 void bdrv_refresh_filename(BlockDriverState *bs)
6870 {
6871     BlockDriver *drv = bs->drv;
6872     BdrvChild *child;
6873     BlockDriverState *primary_child_bs;
6874     QDict *opts;
6875     bool backing_overridden;
6876     bool generate_json_filename; /* Whether our default implementation should
6877                                     fill exact_filename (false) or not (true) */
6878 
6879     if (!drv) {
6880         return;
6881     }
6882 
6883     /* This BDS's file name may depend on any of its children's file names, so
6884      * refresh those first */
6885     QLIST_FOREACH(child, &bs->children, next) {
6886         bdrv_refresh_filename(child->bs);
6887     }
6888 
6889     if (bs->implicit) {
6890         /* For implicit nodes, just copy everything from the single child */
6891         child = QLIST_FIRST(&bs->children);
6892         assert(QLIST_NEXT(child, next) == NULL);
6893 
6894         pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
6895                 child->bs->exact_filename);
6896         pstrcpy(bs->filename, sizeof(bs->filename), child->bs->filename);
6897 
6898         qobject_unref(bs->full_open_options);
6899         bs->full_open_options = qobject_ref(child->bs->full_open_options);
6900 
6901         return;
6902     }
6903 
6904     backing_overridden = bdrv_backing_overridden(bs);
6905 
6906     if (bs->open_flags & BDRV_O_NO_IO) {
6907         /* Without I/O, the backing file does not change anything.
6908          * Therefore, in such a case (primarily qemu-img), we can
6909          * pretend the backing file has not been overridden even if
6910          * it technically has been. */
6911         backing_overridden = false;
6912     }
6913 
6914     /* Gather the options QDict */
6915     opts = qdict_new();
6916     generate_json_filename = append_strong_runtime_options(opts, bs);
6917     generate_json_filename |= backing_overridden;
6918 
6919     if (drv->bdrv_gather_child_options) {
6920         /* Some block drivers may not want to present all of their children's
6921          * options, or name them differently from BdrvChild.name */
6922         drv->bdrv_gather_child_options(bs, opts, backing_overridden);
6923     } else {
6924         QLIST_FOREACH(child, &bs->children, next) {
6925             if (child == bs->backing && !backing_overridden) {
6926                 /* We can skip the backing BDS if it has not been overridden */
6927                 continue;
6928             }
6929 
6930             qdict_put(opts, child->name,
6931                       qobject_ref(child->bs->full_open_options));
6932         }
6933 
6934         if (backing_overridden && !bs->backing) {
6935             /* Force no backing file */
6936             qdict_put_null(opts, "backing");
6937         }
6938     }
6939 
6940     qobject_unref(bs->full_open_options);
6941     bs->full_open_options = opts;
6942 
6943     primary_child_bs = bdrv_primary_bs(bs);
6944 
6945     if (drv->bdrv_refresh_filename) {
6946         /* Obsolete information is of no use here, so drop the old file name
6947          * information before refreshing it */
6948         bs->exact_filename[0] = '\0';
6949 
6950         drv->bdrv_refresh_filename(bs);
6951     } else if (primary_child_bs) {
6952         /*
6953          * Try to reconstruct valid information from the underlying
6954          * file -- this only works for format nodes (filter nodes
6955          * cannot be probed and as such must be selected by the user
6956          * either through an options dict, or through a special
6957          * filename which the filter driver must construct in its
6958          * .bdrv_refresh_filename() implementation).
6959          */
6960 
6961         bs->exact_filename[0] = '\0';
6962 
6963         /*
6964          * We can use the underlying file's filename if:
6965          * - it has a filename,
6966          * - the current BDS is not a filter,
6967          * - the file is a protocol BDS, and
6968          * - opening that file (as this BDS's format) will automatically create
6969          *   the BDS tree we have right now, that is:
6970          *   - the user did not significantly change this BDS's behavior with
6971          *     some explicit (strong) options
6972          *   - no non-file child of this BDS has been overridden by the user
6973          *   Both of these conditions are represented by generate_json_filename.
6974          */
6975         if (primary_child_bs->exact_filename[0] &&
6976             primary_child_bs->drv->bdrv_file_open &&
6977             !drv->is_filter && !generate_json_filename)
6978         {
6979             strcpy(bs->exact_filename, primary_child_bs->exact_filename);
6980         }
6981     }
6982 
6983     if (bs->exact_filename[0]) {
6984         pstrcpy(bs->filename, sizeof(bs->filename), bs->exact_filename);
6985     } else {
6986         GString *json = qobject_to_json(QOBJECT(bs->full_open_options));
6987         if (snprintf(bs->filename, sizeof(bs->filename), "json:%s",
6988                      json->str) >= sizeof(bs->filename)) {
6989             /* Give user a hint if we truncated things. */
6990             strcpy(bs->filename + sizeof(bs->filename) - 4, "...");
6991         }
6992         g_string_free(json, true);
6993     }
6994 }
6995 
6996 char *bdrv_dirname(BlockDriverState *bs, Error **errp)
6997 {
6998     BlockDriver *drv = bs->drv;
6999     BlockDriverState *child_bs;
7000 
7001     if (!drv) {
7002         error_setg(errp, "Node '%s' is ejected", bs->node_name);
7003         return NULL;
7004     }
7005 
7006     if (drv->bdrv_dirname) {
7007         return drv->bdrv_dirname(bs, errp);
7008     }
7009 
7010     child_bs = bdrv_primary_bs(bs);
7011     if (child_bs) {
7012         return bdrv_dirname(child_bs, errp);
7013     }
7014 
7015     bdrv_refresh_filename(bs);
7016     if (bs->exact_filename[0] != '\0') {
7017         return path_combine(bs->exact_filename, "");
7018     }
7019 
7020     error_setg(errp, "Cannot generate a base directory for %s nodes",
7021                drv->format_name);
7022     return NULL;
7023 }
7024 
7025 /*
7026  * Hot add/remove a BDS's child. So the user can take a child offline when
7027  * it is broken and take a new child online
7028  */
7029 void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
7030                     Error **errp)
7031 {
7032 
7033     if (!parent_bs->drv || !parent_bs->drv->bdrv_add_child) {
7034         error_setg(errp, "The node %s does not support adding a child",
7035                    bdrv_get_device_or_node_name(parent_bs));
7036         return;
7037     }
7038 
7039     if (!QLIST_EMPTY(&child_bs->parents)) {
7040         error_setg(errp, "The node %s already has a parent",
7041                    child_bs->node_name);
7042         return;
7043     }
7044 
7045     parent_bs->drv->bdrv_add_child(parent_bs, child_bs, errp);
7046 }
7047 
7048 void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)
7049 {
7050     BdrvChild *tmp;
7051 
7052     if (!parent_bs->drv || !parent_bs->drv->bdrv_del_child) {
7053         error_setg(errp, "The node %s does not support removing a child",
7054                    bdrv_get_device_or_node_name(parent_bs));
7055         return;
7056     }
7057 
7058     QLIST_FOREACH(tmp, &parent_bs->children, next) {
7059         if (tmp == child) {
7060             break;
7061         }
7062     }
7063 
7064     if (!tmp) {
7065         error_setg(errp, "The node %s does not have a child named %s",
7066                    bdrv_get_device_or_node_name(parent_bs),
7067                    bdrv_get_device_or_node_name(child->bs));
7068         return;
7069     }
7070 
7071     parent_bs->drv->bdrv_del_child(parent_bs, child, errp);
7072 }
7073 
7074 int bdrv_make_empty(BdrvChild *c, Error **errp)
7075 {
7076     BlockDriver *drv = c->bs->drv;
7077     int ret;
7078 
7079     assert(c->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED));
7080 
7081     if (!drv->bdrv_make_empty) {
7082         error_setg(errp, "%s does not support emptying nodes",
7083                    drv->format_name);
7084         return -ENOTSUP;
7085     }
7086 
7087     ret = drv->bdrv_make_empty(c->bs);
7088     if (ret < 0) {
7089         error_setg_errno(errp, -ret, "Failed to empty %s",
7090                          c->bs->filename);
7091         return ret;
7092     }
7093 
7094     return 0;
7095 }
7096 
7097 /*
7098  * Return the child that @bs acts as an overlay for, and from which data may be
7099  * copied in COW or COR operations.  Usually this is the backing file.
7100  */
7101 BdrvChild *bdrv_cow_child(BlockDriverState *bs)
7102 {
7103     if (!bs || !bs->drv) {
7104         return NULL;
7105     }
7106 
7107     if (bs->drv->is_filter) {
7108         return NULL;
7109     }
7110 
7111     if (!bs->backing) {
7112         return NULL;
7113     }
7114 
7115     assert(bs->backing->role & BDRV_CHILD_COW);
7116     return bs->backing;
7117 }
7118 
7119 /*
7120  * If @bs acts as a filter for exactly one of its children, return
7121  * that child.
7122  */
7123 BdrvChild *bdrv_filter_child(BlockDriverState *bs)
7124 {
7125     BdrvChild *c;
7126 
7127     if (!bs || !bs->drv) {
7128         return NULL;
7129     }
7130 
7131     if (!bs->drv->is_filter) {
7132         return NULL;
7133     }
7134 
7135     /* Only one of @backing or @file may be used */
7136     assert(!(bs->backing && bs->file));
7137 
7138     c = bs->backing ?: bs->file;
7139     if (!c) {
7140         return NULL;
7141     }
7142 
7143     assert(c->role & BDRV_CHILD_FILTERED);
7144     return c;
7145 }
7146 
7147 /*
7148  * Return either the result of bdrv_cow_child() or bdrv_filter_child(),
7149  * whichever is non-NULL.
7150  *
7151  * Return NULL if both are NULL.
7152  */
7153 BdrvChild *bdrv_filter_or_cow_child(BlockDriverState *bs)
7154 {
7155     BdrvChild *cow_child = bdrv_cow_child(bs);
7156     BdrvChild *filter_child = bdrv_filter_child(bs);
7157 
7158     /* Filter nodes cannot have COW backing files */
7159     assert(!(cow_child && filter_child));
7160 
7161     return cow_child ?: filter_child;
7162 }
7163 
7164 /*
7165  * Return the primary child of this node: For filters, that is the
7166  * filtered child.  For other nodes, that is usually the child storing
7167  * metadata.
7168  * (A generally more helpful description is that this is (usually) the
7169  * child that has the same filename as @bs.)
7170  *
7171  * Drivers do not necessarily have a primary child; for example quorum
7172  * does not.
7173  */
7174 BdrvChild *bdrv_primary_child(BlockDriverState *bs)
7175 {
7176     BdrvChild *c, *found = NULL;
7177 
7178     QLIST_FOREACH(c, &bs->children, next) {
7179         if (c->role & BDRV_CHILD_PRIMARY) {
7180             assert(!found);
7181             found = c;
7182         }
7183     }
7184 
7185     return found;
7186 }
7187 
7188 static BlockDriverState *bdrv_do_skip_filters(BlockDriverState *bs,
7189                                               bool stop_on_explicit_filter)
7190 {
7191     BdrvChild *c;
7192 
7193     if (!bs) {
7194         return NULL;
7195     }
7196 
7197     while (!(stop_on_explicit_filter && !bs->implicit)) {
7198         c = bdrv_filter_child(bs);
7199         if (!c) {
7200             /*
7201              * A filter that is embedded in a working block graph must
7202              * have a child.  Assert this here so this function does
7203              * not return a filter node that is not expected by the
7204              * caller.
7205              */
7206             assert(!bs->drv || !bs->drv->is_filter);
7207             break;
7208         }
7209         bs = c->bs;
7210     }
7211     /*
7212      * Note that this treats nodes with bs->drv == NULL as not being
7213      * filters (bs->drv == NULL should be replaced by something else
7214      * anyway).
7215      * The advantage of this behavior is that this function will thus
7216      * always return a non-NULL value (given a non-NULL @bs).
7217      */
7218 
7219     return bs;
7220 }
7221 
7222 /*
7223  * Return the first BDS that has not been added implicitly or that
7224  * does not have a filtered child down the chain starting from @bs
7225  * (including @bs itself).
7226  */
7227 BlockDriverState *bdrv_skip_implicit_filters(BlockDriverState *bs)
7228 {
7229     return bdrv_do_skip_filters(bs, true);
7230 }
7231 
7232 /*
7233  * Return the first BDS that does not have a filtered child down the
7234  * chain starting from @bs (including @bs itself).
7235  */
7236 BlockDriverState *bdrv_skip_filters(BlockDriverState *bs)
7237 {
7238     return bdrv_do_skip_filters(bs, false);
7239 }
7240 
7241 /*
7242  * For a backing chain, return the first non-filter backing image of
7243  * the first non-filter image.
7244  */
7245 BlockDriverState *bdrv_backing_chain_next(BlockDriverState *bs)
7246 {
7247     return bdrv_skip_filters(bdrv_cow_bs(bdrv_skip_filters(bs)));
7248 }
7249