xref: /openbmc/qemu/block.c (revision c1774bdb)
1 /*
2  * QEMU System Emulator block driver
3  *
4  * Copyright (c) 2003 Fabrice Bellard
5  * Copyright (c) 2020 Virtuozzo International GmbH.
6  *
7  * Permission is hereby granted, free of charge, to any person obtaining a copy
8  * of this software and associated documentation files (the "Software"), to deal
9  * in the Software without restriction, including without limitation the rights
10  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11  * copies of the Software, and to permit persons to whom the Software is
12  * furnished to do so, subject to the following conditions:
13  *
14  * The above copyright notice and this permission notice shall be included in
15  * all copies or substantial portions of the Software.
16  *
17  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23  * THE SOFTWARE.
24  */
25 
26 #include "qemu/osdep.h"
27 #include "block/trace.h"
28 #include "block/block_int.h"
29 #include "block/blockjob.h"
30 #include "block/dirty-bitmap.h"
31 #include "block/fuse.h"
32 #include "block/nbd.h"
33 #include "block/qdict.h"
34 #include "qemu/error-report.h"
35 #include "block/module_block.h"
36 #include "qemu/main-loop.h"
37 #include "qemu/module.h"
38 #include "qapi/error.h"
39 #include "qapi/qmp/qdict.h"
40 #include "qapi/qmp/qjson.h"
41 #include "qapi/qmp/qnull.h"
42 #include "qapi/qmp/qstring.h"
43 #include "qapi/qobject-output-visitor.h"
44 #include "qapi/qapi-visit-block-core.h"
45 #include "sysemu/block-backend.h"
46 #include "qemu/notify.h"
47 #include "qemu/option.h"
48 #include "qemu/coroutine.h"
49 #include "block/qapi.h"
50 #include "qemu/timer.h"
51 #include "qemu/cutils.h"
52 #include "qemu/id.h"
53 #include "qemu/range.h"
54 #include "qemu/rcu.h"
55 #include "block/coroutines.h"
56 
57 #ifdef CONFIG_BSD
58 #include <sys/ioctl.h>
59 #include <sys/queue.h>
60 #if defined(HAVE_SYS_DISK_H)
61 #include <sys/disk.h>
62 #endif
63 #endif
64 
65 #ifdef _WIN32
66 #include <windows.h>
67 #endif
68 
69 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
70 
71 /* Protected by BQL */
72 static QTAILQ_HEAD(, BlockDriverState) graph_bdrv_states =
73     QTAILQ_HEAD_INITIALIZER(graph_bdrv_states);
74 
75 /* Protected by BQL */
76 static QTAILQ_HEAD(, BlockDriverState) all_bdrv_states =
77     QTAILQ_HEAD_INITIALIZER(all_bdrv_states);
78 
79 /* Protected by BQL */
80 static QLIST_HEAD(, BlockDriver) bdrv_drivers =
81     QLIST_HEAD_INITIALIZER(bdrv_drivers);
82 
83 static BlockDriverState *bdrv_open_inherit(const char *filename,
84                                            const char *reference,
85                                            QDict *options, int flags,
86                                            BlockDriverState *parent,
87                                            const BdrvChildClass *child_class,
88                                            BdrvChildRole child_role,
89                                            Error **errp);
90 
91 static bool bdrv_recurse_has_child(BlockDriverState *bs,
92                                    BlockDriverState *child);
93 
94 static void GRAPH_WRLOCK
95 bdrv_replace_child_noperm(BdrvChild *child, BlockDriverState *new_bs);
96 
97 static void GRAPH_WRLOCK
98 bdrv_remove_child(BdrvChild *child, Transaction *tran);
99 
100 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
101                                BlockReopenQueue *queue,
102                                Transaction *change_child_tran, Error **errp);
103 static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
104 static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
105 
106 static bool bdrv_backing_overridden(BlockDriverState *bs);
107 
108 static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
109                                     GHashTable *visited, Transaction *tran,
110                                     Error **errp);
111 
112 /* If non-zero, use only whitelisted block drivers */
113 static int use_bdrv_whitelist;
114 
115 #ifdef _WIN32
116 static int is_windows_drive_prefix(const char *filename)
117 {
118     return (((filename[0] >= 'a' && filename[0] <= 'z') ||
119              (filename[0] >= 'A' && filename[0] <= 'Z')) &&
120             filename[1] == ':');
121 }
122 
123 int is_windows_drive(const char *filename)
124 {
125     if (is_windows_drive_prefix(filename) &&
126         filename[2] == '\0')
127         return 1;
128     if (strstart(filename, "\\\\.\\", NULL) ||
129         strstart(filename, "//./", NULL))
130         return 1;
131     return 0;
132 }
133 #endif
134 
135 size_t bdrv_opt_mem_align(BlockDriverState *bs)
136 {
137     if (!bs || !bs->drv) {
138         /* page size or 4k (hdd sector size) should be on the safe side */
139         return MAX(4096, qemu_real_host_page_size());
140     }
141     IO_CODE();
142 
143     return bs->bl.opt_mem_alignment;
144 }
145 
146 size_t bdrv_min_mem_align(BlockDriverState *bs)
147 {
148     if (!bs || !bs->drv) {
149         /* page size or 4k (hdd sector size) should be on the safe side */
150         return MAX(4096, qemu_real_host_page_size());
151     }
152     IO_CODE();
153 
154     return bs->bl.min_mem_alignment;
155 }
156 
157 /* check if the path starts with "<protocol>:" */
158 int path_has_protocol(const char *path)
159 {
160     const char *p;
161 
162 #ifdef _WIN32
163     if (is_windows_drive(path) ||
164         is_windows_drive_prefix(path)) {
165         return 0;
166     }
167     p = path + strcspn(path, ":/\\");
168 #else
169     p = path + strcspn(path, ":/");
170 #endif
171 
172     return *p == ':';
173 }
174 
175 int path_is_absolute(const char *path)
176 {
177 #ifdef _WIN32
178     /* specific case for names like: "\\.\d:" */
179     if (is_windows_drive(path) || is_windows_drive_prefix(path)) {
180         return 1;
181     }
182     return (*path == '/' || *path == '\\');
183 #else
184     return (*path == '/');
185 #endif
186 }
187 
188 /* if filename is absolute, just return its duplicate. Otherwise, build a
189    path to it by considering it is relative to base_path. URL are
190    supported. */
191 char *path_combine(const char *base_path, const char *filename)
192 {
193     const char *protocol_stripped = NULL;
194     const char *p, *p1;
195     char *result;
196     int len;
197 
198     if (path_is_absolute(filename)) {
199         return g_strdup(filename);
200     }
201 
202     if (path_has_protocol(base_path)) {
203         protocol_stripped = strchr(base_path, ':');
204         if (protocol_stripped) {
205             protocol_stripped++;
206         }
207     }
208     p = protocol_stripped ?: base_path;
209 
210     p1 = strrchr(base_path, '/');
211 #ifdef _WIN32
212     {
213         const char *p2;
214         p2 = strrchr(base_path, '\\');
215         if (!p1 || p2 > p1) {
216             p1 = p2;
217         }
218     }
219 #endif
220     if (p1) {
221         p1++;
222     } else {
223         p1 = base_path;
224     }
225     if (p1 > p) {
226         p = p1;
227     }
228     len = p - base_path;
229 
230     result = g_malloc(len + strlen(filename) + 1);
231     memcpy(result, base_path, len);
232     strcpy(result + len, filename);
233 
234     return result;
235 }
236 
237 /*
238  * Helper function for bdrv_parse_filename() implementations to remove optional
239  * protocol prefixes (especially "file:") from a filename and for putting the
240  * stripped filename into the options QDict if there is such a prefix.
241  */
242 void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
243                                       QDict *options)
244 {
245     if (strstart(filename, prefix, &filename)) {
246         /* Stripping the explicit protocol prefix may result in a protocol
247          * prefix being (wrongly) detected (if the filename contains a colon) */
248         if (path_has_protocol(filename)) {
249             GString *fat_filename;
250 
251             /* This means there is some colon before the first slash; therefore,
252              * this cannot be an absolute path */
253             assert(!path_is_absolute(filename));
254 
255             /* And we can thus fix the protocol detection issue by prefixing it
256              * by "./" */
257             fat_filename = g_string_new("./");
258             g_string_append(fat_filename, filename);
259 
260             assert(!path_has_protocol(fat_filename->str));
261 
262             qdict_put(options, "filename",
263                       qstring_from_gstring(fat_filename));
264         } else {
265             /* If no protocol prefix was detected, we can use the shortened
266              * filename as-is */
267             qdict_put_str(options, "filename", filename);
268         }
269     }
270 }
271 
272 
273 /* Returns whether the image file is opened as read-only. Note that this can
274  * return false and writing to the image file is still not possible because the
275  * image is inactivated. */
276 bool bdrv_is_read_only(BlockDriverState *bs)
277 {
278     IO_CODE();
279     return !(bs->open_flags & BDRV_O_RDWR);
280 }
281 
282 static int bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
283                                   bool ignore_allow_rdw, Error **errp)
284 {
285     IO_CODE();
286 
287     /* Do not set read_only if copy_on_read is enabled */
288     if (bs->copy_on_read && read_only) {
289         error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
290                    bdrv_get_device_or_node_name(bs));
291         return -EINVAL;
292     }
293 
294     /* Do not clear read_only if it is prohibited */
295     if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
296         !ignore_allow_rdw)
297     {
298         error_setg(errp, "Node '%s' is read only",
299                    bdrv_get_device_or_node_name(bs));
300         return -EPERM;
301     }
302 
303     return 0;
304 }
305 
306 /*
307  * Called by a driver that can only provide a read-only image.
308  *
309  * Returns 0 if the node is already read-only or it could switch the node to
310  * read-only because BDRV_O_AUTO_RDONLY is set.
311  *
312  * Returns -EACCES if the node is read-write and BDRV_O_AUTO_RDONLY is not set
313  * or bdrv_can_set_read_only() forbids making the node read-only. If @errmsg
314  * is not NULL, it is used as the error message for the Error object.
315  */
316 int bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
317                               Error **errp)
318 {
319     int ret = 0;
320     IO_CODE();
321 
322     if (!(bs->open_flags & BDRV_O_RDWR)) {
323         return 0;
324     }
325     if (!(bs->open_flags & BDRV_O_AUTO_RDONLY)) {
326         goto fail;
327     }
328 
329     ret = bdrv_can_set_read_only(bs, true, false, NULL);
330     if (ret < 0) {
331         goto fail;
332     }
333 
334     bs->open_flags &= ~BDRV_O_RDWR;
335 
336     return 0;
337 
338 fail:
339     error_setg(errp, "%s", errmsg ?: "Image is read-only");
340     return -EACCES;
341 }
342 
343 /*
344  * If @backing is empty, this function returns NULL without setting
345  * @errp.  In all other cases, NULL will only be returned with @errp
346  * set.
347  *
348  * Therefore, a return value of NULL without @errp set means that
349  * there is no backing file; if @errp is set, there is one but its
350  * absolute filename cannot be generated.
351  */
352 char *bdrv_get_full_backing_filename_from_filename(const char *backed,
353                                                    const char *backing,
354                                                    Error **errp)
355 {
356     if (backing[0] == '\0') {
357         return NULL;
358     } else if (path_has_protocol(backing) || path_is_absolute(backing)) {
359         return g_strdup(backing);
360     } else if (backed[0] == '\0' || strstart(backed, "json:", NULL)) {
361         error_setg(errp, "Cannot use relative backing file names for '%s'",
362                    backed);
363         return NULL;
364     } else {
365         return path_combine(backed, backing);
366     }
367 }
368 
369 /*
370  * If @filename is empty or NULL, this function returns NULL without
371  * setting @errp.  In all other cases, NULL will only be returned with
372  * @errp set.
373  */
374 static char *bdrv_make_absolute_filename(BlockDriverState *relative_to,
375                                          const char *filename, Error **errp)
376 {
377     char *dir, *full_name;
378 
379     if (!filename || filename[0] == '\0') {
380         return NULL;
381     } else if (path_has_protocol(filename) || path_is_absolute(filename)) {
382         return g_strdup(filename);
383     }
384 
385     dir = bdrv_dirname(relative_to, errp);
386     if (!dir) {
387         return NULL;
388     }
389 
390     full_name = g_strconcat(dir, filename, NULL);
391     g_free(dir);
392     return full_name;
393 }
394 
395 char *bdrv_get_full_backing_filename(BlockDriverState *bs, Error **errp)
396 {
397     GLOBAL_STATE_CODE();
398     return bdrv_make_absolute_filename(bs, bs->backing_file, errp);
399 }
400 
401 void bdrv_register(BlockDriver *bdrv)
402 {
403     assert(bdrv->format_name);
404     GLOBAL_STATE_CODE();
405     QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
406 }
407 
408 BlockDriverState *bdrv_new(void)
409 {
410     BlockDriverState *bs;
411     int i;
412 
413     GLOBAL_STATE_CODE();
414 
415     bs = g_new0(BlockDriverState, 1);
416     QLIST_INIT(&bs->dirty_bitmaps);
417     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
418         QLIST_INIT(&bs->op_blockers[i]);
419     }
420     qemu_mutex_init(&bs->reqs_lock);
421     qemu_mutex_init(&bs->dirty_bitmap_mutex);
422     bs->refcnt = 1;
423     bs->aio_context = qemu_get_aio_context();
424 
425     qemu_co_queue_init(&bs->flush_queue);
426 
427     qemu_co_mutex_init(&bs->bsc_modify_lock);
428     bs->block_status_cache = g_new0(BdrvBlockStatusCache, 1);
429 
430     for (i = 0; i < bdrv_drain_all_count; i++) {
431         bdrv_drained_begin(bs);
432     }
433 
434     QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);
435 
436     return bs;
437 }
438 
439 static BlockDriver *bdrv_do_find_format(const char *format_name)
440 {
441     BlockDriver *drv1;
442     GLOBAL_STATE_CODE();
443 
444     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
445         if (!strcmp(drv1->format_name, format_name)) {
446             return drv1;
447         }
448     }
449 
450     return NULL;
451 }
452 
453 BlockDriver *bdrv_find_format(const char *format_name)
454 {
455     BlockDriver *drv1;
456     int i;
457 
458     GLOBAL_STATE_CODE();
459 
460     drv1 = bdrv_do_find_format(format_name);
461     if (drv1) {
462         return drv1;
463     }
464 
465     /* The driver isn't registered, maybe we need to load a module */
466     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
467         if (!strcmp(block_driver_modules[i].format_name, format_name)) {
468             Error *local_err = NULL;
469             int rv = block_module_load(block_driver_modules[i].library_name,
470                                        &local_err);
471             if (rv > 0) {
472                 return bdrv_do_find_format(format_name);
473             } else if (rv < 0) {
474                 error_report_err(local_err);
475             }
476             break;
477         }
478     }
479     return NULL;
480 }
481 
482 static int bdrv_format_is_whitelisted(const char *format_name, bool read_only)
483 {
484     static const char *whitelist_rw[] = {
485         CONFIG_BDRV_RW_WHITELIST
486         NULL
487     };
488     static const char *whitelist_ro[] = {
489         CONFIG_BDRV_RO_WHITELIST
490         NULL
491     };
492     const char **p;
493 
494     if (!whitelist_rw[0] && !whitelist_ro[0]) {
495         return 1;               /* no whitelist, anything goes */
496     }
497 
498     for (p = whitelist_rw; *p; p++) {
499         if (!strcmp(format_name, *p)) {
500             return 1;
501         }
502     }
503     if (read_only) {
504         for (p = whitelist_ro; *p; p++) {
505             if (!strcmp(format_name, *p)) {
506                 return 1;
507             }
508         }
509     }
510     return 0;
511 }
512 
513 int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
514 {
515     GLOBAL_STATE_CODE();
516     return bdrv_format_is_whitelisted(drv->format_name, read_only);
517 }
518 
519 bool bdrv_uses_whitelist(void)
520 {
521     return use_bdrv_whitelist;
522 }
523 
524 typedef struct CreateCo {
525     BlockDriver *drv;
526     char *filename;
527     QemuOpts *opts;
528     int ret;
529     Error *err;
530 } CreateCo;
531 
532 int coroutine_fn bdrv_co_create(BlockDriver *drv, const char *filename,
533                                 QemuOpts *opts, Error **errp)
534 {
535     int ret;
536     GLOBAL_STATE_CODE();
537     ERRP_GUARD();
538 
539     if (!drv->bdrv_co_create_opts) {
540         error_setg(errp, "Driver '%s' does not support image creation",
541                    drv->format_name);
542         return -ENOTSUP;
543     }
544 
545     ret = drv->bdrv_co_create_opts(drv, filename, opts, errp);
546     if (ret < 0 && !*errp) {
547         error_setg_errno(errp, -ret, "Could not create image");
548     }
549 
550     return ret;
551 }
552 
553 /**
554  * Helper function for bdrv_create_file_fallback(): Resize @blk to at
555  * least the given @minimum_size.
556  *
557  * On success, return @blk's actual length.
558  * Otherwise, return -errno.
559  */
560 static int64_t coroutine_fn GRAPH_UNLOCKED
561 create_file_fallback_truncate(BlockBackend *blk, int64_t minimum_size,
562                               Error **errp)
563 {
564     Error *local_err = NULL;
565     int64_t size;
566     int ret;
567 
568     GLOBAL_STATE_CODE();
569 
570     ret = blk_co_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
571                           &local_err);
572     if (ret < 0 && ret != -ENOTSUP) {
573         error_propagate(errp, local_err);
574         return ret;
575     }
576 
577     size = blk_co_getlength(blk);
578     if (size < 0) {
579         error_free(local_err);
580         error_setg_errno(errp, -size,
581                          "Failed to inquire the new image file's length");
582         return size;
583     }
584 
585     if (size < minimum_size) {
586         /* Need to grow the image, but we failed to do that */
587         error_propagate(errp, local_err);
588         return -ENOTSUP;
589     }
590 
591     error_free(local_err);
592     local_err = NULL;
593 
594     return size;
595 }
596 
597 /**
598  * Helper function for bdrv_create_file_fallback(): Zero the first
599  * sector to remove any potentially pre-existing image header.
600  */
601 static int coroutine_fn
602 create_file_fallback_zero_first_sector(BlockBackend *blk,
603                                        int64_t current_size,
604                                        Error **errp)
605 {
606     int64_t bytes_to_clear;
607     int ret;
608 
609     GLOBAL_STATE_CODE();
610 
611     bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
612     if (bytes_to_clear) {
613         ret = blk_co_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
614         if (ret < 0) {
615             error_setg_errno(errp, -ret,
616                              "Failed to clear the new image's first sector");
617             return ret;
618         }
619     }
620 
621     return 0;
622 }
623 
624 /**
625  * Simple implementation of bdrv_co_create_opts for protocol drivers
626  * which only support creation via opening a file
627  * (usually existing raw storage device)
628  */
629 int coroutine_fn bdrv_co_create_opts_simple(BlockDriver *drv,
630                                             const char *filename,
631                                             QemuOpts *opts,
632                                             Error **errp)
633 {
634     BlockBackend *blk;
635     QDict *options;
636     int64_t size = 0;
637     char *buf = NULL;
638     PreallocMode prealloc;
639     Error *local_err = NULL;
640     int ret;
641 
642     GLOBAL_STATE_CODE();
643 
644     size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
645     buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
646     prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
647                                PREALLOC_MODE_OFF, &local_err);
648     g_free(buf);
649     if (local_err) {
650         error_propagate(errp, local_err);
651         return -EINVAL;
652     }
653 
654     if (prealloc != PREALLOC_MODE_OFF) {
655         error_setg(errp, "Unsupported preallocation mode '%s'",
656                    PreallocMode_str(prealloc));
657         return -ENOTSUP;
658     }
659 
660     options = qdict_new();
661     qdict_put_str(options, "driver", drv->format_name);
662 
663     blk = blk_co_new_open(filename, NULL, options,
664                           BDRV_O_RDWR | BDRV_O_RESIZE, errp);
665     if (!blk) {
666         error_prepend(errp, "Protocol driver '%s' does not support creating "
667                       "new images, so an existing image must be selected as "
668                       "the target; however, opening the given target as an "
669                       "existing image failed: ",
670                       drv->format_name);
671         return -EINVAL;
672     }
673 
674     size = create_file_fallback_truncate(blk, size, errp);
675     if (size < 0) {
676         ret = size;
677         goto out;
678     }
679 
680     ret = create_file_fallback_zero_first_sector(blk, size, errp);
681     if (ret < 0) {
682         goto out;
683     }
684 
685     ret = 0;
686 out:
687     blk_co_unref(blk);
688     return ret;
689 }
690 
691 int coroutine_fn bdrv_co_create_file(const char *filename, QemuOpts *opts,
692                                      Error **errp)
693 {
694     QemuOpts *protocol_opts;
695     BlockDriver *drv;
696     QDict *qdict;
697     int ret;
698 
699     GLOBAL_STATE_CODE();
700 
701     drv = bdrv_find_protocol(filename, true, errp);
702     if (drv == NULL) {
703         return -ENOENT;
704     }
705 
706     if (!drv->create_opts) {
707         error_setg(errp, "Driver '%s' does not support image creation",
708                    drv->format_name);
709         return -ENOTSUP;
710     }
711 
712     /*
713      * 'opts' contains a QemuOptsList with a combination of format and protocol
714      * default values.
715      *
716      * The format properly removes its options, but the default values remain
717      * in 'opts->list'.  So if the protocol has options with the same name
718      * (e.g. rbd has 'cluster_size' as qcow2), it will see the default values
719      * of the format, since for overlapping options, the format wins.
720      *
721      * To avoid this issue, lets convert QemuOpts to QDict, in this way we take
722      * only the set options, and then convert it back to QemuOpts, using the
723      * create_opts of the protocol. So the new QemuOpts, will contain only the
724      * protocol defaults.
725      */
726     qdict = qemu_opts_to_qdict(opts, NULL);
727     protocol_opts = qemu_opts_from_qdict(drv->create_opts, qdict, errp);
728     if (protocol_opts == NULL) {
729         ret = -EINVAL;
730         goto out;
731     }
732 
733     ret = bdrv_co_create(drv, filename, protocol_opts, errp);
734 out:
735     qemu_opts_del(protocol_opts);
736     qobject_unref(qdict);
737     return ret;
738 }
739 
740 int coroutine_fn bdrv_co_delete_file(BlockDriverState *bs, Error **errp)
741 {
742     Error *local_err = NULL;
743     int ret;
744 
745     IO_CODE();
746     assert(bs != NULL);
747     assert_bdrv_graph_readable();
748 
749     if (!bs->drv) {
750         error_setg(errp, "Block node '%s' is not opened", bs->filename);
751         return -ENOMEDIUM;
752     }
753 
754     if (!bs->drv->bdrv_co_delete_file) {
755         error_setg(errp, "Driver '%s' does not support image deletion",
756                    bs->drv->format_name);
757         return -ENOTSUP;
758     }
759 
760     ret = bs->drv->bdrv_co_delete_file(bs, &local_err);
761     if (ret < 0) {
762         error_propagate(errp, local_err);
763     }
764 
765     return ret;
766 }
767 
768 void coroutine_fn bdrv_co_delete_file_noerr(BlockDriverState *bs)
769 {
770     Error *local_err = NULL;
771     int ret;
772     IO_CODE();
773 
774     if (!bs) {
775         return;
776     }
777 
778     ret = bdrv_co_delete_file(bs, &local_err);
779     /*
780      * ENOTSUP will happen if the block driver doesn't support
781      * the 'bdrv_co_delete_file' interface. This is a predictable
782      * scenario and shouldn't be reported back to the user.
783      */
784     if (ret == -ENOTSUP) {
785         error_free(local_err);
786     } else if (ret < 0) {
787         error_report_err(local_err);
788     }
789 }
790 
791 /**
792  * Try to get @bs's logical and physical block size.
793  * On success, store them in @bsz struct and return 0.
794  * On failure return -errno.
795  * @bs must not be empty.
796  */
797 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
798 {
799     BlockDriver *drv = bs->drv;
800     BlockDriverState *filtered = bdrv_filter_bs(bs);
801     GLOBAL_STATE_CODE();
802 
803     if (drv && drv->bdrv_probe_blocksizes) {
804         return drv->bdrv_probe_blocksizes(bs, bsz);
805     } else if (filtered) {
806         return bdrv_probe_blocksizes(filtered, bsz);
807     }
808 
809     return -ENOTSUP;
810 }
811 
812 /**
813  * Try to get @bs's geometry (cyls, heads, sectors).
814  * On success, store them in @geo struct and return 0.
815  * On failure return -errno.
816  * @bs must not be empty.
817  */
818 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
819 {
820     BlockDriver *drv = bs->drv;
821     BlockDriverState *filtered = bdrv_filter_bs(bs);
822     GLOBAL_STATE_CODE();
823 
824     if (drv && drv->bdrv_probe_geometry) {
825         return drv->bdrv_probe_geometry(bs, geo);
826     } else if (filtered) {
827         return bdrv_probe_geometry(filtered, geo);
828     }
829 
830     return -ENOTSUP;
831 }
832 
833 /*
834  * Create a uniquely-named empty temporary file.
835  * Return the actual file name used upon success, otherwise NULL.
836  * This string should be freed with g_free() when not needed any longer.
837  *
838  * Note: creating a temporary file for the caller to (re)open is
839  * inherently racy. Use g_file_open_tmp() instead whenever practical.
840  */
841 char *create_tmp_file(Error **errp)
842 {
843     int fd;
844     const char *tmpdir;
845     g_autofree char *filename = NULL;
846 
847     tmpdir = g_get_tmp_dir();
848 #ifndef _WIN32
849     /*
850      * See commit 69bef79 ("block: use /var/tmp instead of /tmp for -snapshot")
851      *
852      * This function is used to create temporary disk images (like -snapshot),
853      * so the files can become very large. /tmp is often a tmpfs where as
854      * /var/tmp is usually on a disk, so more appropriate for disk images.
855      */
856     if (!g_strcmp0(tmpdir, "/tmp")) {
857         tmpdir = "/var/tmp";
858     }
859 #endif
860 
861     filename = g_strdup_printf("%s/vl.XXXXXX", tmpdir);
862     fd = g_mkstemp(filename);
863     if (fd < 0) {
864         error_setg_errno(errp, errno, "Could not open temporary file '%s'",
865                          filename);
866         return NULL;
867     }
868     close(fd);
869 
870     return g_steal_pointer(&filename);
871 }
872 
873 /*
874  * Detect host devices. By convention, /dev/cdrom[N] is always
875  * recognized as a host CDROM.
876  */
877 static BlockDriver *find_hdev_driver(const char *filename)
878 {
879     int score_max = 0, score;
880     BlockDriver *drv = NULL, *d;
881     GLOBAL_STATE_CODE();
882 
883     QLIST_FOREACH(d, &bdrv_drivers, list) {
884         if (d->bdrv_probe_device) {
885             score = d->bdrv_probe_device(filename);
886             if (score > score_max) {
887                 score_max = score;
888                 drv = d;
889             }
890         }
891     }
892 
893     return drv;
894 }
895 
896 static BlockDriver *bdrv_do_find_protocol(const char *protocol)
897 {
898     BlockDriver *drv1;
899     GLOBAL_STATE_CODE();
900 
901     QLIST_FOREACH(drv1, &bdrv_drivers, list) {
902         if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
903             return drv1;
904         }
905     }
906 
907     return NULL;
908 }
909 
910 BlockDriver *bdrv_find_protocol(const char *filename,
911                                 bool allow_protocol_prefix,
912                                 Error **errp)
913 {
914     BlockDriver *drv1;
915     char protocol[128];
916     int len;
917     const char *p;
918     int i;
919 
920     GLOBAL_STATE_CODE();
921     /* TODO Drivers without bdrv_file_open must be specified explicitly */
922 
923     /*
924      * XXX(hch): we really should not let host device detection
925      * override an explicit protocol specification, but moving this
926      * later breaks access to device names with colons in them.
927      * Thanks to the brain-dead persistent naming schemes on udev-
928      * based Linux systems those actually are quite common.
929      */
930     drv1 = find_hdev_driver(filename);
931     if (drv1) {
932         return drv1;
933     }
934 
935     if (!path_has_protocol(filename) || !allow_protocol_prefix) {
936         return &bdrv_file;
937     }
938 
939     p = strchr(filename, ':');
940     assert(p != NULL);
941     len = p - filename;
942     if (len > sizeof(protocol) - 1)
943         len = sizeof(protocol) - 1;
944     memcpy(protocol, filename, len);
945     protocol[len] = '\0';
946 
947     drv1 = bdrv_do_find_protocol(protocol);
948     if (drv1) {
949         return drv1;
950     }
951 
952     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
953         if (block_driver_modules[i].protocol_name &&
954             !strcmp(block_driver_modules[i].protocol_name, protocol)) {
955             int rv = block_module_load(block_driver_modules[i].library_name, errp);
956             if (rv > 0) {
957                 drv1 = bdrv_do_find_protocol(protocol);
958             } else if (rv < 0) {
959                 return NULL;
960             }
961             break;
962         }
963     }
964 
965     if (!drv1) {
966         error_setg(errp, "Unknown protocol '%s'", protocol);
967     }
968     return drv1;
969 }
970 
971 /*
972  * Guess image format by probing its contents.
973  * This is not a good idea when your image is raw (CVE-2008-2004), but
974  * we do it anyway for backward compatibility.
975  *
976  * @buf         contains the image's first @buf_size bytes.
977  * @buf_size    is the buffer size in bytes (generally BLOCK_PROBE_BUF_SIZE,
978  *              but can be smaller if the image file is smaller)
979  * @filename    is its filename.
980  *
981  * For all block drivers, call the bdrv_probe() method to get its
982  * probing score.
983  * Return the first block driver with the highest probing score.
984  */
985 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
986                             const char *filename)
987 {
988     int score_max = 0, score;
989     BlockDriver *drv = NULL, *d;
990     IO_CODE();
991 
992     QLIST_FOREACH(d, &bdrv_drivers, list) {
993         if (d->bdrv_probe) {
994             score = d->bdrv_probe(buf, buf_size, filename);
995             if (score > score_max) {
996                 score_max = score;
997                 drv = d;
998             }
999         }
1000     }
1001 
1002     return drv;
1003 }
1004 
1005 static int find_image_format(BlockBackend *file, const char *filename,
1006                              BlockDriver **pdrv, Error **errp)
1007 {
1008     BlockDriver *drv;
1009     uint8_t buf[BLOCK_PROBE_BUF_SIZE];
1010     int ret = 0;
1011 
1012     GLOBAL_STATE_CODE();
1013 
1014     /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
1015     if (blk_is_sg(file) || !blk_is_inserted(file) || blk_getlength(file) == 0) {
1016         *pdrv = &bdrv_raw;
1017         return ret;
1018     }
1019 
1020     ret = blk_pread(file, 0, sizeof(buf), buf, 0);
1021     if (ret < 0) {
1022         error_setg_errno(errp, -ret, "Could not read image for determining its "
1023                          "format");
1024         *pdrv = NULL;
1025         return ret;
1026     }
1027 
1028     drv = bdrv_probe_all(buf, sizeof(buf), filename);
1029     if (!drv) {
1030         error_setg(errp, "Could not determine image format: No compatible "
1031                    "driver found");
1032         *pdrv = NULL;
1033         return -ENOENT;
1034     }
1035 
1036     *pdrv = drv;
1037     return 0;
1038 }
1039 
1040 /**
1041  * Set the current 'total_sectors' value
1042  * Return 0 on success, -errno on error.
1043  */
1044 int coroutine_fn bdrv_co_refresh_total_sectors(BlockDriverState *bs,
1045                                                int64_t hint)
1046 {
1047     BlockDriver *drv = bs->drv;
1048     IO_CODE();
1049     assert_bdrv_graph_readable();
1050 
1051     if (!drv) {
1052         return -ENOMEDIUM;
1053     }
1054 
1055     /* Do not attempt drv->bdrv_co_getlength() on scsi-generic devices */
1056     if (bdrv_is_sg(bs))
1057         return 0;
1058 
1059     /* query actual device if possible, otherwise just trust the hint */
1060     if (drv->bdrv_co_getlength) {
1061         int64_t length = drv->bdrv_co_getlength(bs);
1062         if (length < 0) {
1063             return length;
1064         }
1065         hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
1066     }
1067 
1068     bs->total_sectors = hint;
1069 
1070     if (bs->total_sectors * BDRV_SECTOR_SIZE > BDRV_MAX_LENGTH) {
1071         return -EFBIG;
1072     }
1073 
1074     return 0;
1075 }
1076 
1077 /**
1078  * Combines a QDict of new block driver @options with any missing options taken
1079  * from @old_options, so that leaving out an option defaults to its old value.
1080  */
1081 static void bdrv_join_options(BlockDriverState *bs, QDict *options,
1082                               QDict *old_options)
1083 {
1084     GLOBAL_STATE_CODE();
1085     if (bs->drv && bs->drv->bdrv_join_options) {
1086         bs->drv->bdrv_join_options(options, old_options);
1087     } else {
1088         qdict_join(options, old_options, false);
1089     }
1090 }
1091 
1092 static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
1093                                                             int open_flags,
1094                                                             Error **errp)
1095 {
1096     Error *local_err = NULL;
1097     char *value = qemu_opt_get_del(opts, "detect-zeroes");
1098     BlockdevDetectZeroesOptions detect_zeroes =
1099         qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
1100                         BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
1101     GLOBAL_STATE_CODE();
1102     g_free(value);
1103     if (local_err) {
1104         error_propagate(errp, local_err);
1105         return detect_zeroes;
1106     }
1107 
1108     if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
1109         !(open_flags & BDRV_O_UNMAP))
1110     {
1111         error_setg(errp, "setting detect-zeroes to unmap is not allowed "
1112                    "without setting discard operation to unmap");
1113     }
1114 
1115     return detect_zeroes;
1116 }
1117 
1118 /**
1119  * Set open flags for aio engine
1120  *
1121  * Return 0 on success, -1 if the engine specified is invalid
1122  */
1123 int bdrv_parse_aio(const char *mode, int *flags)
1124 {
1125     if (!strcmp(mode, "threads")) {
1126         /* do nothing, default */
1127     } else if (!strcmp(mode, "native")) {
1128         *flags |= BDRV_O_NATIVE_AIO;
1129 #ifdef CONFIG_LINUX_IO_URING
1130     } else if (!strcmp(mode, "io_uring")) {
1131         *flags |= BDRV_O_IO_URING;
1132 #endif
1133     } else {
1134         return -1;
1135     }
1136 
1137     return 0;
1138 }
1139 
1140 /**
1141  * Set open flags for a given discard mode
1142  *
1143  * Return 0 on success, -1 if the discard mode was invalid.
1144  */
1145 int bdrv_parse_discard_flags(const char *mode, int *flags)
1146 {
1147     *flags &= ~BDRV_O_UNMAP;
1148 
1149     if (!strcmp(mode, "off") || !strcmp(mode, "ignore")) {
1150         /* do nothing */
1151     } else if (!strcmp(mode, "on") || !strcmp(mode, "unmap")) {
1152         *flags |= BDRV_O_UNMAP;
1153     } else {
1154         return -1;
1155     }
1156 
1157     return 0;
1158 }
1159 
1160 /**
1161  * Set open flags for a given cache mode
1162  *
1163  * Return 0 on success, -1 if the cache mode was invalid.
1164  */
1165 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough)
1166 {
1167     *flags &= ~BDRV_O_CACHE_MASK;
1168 
1169     if (!strcmp(mode, "off") || !strcmp(mode, "none")) {
1170         *writethrough = false;
1171         *flags |= BDRV_O_NOCACHE;
1172     } else if (!strcmp(mode, "directsync")) {
1173         *writethrough = true;
1174         *flags |= BDRV_O_NOCACHE;
1175     } else if (!strcmp(mode, "writeback")) {
1176         *writethrough = false;
1177     } else if (!strcmp(mode, "unsafe")) {
1178         *writethrough = false;
1179         *flags |= BDRV_O_NO_FLUSH;
1180     } else if (!strcmp(mode, "writethrough")) {
1181         *writethrough = true;
1182     } else {
1183         return -1;
1184     }
1185 
1186     return 0;
1187 }
1188 
1189 static char *bdrv_child_get_parent_desc(BdrvChild *c)
1190 {
1191     BlockDriverState *parent = c->opaque;
1192     return g_strdup_printf("node '%s'", bdrv_get_node_name(parent));
1193 }
1194 
1195 static void bdrv_child_cb_drained_begin(BdrvChild *child)
1196 {
1197     BlockDriverState *bs = child->opaque;
1198     bdrv_do_drained_begin_quiesce(bs, NULL);
1199 }
1200 
1201 static bool bdrv_child_cb_drained_poll(BdrvChild *child)
1202 {
1203     BlockDriverState *bs = child->opaque;
1204     return bdrv_drain_poll(bs, NULL, false);
1205 }
1206 
1207 static void bdrv_child_cb_drained_end(BdrvChild *child)
1208 {
1209     BlockDriverState *bs = child->opaque;
1210     bdrv_drained_end(bs);
1211 }
1212 
1213 static int bdrv_child_cb_inactivate(BdrvChild *child)
1214 {
1215     BlockDriverState *bs = child->opaque;
1216     GLOBAL_STATE_CODE();
1217     assert(bs->open_flags & BDRV_O_INACTIVE);
1218     return 0;
1219 }
1220 
1221 static bool bdrv_child_cb_change_aio_ctx(BdrvChild *child, AioContext *ctx,
1222                                          GHashTable *visited, Transaction *tran,
1223                                          Error **errp)
1224 {
1225     BlockDriverState *bs = child->opaque;
1226     return bdrv_change_aio_context(bs, ctx, visited, tran, errp);
1227 }
1228 
1229 /*
1230  * Returns the options and flags that a temporary snapshot should get, based on
1231  * the originally requested flags (the originally requested image will have
1232  * flags like a backing file)
1233  */
1234 static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
1235                                        int parent_flags, QDict *parent_options)
1236 {
1237     GLOBAL_STATE_CODE();
1238     *child_flags = (parent_flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
1239 
1240     /* For temporary files, unconditional cache=unsafe is fine */
1241     qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
1242     qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
1243 
1244     /* Copy the read-only and discard options from the parent */
1245     qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1246     qdict_copy_default(child_options, parent_options, BDRV_OPT_DISCARD);
1247 
1248     /* aio=native doesn't work for cache.direct=off, so disable it for the
1249      * temporary snapshot */
1250     *child_flags &= ~BDRV_O_NATIVE_AIO;
1251 }
1252 
1253 static void bdrv_backing_attach(BdrvChild *c)
1254 {
1255     BlockDriverState *parent = c->opaque;
1256     BlockDriverState *backing_hd = c->bs;
1257 
1258     GLOBAL_STATE_CODE();
1259     assert(!parent->backing_blocker);
1260     error_setg(&parent->backing_blocker,
1261                "node is used as backing hd of '%s'",
1262                bdrv_get_device_or_node_name(parent));
1263 
1264     bdrv_refresh_filename(backing_hd);
1265 
1266     parent->open_flags &= ~BDRV_O_NO_BACKING;
1267 
1268     bdrv_op_block_all(backing_hd, parent->backing_blocker);
1269     /* Otherwise we won't be able to commit or stream */
1270     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
1271                     parent->backing_blocker);
1272     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
1273                     parent->backing_blocker);
1274     /*
1275      * We do backup in 3 ways:
1276      * 1. drive backup
1277      *    The target bs is new opened, and the source is top BDS
1278      * 2. blockdev backup
1279      *    Both the source and the target are top BDSes.
1280      * 3. internal backup(used for block replication)
1281      *    Both the source and the target are backing file
1282      *
1283      * In case 1 and 2, neither the source nor the target is the backing file.
1284      * In case 3, we will block the top BDS, so there is only one block job
1285      * for the top BDS and its backing chain.
1286      */
1287     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
1288                     parent->backing_blocker);
1289     bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
1290                     parent->backing_blocker);
1291 }
1292 
1293 static void bdrv_backing_detach(BdrvChild *c)
1294 {
1295     BlockDriverState *parent = c->opaque;
1296 
1297     GLOBAL_STATE_CODE();
1298     assert(parent->backing_blocker);
1299     bdrv_op_unblock_all(c->bs, parent->backing_blocker);
1300     error_free(parent->backing_blocker);
1301     parent->backing_blocker = NULL;
1302 }
1303 
1304 static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
1305                                         const char *filename, Error **errp)
1306 {
1307     BlockDriverState *parent = c->opaque;
1308     bool read_only = bdrv_is_read_only(parent);
1309     int ret;
1310     GLOBAL_STATE_CODE();
1311 
1312     if (read_only) {
1313         ret = bdrv_reopen_set_read_only(parent, false, errp);
1314         if (ret < 0) {
1315             return ret;
1316         }
1317     }
1318 
1319     ret = bdrv_change_backing_file(parent, filename,
1320                                    base->drv ? base->drv->format_name : "",
1321                                    false);
1322     if (ret < 0) {
1323         error_setg_errno(errp, -ret, "Could not update backing file link");
1324     }
1325 
1326     if (read_only) {
1327         bdrv_reopen_set_read_only(parent, true, NULL);
1328     }
1329 
1330     return ret;
1331 }
1332 
1333 /*
1334  * Returns the options and flags that a generic child of a BDS should
1335  * get, based on the given options and flags for the parent BDS.
1336  */
1337 static void bdrv_inherited_options(BdrvChildRole role, bool parent_is_format,
1338                                    int *child_flags, QDict *child_options,
1339                                    int parent_flags, QDict *parent_options)
1340 {
1341     int flags = parent_flags;
1342     GLOBAL_STATE_CODE();
1343 
1344     /*
1345      * First, decide whether to set, clear, or leave BDRV_O_PROTOCOL.
1346      * Generally, the question to answer is: Should this child be
1347      * format-probed by default?
1348      */
1349 
1350     /*
1351      * Pure and non-filtered data children of non-format nodes should
1352      * be probed by default (even when the node itself has BDRV_O_PROTOCOL
1353      * set).  This only affects a very limited set of drivers (namely
1354      * quorum and blkverify when this comment was written).
1355      * Force-clear BDRV_O_PROTOCOL then.
1356      */
1357     if (!parent_is_format &&
1358         (role & BDRV_CHILD_DATA) &&
1359         !(role & (BDRV_CHILD_METADATA | BDRV_CHILD_FILTERED)))
1360     {
1361         flags &= ~BDRV_O_PROTOCOL;
1362     }
1363 
1364     /*
1365      * All children of format nodes (except for COW children) and all
1366      * metadata children in general should never be format-probed.
1367      * Force-set BDRV_O_PROTOCOL then.
1368      */
1369     if ((parent_is_format && !(role & BDRV_CHILD_COW)) ||
1370         (role & BDRV_CHILD_METADATA))
1371     {
1372         flags |= BDRV_O_PROTOCOL;
1373     }
1374 
1375     /*
1376      * If the cache mode isn't explicitly set, inherit direct and no-flush from
1377      * the parent.
1378      */
1379     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1380     qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1381     qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1382 
1383     if (role & BDRV_CHILD_COW) {
1384         /* backing files are opened read-only by default */
1385         qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
1386         qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
1387     } else {
1388         /* Inherit the read-only option from the parent if it's not set */
1389         qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1390         qdict_copy_default(child_options, parent_options,
1391                            BDRV_OPT_AUTO_READ_ONLY);
1392     }
1393 
1394     /*
1395      * bdrv_co_pdiscard() respects unmap policy for the parent, so we
1396      * can default to enable it on lower layers regardless of the
1397      * parent option.
1398      */
1399     qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
1400 
1401     /* Clear flags that only apply to the top layer */
1402     flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);
1403 
1404     if (role & BDRV_CHILD_METADATA) {
1405         flags &= ~BDRV_O_NO_IO;
1406     }
1407     if (role & BDRV_CHILD_COW) {
1408         flags &= ~BDRV_O_TEMPORARY;
1409     }
1410 
1411     *child_flags = flags;
1412 }
1413 
1414 static void GRAPH_WRLOCK bdrv_child_cb_attach(BdrvChild *child)
1415 {
1416     BlockDriverState *bs = child->opaque;
1417 
1418     assert_bdrv_graph_writable();
1419     QLIST_INSERT_HEAD(&bs->children, child, next);
1420     if (bs->drv->is_filter || (child->role & BDRV_CHILD_FILTERED)) {
1421         /*
1422          * Here we handle filters and block/raw-format.c when it behave like
1423          * filter. They generally have a single PRIMARY child, which is also the
1424          * FILTERED child, and that they may have multiple more children, which
1425          * are neither PRIMARY nor FILTERED. And never we have a COW child here.
1426          * So bs->file will be the PRIMARY child, unless the PRIMARY child goes
1427          * into bs->backing on exceptional cases; and bs->backing will be
1428          * nothing else.
1429          */
1430         assert(!(child->role & BDRV_CHILD_COW));
1431         if (child->role & BDRV_CHILD_PRIMARY) {
1432             assert(child->role & BDRV_CHILD_FILTERED);
1433             assert(!bs->backing);
1434             assert(!bs->file);
1435 
1436             if (bs->drv->filtered_child_is_backing) {
1437                 bs->backing = child;
1438             } else {
1439                 bs->file = child;
1440             }
1441         } else {
1442             assert(!(child->role & BDRV_CHILD_FILTERED));
1443         }
1444     } else if (child->role & BDRV_CHILD_COW) {
1445         assert(bs->drv->supports_backing);
1446         assert(!(child->role & BDRV_CHILD_PRIMARY));
1447         assert(!bs->backing);
1448         bs->backing = child;
1449         bdrv_backing_attach(child);
1450     } else if (child->role & BDRV_CHILD_PRIMARY) {
1451         assert(!bs->file);
1452         bs->file = child;
1453     }
1454 }
1455 
1456 static void GRAPH_WRLOCK bdrv_child_cb_detach(BdrvChild *child)
1457 {
1458     BlockDriverState *bs = child->opaque;
1459 
1460     if (child->role & BDRV_CHILD_COW) {
1461         bdrv_backing_detach(child);
1462     }
1463 
1464     assert_bdrv_graph_writable();
1465     QLIST_REMOVE(child, next);
1466     if (child == bs->backing) {
1467         assert(child != bs->file);
1468         bs->backing = NULL;
1469     } else if (child == bs->file) {
1470         bs->file = NULL;
1471     }
1472 }
1473 
1474 static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
1475                                          const char *filename, Error **errp)
1476 {
1477     if (c->role & BDRV_CHILD_COW) {
1478         return bdrv_backing_update_filename(c, base, filename, errp);
1479     }
1480     return 0;
1481 }
1482 
1483 AioContext *child_of_bds_get_parent_aio_context(BdrvChild *c)
1484 {
1485     BlockDriverState *bs = c->opaque;
1486     IO_CODE();
1487 
1488     return bdrv_get_aio_context(bs);
1489 }
1490 
1491 const BdrvChildClass child_of_bds = {
1492     .parent_is_bds   = true,
1493     .get_parent_desc = bdrv_child_get_parent_desc,
1494     .inherit_options = bdrv_inherited_options,
1495     .drained_begin   = bdrv_child_cb_drained_begin,
1496     .drained_poll    = bdrv_child_cb_drained_poll,
1497     .drained_end     = bdrv_child_cb_drained_end,
1498     .attach          = bdrv_child_cb_attach,
1499     .detach          = bdrv_child_cb_detach,
1500     .inactivate      = bdrv_child_cb_inactivate,
1501     .change_aio_ctx  = bdrv_child_cb_change_aio_ctx,
1502     .update_filename = bdrv_child_cb_update_filename,
1503     .get_parent_aio_context = child_of_bds_get_parent_aio_context,
1504 };
1505 
1506 AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c)
1507 {
1508     IO_CODE();
1509     return c->klass->get_parent_aio_context(c);
1510 }
1511 
1512 static int bdrv_open_flags(BlockDriverState *bs, int flags)
1513 {
1514     int open_flags = flags;
1515     GLOBAL_STATE_CODE();
1516 
1517     /*
1518      * Clear flags that are internal to the block layer before opening the
1519      * image.
1520      */
1521     open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_PROTOCOL);
1522 
1523     return open_flags;
1524 }
1525 
1526 static void update_flags_from_options(int *flags, QemuOpts *opts)
1527 {
1528     GLOBAL_STATE_CODE();
1529 
1530     *flags &= ~(BDRV_O_CACHE_MASK | BDRV_O_RDWR | BDRV_O_AUTO_RDONLY);
1531 
1532     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
1533         *flags |= BDRV_O_NO_FLUSH;
1534     }
1535 
1536     if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
1537         *flags |= BDRV_O_NOCACHE;
1538     }
1539 
1540     if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
1541         *flags |= BDRV_O_RDWR;
1542     }
1543 
1544     if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
1545         *flags |= BDRV_O_AUTO_RDONLY;
1546     }
1547 }
1548 
1549 static void update_options_from_flags(QDict *options, int flags)
1550 {
1551     GLOBAL_STATE_CODE();
1552     if (!qdict_haskey(options, BDRV_OPT_CACHE_DIRECT)) {
1553         qdict_put_bool(options, BDRV_OPT_CACHE_DIRECT, flags & BDRV_O_NOCACHE);
1554     }
1555     if (!qdict_haskey(options, BDRV_OPT_CACHE_NO_FLUSH)) {
1556         qdict_put_bool(options, BDRV_OPT_CACHE_NO_FLUSH,
1557                        flags & BDRV_O_NO_FLUSH);
1558     }
1559     if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
1560         qdict_put_bool(options, BDRV_OPT_READ_ONLY, !(flags & BDRV_O_RDWR));
1561     }
1562     if (!qdict_haskey(options, BDRV_OPT_AUTO_READ_ONLY)) {
1563         qdict_put_bool(options, BDRV_OPT_AUTO_READ_ONLY,
1564                        flags & BDRV_O_AUTO_RDONLY);
1565     }
1566 }
1567 
1568 static void bdrv_assign_node_name(BlockDriverState *bs,
1569                                   const char *node_name,
1570                                   Error **errp)
1571 {
1572     char *gen_node_name = NULL;
1573     GLOBAL_STATE_CODE();
1574 
1575     if (!node_name) {
1576         node_name = gen_node_name = id_generate(ID_BLOCK);
1577     } else if (!id_wellformed(node_name)) {
1578         /*
1579          * Check for empty string or invalid characters, but not if it is
1580          * generated (generated names use characters not available to the user)
1581          */
1582         error_setg(errp, "Invalid node-name: '%s'", node_name);
1583         return;
1584     }
1585 
1586     /* takes care of avoiding namespaces collisions */
1587     if (blk_by_name(node_name)) {
1588         error_setg(errp, "node-name=%s is conflicting with a device id",
1589                    node_name);
1590         goto out;
1591     }
1592 
1593     /* takes care of avoiding duplicates node names */
1594     if (bdrv_find_node(node_name)) {
1595         error_setg(errp, "Duplicate nodes with node-name='%s'", node_name);
1596         goto out;
1597     }
1598 
1599     /* Make sure that the node name isn't truncated */
1600     if (strlen(node_name) >= sizeof(bs->node_name)) {
1601         error_setg(errp, "Node name too long");
1602         goto out;
1603     }
1604 
1605     /* copy node name into the bs and insert it into the graph list */
1606     pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
1607     QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
1608 out:
1609     g_free(gen_node_name);
1610 }
1611 
1612 /*
1613  * The caller must always hold @bs AioContext lock, because this function calls
1614  * bdrv_refresh_total_sectors() which polls when called from non-coroutine
1615  * context.
1616  */
1617 static int no_coroutine_fn GRAPH_UNLOCKED
1618 bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv, const char *node_name,
1619                  QDict *options, int open_flags, Error **errp)
1620 {
1621     AioContext *ctx;
1622     Error *local_err = NULL;
1623     int i, ret;
1624     GLOBAL_STATE_CODE();
1625 
1626     bdrv_assign_node_name(bs, node_name, &local_err);
1627     if (local_err) {
1628         error_propagate(errp, local_err);
1629         return -EINVAL;
1630     }
1631 
1632     bs->drv = drv;
1633     bs->opaque = g_malloc0(drv->instance_size);
1634 
1635     if (drv->bdrv_file_open) {
1636         assert(!drv->bdrv_needs_filename || bs->filename[0]);
1637         ret = drv->bdrv_file_open(bs, options, open_flags, &local_err);
1638     } else if (drv->bdrv_open) {
1639         ret = drv->bdrv_open(bs, options, open_flags, &local_err);
1640     } else {
1641         ret = 0;
1642     }
1643 
1644     if (ret < 0) {
1645         if (local_err) {
1646             error_propagate(errp, local_err);
1647         } else if (bs->filename[0]) {
1648             error_setg_errno(errp, -ret, "Could not open '%s'", bs->filename);
1649         } else {
1650             error_setg_errno(errp, -ret, "Could not open image");
1651         }
1652         goto open_failed;
1653     }
1654 
1655     assert(!(bs->supported_read_flags & ~BDRV_REQ_MASK));
1656     assert(!(bs->supported_write_flags & ~BDRV_REQ_MASK));
1657 
1658     /*
1659      * Always allow the BDRV_REQ_REGISTERED_BUF optimization hint. This saves
1660      * drivers that pass read/write requests through to a child the trouble of
1661      * declaring support explicitly.
1662      *
1663      * Drivers must not propagate this flag accidentally when they initiate I/O
1664      * to a bounce buffer. That case should be rare though.
1665      */
1666     bs->supported_read_flags |= BDRV_REQ_REGISTERED_BUF;
1667     bs->supported_write_flags |= BDRV_REQ_REGISTERED_BUF;
1668 
1669     /* Get the context after .bdrv_open, it can change the context */
1670     ctx = bdrv_get_aio_context(bs);
1671     aio_context_acquire(ctx);
1672 
1673     ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
1674     if (ret < 0) {
1675         error_setg_errno(errp, -ret, "Could not refresh total sector count");
1676         aio_context_release(ctx);
1677         return ret;
1678     }
1679 
1680     bdrv_graph_rdlock_main_loop();
1681     bdrv_refresh_limits(bs, NULL, &local_err);
1682     bdrv_graph_rdunlock_main_loop();
1683     aio_context_release(ctx);
1684 
1685     if (local_err) {
1686         error_propagate(errp, local_err);
1687         return -EINVAL;
1688     }
1689 
1690     assert(bdrv_opt_mem_align(bs) != 0);
1691     assert(bdrv_min_mem_align(bs) != 0);
1692     assert(is_power_of_2(bs->bl.request_alignment));
1693 
1694     for (i = 0; i < bs->quiesce_counter; i++) {
1695         if (drv->bdrv_drain_begin) {
1696             drv->bdrv_drain_begin(bs);
1697         }
1698     }
1699 
1700     return 0;
1701 open_failed:
1702     bs->drv = NULL;
1703     if (bs->file != NULL) {
1704         bdrv_graph_wrlock(NULL);
1705         bdrv_unref_child(bs, bs->file);
1706         bdrv_graph_wrunlock();
1707         assert(!bs->file);
1708     }
1709     g_free(bs->opaque);
1710     bs->opaque = NULL;
1711     return ret;
1712 }
1713 
1714 /*
1715  * Create and open a block node.
1716  *
1717  * @options is a QDict of options to pass to the block drivers, or NULL for an
1718  * empty set of options. The reference to the QDict belongs to the block layer
1719  * after the call (even on failure), so if the caller intends to reuse the
1720  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
1721  */
1722 BlockDriverState *bdrv_new_open_driver_opts(BlockDriver *drv,
1723                                             const char *node_name,
1724                                             QDict *options, int flags,
1725                                             Error **errp)
1726 {
1727     BlockDriverState *bs;
1728     int ret;
1729 
1730     GLOBAL_STATE_CODE();
1731 
1732     bs = bdrv_new();
1733     bs->open_flags = flags;
1734     bs->options = options ?: qdict_new();
1735     bs->explicit_options = qdict_clone_shallow(bs->options);
1736     bs->opaque = NULL;
1737 
1738     update_options_from_flags(bs->options, flags);
1739 
1740     ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
1741     if (ret < 0) {
1742         qobject_unref(bs->explicit_options);
1743         bs->explicit_options = NULL;
1744         qobject_unref(bs->options);
1745         bs->options = NULL;
1746         bdrv_unref(bs);
1747         return NULL;
1748     }
1749 
1750     return bs;
1751 }
1752 
1753 /* Create and open a block node. */
1754 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
1755                                        int flags, Error **errp)
1756 {
1757     GLOBAL_STATE_CODE();
1758     return bdrv_new_open_driver_opts(drv, node_name, NULL, flags, errp);
1759 }
1760 
1761 QemuOptsList bdrv_runtime_opts = {
1762     .name = "bdrv_common",
1763     .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
1764     .desc = {
1765         {
1766             .name = "node-name",
1767             .type = QEMU_OPT_STRING,
1768             .help = "Node name of the block device node",
1769         },
1770         {
1771             .name = "driver",
1772             .type = QEMU_OPT_STRING,
1773             .help = "Block driver to use for the node",
1774         },
1775         {
1776             .name = BDRV_OPT_CACHE_DIRECT,
1777             .type = QEMU_OPT_BOOL,
1778             .help = "Bypass software writeback cache on the host",
1779         },
1780         {
1781             .name = BDRV_OPT_CACHE_NO_FLUSH,
1782             .type = QEMU_OPT_BOOL,
1783             .help = "Ignore flush requests",
1784         },
1785         {
1786             .name = BDRV_OPT_READ_ONLY,
1787             .type = QEMU_OPT_BOOL,
1788             .help = "Node is opened in read-only mode",
1789         },
1790         {
1791             .name = BDRV_OPT_AUTO_READ_ONLY,
1792             .type = QEMU_OPT_BOOL,
1793             .help = "Node can become read-only if opening read-write fails",
1794         },
1795         {
1796             .name = "detect-zeroes",
1797             .type = QEMU_OPT_STRING,
1798             .help = "try to optimize zero writes (off, on, unmap)",
1799         },
1800         {
1801             .name = BDRV_OPT_DISCARD,
1802             .type = QEMU_OPT_STRING,
1803             .help = "discard operation (ignore/off, unmap/on)",
1804         },
1805         {
1806             .name = BDRV_OPT_FORCE_SHARE,
1807             .type = QEMU_OPT_BOOL,
1808             .help = "always accept other writers (default: off)",
1809         },
1810         { /* end of list */ }
1811     },
1812 };
1813 
1814 QemuOptsList bdrv_create_opts_simple = {
1815     .name = "simple-create-opts",
1816     .head = QTAILQ_HEAD_INITIALIZER(bdrv_create_opts_simple.head),
1817     .desc = {
1818         {
1819             .name = BLOCK_OPT_SIZE,
1820             .type = QEMU_OPT_SIZE,
1821             .help = "Virtual disk size"
1822         },
1823         {
1824             .name = BLOCK_OPT_PREALLOC,
1825             .type = QEMU_OPT_STRING,
1826             .help = "Preallocation mode (allowed values: off)"
1827         },
1828         { /* end of list */ }
1829     }
1830 };
1831 
1832 /*
1833  * Common part for opening disk images and files
1834  *
1835  * Removes all processed options from *options.
1836  */
1837 static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
1838                             QDict *options, Error **errp)
1839 {
1840     int ret, open_flags;
1841     const char *filename;
1842     const char *driver_name = NULL;
1843     const char *node_name = NULL;
1844     const char *discard;
1845     QemuOpts *opts;
1846     BlockDriver *drv;
1847     Error *local_err = NULL;
1848     bool ro;
1849 
1850     assert(bs->file == NULL);
1851     assert(options != NULL && bs->options != options);
1852     GLOBAL_STATE_CODE();
1853 
1854     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
1855     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1856         ret = -EINVAL;
1857         goto fail_opts;
1858     }
1859 
1860     update_flags_from_options(&bs->open_flags, opts);
1861 
1862     driver_name = qemu_opt_get(opts, "driver");
1863     drv = bdrv_find_format(driver_name);
1864     assert(drv != NULL);
1865 
1866     bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
1867 
1868     if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
1869         error_setg(errp,
1870                    BDRV_OPT_FORCE_SHARE
1871                    "=on can only be used with read-only images");
1872         ret = -EINVAL;
1873         goto fail_opts;
1874     }
1875 
1876     if (file != NULL) {
1877         bdrv_refresh_filename(blk_bs(file));
1878         filename = blk_bs(file)->filename;
1879     } else {
1880         /*
1881          * Caution: while qdict_get_try_str() is fine, getting
1882          * non-string types would require more care.  When @options
1883          * come from -blockdev or blockdev_add, its members are typed
1884          * according to the QAPI schema, but when they come from
1885          * -drive, they're all QString.
1886          */
1887         filename = qdict_get_try_str(options, "filename");
1888     }
1889 
1890     if (drv->bdrv_needs_filename && (!filename || !filename[0])) {
1891         error_setg(errp, "The '%s' block driver requires a file name",
1892                    drv->format_name);
1893         ret = -EINVAL;
1894         goto fail_opts;
1895     }
1896 
1897     trace_bdrv_open_common(bs, filename ?: "", bs->open_flags,
1898                            drv->format_name);
1899 
1900     ro = bdrv_is_read_only(bs);
1901 
1902     if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, ro)) {
1903         if (!ro && bdrv_is_whitelisted(drv, true)) {
1904             ret = bdrv_apply_auto_read_only(bs, NULL, NULL);
1905         } else {
1906             ret = -ENOTSUP;
1907         }
1908         if (ret < 0) {
1909             error_setg(errp,
1910                        !ro && bdrv_is_whitelisted(drv, true)
1911                        ? "Driver '%s' can only be used for read-only devices"
1912                        : "Driver '%s' is not whitelisted",
1913                        drv->format_name);
1914             goto fail_opts;
1915         }
1916     }
1917 
1918     /* bdrv_new() and bdrv_close() make it so */
1919     assert(qatomic_read(&bs->copy_on_read) == 0);
1920 
1921     if (bs->open_flags & BDRV_O_COPY_ON_READ) {
1922         if (!ro) {
1923             bdrv_enable_copy_on_read(bs);
1924         } else {
1925             error_setg(errp, "Can't use copy-on-read on read-only device");
1926             ret = -EINVAL;
1927             goto fail_opts;
1928         }
1929     }
1930 
1931     discard = qemu_opt_get(opts, BDRV_OPT_DISCARD);
1932     if (discard != NULL) {
1933         if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
1934             error_setg(errp, "Invalid discard option");
1935             ret = -EINVAL;
1936             goto fail_opts;
1937         }
1938     }
1939 
1940     bs->detect_zeroes =
1941         bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
1942     if (local_err) {
1943         error_propagate(errp, local_err);
1944         ret = -EINVAL;
1945         goto fail_opts;
1946     }
1947 
1948     if (filename != NULL) {
1949         pstrcpy(bs->filename, sizeof(bs->filename), filename);
1950     } else {
1951         bs->filename[0] = '\0';
1952     }
1953     pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), bs->filename);
1954 
1955     /* Open the image, either directly or using a protocol */
1956     open_flags = bdrv_open_flags(bs, bs->open_flags);
1957     node_name = qemu_opt_get(opts, "node-name");
1958 
1959     assert(!drv->bdrv_file_open || file == NULL);
1960     ret = bdrv_open_driver(bs, drv, node_name, options, open_flags, errp);
1961     if (ret < 0) {
1962         goto fail_opts;
1963     }
1964 
1965     qemu_opts_del(opts);
1966     return 0;
1967 
1968 fail_opts:
1969     qemu_opts_del(opts);
1970     return ret;
1971 }
1972 
1973 static QDict *parse_json_filename(const char *filename, Error **errp)
1974 {
1975     QObject *options_obj;
1976     QDict *options;
1977     int ret;
1978     GLOBAL_STATE_CODE();
1979 
1980     ret = strstart(filename, "json:", &filename);
1981     assert(ret);
1982 
1983     options_obj = qobject_from_json(filename, errp);
1984     if (!options_obj) {
1985         error_prepend(errp, "Could not parse the JSON options: ");
1986         return NULL;
1987     }
1988 
1989     options = qobject_to(QDict, options_obj);
1990     if (!options) {
1991         qobject_unref(options_obj);
1992         error_setg(errp, "Invalid JSON object given");
1993         return NULL;
1994     }
1995 
1996     qdict_flatten(options);
1997 
1998     return options;
1999 }
2000 
2001 static void parse_json_protocol(QDict *options, const char **pfilename,
2002                                 Error **errp)
2003 {
2004     QDict *json_options;
2005     Error *local_err = NULL;
2006     GLOBAL_STATE_CODE();
2007 
2008     /* Parse json: pseudo-protocol */
2009     if (!*pfilename || !g_str_has_prefix(*pfilename, "json:")) {
2010         return;
2011     }
2012 
2013     json_options = parse_json_filename(*pfilename, &local_err);
2014     if (local_err) {
2015         error_propagate(errp, local_err);
2016         return;
2017     }
2018 
2019     /* Options given in the filename have lower priority than options
2020      * specified directly */
2021     qdict_join(options, json_options, false);
2022     qobject_unref(json_options);
2023     *pfilename = NULL;
2024 }
2025 
2026 /*
2027  * Fills in default options for opening images and converts the legacy
2028  * filename/flags pair to option QDict entries.
2029  * The BDRV_O_PROTOCOL flag in *flags will be set or cleared accordingly if a
2030  * block driver has been specified explicitly.
2031  */
2032 static int bdrv_fill_options(QDict **options, const char *filename,
2033                              int *flags, Error **errp)
2034 {
2035     const char *drvname;
2036     bool protocol = *flags & BDRV_O_PROTOCOL;
2037     bool parse_filename = false;
2038     BlockDriver *drv = NULL;
2039     Error *local_err = NULL;
2040 
2041     GLOBAL_STATE_CODE();
2042 
2043     /*
2044      * Caution: while qdict_get_try_str() is fine, getting non-string
2045      * types would require more care.  When @options come from
2046      * -blockdev or blockdev_add, its members are typed according to
2047      * the QAPI schema, but when they come from -drive, they're all
2048      * QString.
2049      */
2050     drvname = qdict_get_try_str(*options, "driver");
2051     if (drvname) {
2052         drv = bdrv_find_format(drvname);
2053         if (!drv) {
2054             error_setg(errp, "Unknown driver '%s'", drvname);
2055             return -ENOENT;
2056         }
2057         /* If the user has explicitly specified the driver, this choice should
2058          * override the BDRV_O_PROTOCOL flag */
2059         protocol = drv->bdrv_file_open;
2060     }
2061 
2062     if (protocol) {
2063         *flags |= BDRV_O_PROTOCOL;
2064     } else {
2065         *flags &= ~BDRV_O_PROTOCOL;
2066     }
2067 
2068     /* Translate cache options from flags into options */
2069     update_options_from_flags(*options, *flags);
2070 
2071     /* Fetch the file name from the options QDict if necessary */
2072     if (protocol && filename) {
2073         if (!qdict_haskey(*options, "filename")) {
2074             qdict_put_str(*options, "filename", filename);
2075             parse_filename = true;
2076         } else {
2077             error_setg(errp, "Can't specify 'file' and 'filename' options at "
2078                              "the same time");
2079             return -EINVAL;
2080         }
2081     }
2082 
2083     /* Find the right block driver */
2084     /* See cautionary note on accessing @options above */
2085     filename = qdict_get_try_str(*options, "filename");
2086 
2087     if (!drvname && protocol) {
2088         if (filename) {
2089             drv = bdrv_find_protocol(filename, parse_filename, errp);
2090             if (!drv) {
2091                 return -EINVAL;
2092             }
2093 
2094             drvname = drv->format_name;
2095             qdict_put_str(*options, "driver", drvname);
2096         } else {
2097             error_setg(errp, "Must specify either driver or file");
2098             return -EINVAL;
2099         }
2100     }
2101 
2102     assert(drv || !protocol);
2103 
2104     /* Driver-specific filename parsing */
2105     if (drv && drv->bdrv_parse_filename && parse_filename) {
2106         drv->bdrv_parse_filename(filename, *options, &local_err);
2107         if (local_err) {
2108             error_propagate(errp, local_err);
2109             return -EINVAL;
2110         }
2111 
2112         if (!drv->bdrv_needs_filename) {
2113             qdict_del(*options, "filename");
2114         }
2115     }
2116 
2117     return 0;
2118 }
2119 
2120 typedef struct BlockReopenQueueEntry {
2121      bool prepared;
2122      BDRVReopenState state;
2123      QTAILQ_ENTRY(BlockReopenQueueEntry) entry;
2124 } BlockReopenQueueEntry;
2125 
2126 /*
2127  * Return the flags that @bs will have after the reopens in @q have
2128  * successfully completed. If @q is NULL (or @bs is not contained in @q),
2129  * return the current flags.
2130  */
2131 static int bdrv_reopen_get_flags(BlockReopenQueue *q, BlockDriverState *bs)
2132 {
2133     BlockReopenQueueEntry *entry;
2134 
2135     if (q != NULL) {
2136         QTAILQ_FOREACH(entry, q, entry) {
2137             if (entry->state.bs == bs) {
2138                 return entry->state.flags;
2139             }
2140         }
2141     }
2142 
2143     return bs->open_flags;
2144 }
2145 
2146 /* Returns whether the image file can be written to after the reopen queue @q
2147  * has been successfully applied, or right now if @q is NULL. */
2148 static bool bdrv_is_writable_after_reopen(BlockDriverState *bs,
2149                                           BlockReopenQueue *q)
2150 {
2151     int flags = bdrv_reopen_get_flags(q, bs);
2152 
2153     return (flags & (BDRV_O_RDWR | BDRV_O_INACTIVE)) == BDRV_O_RDWR;
2154 }
2155 
2156 /*
2157  * Return whether the BDS can be written to.  This is not necessarily
2158  * the same as !bdrv_is_read_only(bs), as inactivated images may not
2159  * be written to but do not count as read-only images.
2160  */
2161 bool bdrv_is_writable(BlockDriverState *bs)
2162 {
2163     IO_CODE();
2164     return bdrv_is_writable_after_reopen(bs, NULL);
2165 }
2166 
2167 static char *bdrv_child_user_desc(BdrvChild *c)
2168 {
2169     GLOBAL_STATE_CODE();
2170     return c->klass->get_parent_desc(c);
2171 }
2172 
2173 /*
2174  * Check that @a allows everything that @b needs. @a and @b must reference same
2175  * child node.
2176  */
2177 static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
2178 {
2179     const char *child_bs_name;
2180     g_autofree char *a_user = NULL;
2181     g_autofree char *b_user = NULL;
2182     g_autofree char *perms = NULL;
2183 
2184     assert(a->bs);
2185     assert(a->bs == b->bs);
2186     GLOBAL_STATE_CODE();
2187 
2188     if ((b->perm & a->shared_perm) == b->perm) {
2189         return true;
2190     }
2191 
2192     child_bs_name = bdrv_get_node_name(b->bs);
2193     a_user = bdrv_child_user_desc(a);
2194     b_user = bdrv_child_user_desc(b);
2195     perms = bdrv_perm_names(b->perm & ~a->shared_perm);
2196 
2197     error_setg(errp, "Permission conflict on node '%s': permissions '%s' are "
2198                "both required by %s (uses node '%s' as '%s' child) and "
2199                "unshared by %s (uses node '%s' as '%s' child).",
2200                child_bs_name, perms,
2201                b_user, child_bs_name, b->name,
2202                a_user, child_bs_name, a->name);
2203 
2204     return false;
2205 }
2206 
2207 static bool GRAPH_RDLOCK
2208 bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
2209 {
2210     BdrvChild *a, *b;
2211     GLOBAL_STATE_CODE();
2212 
2213     /*
2214      * During the loop we'll look at each pair twice. That's correct because
2215      * bdrv_a_allow_b() is asymmetric and we should check each pair in both
2216      * directions.
2217      */
2218     QLIST_FOREACH(a, &bs->parents, next_parent) {
2219         QLIST_FOREACH(b, &bs->parents, next_parent) {
2220             if (a == b) {
2221                 continue;
2222             }
2223 
2224             if (!bdrv_a_allow_b(a, b, errp)) {
2225                 return true;
2226             }
2227         }
2228     }
2229 
2230     return false;
2231 }
2232 
2233 static void GRAPH_RDLOCK
2234 bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
2235                 BdrvChild *c, BdrvChildRole role,
2236                 BlockReopenQueue *reopen_queue,
2237                 uint64_t parent_perm, uint64_t parent_shared,
2238                 uint64_t *nperm, uint64_t *nshared)
2239 {
2240     assert(bs->drv && bs->drv->bdrv_child_perm);
2241     GLOBAL_STATE_CODE();
2242     bs->drv->bdrv_child_perm(bs, c, role, reopen_queue,
2243                              parent_perm, parent_shared,
2244                              nperm, nshared);
2245     /* TODO Take force_share from reopen_queue */
2246     if (child_bs && child_bs->force_share) {
2247         *nshared = BLK_PERM_ALL;
2248     }
2249 }
2250 
2251 /*
2252  * Adds the whole subtree of @bs (including @bs itself) to the @list (except for
2253  * nodes that are already in the @list, of course) so that final list is
2254  * topologically sorted. Return the result (GSList @list object is updated, so
2255  * don't use old reference after function call).
2256  *
2257  * On function start @list must be already topologically sorted and for any node
2258  * in the @list the whole subtree of the node must be in the @list as well. The
2259  * simplest way to satisfy this criteria: use only result of
2260  * bdrv_topological_dfs() or NULL as @list parameter.
2261  */
2262 static GSList * GRAPH_RDLOCK
2263 bdrv_topological_dfs(GSList *list, GHashTable *found, BlockDriverState *bs)
2264 {
2265     BdrvChild *child;
2266     g_autoptr(GHashTable) local_found = NULL;
2267 
2268     GLOBAL_STATE_CODE();
2269 
2270     if (!found) {
2271         assert(!list);
2272         found = local_found = g_hash_table_new(NULL, NULL);
2273     }
2274 
2275     if (g_hash_table_contains(found, bs)) {
2276         return list;
2277     }
2278     g_hash_table_add(found, bs);
2279 
2280     QLIST_FOREACH(child, &bs->children, next) {
2281         list = bdrv_topological_dfs(list, found, child->bs);
2282     }
2283 
2284     return g_slist_prepend(list, bs);
2285 }
2286 
2287 typedef struct BdrvChildSetPermState {
2288     BdrvChild *child;
2289     uint64_t old_perm;
2290     uint64_t old_shared_perm;
2291 } BdrvChildSetPermState;
2292 
2293 static void bdrv_child_set_perm_abort(void *opaque)
2294 {
2295     BdrvChildSetPermState *s = opaque;
2296 
2297     GLOBAL_STATE_CODE();
2298 
2299     s->child->perm = s->old_perm;
2300     s->child->shared_perm = s->old_shared_perm;
2301 }
2302 
2303 static TransactionActionDrv bdrv_child_set_pem_drv = {
2304     .abort = bdrv_child_set_perm_abort,
2305     .clean = g_free,
2306 };
2307 
2308 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm,
2309                                 uint64_t shared, Transaction *tran)
2310 {
2311     BdrvChildSetPermState *s = g_new(BdrvChildSetPermState, 1);
2312     GLOBAL_STATE_CODE();
2313 
2314     *s = (BdrvChildSetPermState) {
2315         .child = c,
2316         .old_perm = c->perm,
2317         .old_shared_perm = c->shared_perm,
2318     };
2319 
2320     c->perm = perm;
2321     c->shared_perm = shared;
2322 
2323     tran_add(tran, &bdrv_child_set_pem_drv, s);
2324 }
2325 
2326 static void GRAPH_RDLOCK bdrv_drv_set_perm_commit(void *opaque)
2327 {
2328     BlockDriverState *bs = opaque;
2329     uint64_t cumulative_perms, cumulative_shared_perms;
2330     GLOBAL_STATE_CODE();
2331 
2332     if (bs->drv->bdrv_set_perm) {
2333         bdrv_get_cumulative_perm(bs, &cumulative_perms,
2334                                  &cumulative_shared_perms);
2335         bs->drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
2336     }
2337 }
2338 
2339 static void GRAPH_RDLOCK bdrv_drv_set_perm_abort(void *opaque)
2340 {
2341     BlockDriverState *bs = opaque;
2342     GLOBAL_STATE_CODE();
2343 
2344     if (bs->drv->bdrv_abort_perm_update) {
2345         bs->drv->bdrv_abort_perm_update(bs);
2346     }
2347 }
2348 
2349 TransactionActionDrv bdrv_drv_set_perm_drv = {
2350     .abort = bdrv_drv_set_perm_abort,
2351     .commit = bdrv_drv_set_perm_commit,
2352 };
2353 
2354 /*
2355  * After calling this function, the transaction @tran may only be completed
2356  * while holding a reader lock for the graph.
2357  */
2358 static int GRAPH_RDLOCK
2359 bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared_perm,
2360                   Transaction *tran, Error **errp)
2361 {
2362     GLOBAL_STATE_CODE();
2363     if (!bs->drv) {
2364         return 0;
2365     }
2366 
2367     if (bs->drv->bdrv_check_perm) {
2368         int ret = bs->drv->bdrv_check_perm(bs, perm, shared_perm, errp);
2369         if (ret < 0) {
2370             return ret;
2371         }
2372     }
2373 
2374     if (tran) {
2375         tran_add(tran, &bdrv_drv_set_perm_drv, bs);
2376     }
2377 
2378     return 0;
2379 }
2380 
2381 typedef struct BdrvReplaceChildState {
2382     BdrvChild *child;
2383     BlockDriverState *old_bs;
2384 } BdrvReplaceChildState;
2385 
2386 static void GRAPH_WRLOCK bdrv_replace_child_commit(void *opaque)
2387 {
2388     BdrvReplaceChildState *s = opaque;
2389     GLOBAL_STATE_CODE();
2390 
2391     bdrv_schedule_unref(s->old_bs);
2392 }
2393 
2394 static void GRAPH_WRLOCK bdrv_replace_child_abort(void *opaque)
2395 {
2396     BdrvReplaceChildState *s = opaque;
2397     BlockDriverState *new_bs = s->child->bs;
2398 
2399     GLOBAL_STATE_CODE();
2400     assert_bdrv_graph_writable();
2401 
2402     /* old_bs reference is transparently moved from @s to @s->child */
2403     if (!s->child->bs) {
2404         /*
2405          * The parents were undrained when removing old_bs from the child. New
2406          * requests can't have been made, though, because the child was empty.
2407          *
2408          * TODO Make bdrv_replace_child_noperm() transactionable to avoid
2409          * undraining the parent in the first place. Once this is done, having
2410          * new_bs drained when calling bdrv_replace_child_tran() is not a
2411          * requirement any more.
2412          */
2413         bdrv_parent_drained_begin_single(s->child);
2414         assert(!bdrv_parent_drained_poll_single(s->child));
2415     }
2416     assert(s->child->quiesced_parent);
2417     bdrv_replace_child_noperm(s->child, s->old_bs);
2418 
2419     bdrv_unref(new_bs);
2420 }
2421 
2422 static TransactionActionDrv bdrv_replace_child_drv = {
2423     .commit = bdrv_replace_child_commit,
2424     .abort = bdrv_replace_child_abort,
2425     .clean = g_free,
2426 };
2427 
2428 /*
2429  * bdrv_replace_child_tran
2430  *
2431  * Note: real unref of old_bs is done only on commit.
2432  *
2433  * Both @child->bs and @new_bs (if non-NULL) must be drained. @new_bs must be
2434  * kept drained until the transaction is completed.
2435  *
2436  * After calling this function, the transaction @tran may only be completed
2437  * while holding a writer lock for the graph.
2438  *
2439  * The function doesn't update permissions, caller is responsible for this.
2440  */
2441 static void GRAPH_WRLOCK
2442 bdrv_replace_child_tran(BdrvChild *child, BlockDriverState *new_bs,
2443                         Transaction *tran)
2444 {
2445     BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
2446 
2447     assert(child->quiesced_parent);
2448     assert(!new_bs || new_bs->quiesce_counter);
2449 
2450     *s = (BdrvReplaceChildState) {
2451         .child = child,
2452         .old_bs = child->bs,
2453     };
2454     tran_add(tran, &bdrv_replace_child_drv, s);
2455 
2456     if (new_bs) {
2457         bdrv_ref(new_bs);
2458     }
2459 
2460     bdrv_replace_child_noperm(child, new_bs);
2461     /* old_bs reference is transparently moved from @child to @s */
2462 }
2463 
2464 /*
2465  * Refresh permissions in @bs subtree. The function is intended to be called
2466  * after some graph modification that was done without permission update.
2467  *
2468  * After calling this function, the transaction @tran may only be completed
2469  * while holding a reader lock for the graph.
2470  */
2471 static int GRAPH_RDLOCK
2472 bdrv_node_refresh_perm(BlockDriverState *bs, BlockReopenQueue *q,
2473                        Transaction *tran, Error **errp)
2474 {
2475     BlockDriver *drv = bs->drv;
2476     BdrvChild *c;
2477     int ret;
2478     uint64_t cumulative_perms, cumulative_shared_perms;
2479     GLOBAL_STATE_CODE();
2480 
2481     bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
2482 
2483     /* Write permissions never work with read-only images */
2484     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2485         !bdrv_is_writable_after_reopen(bs, q))
2486     {
2487         if (!bdrv_is_writable_after_reopen(bs, NULL)) {
2488             error_setg(errp, "Block node is read-only");
2489         } else {
2490             error_setg(errp, "Read-only block node '%s' cannot support "
2491                        "read-write users", bdrv_get_node_name(bs));
2492         }
2493 
2494         return -EPERM;
2495     }
2496 
2497     /*
2498      * Unaligned requests will automatically be aligned to bl.request_alignment
2499      * and without RESIZE we can't extend requests to write to space beyond the
2500      * end of the image, so it's required that the image size is aligned.
2501      */
2502     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2503         !(cumulative_perms & BLK_PERM_RESIZE))
2504     {
2505         if ((bs->total_sectors * BDRV_SECTOR_SIZE) % bs->bl.request_alignment) {
2506             error_setg(errp, "Cannot get 'write' permission without 'resize': "
2507                              "Image size is not a multiple of request "
2508                              "alignment");
2509             return -EPERM;
2510         }
2511     }
2512 
2513     /* Check this node */
2514     if (!drv) {
2515         return 0;
2516     }
2517 
2518     ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, tran,
2519                             errp);
2520     if (ret < 0) {
2521         return ret;
2522     }
2523 
2524     /* Drivers that never have children can omit .bdrv_child_perm() */
2525     if (!drv->bdrv_child_perm) {
2526         assert(QLIST_EMPTY(&bs->children));
2527         return 0;
2528     }
2529 
2530     /* Check all children */
2531     QLIST_FOREACH(c, &bs->children, next) {
2532         uint64_t cur_perm, cur_shared;
2533 
2534         bdrv_child_perm(bs, c->bs, c, c->role, q,
2535                         cumulative_perms, cumulative_shared_perms,
2536                         &cur_perm, &cur_shared);
2537         bdrv_child_set_perm(c, cur_perm, cur_shared, tran);
2538     }
2539 
2540     return 0;
2541 }
2542 
2543 /*
2544  * @list is a product of bdrv_topological_dfs() (may be called several times) -
2545  * a topologically sorted subgraph.
2546  *
2547  * After calling this function, the transaction @tran may only be completed
2548  * while holding a reader lock for the graph.
2549  */
2550 static int GRAPH_RDLOCK
2551 bdrv_do_refresh_perms(GSList *list, BlockReopenQueue *q, Transaction *tran,
2552                       Error **errp)
2553 {
2554     int ret;
2555     BlockDriverState *bs;
2556     GLOBAL_STATE_CODE();
2557 
2558     for ( ; list; list = list->next) {
2559         bs = list->data;
2560 
2561         if (bdrv_parent_perms_conflict(bs, errp)) {
2562             return -EINVAL;
2563         }
2564 
2565         ret = bdrv_node_refresh_perm(bs, q, tran, errp);
2566         if (ret < 0) {
2567             return ret;
2568         }
2569     }
2570 
2571     return 0;
2572 }
2573 
2574 /*
2575  * @list is any list of nodes. List is completed by all subtrees and
2576  * topologically sorted. It's not a problem if some node occurs in the @list
2577  * several times.
2578  *
2579  * After calling this function, the transaction @tran may only be completed
2580  * while holding a reader lock for the graph.
2581  */
2582 static int GRAPH_RDLOCK
2583 bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q, Transaction *tran,
2584                         Error **errp)
2585 {
2586     g_autoptr(GHashTable) found = g_hash_table_new(NULL, NULL);
2587     g_autoptr(GSList) refresh_list = NULL;
2588 
2589     for ( ; list; list = list->next) {
2590         refresh_list = bdrv_topological_dfs(refresh_list, found, list->data);
2591     }
2592 
2593     return bdrv_do_refresh_perms(refresh_list, q, tran, errp);
2594 }
2595 
2596 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
2597                               uint64_t *shared_perm)
2598 {
2599     BdrvChild *c;
2600     uint64_t cumulative_perms = 0;
2601     uint64_t cumulative_shared_perms = BLK_PERM_ALL;
2602 
2603     GLOBAL_STATE_CODE();
2604 
2605     QLIST_FOREACH(c, &bs->parents, next_parent) {
2606         cumulative_perms |= c->perm;
2607         cumulative_shared_perms &= c->shared_perm;
2608     }
2609 
2610     *perm = cumulative_perms;
2611     *shared_perm = cumulative_shared_perms;
2612 }
2613 
2614 char *bdrv_perm_names(uint64_t perm)
2615 {
2616     struct perm_name {
2617         uint64_t perm;
2618         const char *name;
2619     } permissions[] = {
2620         { BLK_PERM_CONSISTENT_READ, "consistent read" },
2621         { BLK_PERM_WRITE,           "write" },
2622         { BLK_PERM_WRITE_UNCHANGED, "write unchanged" },
2623         { BLK_PERM_RESIZE,          "resize" },
2624         { 0, NULL }
2625     };
2626 
2627     GString *result = g_string_sized_new(30);
2628     struct perm_name *p;
2629 
2630     for (p = permissions; p->name; p++) {
2631         if (perm & p->perm) {
2632             if (result->len > 0) {
2633                 g_string_append(result, ", ");
2634             }
2635             g_string_append(result, p->name);
2636         }
2637     }
2638 
2639     return g_string_free(result, FALSE);
2640 }
2641 
2642 
2643 /*
2644  * @tran is allowed to be NULL. In this case no rollback is possible.
2645  *
2646  * After calling this function, the transaction @tran may only be completed
2647  * while holding a reader lock for the graph.
2648  */
2649 static int GRAPH_RDLOCK
2650 bdrv_refresh_perms(BlockDriverState *bs, Transaction *tran, Error **errp)
2651 {
2652     int ret;
2653     Transaction *local_tran = NULL;
2654     g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
2655     GLOBAL_STATE_CODE();
2656 
2657     if (!tran) {
2658         tran = local_tran = tran_new();
2659     }
2660 
2661     ret = bdrv_do_refresh_perms(list, NULL, tran, errp);
2662 
2663     if (local_tran) {
2664         tran_finalize(local_tran, ret);
2665     }
2666 
2667     return ret;
2668 }
2669 
2670 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
2671                             Error **errp)
2672 {
2673     Error *local_err = NULL;
2674     Transaction *tran = tran_new();
2675     int ret;
2676 
2677     GLOBAL_STATE_CODE();
2678 
2679     bdrv_child_set_perm(c, perm, shared, tran);
2680 
2681     ret = bdrv_refresh_perms(c->bs, tran, &local_err);
2682 
2683     tran_finalize(tran, ret);
2684 
2685     if (ret < 0) {
2686         if ((perm & ~c->perm) || (c->shared_perm & ~shared)) {
2687             /* tighten permissions */
2688             error_propagate(errp, local_err);
2689         } else {
2690             /*
2691              * Our caller may intend to only loosen restrictions and
2692              * does not expect this function to fail.  Errors are not
2693              * fatal in such a case, so we can just hide them from our
2694              * caller.
2695              */
2696             error_free(local_err);
2697             ret = 0;
2698         }
2699     }
2700 
2701     return ret;
2702 }
2703 
2704 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
2705 {
2706     uint64_t parent_perms, parent_shared;
2707     uint64_t perms, shared;
2708 
2709     GLOBAL_STATE_CODE();
2710 
2711     bdrv_get_cumulative_perm(bs, &parent_perms, &parent_shared);
2712     bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2713                     parent_perms, parent_shared, &perms, &shared);
2714 
2715     return bdrv_child_try_set_perm(c, perms, shared, errp);
2716 }
2717 
2718 /*
2719  * Default implementation for .bdrv_child_perm() for block filters:
2720  * Forward CONSISTENT_READ, WRITE, WRITE_UNCHANGED, and RESIZE to the
2721  * filtered child.
2722  */
2723 static void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
2724                                       BdrvChildRole role,
2725                                       BlockReopenQueue *reopen_queue,
2726                                       uint64_t perm, uint64_t shared,
2727                                       uint64_t *nperm, uint64_t *nshared)
2728 {
2729     GLOBAL_STATE_CODE();
2730     *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
2731     *nshared = (shared & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
2732 }
2733 
2734 static void bdrv_default_perms_for_cow(BlockDriverState *bs, BdrvChild *c,
2735                                        BdrvChildRole role,
2736                                        BlockReopenQueue *reopen_queue,
2737                                        uint64_t perm, uint64_t shared,
2738                                        uint64_t *nperm, uint64_t *nshared)
2739 {
2740     assert(role & BDRV_CHILD_COW);
2741     GLOBAL_STATE_CODE();
2742 
2743     /*
2744      * We want consistent read from backing files if the parent needs it.
2745      * No other operations are performed on backing files.
2746      */
2747     perm &= BLK_PERM_CONSISTENT_READ;
2748 
2749     /*
2750      * If the parent can deal with changing data, we're okay with a
2751      * writable and resizable backing file.
2752      * TODO Require !(perm & BLK_PERM_CONSISTENT_READ), too?
2753      */
2754     if (shared & BLK_PERM_WRITE) {
2755         shared = BLK_PERM_WRITE | BLK_PERM_RESIZE;
2756     } else {
2757         shared = 0;
2758     }
2759 
2760     shared |= BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED;
2761 
2762     if (bs->open_flags & BDRV_O_INACTIVE) {
2763         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2764     }
2765 
2766     *nperm = perm;
2767     *nshared = shared;
2768 }
2769 
2770 static void bdrv_default_perms_for_storage(BlockDriverState *bs, BdrvChild *c,
2771                                            BdrvChildRole role,
2772                                            BlockReopenQueue *reopen_queue,
2773                                            uint64_t perm, uint64_t shared,
2774                                            uint64_t *nperm, uint64_t *nshared)
2775 {
2776     int flags;
2777 
2778     GLOBAL_STATE_CODE();
2779     assert(role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA));
2780 
2781     flags = bdrv_reopen_get_flags(reopen_queue, bs);
2782 
2783     /*
2784      * Apart from the modifications below, the same permissions are
2785      * forwarded and left alone as for filters
2786      */
2787     bdrv_filter_default_perms(bs, c, role, reopen_queue,
2788                               perm, shared, &perm, &shared);
2789 
2790     if (role & BDRV_CHILD_METADATA) {
2791         /* Format drivers may touch metadata even if the guest doesn't write */
2792         if (bdrv_is_writable_after_reopen(bs, reopen_queue)) {
2793             perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2794         }
2795 
2796         /*
2797          * bs->file always needs to be consistent because of the
2798          * metadata. We can never allow other users to resize or write
2799          * to it.
2800          */
2801         if (!(flags & BDRV_O_NO_IO)) {
2802             perm |= BLK_PERM_CONSISTENT_READ;
2803         }
2804         shared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
2805     }
2806 
2807     if (role & BDRV_CHILD_DATA) {
2808         /*
2809          * Technically, everything in this block is a subset of the
2810          * BDRV_CHILD_METADATA path taken above, and so this could
2811          * be an "else if" branch.  However, that is not obvious, and
2812          * this function is not performance critical, therefore we let
2813          * this be an independent "if".
2814          */
2815 
2816         /*
2817          * We cannot allow other users to resize the file because the
2818          * format driver might have some assumptions about the size
2819          * (e.g. because it is stored in metadata, or because the file
2820          * is split into fixed-size data files).
2821          */
2822         shared &= ~BLK_PERM_RESIZE;
2823 
2824         /*
2825          * WRITE_UNCHANGED often cannot be performed as such on the
2826          * data file.  For example, the qcow2 driver may still need to
2827          * write copied clusters on copy-on-read.
2828          */
2829         if (perm & BLK_PERM_WRITE_UNCHANGED) {
2830             perm |= BLK_PERM_WRITE;
2831         }
2832 
2833         /*
2834          * If the data file is written to, the format driver may
2835          * expect to be able to resize it by writing beyond the EOF.
2836          */
2837         if (perm & BLK_PERM_WRITE) {
2838             perm |= BLK_PERM_RESIZE;
2839         }
2840     }
2841 
2842     if (bs->open_flags & BDRV_O_INACTIVE) {
2843         shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2844     }
2845 
2846     *nperm = perm;
2847     *nshared = shared;
2848 }
2849 
2850 void bdrv_default_perms(BlockDriverState *bs, BdrvChild *c,
2851                         BdrvChildRole role, BlockReopenQueue *reopen_queue,
2852                         uint64_t perm, uint64_t shared,
2853                         uint64_t *nperm, uint64_t *nshared)
2854 {
2855     GLOBAL_STATE_CODE();
2856     if (role & BDRV_CHILD_FILTERED) {
2857         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
2858                          BDRV_CHILD_COW)));
2859         bdrv_filter_default_perms(bs, c, role, reopen_queue,
2860                                   perm, shared, nperm, nshared);
2861     } else if (role & BDRV_CHILD_COW) {
2862         assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA)));
2863         bdrv_default_perms_for_cow(bs, c, role, reopen_queue,
2864                                    perm, shared, nperm, nshared);
2865     } else if (role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA)) {
2866         bdrv_default_perms_for_storage(bs, c, role, reopen_queue,
2867                                        perm, shared, nperm, nshared);
2868     } else {
2869         g_assert_not_reached();
2870     }
2871 }
2872 
2873 uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
2874 {
2875     static const uint64_t permissions[] = {
2876         [BLOCK_PERMISSION_CONSISTENT_READ]  = BLK_PERM_CONSISTENT_READ,
2877         [BLOCK_PERMISSION_WRITE]            = BLK_PERM_WRITE,
2878         [BLOCK_PERMISSION_WRITE_UNCHANGED]  = BLK_PERM_WRITE_UNCHANGED,
2879         [BLOCK_PERMISSION_RESIZE]           = BLK_PERM_RESIZE,
2880     };
2881 
2882     QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
2883     QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
2884 
2885     assert(qapi_perm < BLOCK_PERMISSION__MAX);
2886 
2887     return permissions[qapi_perm];
2888 }
2889 
2890 /*
2891  * Replaces the node that a BdrvChild points to without updating permissions.
2892  *
2893  * If @new_bs is non-NULL, the parent of @child must already be drained through
2894  * @child and the caller must hold the AioContext lock for @new_bs.
2895  */
2896 static void GRAPH_WRLOCK
2897 bdrv_replace_child_noperm(BdrvChild *child, BlockDriverState *new_bs)
2898 {
2899     BlockDriverState *old_bs = child->bs;
2900     int new_bs_quiesce_counter;
2901 
2902     assert(!child->frozen);
2903 
2904     /*
2905      * If we want to change the BdrvChild to point to a drained node as its new
2906      * child->bs, we need to make sure that its new parent is drained, too. In
2907      * other words, either child->quiesce_parent must already be true or we must
2908      * be able to set it and keep the parent's quiesce_counter consistent with
2909      * that, but without polling or starting new requests (this function
2910      * guarantees that it doesn't poll, and starting new requests would be
2911      * against the invariants of drain sections).
2912      *
2913      * To keep things simple, we pick the first option (child->quiesce_parent
2914      * must already be true). We also generalise the rule a bit to make it
2915      * easier to verify in callers and more likely to be covered in test cases:
2916      * The parent must be quiesced through this child even if new_bs isn't
2917      * currently drained.
2918      *
2919      * The only exception is for callers that always pass new_bs == NULL. In
2920      * this case, we obviously never need to consider the case of a drained
2921      * new_bs, so we can keep the callers simpler by allowing them not to drain
2922      * the parent.
2923      */
2924     assert(!new_bs || child->quiesced_parent);
2925     assert(old_bs != new_bs);
2926     GLOBAL_STATE_CODE();
2927 
2928     if (old_bs && new_bs) {
2929         assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
2930     }
2931 
2932     if (old_bs) {
2933         if (child->klass->detach) {
2934             child->klass->detach(child);
2935         }
2936         QLIST_REMOVE(child, next_parent);
2937     }
2938 
2939     child->bs = new_bs;
2940 
2941     if (new_bs) {
2942         QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
2943         if (child->klass->attach) {
2944             child->klass->attach(child);
2945         }
2946     }
2947 
2948     /*
2949      * If the parent was drained through this BdrvChild previously, but new_bs
2950      * is not drained, allow requests to come in only after the new node has
2951      * been attached.
2952      */
2953     new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
2954     if (!new_bs_quiesce_counter && child->quiesced_parent) {
2955         bdrv_parent_drained_end_single(child);
2956     }
2957 }
2958 
2959 /**
2960  * Free the given @child.
2961  *
2962  * The child must be empty (i.e. `child->bs == NULL`) and it must be
2963  * unused (i.e. not in a children list).
2964  */
2965 static void bdrv_child_free(BdrvChild *child)
2966 {
2967     assert(!child->bs);
2968     GLOBAL_STATE_CODE();
2969     assert(!child->next.le_prev); /* not in children list */
2970 
2971     g_free(child->name);
2972     g_free(child);
2973 }
2974 
2975 typedef struct BdrvAttachChildCommonState {
2976     BdrvChild *child;
2977     AioContext *old_parent_ctx;
2978     AioContext *old_child_ctx;
2979 } BdrvAttachChildCommonState;
2980 
2981 static void GRAPH_WRLOCK bdrv_attach_child_common_abort(void *opaque)
2982 {
2983     BdrvAttachChildCommonState *s = opaque;
2984     BlockDriverState *bs = s->child->bs;
2985 
2986     GLOBAL_STATE_CODE();
2987     assert_bdrv_graph_writable();
2988 
2989     bdrv_replace_child_noperm(s->child, NULL);
2990 
2991     if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
2992         bdrv_try_change_aio_context(bs, s->old_child_ctx, NULL, &error_abort);
2993     }
2994 
2995     if (bdrv_child_get_parent_aio_context(s->child) != s->old_parent_ctx) {
2996         Transaction *tran;
2997         GHashTable *visited;
2998         bool ret;
2999 
3000         tran = tran_new();
3001 
3002         /* No need to visit `child`, because it has been detached already */
3003         visited = g_hash_table_new(NULL, NULL);
3004         ret = s->child->klass->change_aio_ctx(s->child, s->old_parent_ctx,
3005                                               visited, tran, &error_abort);
3006         g_hash_table_destroy(visited);
3007 
3008         /* transaction is supposed to always succeed */
3009         assert(ret == true);
3010         tran_commit(tran);
3011     }
3012 
3013     bdrv_schedule_unref(bs);
3014     bdrv_child_free(s->child);
3015 }
3016 
3017 static TransactionActionDrv bdrv_attach_child_common_drv = {
3018     .abort = bdrv_attach_child_common_abort,
3019     .clean = g_free,
3020 };
3021 
3022 /*
3023  * Common part of attaching bdrv child to bs or to blk or to job
3024  *
3025  * Function doesn't update permissions, caller is responsible for this.
3026  *
3027  * After calling this function, the transaction @tran may only be completed
3028  * while holding a writer lock for the graph.
3029  *
3030  * Returns new created child.
3031  *
3032  * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
3033  * @child_bs can move to a different AioContext in this function. Callers must
3034  * make sure that their AioContext locking is still correct after this.
3035  */
3036 static BdrvChild * GRAPH_WRLOCK
3037 bdrv_attach_child_common(BlockDriverState *child_bs,
3038                          const char *child_name,
3039                          const BdrvChildClass *child_class,
3040                          BdrvChildRole child_role,
3041                          uint64_t perm, uint64_t shared_perm,
3042                          void *opaque,
3043                          Transaction *tran, Error **errp)
3044 {
3045     BdrvChild *new_child;
3046     AioContext *parent_ctx, *new_child_ctx;
3047     AioContext *child_ctx = bdrv_get_aio_context(child_bs);
3048 
3049     assert(child_class->get_parent_desc);
3050     GLOBAL_STATE_CODE();
3051 
3052     new_child = g_new(BdrvChild, 1);
3053     *new_child = (BdrvChild) {
3054         .bs             = NULL,
3055         .name           = g_strdup(child_name),
3056         .klass          = child_class,
3057         .role           = child_role,
3058         .perm           = perm,
3059         .shared_perm    = shared_perm,
3060         .opaque         = opaque,
3061     };
3062 
3063     /*
3064      * If the AioContexts don't match, first try to move the subtree of
3065      * child_bs into the AioContext of the new parent. If this doesn't work,
3066      * try moving the parent into the AioContext of child_bs instead.
3067      */
3068     parent_ctx = bdrv_child_get_parent_aio_context(new_child);
3069     if (child_ctx != parent_ctx) {
3070         Error *local_err = NULL;
3071         int ret = bdrv_try_change_aio_context(child_bs, parent_ctx, NULL,
3072                                               &local_err);
3073 
3074         if (ret < 0 && child_class->change_aio_ctx) {
3075             Transaction *aio_ctx_tran = tran_new();
3076             GHashTable *visited = g_hash_table_new(NULL, NULL);
3077             bool ret_child;
3078 
3079             g_hash_table_add(visited, new_child);
3080             ret_child = child_class->change_aio_ctx(new_child, child_ctx,
3081                                                     visited, aio_ctx_tran,
3082                                                     NULL);
3083             if (ret_child == true) {
3084                 error_free(local_err);
3085                 ret = 0;
3086             }
3087             tran_finalize(aio_ctx_tran, ret_child == true ? 0 : -1);
3088             g_hash_table_destroy(visited);
3089         }
3090 
3091         if (ret < 0) {
3092             error_propagate(errp, local_err);
3093             bdrv_child_free(new_child);
3094             return NULL;
3095         }
3096     }
3097 
3098     new_child_ctx = bdrv_get_aio_context(child_bs);
3099     if (new_child_ctx != child_ctx) {
3100         aio_context_release(child_ctx);
3101         aio_context_acquire(new_child_ctx);
3102     }
3103 
3104     bdrv_ref(child_bs);
3105     /*
3106      * Let every new BdrvChild start with a drained parent. Inserting the child
3107      * in the graph with bdrv_replace_child_noperm() will undrain it if
3108      * @child_bs is not drained.
3109      *
3110      * The child was only just created and is not yet visible in global state
3111      * until bdrv_replace_child_noperm() inserts it into the graph, so nobody
3112      * could have sent requests and polling is not necessary.
3113      *
3114      * Note that this means that the parent isn't fully drained yet, we only
3115      * stop new requests from coming in. This is fine, we don't care about the
3116      * old requests here, they are not for this child. If another place enters a
3117      * drain section for the same parent, but wants it to be fully quiesced, it
3118      * will not run most of the the code in .drained_begin() again (which is not
3119      * a problem, we already did this), but it will still poll until the parent
3120      * is fully quiesced, so it will not be negatively affected either.
3121      */
3122     bdrv_parent_drained_begin_single(new_child);
3123     bdrv_replace_child_noperm(new_child, child_bs);
3124 
3125     BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
3126     *s = (BdrvAttachChildCommonState) {
3127         .child = new_child,
3128         .old_parent_ctx = parent_ctx,
3129         .old_child_ctx = child_ctx,
3130     };
3131     tran_add(tran, &bdrv_attach_child_common_drv, s);
3132 
3133     if (new_child_ctx != child_ctx) {
3134         aio_context_release(new_child_ctx);
3135         aio_context_acquire(child_ctx);
3136     }
3137 
3138     return new_child;
3139 }
3140 
3141 /*
3142  * Function doesn't update permissions, caller is responsible for this.
3143  *
3144  * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
3145  * @child_bs can move to a different AioContext in this function. Callers must
3146  * make sure that their AioContext locking is still correct after this.
3147  *
3148  * After calling this function, the transaction @tran may only be completed
3149  * while holding a writer lock for the graph.
3150  */
3151 static BdrvChild * GRAPH_WRLOCK
3152 bdrv_attach_child_noperm(BlockDriverState *parent_bs,
3153                          BlockDriverState *child_bs,
3154                          const char *child_name,
3155                          const BdrvChildClass *child_class,
3156                          BdrvChildRole child_role,
3157                          Transaction *tran,
3158                          Error **errp)
3159 {
3160     uint64_t perm, shared_perm;
3161 
3162     assert(parent_bs->drv);
3163     GLOBAL_STATE_CODE();
3164 
3165     if (bdrv_recurse_has_child(child_bs, parent_bs)) {
3166         error_setg(errp, "Making '%s' a %s child of '%s' would create a cycle",
3167                    child_bs->node_name, child_name, parent_bs->node_name);
3168         return NULL;
3169     }
3170 
3171     bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
3172     bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
3173                     perm, shared_perm, &perm, &shared_perm);
3174 
3175     return bdrv_attach_child_common(child_bs, child_name, child_class,
3176                                     child_role, perm, shared_perm, parent_bs,
3177                                     tran, errp);
3178 }
3179 
3180 /*
3181  * This function steals the reference to child_bs from the caller.
3182  * That reference is later dropped by bdrv_root_unref_child().
3183  *
3184  * On failure NULL is returned, errp is set and the reference to
3185  * child_bs is also dropped.
3186  *
3187  * The caller must hold the AioContext lock @child_bs, but not that of @ctx
3188  * (unless @child_bs is already in @ctx).
3189  */
3190 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
3191                                   const char *child_name,
3192                                   const BdrvChildClass *child_class,
3193                                   BdrvChildRole child_role,
3194                                   uint64_t perm, uint64_t shared_perm,
3195                                   void *opaque, Error **errp)
3196 {
3197     int ret;
3198     BdrvChild *child;
3199     Transaction *tran = tran_new();
3200 
3201     GLOBAL_STATE_CODE();
3202 
3203     bdrv_graph_wrlock(child_bs);
3204 
3205     child = bdrv_attach_child_common(child_bs, child_name, child_class,
3206                                    child_role, perm, shared_perm, opaque,
3207                                    tran, errp);
3208     if (!child) {
3209         ret = -EINVAL;
3210         goto out;
3211     }
3212 
3213     ret = bdrv_refresh_perms(child_bs, tran, errp);
3214 
3215 out:
3216     tran_finalize(tran, ret);
3217     bdrv_graph_wrunlock();
3218 
3219     bdrv_unref(child_bs);
3220 
3221     return ret < 0 ? NULL : child;
3222 }
3223 
3224 /*
3225  * This function transfers the reference to child_bs from the caller
3226  * to parent_bs. That reference is later dropped by parent_bs on
3227  * bdrv_close() or if someone calls bdrv_unref_child().
3228  *
3229  * On failure NULL is returned, errp is set and the reference to
3230  * child_bs is also dropped.
3231  *
3232  * If @parent_bs and @child_bs are in different AioContexts, the caller must
3233  * hold the AioContext lock for @child_bs, but not for @parent_bs.
3234  */
3235 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
3236                              BlockDriverState *child_bs,
3237                              const char *child_name,
3238                              const BdrvChildClass *child_class,
3239                              BdrvChildRole child_role,
3240                              Error **errp)
3241 {
3242     int ret;
3243     BdrvChild *child;
3244     Transaction *tran = tran_new();
3245 
3246     GLOBAL_STATE_CODE();
3247 
3248     child = bdrv_attach_child_noperm(parent_bs, child_bs, child_name,
3249                                      child_class, child_role, tran, errp);
3250     if (!child) {
3251         ret = -EINVAL;
3252         goto out;
3253     }
3254 
3255     ret = bdrv_refresh_perms(parent_bs, tran, errp);
3256     if (ret < 0) {
3257         goto out;
3258     }
3259 
3260 out:
3261     tran_finalize(tran, ret);
3262 
3263     bdrv_schedule_unref(child_bs);
3264 
3265     return ret < 0 ? NULL : child;
3266 }
3267 
3268 /* Callers must ensure that child->frozen is false. */
3269 void bdrv_root_unref_child(BdrvChild *child)
3270 {
3271     BlockDriverState *child_bs = child->bs;
3272 
3273     GLOBAL_STATE_CODE();
3274     bdrv_replace_child_noperm(child, NULL);
3275     bdrv_child_free(child);
3276 
3277     if (child_bs) {
3278         /*
3279          * Update permissions for old node. We're just taking a parent away, so
3280          * we're loosening restrictions. Errors of permission update are not
3281          * fatal in this case, ignore them.
3282          */
3283         bdrv_refresh_perms(child_bs, NULL, NULL);
3284 
3285         /*
3286          * When the parent requiring a non-default AioContext is removed, the
3287          * node moves back to the main AioContext
3288          */
3289         bdrv_try_change_aio_context(child_bs, qemu_get_aio_context(), NULL,
3290                                     NULL);
3291     }
3292 
3293     bdrv_schedule_unref(child_bs);
3294 }
3295 
3296 typedef struct BdrvSetInheritsFrom {
3297     BlockDriverState *bs;
3298     BlockDriverState *old_inherits_from;
3299 } BdrvSetInheritsFrom;
3300 
3301 static void bdrv_set_inherits_from_abort(void *opaque)
3302 {
3303     BdrvSetInheritsFrom *s = opaque;
3304 
3305     s->bs->inherits_from = s->old_inherits_from;
3306 }
3307 
3308 static TransactionActionDrv bdrv_set_inherits_from_drv = {
3309     .abort = bdrv_set_inherits_from_abort,
3310     .clean = g_free,
3311 };
3312 
3313 /* @tran is allowed to be NULL. In this case no rollback is possible */
3314 static void bdrv_set_inherits_from(BlockDriverState *bs,
3315                                    BlockDriverState *new_inherits_from,
3316                                    Transaction *tran)
3317 {
3318     if (tran) {
3319         BdrvSetInheritsFrom *s = g_new(BdrvSetInheritsFrom, 1);
3320 
3321         *s = (BdrvSetInheritsFrom) {
3322             .bs = bs,
3323             .old_inherits_from = bs->inherits_from,
3324         };
3325 
3326         tran_add(tran, &bdrv_set_inherits_from_drv, s);
3327     }
3328 
3329     bs->inherits_from = new_inherits_from;
3330 }
3331 
3332 /**
3333  * Clear all inherits_from pointers from children and grandchildren of
3334  * @root that point to @root, where necessary.
3335  * @tran is allowed to be NULL. In this case no rollback is possible
3336  */
3337 static void GRAPH_WRLOCK
3338 bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child,
3339                          Transaction *tran)
3340 {
3341     BdrvChild *c;
3342 
3343     if (child->bs->inherits_from == root) {
3344         /*
3345          * Remove inherits_from only when the last reference between root and
3346          * child->bs goes away.
3347          */
3348         QLIST_FOREACH(c, &root->children, next) {
3349             if (c != child && c->bs == child->bs) {
3350                 break;
3351             }
3352         }
3353         if (c == NULL) {
3354             bdrv_set_inherits_from(child->bs, NULL, tran);
3355         }
3356     }
3357 
3358     QLIST_FOREACH(c, &child->bs->children, next) {
3359         bdrv_unset_inherits_from(root, c, tran);
3360     }
3361 }
3362 
3363 /* Callers must ensure that child->frozen is false. */
3364 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
3365 {
3366     GLOBAL_STATE_CODE();
3367     if (child == NULL) {
3368         return;
3369     }
3370 
3371     bdrv_unset_inherits_from(parent, child, NULL);
3372     bdrv_root_unref_child(child);
3373 }
3374 
3375 
3376 static void GRAPH_RDLOCK
3377 bdrv_parent_cb_change_media(BlockDriverState *bs, bool load)
3378 {
3379     BdrvChild *c;
3380     GLOBAL_STATE_CODE();
3381     QLIST_FOREACH(c, &bs->parents, next_parent) {
3382         if (c->klass->change_media) {
3383             c->klass->change_media(c, load);
3384         }
3385     }
3386 }
3387 
3388 /* Return true if you can reach parent going through child->inherits_from
3389  * recursively. If parent or child are NULL, return false */
3390 static bool bdrv_inherits_from_recursive(BlockDriverState *child,
3391                                          BlockDriverState *parent)
3392 {
3393     while (child && child != parent) {
3394         child = child->inherits_from;
3395     }
3396 
3397     return child != NULL;
3398 }
3399 
3400 /*
3401  * Return the BdrvChildRole for @bs's backing child.  bs->backing is
3402  * mostly used for COW backing children (role = COW), but also for
3403  * filtered children (role = FILTERED | PRIMARY).
3404  */
3405 static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
3406 {
3407     if (bs->drv && bs->drv->is_filter) {
3408         return BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
3409     } else {
3410         return BDRV_CHILD_COW;
3411     }
3412 }
3413 
3414 /*
3415  * Sets the bs->backing or bs->file link of a BDS. A new reference is created;
3416  * callers which don't need their own reference any more must call bdrv_unref().
3417  *
3418  * If the respective child is already present (i.e. we're detaching a node),
3419  * that child node must be drained.
3420  *
3421  * Function doesn't update permissions, caller is responsible for this.
3422  *
3423  * The caller must hold the AioContext lock for @child_bs. Both @parent_bs and
3424  * @child_bs can move to a different AioContext in this function. Callers must
3425  * make sure that their AioContext locking is still correct after this.
3426  *
3427  * After calling this function, the transaction @tran may only be completed
3428  * while holding a writer lock for the graph.
3429  */
3430 static int GRAPH_WRLOCK
3431 bdrv_set_file_or_backing_noperm(BlockDriverState *parent_bs,
3432                                 BlockDriverState *child_bs,
3433                                 bool is_backing,
3434                                 Transaction *tran, Error **errp)
3435 {
3436     bool update_inherits_from =
3437         bdrv_inherits_from_recursive(child_bs, parent_bs);
3438     BdrvChild *child = is_backing ? parent_bs->backing : parent_bs->file;
3439     BdrvChildRole role;
3440 
3441     GLOBAL_STATE_CODE();
3442 
3443     if (!parent_bs->drv) {
3444         /*
3445          * Node without drv is an object without a class :/. TODO: finally fix
3446          * qcow2 driver to never clear bs->drv and implement format corruption
3447          * handling in other way.
3448          */
3449         error_setg(errp, "Node corrupted");
3450         return -EINVAL;
3451     }
3452 
3453     if (child && child->frozen) {
3454         error_setg(errp, "Cannot change frozen '%s' link from '%s' to '%s'",
3455                    child->name, parent_bs->node_name, child->bs->node_name);
3456         return -EPERM;
3457     }
3458 
3459     if (is_backing && !parent_bs->drv->is_filter &&
3460         !parent_bs->drv->supports_backing)
3461     {
3462         error_setg(errp, "Driver '%s' of node '%s' does not support backing "
3463                    "files", parent_bs->drv->format_name, parent_bs->node_name);
3464         return -EINVAL;
3465     }
3466 
3467     if (parent_bs->drv->is_filter) {
3468         role = BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
3469     } else if (is_backing) {
3470         role = BDRV_CHILD_COW;
3471     } else {
3472         /*
3473          * We only can use same role as it is in existing child. We don't have
3474          * infrastructure to determine role of file child in generic way
3475          */
3476         if (!child) {
3477             error_setg(errp, "Cannot set file child to format node without "
3478                        "file child");
3479             return -EINVAL;
3480         }
3481         role = child->role;
3482     }
3483 
3484     if (child) {
3485         assert(child->bs->quiesce_counter);
3486         bdrv_unset_inherits_from(parent_bs, child, tran);
3487         bdrv_remove_child(child, tran);
3488     }
3489 
3490     if (!child_bs) {
3491         goto out;
3492     }
3493 
3494     child = bdrv_attach_child_noperm(parent_bs, child_bs,
3495                                      is_backing ? "backing" : "file",
3496                                      &child_of_bds, role,
3497                                      tran, errp);
3498     if (!child) {
3499         return -EINVAL;
3500     }
3501 
3502 
3503     /*
3504      * If inherits_from pointed recursively to bs then let's update it to
3505      * point directly to bs (else it will become NULL).
3506      */
3507     if (update_inherits_from) {
3508         bdrv_set_inherits_from(child_bs, parent_bs, tran);
3509     }
3510 
3511 out:
3512     bdrv_refresh_limits(parent_bs, tran, NULL);
3513 
3514     return 0;
3515 }
3516 
3517 /*
3518  * The caller must hold the AioContext lock for @backing_hd. Both @bs and
3519  * @backing_hd can move to a different AioContext in this function. Callers must
3520  * make sure that their AioContext locking is still correct after this.
3521  *
3522  * If a backing child is already present (i.e. we're detaching a node), that
3523  * child node must be drained.
3524  *
3525  * After calling this function, the transaction @tran may only be completed
3526  * while holding a writer lock for the graph.
3527  */
3528 static int GRAPH_WRLOCK
3529 bdrv_set_backing_noperm(BlockDriverState *bs,
3530                         BlockDriverState *backing_hd,
3531                         Transaction *tran, Error **errp)
3532 {
3533     GLOBAL_STATE_CODE();
3534     return bdrv_set_file_or_backing_noperm(bs, backing_hd, true, tran, errp);
3535 }
3536 
3537 int bdrv_set_backing_hd_drained(BlockDriverState *bs,
3538                                 BlockDriverState *backing_hd,
3539                                 Error **errp)
3540 {
3541     int ret;
3542     Transaction *tran = tran_new();
3543 
3544     GLOBAL_STATE_CODE();
3545     assert(bs->quiesce_counter > 0);
3546     if (bs->backing) {
3547         assert(bs->backing->bs->quiesce_counter > 0);
3548     }
3549     bdrv_graph_wrlock(backing_hd);
3550 
3551     ret = bdrv_set_backing_noperm(bs, backing_hd, tran, errp);
3552     if (ret < 0) {
3553         goto out;
3554     }
3555 
3556     ret = bdrv_refresh_perms(bs, tran, errp);
3557 out:
3558     tran_finalize(tran, ret);
3559     bdrv_graph_wrunlock();
3560     return ret;
3561 }
3562 
3563 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
3564                         Error **errp)
3565 {
3566     BlockDriverState *drain_bs = bs->backing ? bs->backing->bs : bs;
3567     int ret;
3568     GLOBAL_STATE_CODE();
3569 
3570     bdrv_ref(drain_bs);
3571     bdrv_drained_begin(drain_bs);
3572     ret = bdrv_set_backing_hd_drained(bs, backing_hd, errp);
3573     bdrv_drained_end(drain_bs);
3574     bdrv_unref(drain_bs);
3575 
3576     return ret;
3577 }
3578 
3579 /*
3580  * Opens the backing file for a BlockDriverState if not yet open
3581  *
3582  * bdref_key specifies the key for the image's BlockdevRef in the options QDict.
3583  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3584  * itself, all options starting with "${bdref_key}." are considered part of the
3585  * BlockdevRef.
3586  *
3587  * The caller must hold the main AioContext lock.
3588  *
3589  * TODO Can this be unified with bdrv_open_image()?
3590  */
3591 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
3592                            const char *bdref_key, Error **errp)
3593 {
3594     char *backing_filename = NULL;
3595     char *bdref_key_dot;
3596     const char *reference = NULL;
3597     int ret = 0;
3598     bool implicit_backing = false;
3599     BlockDriverState *backing_hd;
3600     AioContext *backing_hd_ctx;
3601     QDict *options;
3602     QDict *tmp_parent_options = NULL;
3603     Error *local_err = NULL;
3604 
3605     GLOBAL_STATE_CODE();
3606 
3607     if (bs->backing != NULL) {
3608         goto free_exit;
3609     }
3610 
3611     /* NULL means an empty set of options */
3612     if (parent_options == NULL) {
3613         tmp_parent_options = qdict_new();
3614         parent_options = tmp_parent_options;
3615     }
3616 
3617     bs->open_flags &= ~BDRV_O_NO_BACKING;
3618 
3619     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3620     qdict_extract_subqdict(parent_options, &options, bdref_key_dot);
3621     g_free(bdref_key_dot);
3622 
3623     /*
3624      * Caution: while qdict_get_try_str() is fine, getting non-string
3625      * types would require more care.  When @parent_options come from
3626      * -blockdev or blockdev_add, its members are typed according to
3627      * the QAPI schema, but when they come from -drive, they're all
3628      * QString.
3629      */
3630     reference = qdict_get_try_str(parent_options, bdref_key);
3631     if (reference || qdict_haskey(options, "file.filename")) {
3632         /* keep backing_filename NULL */
3633     } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
3634         qobject_unref(options);
3635         goto free_exit;
3636     } else {
3637         if (qdict_size(options) == 0) {
3638             /* If the user specifies options that do not modify the
3639              * backing file's behavior, we might still consider it the
3640              * implicit backing file.  But it's easier this way, and
3641              * just specifying some of the backing BDS's options is
3642              * only possible with -drive anyway (otherwise the QAPI
3643              * schema forces the user to specify everything). */
3644             implicit_backing = !strcmp(bs->auto_backing_file, bs->backing_file);
3645         }
3646 
3647         backing_filename = bdrv_get_full_backing_filename(bs, &local_err);
3648         if (local_err) {
3649             ret = -EINVAL;
3650             error_propagate(errp, local_err);
3651             qobject_unref(options);
3652             goto free_exit;
3653         }
3654     }
3655 
3656     if (!bs->drv || !bs->drv->supports_backing) {
3657         ret = -EINVAL;
3658         error_setg(errp, "Driver doesn't support backing files");
3659         qobject_unref(options);
3660         goto free_exit;
3661     }
3662 
3663     if (!reference &&
3664         bs->backing_format[0] != '\0' && !qdict_haskey(options, "driver")) {
3665         qdict_put_str(options, "driver", bs->backing_format);
3666     }
3667 
3668     backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
3669                                    &child_of_bds, bdrv_backing_role(bs), errp);
3670     if (!backing_hd) {
3671         bs->open_flags |= BDRV_O_NO_BACKING;
3672         error_prepend(errp, "Could not open backing file: ");
3673         ret = -EINVAL;
3674         goto free_exit;
3675     }
3676 
3677     if (implicit_backing) {
3678         bdrv_refresh_filename(backing_hd);
3679         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
3680                 backing_hd->filename);
3681     }
3682 
3683     /* Hook up the backing file link; drop our reference, bs owns the
3684      * backing_hd reference now */
3685     backing_hd_ctx = bdrv_get_aio_context(backing_hd);
3686     aio_context_acquire(backing_hd_ctx);
3687     ret = bdrv_set_backing_hd(bs, backing_hd, errp);
3688     bdrv_unref(backing_hd);
3689     aio_context_release(backing_hd_ctx);
3690 
3691     if (ret < 0) {
3692         goto free_exit;
3693     }
3694 
3695     qdict_del(parent_options, bdref_key);
3696 
3697 free_exit:
3698     g_free(backing_filename);
3699     qobject_unref(tmp_parent_options);
3700     return ret;
3701 }
3702 
3703 static BlockDriverState *
3704 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
3705                    BlockDriverState *parent, const BdrvChildClass *child_class,
3706                    BdrvChildRole child_role, bool allow_none, Error **errp)
3707 {
3708     BlockDriverState *bs = NULL;
3709     QDict *image_options;
3710     char *bdref_key_dot;
3711     const char *reference;
3712 
3713     assert(child_class != NULL);
3714 
3715     bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3716     qdict_extract_subqdict(options, &image_options, bdref_key_dot);
3717     g_free(bdref_key_dot);
3718 
3719     /*
3720      * Caution: while qdict_get_try_str() is fine, getting non-string
3721      * types would require more care.  When @options come from
3722      * -blockdev or blockdev_add, its members are typed according to
3723      * the QAPI schema, but when they come from -drive, they're all
3724      * QString.
3725      */
3726     reference = qdict_get_try_str(options, bdref_key);
3727     if (!filename && !reference && !qdict_size(image_options)) {
3728         if (!allow_none) {
3729             error_setg(errp, "A block device must be specified for \"%s\"",
3730                        bdref_key);
3731         }
3732         qobject_unref(image_options);
3733         goto done;
3734     }
3735 
3736     bs = bdrv_open_inherit(filename, reference, image_options, 0,
3737                            parent, child_class, child_role, errp);
3738     if (!bs) {
3739         goto done;
3740     }
3741 
3742 done:
3743     qdict_del(options, bdref_key);
3744     return bs;
3745 }
3746 
3747 /*
3748  * Opens a disk image whose options are given as BlockdevRef in another block
3749  * device's options.
3750  *
3751  * If allow_none is true, no image will be opened if filename is false and no
3752  * BlockdevRef is given. NULL will be returned, but errp remains unset.
3753  *
3754  * bdrev_key specifies the key for the image's BlockdevRef in the options QDict.
3755  * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3756  * itself, all options starting with "${bdref_key}." are considered part of the
3757  * BlockdevRef.
3758  *
3759  * The BlockdevRef will be removed from the options QDict.
3760  *
3761  * The caller must hold the lock of the main AioContext and no other AioContext.
3762  * @parent can move to a different AioContext in this function. Callers must
3763  * make sure that their AioContext locking is still correct after this.
3764  */
3765 BdrvChild *bdrv_open_child(const char *filename,
3766                            QDict *options, const char *bdref_key,
3767                            BlockDriverState *parent,
3768                            const BdrvChildClass *child_class,
3769                            BdrvChildRole child_role,
3770                            bool allow_none, Error **errp)
3771 {
3772     BlockDriverState *bs;
3773     BdrvChild *child;
3774     AioContext *ctx;
3775 
3776     GLOBAL_STATE_CODE();
3777 
3778     bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
3779                             child_role, allow_none, errp);
3780     if (bs == NULL) {
3781         return NULL;
3782     }
3783 
3784     bdrv_graph_wrlock(NULL);
3785     ctx = bdrv_get_aio_context(bs);
3786     aio_context_acquire(ctx);
3787     child = bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
3788                               errp);
3789     aio_context_release(ctx);
3790     bdrv_graph_wrunlock();
3791 
3792     return child;
3793 }
3794 
3795 /*
3796  * Wrapper on bdrv_open_child() for most popular case: open primary child of bs.
3797  *
3798  * The caller must hold the lock of the main AioContext and no other AioContext.
3799  * @parent can move to a different AioContext in this function. Callers must
3800  * make sure that their AioContext locking is still correct after this.
3801  */
3802 int bdrv_open_file_child(const char *filename,
3803                          QDict *options, const char *bdref_key,
3804                          BlockDriverState *parent, Error **errp)
3805 {
3806     BdrvChildRole role;
3807 
3808     /* commit_top and mirror_top don't use this function */
3809     assert(!parent->drv->filtered_child_is_backing);
3810     role = parent->drv->is_filter ?
3811         (BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY) : BDRV_CHILD_IMAGE;
3812 
3813     if (!bdrv_open_child(filename, options, bdref_key, parent,
3814                          &child_of_bds, role, false, errp))
3815     {
3816         return -EINVAL;
3817     }
3818 
3819     return 0;
3820 }
3821 
3822 /*
3823  * TODO Future callers may need to specify parent/child_class in order for
3824  * option inheritance to work. Existing callers use it for the root node.
3825  */
3826 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
3827 {
3828     BlockDriverState *bs = NULL;
3829     QObject *obj = NULL;
3830     QDict *qdict = NULL;
3831     const char *reference = NULL;
3832     Visitor *v = NULL;
3833 
3834     GLOBAL_STATE_CODE();
3835 
3836     if (ref->type == QTYPE_QSTRING) {
3837         reference = ref->u.reference;
3838     } else {
3839         BlockdevOptions *options = &ref->u.definition;
3840         assert(ref->type == QTYPE_QDICT);
3841 
3842         v = qobject_output_visitor_new(&obj);
3843         visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3844         visit_complete(v, &obj);
3845 
3846         qdict = qobject_to(QDict, obj);
3847         qdict_flatten(qdict);
3848 
3849         /* bdrv_open_inherit() defaults to the values in bdrv_flags (for
3850          * compatibility with other callers) rather than what we want as the
3851          * real defaults. Apply the defaults here instead. */
3852         qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
3853         qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
3854         qdict_set_default_str(qdict, BDRV_OPT_READ_ONLY, "off");
3855         qdict_set_default_str(qdict, BDRV_OPT_AUTO_READ_ONLY, "off");
3856 
3857     }
3858 
3859     bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, errp);
3860     obj = NULL;
3861     qobject_unref(obj);
3862     visit_free(v);
3863     return bs;
3864 }
3865 
3866 static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
3867                                                    int flags,
3868                                                    QDict *snapshot_options,
3869                                                    Error **errp)
3870 {
3871     g_autofree char *tmp_filename = NULL;
3872     int64_t total_size;
3873     QemuOpts *opts = NULL;
3874     BlockDriverState *bs_snapshot = NULL;
3875     AioContext *ctx = bdrv_get_aio_context(bs);
3876     int ret;
3877 
3878     GLOBAL_STATE_CODE();
3879 
3880     /* if snapshot, we create a temporary backing file and open it
3881        instead of opening 'filename' directly */
3882 
3883     /* Get the required size from the image */
3884     aio_context_acquire(ctx);
3885     total_size = bdrv_getlength(bs);
3886     aio_context_release(ctx);
3887 
3888     if (total_size < 0) {
3889         error_setg_errno(errp, -total_size, "Could not get image size");
3890         goto out;
3891     }
3892 
3893     /* Create the temporary image */
3894     tmp_filename = create_tmp_file(errp);
3895     if (!tmp_filename) {
3896         goto out;
3897     }
3898 
3899     opts = qemu_opts_create(bdrv_qcow2.create_opts, NULL, 0,
3900                             &error_abort);
3901     qemu_opt_set_number(opts, BLOCK_OPT_SIZE, total_size, &error_abort);
3902     ret = bdrv_create(&bdrv_qcow2, tmp_filename, opts, errp);
3903     qemu_opts_del(opts);
3904     if (ret < 0) {
3905         error_prepend(errp, "Could not create temporary overlay '%s': ",
3906                       tmp_filename);
3907         goto out;
3908     }
3909 
3910     /* Prepare options QDict for the temporary file */
3911     qdict_put_str(snapshot_options, "file.driver", "file");
3912     qdict_put_str(snapshot_options, "file.filename", tmp_filename);
3913     qdict_put_str(snapshot_options, "driver", "qcow2");
3914 
3915     bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
3916     snapshot_options = NULL;
3917     if (!bs_snapshot) {
3918         goto out;
3919     }
3920 
3921     aio_context_acquire(ctx);
3922     ret = bdrv_append(bs_snapshot, bs, errp);
3923     aio_context_release(ctx);
3924 
3925     if (ret < 0) {
3926         bs_snapshot = NULL;
3927         goto out;
3928     }
3929 
3930 out:
3931     qobject_unref(snapshot_options);
3932     return bs_snapshot;
3933 }
3934 
3935 /*
3936  * Opens a disk image (raw, qcow2, vmdk, ...)
3937  *
3938  * options is a QDict of options to pass to the block drivers, or NULL for an
3939  * empty set of options. The reference to the QDict belongs to the block layer
3940  * after the call (even on failure), so if the caller intends to reuse the
3941  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
3942  *
3943  * If *pbs is NULL, a new BDS will be created with a pointer to it stored there.
3944  * If it is not NULL, the referenced BDS will be reused.
3945  *
3946  * The reference parameter may be used to specify an existing block device which
3947  * should be opened. If specified, neither options nor a filename may be given,
3948  * nor can an existing BDS be reused (that is, *pbs has to be NULL).
3949  *
3950  * The caller must always hold the main AioContext lock.
3951  */
3952 static BlockDriverState * no_coroutine_fn
3953 bdrv_open_inherit(const char *filename, const char *reference, QDict *options,
3954                   int flags, BlockDriverState *parent,
3955                   const BdrvChildClass *child_class, BdrvChildRole child_role,
3956                   Error **errp)
3957 {
3958     int ret;
3959     BlockBackend *file = NULL;
3960     BlockDriverState *bs;
3961     BlockDriver *drv = NULL;
3962     BdrvChild *child;
3963     const char *drvname;
3964     const char *backing;
3965     Error *local_err = NULL;
3966     QDict *snapshot_options = NULL;
3967     int snapshot_flags = 0;
3968     AioContext *ctx = qemu_get_aio_context();
3969 
3970     assert(!child_class || !flags);
3971     assert(!child_class == !parent);
3972     GLOBAL_STATE_CODE();
3973     assert(!qemu_in_coroutine());
3974 
3975     /* TODO We'll eventually have to take a writer lock in this function */
3976     GRAPH_RDLOCK_GUARD_MAINLOOP();
3977 
3978     if (reference) {
3979         bool options_non_empty = options ? qdict_size(options) : false;
3980         qobject_unref(options);
3981 
3982         if (filename || options_non_empty) {
3983             error_setg(errp, "Cannot reference an existing block device with "
3984                        "additional options or a new filename");
3985             return NULL;
3986         }
3987 
3988         bs = bdrv_lookup_bs(reference, reference, errp);
3989         if (!bs) {
3990             return NULL;
3991         }
3992 
3993         bdrv_ref(bs);
3994         return bs;
3995     }
3996 
3997     bs = bdrv_new();
3998 
3999     /* NULL means an empty set of options */
4000     if (options == NULL) {
4001         options = qdict_new();
4002     }
4003 
4004     /* json: syntax counts as explicit options, as if in the QDict */
4005     parse_json_protocol(options, &filename, &local_err);
4006     if (local_err) {
4007         goto fail;
4008     }
4009 
4010     bs->explicit_options = qdict_clone_shallow(options);
4011 
4012     if (child_class) {
4013         bool parent_is_format;
4014 
4015         if (parent->drv) {
4016             parent_is_format = parent->drv->is_format;
4017         } else {
4018             /*
4019              * parent->drv is not set yet because this node is opened for
4020              * (potential) format probing.  That means that @parent is going
4021              * to be a format node.
4022              */
4023             parent_is_format = true;
4024         }
4025 
4026         bs->inherits_from = parent;
4027         child_class->inherit_options(child_role, parent_is_format,
4028                                      &flags, options,
4029                                      parent->open_flags, parent->options);
4030     }
4031 
4032     ret = bdrv_fill_options(&options, filename, &flags, &local_err);
4033     if (ret < 0) {
4034         goto fail;
4035     }
4036 
4037     /*
4038      * Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
4039      * Caution: getting a boolean member of @options requires care.
4040      * When @options come from -blockdev or blockdev_add, members are
4041      * typed according to the QAPI schema, but when they come from
4042      * -drive, they're all QString.
4043      */
4044     if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
4045         !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
4046         flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
4047     } else {
4048         flags &= ~BDRV_O_RDWR;
4049     }
4050 
4051     if (flags & BDRV_O_SNAPSHOT) {
4052         snapshot_options = qdict_new();
4053         bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
4054                                    flags, options);
4055         /* Let bdrv_backing_options() override "read-only" */
4056         qdict_del(options, BDRV_OPT_READ_ONLY);
4057         bdrv_inherited_options(BDRV_CHILD_COW, true,
4058                                &flags, options, flags, options);
4059     }
4060 
4061     bs->open_flags = flags;
4062     bs->options = options;
4063     options = qdict_clone_shallow(options);
4064 
4065     /* Find the right image format driver */
4066     /* See cautionary note on accessing @options above */
4067     drvname = qdict_get_try_str(options, "driver");
4068     if (drvname) {
4069         drv = bdrv_find_format(drvname);
4070         if (!drv) {
4071             error_setg(errp, "Unknown driver: '%s'", drvname);
4072             goto fail;
4073         }
4074     }
4075 
4076     assert(drvname || !(flags & BDRV_O_PROTOCOL));
4077 
4078     /* See cautionary note on accessing @options above */
4079     backing = qdict_get_try_str(options, "backing");
4080     if (qobject_to(QNull, qdict_get(options, "backing")) != NULL ||
4081         (backing && *backing == '\0'))
4082     {
4083         if (backing) {
4084             warn_report("Use of \"backing\": \"\" is deprecated; "
4085                         "use \"backing\": null instead");
4086         }
4087         flags |= BDRV_O_NO_BACKING;
4088         qdict_del(bs->explicit_options, "backing");
4089         qdict_del(bs->options, "backing");
4090         qdict_del(options, "backing");
4091     }
4092 
4093     /* Open image file without format layer. This BlockBackend is only used for
4094      * probing, the block drivers will do their own bdrv_open_child() for the
4095      * same BDS, which is why we put the node name back into options. */
4096     if ((flags & BDRV_O_PROTOCOL) == 0) {
4097         BlockDriverState *file_bs;
4098 
4099         file_bs = bdrv_open_child_bs(filename, options, "file", bs,
4100                                      &child_of_bds, BDRV_CHILD_IMAGE,
4101                                      true, &local_err);
4102         if (local_err) {
4103             goto fail;
4104         }
4105         if (file_bs != NULL) {
4106             /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
4107              * looking at the header to guess the image format. This works even
4108              * in cases where a guest would not see a consistent state. */
4109             ctx = bdrv_get_aio_context(file_bs);
4110             aio_context_acquire(ctx);
4111             file = blk_new(ctx, 0, BLK_PERM_ALL);
4112             blk_insert_bs(file, file_bs, &local_err);
4113             bdrv_unref(file_bs);
4114             aio_context_release(ctx);
4115 
4116             if (local_err) {
4117                 goto fail;
4118             }
4119 
4120             qdict_put_str(options, "file", bdrv_get_node_name(file_bs));
4121         }
4122     }
4123 
4124     /* Image format probing */
4125     bs->probed = !drv;
4126     if (!drv && file) {
4127         ret = find_image_format(file, filename, &drv, &local_err);
4128         if (ret < 0) {
4129             goto fail;
4130         }
4131         /*
4132          * This option update would logically belong in bdrv_fill_options(),
4133          * but we first need to open bs->file for the probing to work, while
4134          * opening bs->file already requires the (mostly) final set of options
4135          * so that cache mode etc. can be inherited.
4136          *
4137          * Adding the driver later is somewhat ugly, but it's not an option
4138          * that would ever be inherited, so it's correct. We just need to make
4139          * sure to update both bs->options (which has the full effective
4140          * options for bs) and options (which has file.* already removed).
4141          */
4142         qdict_put_str(bs->options, "driver", drv->format_name);
4143         qdict_put_str(options, "driver", drv->format_name);
4144     } else if (!drv) {
4145         error_setg(errp, "Must specify either driver or file");
4146         goto fail;
4147     }
4148 
4149     /* BDRV_O_PROTOCOL must be set iff a protocol BDS is about to be created */
4150     assert(!!(flags & BDRV_O_PROTOCOL) == !!drv->bdrv_file_open);
4151     /* file must be NULL if a protocol BDS is about to be created
4152      * (the inverse results in an error message from bdrv_open_common()) */
4153     assert(!(flags & BDRV_O_PROTOCOL) || !file);
4154 
4155     /* Open the image */
4156     ret = bdrv_open_common(bs, file, options, &local_err);
4157     if (ret < 0) {
4158         goto fail;
4159     }
4160 
4161     /* The AioContext could have changed during bdrv_open_common() */
4162     ctx = bdrv_get_aio_context(bs);
4163 
4164     if (file) {
4165         aio_context_acquire(ctx);
4166         blk_unref(file);
4167         aio_context_release(ctx);
4168         file = NULL;
4169     }
4170 
4171     /* If there is a backing file, use it */
4172     if ((flags & BDRV_O_NO_BACKING) == 0) {
4173         ret = bdrv_open_backing_file(bs, options, "backing", &local_err);
4174         if (ret < 0) {
4175             goto close_and_fail;
4176         }
4177     }
4178 
4179     /* Remove all children options and references
4180      * from bs->options and bs->explicit_options */
4181     QLIST_FOREACH(child, &bs->children, next) {
4182         char *child_key_dot;
4183         child_key_dot = g_strdup_printf("%s.", child->name);
4184         qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
4185         qdict_extract_subqdict(bs->options, NULL, child_key_dot);
4186         qdict_del(bs->explicit_options, child->name);
4187         qdict_del(bs->options, child->name);
4188         g_free(child_key_dot);
4189     }
4190 
4191     /* Check if any unknown options were used */
4192     if (qdict_size(options) != 0) {
4193         const QDictEntry *entry = qdict_first(options);
4194         if (flags & BDRV_O_PROTOCOL) {
4195             error_setg(errp, "Block protocol '%s' doesn't support the option "
4196                        "'%s'", drv->format_name, entry->key);
4197         } else {
4198             error_setg(errp,
4199                        "Block format '%s' does not support the option '%s'",
4200                        drv->format_name, entry->key);
4201         }
4202 
4203         goto close_and_fail;
4204     }
4205 
4206     bdrv_parent_cb_change_media(bs, true);
4207 
4208     qobject_unref(options);
4209     options = NULL;
4210 
4211     /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
4212      * temporary snapshot afterwards. */
4213     if (snapshot_flags) {
4214         BlockDriverState *snapshot_bs;
4215         snapshot_bs = bdrv_append_temp_snapshot(bs, snapshot_flags,
4216                                                 snapshot_options, &local_err);
4217         snapshot_options = NULL;
4218         if (local_err) {
4219             goto close_and_fail;
4220         }
4221         /* We are not going to return bs but the overlay on top of it
4222          * (snapshot_bs); thus, we have to drop the strong reference to bs
4223          * (which we obtained by calling bdrv_new()). bs will not be deleted,
4224          * though, because the overlay still has a reference to it. */
4225         aio_context_acquire(ctx);
4226         bdrv_unref(bs);
4227         aio_context_release(ctx);
4228         bs = snapshot_bs;
4229     }
4230 
4231     return bs;
4232 
4233 fail:
4234     aio_context_acquire(ctx);
4235     blk_unref(file);
4236     qobject_unref(snapshot_options);
4237     qobject_unref(bs->explicit_options);
4238     qobject_unref(bs->options);
4239     qobject_unref(options);
4240     bs->options = NULL;
4241     bs->explicit_options = NULL;
4242     bdrv_unref(bs);
4243     aio_context_release(ctx);
4244     error_propagate(errp, local_err);
4245     return NULL;
4246 
4247 close_and_fail:
4248     aio_context_acquire(ctx);
4249     bdrv_unref(bs);
4250     aio_context_release(ctx);
4251     qobject_unref(snapshot_options);
4252     qobject_unref(options);
4253     error_propagate(errp, local_err);
4254     return NULL;
4255 }
4256 
4257 /* The caller must always hold the main AioContext lock. */
4258 BlockDriverState *bdrv_open(const char *filename, const char *reference,
4259                             QDict *options, int flags, Error **errp)
4260 {
4261     GLOBAL_STATE_CODE();
4262 
4263     return bdrv_open_inherit(filename, reference, options, flags, NULL,
4264                              NULL, 0, errp);
4265 }
4266 
4267 /* Return true if the NULL-terminated @list contains @str */
4268 static bool is_str_in_list(const char *str, const char *const *list)
4269 {
4270     if (str && list) {
4271         int i;
4272         for (i = 0; list[i] != NULL; i++) {
4273             if (!strcmp(str, list[i])) {
4274                 return true;
4275             }
4276         }
4277     }
4278     return false;
4279 }
4280 
4281 /*
4282  * Check that every option set in @bs->options is also set in
4283  * @new_opts.
4284  *
4285  * Options listed in the common_options list and in
4286  * @bs->drv->mutable_opts are skipped.
4287  *
4288  * Return 0 on success, otherwise return -EINVAL and set @errp.
4289  */
4290 static int bdrv_reset_options_allowed(BlockDriverState *bs,
4291                                       const QDict *new_opts, Error **errp)
4292 {
4293     const QDictEntry *e;
4294     /* These options are common to all block drivers and are handled
4295      * in bdrv_reopen_prepare() so they can be left out of @new_opts */
4296     const char *const common_options[] = {
4297         "node-name", "discard", "cache.direct", "cache.no-flush",
4298         "read-only", "auto-read-only", "detect-zeroes", NULL
4299     };
4300 
4301     for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
4302         if (!qdict_haskey(new_opts, e->key) &&
4303             !is_str_in_list(e->key, common_options) &&
4304             !is_str_in_list(e->key, bs->drv->mutable_opts)) {
4305             error_setg(errp, "Option '%s' cannot be reset "
4306                        "to its default value", e->key);
4307             return -EINVAL;
4308         }
4309     }
4310 
4311     return 0;
4312 }
4313 
4314 /*
4315  * Returns true if @child can be reached recursively from @bs
4316  */
4317 static bool bdrv_recurse_has_child(BlockDriverState *bs,
4318                                    BlockDriverState *child)
4319 {
4320     BdrvChild *c;
4321 
4322     if (bs == child) {
4323         return true;
4324     }
4325 
4326     QLIST_FOREACH(c, &bs->children, next) {
4327         if (bdrv_recurse_has_child(c->bs, child)) {
4328             return true;
4329         }
4330     }
4331 
4332     return false;
4333 }
4334 
4335 /*
4336  * Adds a BlockDriverState to a simple queue for an atomic, transactional
4337  * reopen of multiple devices.
4338  *
4339  * bs_queue can either be an existing BlockReopenQueue that has had QTAILQ_INIT
4340  * already performed, or alternatively may be NULL a new BlockReopenQueue will
4341  * be created and initialized. This newly created BlockReopenQueue should be
4342  * passed back in for subsequent calls that are intended to be of the same
4343  * atomic 'set'.
4344  *
4345  * bs is the BlockDriverState to add to the reopen queue.
4346  *
4347  * options contains the changed options for the associated bs
4348  * (the BlockReopenQueue takes ownership)
4349  *
4350  * flags contains the open flags for the associated bs
4351  *
4352  * returns a pointer to bs_queue, which is either the newly allocated
4353  * bs_queue, or the existing bs_queue being used.
4354  *
4355  * bs is drained here and undrained by bdrv_reopen_queue_free().
4356  *
4357  * To be called with bs->aio_context locked.
4358  */
4359 static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
4360                                                  BlockDriverState *bs,
4361                                                  QDict *options,
4362                                                  const BdrvChildClass *klass,
4363                                                  BdrvChildRole role,
4364                                                  bool parent_is_format,
4365                                                  QDict *parent_options,
4366                                                  int parent_flags,
4367                                                  bool keep_old_opts)
4368 {
4369     assert(bs != NULL);
4370 
4371     BlockReopenQueueEntry *bs_entry;
4372     BdrvChild *child;
4373     QDict *old_options, *explicit_options, *options_copy;
4374     int flags;
4375     QemuOpts *opts;
4376 
4377     GLOBAL_STATE_CODE();
4378 
4379     bdrv_drained_begin(bs);
4380 
4381     if (bs_queue == NULL) {
4382         bs_queue = g_new0(BlockReopenQueue, 1);
4383         QTAILQ_INIT(bs_queue);
4384     }
4385 
4386     if (!options) {
4387         options = qdict_new();
4388     }
4389 
4390     /* Check if this BlockDriverState is already in the queue */
4391     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4392         if (bs == bs_entry->state.bs) {
4393             break;
4394         }
4395     }
4396 
4397     /*
4398      * Precedence of options:
4399      * 1. Explicitly passed in options (highest)
4400      * 2. Retained from explicitly set options of bs
4401      * 3. Inherited from parent node
4402      * 4. Retained from effective options of bs
4403      */
4404 
4405     /* Old explicitly set values (don't overwrite by inherited value) */
4406     if (bs_entry || keep_old_opts) {
4407         old_options = qdict_clone_shallow(bs_entry ?
4408                                           bs_entry->state.explicit_options :
4409                                           bs->explicit_options);
4410         bdrv_join_options(bs, options, old_options);
4411         qobject_unref(old_options);
4412     }
4413 
4414     explicit_options = qdict_clone_shallow(options);
4415 
4416     /* Inherit from parent node */
4417     if (parent_options) {
4418         flags = 0;
4419         klass->inherit_options(role, parent_is_format, &flags, options,
4420                                parent_flags, parent_options);
4421     } else {
4422         flags = bdrv_get_flags(bs);
4423     }
4424 
4425     if (keep_old_opts) {
4426         /* Old values are used for options that aren't set yet */
4427         old_options = qdict_clone_shallow(bs->options);
4428         bdrv_join_options(bs, options, old_options);
4429         qobject_unref(old_options);
4430     }
4431 
4432     /* We have the final set of options so let's update the flags */
4433     options_copy = qdict_clone_shallow(options);
4434     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
4435     qemu_opts_absorb_qdict(opts, options_copy, NULL);
4436     update_flags_from_options(&flags, opts);
4437     qemu_opts_del(opts);
4438     qobject_unref(options_copy);
4439 
4440     /* bdrv_open_inherit() sets and clears some additional flags internally */
4441     flags &= ~BDRV_O_PROTOCOL;
4442     if (flags & BDRV_O_RDWR) {
4443         flags |= BDRV_O_ALLOW_RDWR;
4444     }
4445 
4446     if (!bs_entry) {
4447         bs_entry = g_new0(BlockReopenQueueEntry, 1);
4448         QTAILQ_INSERT_TAIL(bs_queue, bs_entry, entry);
4449     } else {
4450         qobject_unref(bs_entry->state.options);
4451         qobject_unref(bs_entry->state.explicit_options);
4452     }
4453 
4454     bs_entry->state.bs = bs;
4455     bs_entry->state.options = options;
4456     bs_entry->state.explicit_options = explicit_options;
4457     bs_entry->state.flags = flags;
4458 
4459     /*
4460      * If keep_old_opts is false then it means that unspecified
4461      * options must be reset to their original value. We don't allow
4462      * resetting 'backing' but we need to know if the option is
4463      * missing in order to decide if we have to return an error.
4464      */
4465     if (!keep_old_opts) {
4466         bs_entry->state.backing_missing =
4467             !qdict_haskey(options, "backing") &&
4468             !qdict_haskey(options, "backing.driver");
4469     }
4470 
4471     QLIST_FOREACH(child, &bs->children, next) {
4472         QDict *new_child_options = NULL;
4473         bool child_keep_old = keep_old_opts;
4474 
4475         /* reopen can only change the options of block devices that were
4476          * implicitly created and inherited options. For other (referenced)
4477          * block devices, a syntax like "backing.foo" results in an error. */
4478         if (child->bs->inherits_from != bs) {
4479             continue;
4480         }
4481 
4482         /* Check if the options contain a child reference */
4483         if (qdict_haskey(options, child->name)) {
4484             const char *childref = qdict_get_try_str(options, child->name);
4485             /*
4486              * The current child must not be reopened if the child
4487              * reference is null or points to a different node.
4488              */
4489             if (g_strcmp0(childref, child->bs->node_name)) {
4490                 continue;
4491             }
4492             /*
4493              * If the child reference points to the current child then
4494              * reopen it with its existing set of options (note that
4495              * it can still inherit new options from the parent).
4496              */
4497             child_keep_old = true;
4498         } else {
4499             /* Extract child options ("child-name.*") */
4500             char *child_key_dot = g_strdup_printf("%s.", child->name);
4501             qdict_extract_subqdict(explicit_options, NULL, child_key_dot);
4502             qdict_extract_subqdict(options, &new_child_options, child_key_dot);
4503             g_free(child_key_dot);
4504         }
4505 
4506         bdrv_reopen_queue_child(bs_queue, child->bs, new_child_options,
4507                                 child->klass, child->role, bs->drv->is_format,
4508                                 options, flags, child_keep_old);
4509     }
4510 
4511     return bs_queue;
4512 }
4513 
4514 /* To be called with bs->aio_context locked */
4515 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
4516                                     BlockDriverState *bs,
4517                                     QDict *options, bool keep_old_opts)
4518 {
4519     GLOBAL_STATE_CODE();
4520 
4521     return bdrv_reopen_queue_child(bs_queue, bs, options, NULL, 0, false,
4522                                    NULL, 0, keep_old_opts);
4523 }
4524 
4525 void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
4526 {
4527     GLOBAL_STATE_CODE();
4528     if (bs_queue) {
4529         BlockReopenQueueEntry *bs_entry, *next;
4530         QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
4531             AioContext *ctx = bdrv_get_aio_context(bs_entry->state.bs);
4532 
4533             aio_context_acquire(ctx);
4534             bdrv_drained_end(bs_entry->state.bs);
4535             aio_context_release(ctx);
4536 
4537             qobject_unref(bs_entry->state.explicit_options);
4538             qobject_unref(bs_entry->state.options);
4539             g_free(bs_entry);
4540         }
4541         g_free(bs_queue);
4542     }
4543 }
4544 
4545 /*
4546  * Reopen multiple BlockDriverStates atomically & transactionally.
4547  *
4548  * The queue passed in (bs_queue) must have been built up previous
4549  * via bdrv_reopen_queue().
4550  *
4551  * Reopens all BDS specified in the queue, with the appropriate
4552  * flags.  All devices are prepared for reopen, and failure of any
4553  * device will cause all device changes to be abandoned, and intermediate
4554  * data cleaned up.
4555  *
4556  * If all devices prepare successfully, then the changes are committed
4557  * to all devices.
4558  *
4559  * All affected nodes must be drained between bdrv_reopen_queue() and
4560  * bdrv_reopen_multiple().
4561  *
4562  * To be called from the main thread, with all other AioContexts unlocked.
4563  */
4564 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
4565 {
4566     int ret = -1;
4567     BlockReopenQueueEntry *bs_entry, *next;
4568     AioContext *ctx;
4569     Transaction *tran = tran_new();
4570     g_autoptr(GSList) refresh_list = NULL;
4571 
4572     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
4573     assert(bs_queue != NULL);
4574     GLOBAL_STATE_CODE();
4575 
4576     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4577         ctx = bdrv_get_aio_context(bs_entry->state.bs);
4578         aio_context_acquire(ctx);
4579         ret = bdrv_flush(bs_entry->state.bs);
4580         aio_context_release(ctx);
4581         if (ret < 0) {
4582             error_setg_errno(errp, -ret, "Error flushing drive");
4583             goto abort;
4584         }
4585     }
4586 
4587     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4588         assert(bs_entry->state.bs->quiesce_counter > 0);
4589         ctx = bdrv_get_aio_context(bs_entry->state.bs);
4590         aio_context_acquire(ctx);
4591         ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
4592         aio_context_release(ctx);
4593         if (ret < 0) {
4594             goto abort;
4595         }
4596         bs_entry->prepared = true;
4597     }
4598 
4599     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4600         BDRVReopenState *state = &bs_entry->state;
4601 
4602         refresh_list = g_slist_prepend(refresh_list, state->bs);
4603         if (state->old_backing_bs) {
4604             refresh_list = g_slist_prepend(refresh_list, state->old_backing_bs);
4605         }
4606         if (state->old_file_bs) {
4607             refresh_list = g_slist_prepend(refresh_list, state->old_file_bs);
4608         }
4609     }
4610 
4611     /*
4612      * Note that file-posix driver rely on permission update done during reopen
4613      * (even if no permission changed), because it wants "new" permissions for
4614      * reconfiguring the fd and that's why it does it in raw_check_perm(), not
4615      * in raw_reopen_prepare() which is called with "old" permissions.
4616      */
4617     bdrv_graph_rdlock_main_loop();
4618     ret = bdrv_list_refresh_perms(refresh_list, bs_queue, tran, errp);
4619     bdrv_graph_rdunlock_main_loop();
4620 
4621     if (ret < 0) {
4622         goto abort;
4623     }
4624 
4625     /*
4626      * If we reach this point, we have success and just need to apply the
4627      * changes.
4628      *
4629      * Reverse order is used to comfort qcow2 driver: on commit it need to write
4630      * IN_USE flag to the image, to mark bitmaps in the image as invalid. But
4631      * children are usually goes after parents in reopen-queue, so go from last
4632      * to first element.
4633      */
4634     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
4635         ctx = bdrv_get_aio_context(bs_entry->state.bs);
4636         aio_context_acquire(ctx);
4637         bdrv_reopen_commit(&bs_entry->state);
4638         aio_context_release(ctx);
4639     }
4640 
4641     bdrv_graph_wrlock(NULL);
4642     tran_commit(tran);
4643     bdrv_graph_wrunlock();
4644 
4645     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
4646         BlockDriverState *bs = bs_entry->state.bs;
4647 
4648         if (bs->drv->bdrv_reopen_commit_post) {
4649             ctx = bdrv_get_aio_context(bs);
4650             aio_context_acquire(ctx);
4651             bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
4652             aio_context_release(ctx);
4653         }
4654     }
4655 
4656     ret = 0;
4657     goto cleanup;
4658 
4659 abort:
4660     bdrv_graph_wrlock(NULL);
4661     tran_abort(tran);
4662     bdrv_graph_wrunlock();
4663 
4664     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
4665         if (bs_entry->prepared) {
4666             ctx = bdrv_get_aio_context(bs_entry->state.bs);
4667             aio_context_acquire(ctx);
4668             bdrv_reopen_abort(&bs_entry->state);
4669             aio_context_release(ctx);
4670         }
4671     }
4672 
4673 cleanup:
4674     bdrv_reopen_queue_free(bs_queue);
4675 
4676     return ret;
4677 }
4678 
4679 int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
4680                 Error **errp)
4681 {
4682     AioContext *ctx = bdrv_get_aio_context(bs);
4683     BlockReopenQueue *queue;
4684     int ret;
4685 
4686     GLOBAL_STATE_CODE();
4687 
4688     queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
4689 
4690     if (ctx != qemu_get_aio_context()) {
4691         aio_context_release(ctx);
4692     }
4693     ret = bdrv_reopen_multiple(queue, errp);
4694 
4695     if (ctx != qemu_get_aio_context()) {
4696         aio_context_acquire(ctx);
4697     }
4698 
4699     return ret;
4700 }
4701 
4702 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
4703                               Error **errp)
4704 {
4705     QDict *opts = qdict_new();
4706 
4707     GLOBAL_STATE_CODE();
4708 
4709     qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
4710 
4711     return bdrv_reopen(bs, opts, true, errp);
4712 }
4713 
4714 /*
4715  * Take a BDRVReopenState and check if the value of 'backing' in the
4716  * reopen_state->options QDict is valid or not.
4717  *
4718  * If 'backing' is missing from the QDict then return 0.
4719  *
4720  * If 'backing' contains the node name of the backing file of
4721  * reopen_state->bs then return 0.
4722  *
4723  * If 'backing' contains a different node name (or is null) then check
4724  * whether the current backing file can be replaced with the new one.
4725  * If that's the case then reopen_state->replace_backing_bs is set to
4726  * true and reopen_state->new_backing_bs contains a pointer to the new
4727  * backing BlockDriverState (or NULL).
4728  *
4729  * After calling this function, the transaction @tran may only be completed
4730  * while holding a writer lock for the graph.
4731  *
4732  * Return 0 on success, otherwise return < 0 and set @errp.
4733  *
4734  * The caller must hold the AioContext lock of @reopen_state->bs.
4735  * @reopen_state->bs can move to a different AioContext in this function.
4736  * Callers must make sure that their AioContext locking is still correct after
4737  * this.
4738  */
4739 static int bdrv_reopen_parse_file_or_backing(BDRVReopenState *reopen_state,
4740                                              bool is_backing, Transaction *tran,
4741                                              Error **errp)
4742 {
4743     BlockDriverState *bs = reopen_state->bs;
4744     BlockDriverState *new_child_bs;
4745     BlockDriverState *old_child_bs = is_backing ? child_bs(bs->backing) :
4746                                                   child_bs(bs->file);
4747     const char *child_name = is_backing ? "backing" : "file";
4748     QObject *value;
4749     const char *str;
4750     AioContext *ctx, *old_ctx;
4751     int ret;
4752 
4753     GLOBAL_STATE_CODE();
4754 
4755     value = qdict_get(reopen_state->options, child_name);
4756     if (value == NULL) {
4757         return 0;
4758     }
4759 
4760     switch (qobject_type(value)) {
4761     case QTYPE_QNULL:
4762         assert(is_backing); /* The 'file' option does not allow a null value */
4763         new_child_bs = NULL;
4764         break;
4765     case QTYPE_QSTRING:
4766         str = qstring_get_str(qobject_to(QString, value));
4767         new_child_bs = bdrv_lookup_bs(NULL, str, errp);
4768         if (new_child_bs == NULL) {
4769             return -EINVAL;
4770         } else if (bdrv_recurse_has_child(new_child_bs, bs)) {
4771             error_setg(errp, "Making '%s' a %s child of '%s' would create a "
4772                        "cycle", str, child_name, bs->node_name);
4773             return -EINVAL;
4774         }
4775         break;
4776     default:
4777         /*
4778          * The options QDict has been flattened, so 'backing' and 'file'
4779          * do not allow any other data type here.
4780          */
4781         g_assert_not_reached();
4782     }
4783 
4784     if (old_child_bs == new_child_bs) {
4785         return 0;
4786     }
4787 
4788     if (old_child_bs) {
4789         if (bdrv_skip_implicit_filters(old_child_bs) == new_child_bs) {
4790             return 0;
4791         }
4792 
4793         if (old_child_bs->implicit) {
4794             error_setg(errp, "Cannot replace implicit %s child of %s",
4795                        child_name, bs->node_name);
4796             return -EPERM;
4797         }
4798     }
4799 
4800     if (bs->drv->is_filter && !old_child_bs) {
4801         /*
4802          * Filters always have a file or a backing child, so we are trying to
4803          * change wrong child
4804          */
4805         error_setg(errp, "'%s' is a %s filter node that does not support a "
4806                    "%s child", bs->node_name, bs->drv->format_name, child_name);
4807         return -EINVAL;
4808     }
4809 
4810     if (is_backing) {
4811         reopen_state->old_backing_bs = old_child_bs;
4812     } else {
4813         reopen_state->old_file_bs = old_child_bs;
4814     }
4815 
4816     if (old_child_bs) {
4817         bdrv_ref(old_child_bs);
4818         bdrv_drained_begin(old_child_bs);
4819     }
4820 
4821     old_ctx = bdrv_get_aio_context(bs);
4822     ctx = bdrv_get_aio_context(new_child_bs);
4823     if (old_ctx != ctx) {
4824         aio_context_release(old_ctx);
4825         aio_context_acquire(ctx);
4826     }
4827 
4828     bdrv_graph_wrlock(new_child_bs);
4829 
4830     ret = bdrv_set_file_or_backing_noperm(bs, new_child_bs, is_backing,
4831                                           tran, errp);
4832 
4833     bdrv_graph_wrunlock();
4834 
4835     if (old_ctx != ctx) {
4836         aio_context_release(ctx);
4837         aio_context_acquire(old_ctx);
4838     }
4839 
4840     if (old_child_bs) {
4841         bdrv_drained_end(old_child_bs);
4842         bdrv_unref(old_child_bs);
4843     }
4844 
4845     return ret;
4846 }
4847 
4848 /*
4849  * Prepares a BlockDriverState for reopen. All changes are staged in the
4850  * 'opaque' field of the BDRVReopenState, which is used and allocated by
4851  * the block driver layer .bdrv_reopen_prepare()
4852  *
4853  * bs is the BlockDriverState to reopen
4854  * flags are the new open flags
4855  * queue is the reopen queue
4856  *
4857  * Returns 0 on success, non-zero on error.  On error errp will be set
4858  * as well.
4859  *
4860  * On failure, bdrv_reopen_abort() will be called to clean up any data.
4861  * It is the responsibility of the caller to then call the abort() or
4862  * commit() for any other BDS that have been left in a prepare() state
4863  *
4864  * The caller must hold the AioContext lock of @reopen_state->bs.
4865  *
4866  * After calling this function, the transaction @change_child_tran may only be
4867  * completed while holding a writer lock for the graph.
4868  */
4869 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
4870                                BlockReopenQueue *queue,
4871                                Transaction *change_child_tran, Error **errp)
4872 {
4873     int ret = -1;
4874     int old_flags;
4875     Error *local_err = NULL;
4876     BlockDriver *drv;
4877     QemuOpts *opts;
4878     QDict *orig_reopen_opts;
4879     char *discard = NULL;
4880     bool read_only;
4881     bool drv_prepared = false;
4882 
4883     assert(reopen_state != NULL);
4884     assert(reopen_state->bs->drv != NULL);
4885     GLOBAL_STATE_CODE();
4886     drv = reopen_state->bs->drv;
4887 
4888     /* This function and each driver's bdrv_reopen_prepare() remove
4889      * entries from reopen_state->options as they are processed, so
4890      * we need to make a copy of the original QDict. */
4891     orig_reopen_opts = qdict_clone_shallow(reopen_state->options);
4892 
4893     /* Process generic block layer options */
4894     opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
4895     if (!qemu_opts_absorb_qdict(opts, reopen_state->options, errp)) {
4896         ret = -EINVAL;
4897         goto error;
4898     }
4899 
4900     /* This was already called in bdrv_reopen_queue_child() so the flags
4901      * are up-to-date. This time we simply want to remove the options from
4902      * QemuOpts in order to indicate that they have been processed. */
4903     old_flags = reopen_state->flags;
4904     update_flags_from_options(&reopen_state->flags, opts);
4905     assert(old_flags == reopen_state->flags);
4906 
4907     discard = qemu_opt_get_del(opts, BDRV_OPT_DISCARD);
4908     if (discard != NULL) {
4909         if (bdrv_parse_discard_flags(discard, &reopen_state->flags) != 0) {
4910             error_setg(errp, "Invalid discard option");
4911             ret = -EINVAL;
4912             goto error;
4913         }
4914     }
4915 
4916     reopen_state->detect_zeroes =
4917         bdrv_parse_detect_zeroes(opts, reopen_state->flags, &local_err);
4918     if (local_err) {
4919         error_propagate(errp, local_err);
4920         ret = -EINVAL;
4921         goto error;
4922     }
4923 
4924     /* All other options (including node-name and driver) must be unchanged.
4925      * Put them back into the QDict, so that they are checked at the end
4926      * of this function. */
4927     qemu_opts_to_qdict(opts, reopen_state->options);
4928 
4929     /* If we are to stay read-only, do not allow permission change
4930      * to r/w. Attempting to set to r/w may fail if either BDRV_O_ALLOW_RDWR is
4931      * not set, or if the BDS still has copy_on_read enabled */
4932     read_only = !(reopen_state->flags & BDRV_O_RDWR);
4933     ret = bdrv_can_set_read_only(reopen_state->bs, read_only, true, &local_err);
4934     if (local_err) {
4935         error_propagate(errp, local_err);
4936         goto error;
4937     }
4938 
4939     if (drv->bdrv_reopen_prepare) {
4940         /*
4941          * If a driver-specific option is missing, it means that we
4942          * should reset it to its default value.
4943          * But not all options allow that, so we need to check it first.
4944          */
4945         ret = bdrv_reset_options_allowed(reopen_state->bs,
4946                                          reopen_state->options, errp);
4947         if (ret) {
4948             goto error;
4949         }
4950 
4951         ret = drv->bdrv_reopen_prepare(reopen_state, queue, &local_err);
4952         if (ret) {
4953             if (local_err != NULL) {
4954                 error_propagate(errp, local_err);
4955             } else {
4956                 bdrv_refresh_filename(reopen_state->bs);
4957                 error_setg(errp, "failed while preparing to reopen image '%s'",
4958                            reopen_state->bs->filename);
4959             }
4960             goto error;
4961         }
4962     } else {
4963         /* It is currently mandatory to have a bdrv_reopen_prepare()
4964          * handler for each supported drv. */
4965         error_setg(errp, "Block format '%s' used by node '%s' "
4966                    "does not support reopening files", drv->format_name,
4967                    bdrv_get_device_or_node_name(reopen_state->bs));
4968         ret = -1;
4969         goto error;
4970     }
4971 
4972     drv_prepared = true;
4973 
4974     /*
4975      * We must provide the 'backing' option if the BDS has a backing
4976      * file or if the image file has a backing file name as part of
4977      * its metadata. Otherwise the 'backing' option can be omitted.
4978      */
4979     if (drv->supports_backing && reopen_state->backing_missing &&
4980         (reopen_state->bs->backing || reopen_state->bs->backing_file[0])) {
4981         error_setg(errp, "backing is missing for '%s'",
4982                    reopen_state->bs->node_name);
4983         ret = -EINVAL;
4984         goto error;
4985     }
4986 
4987     /*
4988      * Allow changing the 'backing' option. The new value can be
4989      * either a reference to an existing node (using its node name)
4990      * or NULL to simply detach the current backing file.
4991      */
4992     ret = bdrv_reopen_parse_file_or_backing(reopen_state, true,
4993                                             change_child_tran, errp);
4994     if (ret < 0) {
4995         goto error;
4996     }
4997     qdict_del(reopen_state->options, "backing");
4998 
4999     /* Allow changing the 'file' option. In this case NULL is not allowed */
5000     ret = bdrv_reopen_parse_file_or_backing(reopen_state, false,
5001                                             change_child_tran, errp);
5002     if (ret < 0) {
5003         goto error;
5004     }
5005     qdict_del(reopen_state->options, "file");
5006 
5007     /* Options that are not handled are only okay if they are unchanged
5008      * compared to the old state. It is expected that some options are only
5009      * used for the initial open, but not reopen (e.g. filename) */
5010     if (qdict_size(reopen_state->options)) {
5011         const QDictEntry *entry = qdict_first(reopen_state->options);
5012 
5013         do {
5014             QObject *new = entry->value;
5015             QObject *old = qdict_get(reopen_state->bs->options, entry->key);
5016 
5017             /* Allow child references (child_name=node_name) as long as they
5018              * point to the current child (i.e. everything stays the same). */
5019             if (qobject_type(new) == QTYPE_QSTRING) {
5020                 BdrvChild *child;
5021                 QLIST_FOREACH(child, &reopen_state->bs->children, next) {
5022                     if (!strcmp(child->name, entry->key)) {
5023                         break;
5024                     }
5025                 }
5026 
5027                 if (child) {
5028                     if (!strcmp(child->bs->node_name,
5029                                 qstring_get_str(qobject_to(QString, new)))) {
5030                         continue; /* Found child with this name, skip option */
5031                     }
5032                 }
5033             }
5034 
5035             /*
5036              * TODO: When using -drive to specify blockdev options, all values
5037              * will be strings; however, when using -blockdev, blockdev-add or
5038              * filenames using the json:{} pseudo-protocol, they will be
5039              * correctly typed.
5040              * In contrast, reopening options are (currently) always strings
5041              * (because you can only specify them through qemu-io; all other
5042              * callers do not specify any options).
5043              * Therefore, when using anything other than -drive to create a BDS,
5044              * this cannot detect non-string options as unchanged, because
5045              * qobject_is_equal() always returns false for objects of different
5046              * type.  In the future, this should be remedied by correctly typing
5047              * all options.  For now, this is not too big of an issue because
5048              * the user can simply omit options which cannot be changed anyway,
5049              * so they will stay unchanged.
5050              */
5051             if (!qobject_is_equal(new, old)) {
5052                 error_setg(errp, "Cannot change the option '%s'", entry->key);
5053                 ret = -EINVAL;
5054                 goto error;
5055             }
5056         } while ((entry = qdict_next(reopen_state->options, entry)));
5057     }
5058 
5059     ret = 0;
5060 
5061     /* Restore the original reopen_state->options QDict */
5062     qobject_unref(reopen_state->options);
5063     reopen_state->options = qobject_ref(orig_reopen_opts);
5064 
5065 error:
5066     if (ret < 0 && drv_prepared) {
5067         /* drv->bdrv_reopen_prepare() has succeeded, so we need to
5068          * call drv->bdrv_reopen_abort() before signaling an error
5069          * (bdrv_reopen_multiple() will not call bdrv_reopen_abort()
5070          * when the respective bdrv_reopen_prepare() has failed) */
5071         if (drv->bdrv_reopen_abort) {
5072             drv->bdrv_reopen_abort(reopen_state);
5073         }
5074     }
5075     qemu_opts_del(opts);
5076     qobject_unref(orig_reopen_opts);
5077     g_free(discard);
5078     return ret;
5079 }
5080 
5081 /*
5082  * Takes the staged changes for the reopen from bdrv_reopen_prepare(), and
5083  * makes them final by swapping the staging BlockDriverState contents into
5084  * the active BlockDriverState contents.
5085  */
5086 static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
5087 {
5088     BlockDriver *drv;
5089     BlockDriverState *bs;
5090     BdrvChild *child;
5091 
5092     assert(reopen_state != NULL);
5093     bs = reopen_state->bs;
5094     drv = bs->drv;
5095     assert(drv != NULL);
5096     GLOBAL_STATE_CODE();
5097 
5098     /* If there are any driver level actions to take */
5099     if (drv->bdrv_reopen_commit) {
5100         drv->bdrv_reopen_commit(reopen_state);
5101     }
5102 
5103     /* set BDS specific flags now */
5104     qobject_unref(bs->explicit_options);
5105     qobject_unref(bs->options);
5106     qobject_ref(reopen_state->explicit_options);
5107     qobject_ref(reopen_state->options);
5108 
5109     bs->explicit_options   = reopen_state->explicit_options;
5110     bs->options            = reopen_state->options;
5111     bs->open_flags         = reopen_state->flags;
5112     bs->detect_zeroes      = reopen_state->detect_zeroes;
5113 
5114     /* Remove child references from bs->options and bs->explicit_options.
5115      * Child options were already removed in bdrv_reopen_queue_child() */
5116     QLIST_FOREACH(child, &bs->children, next) {
5117         qdict_del(bs->explicit_options, child->name);
5118         qdict_del(bs->options, child->name);
5119     }
5120     /* backing is probably removed, so it's not handled by previous loop */
5121     qdict_del(bs->explicit_options, "backing");
5122     qdict_del(bs->options, "backing");
5123 
5124     bdrv_graph_rdlock_main_loop();
5125     bdrv_refresh_limits(bs, NULL, NULL);
5126     bdrv_graph_rdunlock_main_loop();
5127     bdrv_refresh_total_sectors(bs, bs->total_sectors);
5128 }
5129 
5130 /*
5131  * Abort the reopen, and delete and free the staged changes in
5132  * reopen_state
5133  */
5134 static void bdrv_reopen_abort(BDRVReopenState *reopen_state)
5135 {
5136     BlockDriver *drv;
5137 
5138     assert(reopen_state != NULL);
5139     drv = reopen_state->bs->drv;
5140     assert(drv != NULL);
5141     GLOBAL_STATE_CODE();
5142 
5143     if (drv->bdrv_reopen_abort) {
5144         drv->bdrv_reopen_abort(reopen_state);
5145     }
5146 }
5147 
5148 
5149 static void bdrv_close(BlockDriverState *bs)
5150 {
5151     BdrvAioNotifier *ban, *ban_next;
5152     BdrvChild *child, *next;
5153 
5154     GLOBAL_STATE_CODE();
5155     assert(!bs->refcnt);
5156 
5157     bdrv_drained_begin(bs); /* complete I/O */
5158     bdrv_flush(bs);
5159     bdrv_drain(bs); /* in case flush left pending I/O */
5160 
5161     if (bs->drv) {
5162         if (bs->drv->bdrv_close) {
5163             /* Must unfreeze all children, so bdrv_unref_child() works */
5164             bs->drv->bdrv_close(bs);
5165         }
5166         bs->drv = NULL;
5167     }
5168 
5169     bdrv_graph_wrlock(NULL);
5170     QLIST_FOREACH_SAFE(child, &bs->children, next, next) {
5171         bdrv_unref_child(bs, child);
5172     }
5173     bdrv_graph_wrunlock();
5174 
5175     assert(!bs->backing);
5176     assert(!bs->file);
5177     g_free(bs->opaque);
5178     bs->opaque = NULL;
5179     qatomic_set(&bs->copy_on_read, 0);
5180     bs->backing_file[0] = '\0';
5181     bs->backing_format[0] = '\0';
5182     bs->total_sectors = 0;
5183     bs->encrypted = false;
5184     bs->sg = false;
5185     qobject_unref(bs->options);
5186     qobject_unref(bs->explicit_options);
5187     bs->options = NULL;
5188     bs->explicit_options = NULL;
5189     qobject_unref(bs->full_open_options);
5190     bs->full_open_options = NULL;
5191     g_free(bs->block_status_cache);
5192     bs->block_status_cache = NULL;
5193 
5194     bdrv_release_named_dirty_bitmaps(bs);
5195     assert(QLIST_EMPTY(&bs->dirty_bitmaps));
5196 
5197     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
5198         g_free(ban);
5199     }
5200     QLIST_INIT(&bs->aio_notifiers);
5201     bdrv_drained_end(bs);
5202 
5203     /*
5204      * If we're still inside some bdrv_drain_all_begin()/end() sections, end
5205      * them now since this BDS won't exist anymore when bdrv_drain_all_end()
5206      * gets called.
5207      */
5208     if (bs->quiesce_counter) {
5209         bdrv_drain_all_end_quiesce(bs);
5210     }
5211 }
5212 
5213 void bdrv_close_all(void)
5214 {
5215     GLOBAL_STATE_CODE();
5216     assert(job_next(NULL) == NULL);
5217 
5218     /* Drop references from requests still in flight, such as canceled block
5219      * jobs whose AIO context has not been polled yet */
5220     bdrv_drain_all();
5221 
5222     blk_remove_all_bs();
5223     blockdev_close_all_bdrv_states();
5224 
5225     assert(QTAILQ_EMPTY(&all_bdrv_states));
5226 }
5227 
5228 static bool GRAPH_RDLOCK should_update_child(BdrvChild *c, BlockDriverState *to)
5229 {
5230     GQueue *queue;
5231     GHashTable *found;
5232     bool ret;
5233 
5234     if (c->klass->stay_at_node) {
5235         return false;
5236     }
5237 
5238     /* If the child @c belongs to the BDS @to, replacing the current
5239      * c->bs by @to would mean to create a loop.
5240      *
5241      * Such a case occurs when appending a BDS to a backing chain.
5242      * For instance, imagine the following chain:
5243      *
5244      *   guest device -> node A -> further backing chain...
5245      *
5246      * Now we create a new BDS B which we want to put on top of this
5247      * chain, so we first attach A as its backing node:
5248      *
5249      *                   node B
5250      *                     |
5251      *                     v
5252      *   guest device -> node A -> further backing chain...
5253      *
5254      * Finally we want to replace A by B.  When doing that, we want to
5255      * replace all pointers to A by pointers to B -- except for the
5256      * pointer from B because (1) that would create a loop, and (2)
5257      * that pointer should simply stay intact:
5258      *
5259      *   guest device -> node B
5260      *                     |
5261      *                     v
5262      *                   node A -> further backing chain...
5263      *
5264      * In general, when replacing a node A (c->bs) by a node B (@to),
5265      * if A is a child of B, that means we cannot replace A by B there
5266      * because that would create a loop.  Silently detaching A from B
5267      * is also not really an option.  So overall just leaving A in
5268      * place there is the most sensible choice.
5269      *
5270      * We would also create a loop in any cases where @c is only
5271      * indirectly referenced by @to. Prevent this by returning false
5272      * if @c is found (by breadth-first search) anywhere in the whole
5273      * subtree of @to.
5274      */
5275 
5276     ret = true;
5277     found = g_hash_table_new(NULL, NULL);
5278     g_hash_table_add(found, to);
5279     queue = g_queue_new();
5280     g_queue_push_tail(queue, to);
5281 
5282     while (!g_queue_is_empty(queue)) {
5283         BlockDriverState *v = g_queue_pop_head(queue);
5284         BdrvChild *c2;
5285 
5286         QLIST_FOREACH(c2, &v->children, next) {
5287             if (c2 == c) {
5288                 ret = false;
5289                 break;
5290             }
5291 
5292             if (g_hash_table_contains(found, c2->bs)) {
5293                 continue;
5294             }
5295 
5296             g_queue_push_tail(queue, c2->bs);
5297             g_hash_table_add(found, c2->bs);
5298         }
5299     }
5300 
5301     g_queue_free(queue);
5302     g_hash_table_destroy(found);
5303 
5304     return ret;
5305 }
5306 
5307 static void bdrv_remove_child_commit(void *opaque)
5308 {
5309     GLOBAL_STATE_CODE();
5310     bdrv_child_free(opaque);
5311 }
5312 
5313 static TransactionActionDrv bdrv_remove_child_drv = {
5314     .commit = bdrv_remove_child_commit,
5315 };
5316 
5317 /*
5318  * Function doesn't update permissions, caller is responsible for this.
5319  *
5320  * @child->bs (if non-NULL) must be drained.
5321  *
5322  * After calling this function, the transaction @tran may only be completed
5323  * while holding a writer lock for the graph.
5324  */
5325 static void GRAPH_WRLOCK bdrv_remove_child(BdrvChild *child, Transaction *tran)
5326 {
5327     if (!child) {
5328         return;
5329     }
5330 
5331     if (child->bs) {
5332         assert(child->quiesced_parent);
5333         bdrv_replace_child_tran(child, NULL, tran);
5334     }
5335 
5336     tran_add(tran, &bdrv_remove_child_drv, child);
5337 }
5338 
5339 /*
5340  * Both @from and @to (if non-NULL) must be drained. @to must be kept drained
5341  * until the transaction is completed.
5342  *
5343  * After calling this function, the transaction @tran may only be completed
5344  * while holding a writer lock for the graph.
5345  */
5346 static int GRAPH_WRLOCK
5347 bdrv_replace_node_noperm(BlockDriverState *from,
5348                          BlockDriverState *to,
5349                          bool auto_skip, Transaction *tran,
5350                          Error **errp)
5351 {
5352     BdrvChild *c, *next;
5353 
5354     GLOBAL_STATE_CODE();
5355 
5356     assert(from->quiesce_counter);
5357     assert(to->quiesce_counter);
5358 
5359     QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
5360         assert(c->bs == from);
5361         if (!should_update_child(c, to)) {
5362             if (auto_skip) {
5363                 continue;
5364             }
5365             error_setg(errp, "Should not change '%s' link to '%s'",
5366                        c->name, from->node_name);
5367             return -EINVAL;
5368         }
5369         if (c->frozen) {
5370             error_setg(errp, "Cannot change '%s' link to '%s'",
5371                        c->name, from->node_name);
5372             return -EPERM;
5373         }
5374         bdrv_replace_child_tran(c, to, tran);
5375     }
5376 
5377     return 0;
5378 }
5379 
5380 /*
5381  * With auto_skip=true bdrv_replace_node_common skips updating from parents
5382  * if it creates a parent-child relation loop or if parent is block-job.
5383  *
5384  * With auto_skip=false the error is returned if from has a parent which should
5385  * not be updated.
5386  *
5387  * With @detach_subchain=true @to must be in a backing chain of @from. In this
5388  * case backing link of the cow-parent of @to is removed.
5389  */
5390 static int bdrv_replace_node_common(BlockDriverState *from,
5391                                     BlockDriverState *to,
5392                                     bool auto_skip, bool detach_subchain,
5393                                     Error **errp)
5394 {
5395     Transaction *tran = tran_new();
5396     g_autoptr(GSList) refresh_list = NULL;
5397     BlockDriverState *to_cow_parent = NULL;
5398     int ret;
5399 
5400     GLOBAL_STATE_CODE();
5401 
5402     if (detach_subchain) {
5403         assert(bdrv_chain_contains(from, to));
5404         assert(from != to);
5405         for (to_cow_parent = from;
5406              bdrv_filter_or_cow_bs(to_cow_parent) != to;
5407              to_cow_parent = bdrv_filter_or_cow_bs(to_cow_parent))
5408         {
5409             ;
5410         }
5411     }
5412 
5413     /* Make sure that @from doesn't go away until we have successfully attached
5414      * all of its parents to @to. */
5415     bdrv_ref(from);
5416 
5417     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
5418     assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
5419     bdrv_drained_begin(from);
5420     bdrv_drained_begin(to);
5421 
5422     bdrv_graph_wrlock(to);
5423 
5424     /*
5425      * Do the replacement without permission update.
5426      * Replacement may influence the permissions, we should calculate new
5427      * permissions based on new graph. If we fail, we'll roll-back the
5428      * replacement.
5429      */
5430     ret = bdrv_replace_node_noperm(from, to, auto_skip, tran, errp);
5431     if (ret < 0) {
5432         goto out;
5433     }
5434 
5435     if (detach_subchain) {
5436         /* to_cow_parent is already drained because from is drained */
5437         bdrv_remove_child(bdrv_filter_or_cow_child(to_cow_parent), tran);
5438     }
5439 
5440     refresh_list = g_slist_prepend(refresh_list, to);
5441     refresh_list = g_slist_prepend(refresh_list, from);
5442 
5443     ret = bdrv_list_refresh_perms(refresh_list, NULL, tran, errp);
5444     if (ret < 0) {
5445         goto out;
5446     }
5447 
5448     ret = 0;
5449 
5450 out:
5451     tran_finalize(tran, ret);
5452     bdrv_graph_wrunlock();
5453 
5454     bdrv_drained_end(to);
5455     bdrv_drained_end(from);
5456     bdrv_unref(from);
5457 
5458     return ret;
5459 }
5460 
5461 int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
5462                       Error **errp)
5463 {
5464     GLOBAL_STATE_CODE();
5465 
5466     return bdrv_replace_node_common(from, to, true, false, errp);
5467 }
5468 
5469 int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
5470 {
5471     GLOBAL_STATE_CODE();
5472 
5473     return bdrv_replace_node_common(bs, bdrv_filter_or_cow_bs(bs), true, true,
5474                                     errp);
5475 }
5476 
5477 /*
5478  * Add new bs contents at the top of an image chain while the chain is
5479  * live, while keeping required fields on the top layer.
5480  *
5481  * This will modify the BlockDriverState fields, and swap contents
5482  * between bs_new and bs_top. Both bs_new and bs_top are modified.
5483  *
5484  * bs_new must not be attached to a BlockBackend and must not have backing
5485  * child.
5486  *
5487  * This function does not create any image files.
5488  *
5489  * The caller must hold the AioContext lock for @bs_top.
5490  */
5491 int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
5492                 Error **errp)
5493 {
5494     int ret;
5495     BdrvChild *child;
5496     Transaction *tran = tran_new();
5497     AioContext *old_context, *new_context = NULL;
5498 
5499     GLOBAL_STATE_CODE();
5500 
5501     assert(!bs_new->backing);
5502 
5503     old_context = bdrv_get_aio_context(bs_top);
5504     bdrv_drained_begin(bs_top);
5505 
5506     /*
5507      * bdrv_drained_begin() requires that only the AioContext of the drained
5508      * node is locked, and at this point it can still differ from the AioContext
5509      * of bs_top.
5510      */
5511     new_context = bdrv_get_aio_context(bs_new);
5512     aio_context_release(old_context);
5513     aio_context_acquire(new_context);
5514     bdrv_drained_begin(bs_new);
5515     aio_context_release(new_context);
5516     aio_context_acquire(old_context);
5517     new_context = NULL;
5518 
5519     bdrv_graph_wrlock(bs_top);
5520 
5521     child = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
5522                                      &child_of_bds, bdrv_backing_role(bs_new),
5523                                      tran, errp);
5524     if (!child) {
5525         ret = -EINVAL;
5526         goto out;
5527     }
5528 
5529     /*
5530      * bdrv_attach_child_noperm could change the AioContext of bs_top and
5531      * bs_new, but at least they are in the same AioContext now. This is the
5532      * AioContext that we need to lock for the rest of the function.
5533      */
5534     new_context = bdrv_get_aio_context(bs_top);
5535 
5536     if (old_context != new_context) {
5537         aio_context_release(old_context);
5538         aio_context_acquire(new_context);
5539     }
5540 
5541     ret = bdrv_replace_node_noperm(bs_top, bs_new, true, tran, errp);
5542     if (ret < 0) {
5543         goto out;
5544     }
5545 
5546     ret = bdrv_refresh_perms(bs_new, tran, errp);
5547 out:
5548     tran_finalize(tran, ret);
5549 
5550     bdrv_refresh_limits(bs_top, NULL, NULL);
5551     bdrv_graph_wrunlock();
5552 
5553     bdrv_drained_end(bs_top);
5554     bdrv_drained_end(bs_new);
5555 
5556     if (new_context && old_context != new_context) {
5557         aio_context_release(new_context);
5558         aio_context_acquire(old_context);
5559     }
5560 
5561     return ret;
5562 }
5563 
5564 /* Not for empty child */
5565 int bdrv_replace_child_bs(BdrvChild *child, BlockDriverState *new_bs,
5566                           Error **errp)
5567 {
5568     int ret;
5569     Transaction *tran = tran_new();
5570     g_autoptr(GSList) refresh_list = NULL;
5571     BlockDriverState *old_bs = child->bs;
5572 
5573     GLOBAL_STATE_CODE();
5574 
5575     bdrv_ref(old_bs);
5576     bdrv_drained_begin(old_bs);
5577     bdrv_drained_begin(new_bs);
5578     bdrv_graph_wrlock(new_bs);
5579 
5580     bdrv_replace_child_tran(child, new_bs, tran);
5581 
5582     refresh_list = g_slist_prepend(refresh_list, old_bs);
5583     refresh_list = g_slist_prepend(refresh_list, new_bs);
5584 
5585     ret = bdrv_list_refresh_perms(refresh_list, NULL, tran, errp);
5586 
5587     tran_finalize(tran, ret);
5588 
5589     bdrv_graph_wrunlock();
5590     bdrv_drained_end(old_bs);
5591     bdrv_drained_end(new_bs);
5592     bdrv_unref(old_bs);
5593 
5594     return ret;
5595 }
5596 
5597 static void bdrv_delete(BlockDriverState *bs)
5598 {
5599     assert(bdrv_op_blocker_is_empty(bs));
5600     assert(!bs->refcnt);
5601     GLOBAL_STATE_CODE();
5602 
5603     /* remove from list, if necessary */
5604     if (bs->node_name[0] != '\0') {
5605         QTAILQ_REMOVE(&graph_bdrv_states, bs, node_list);
5606     }
5607     QTAILQ_REMOVE(&all_bdrv_states, bs, bs_list);
5608 
5609     bdrv_close(bs);
5610 
5611     qemu_mutex_destroy(&bs->reqs_lock);
5612 
5613     g_free(bs);
5614 }
5615 
5616 
5617 /*
5618  * Replace @bs by newly created block node.
5619  *
5620  * @options is a QDict of options to pass to the block drivers, or NULL for an
5621  * empty set of options. The reference to the QDict belongs to the block layer
5622  * after the call (even on failure), so if the caller intends to reuse the
5623  * dictionary, it needs to use qobject_ref() before calling bdrv_open.
5624  *
5625  * The caller holds the AioContext lock for @bs. It must make sure that @bs
5626  * stays in the same AioContext, i.e. @options must not refer to nodes in a
5627  * different AioContext.
5628  */
5629 BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *options,
5630                                    int flags, Error **errp)
5631 {
5632     ERRP_GUARD();
5633     int ret;
5634     AioContext *ctx = bdrv_get_aio_context(bs);
5635     BlockDriverState *new_node_bs = NULL;
5636     const char *drvname, *node_name;
5637     BlockDriver *drv;
5638 
5639     drvname = qdict_get_try_str(options, "driver");
5640     if (!drvname) {
5641         error_setg(errp, "driver is not specified");
5642         goto fail;
5643     }
5644 
5645     drv = bdrv_find_format(drvname);
5646     if (!drv) {
5647         error_setg(errp, "Unknown driver: '%s'", drvname);
5648         goto fail;
5649     }
5650 
5651     node_name = qdict_get_try_str(options, "node-name");
5652 
5653     GLOBAL_STATE_CODE();
5654 
5655     aio_context_release(ctx);
5656     aio_context_acquire(qemu_get_aio_context());
5657     new_node_bs = bdrv_new_open_driver_opts(drv, node_name, options, flags,
5658                                             errp);
5659     aio_context_release(qemu_get_aio_context());
5660     aio_context_acquire(ctx);
5661     assert(bdrv_get_aio_context(bs) == ctx);
5662 
5663     options = NULL; /* bdrv_new_open_driver() eats options */
5664     if (!new_node_bs) {
5665         error_prepend(errp, "Could not create node: ");
5666         goto fail;
5667     }
5668 
5669     bdrv_drained_begin(bs);
5670     ret = bdrv_replace_node(bs, new_node_bs, errp);
5671     bdrv_drained_end(bs);
5672 
5673     if (ret < 0) {
5674         error_prepend(errp, "Could not replace node: ");
5675         goto fail;
5676     }
5677 
5678     return new_node_bs;
5679 
5680 fail:
5681     qobject_unref(options);
5682     bdrv_unref(new_node_bs);
5683     return NULL;
5684 }
5685 
5686 /*
5687  * Run consistency checks on an image
5688  *
5689  * Returns 0 if the check could be completed (it doesn't mean that the image is
5690  * free of errors) or -errno when an internal error occurred. The results of the
5691  * check are stored in res.
5692  */
5693 int coroutine_fn bdrv_co_check(BlockDriverState *bs,
5694                                BdrvCheckResult *res, BdrvCheckMode fix)
5695 {
5696     IO_CODE();
5697     assert_bdrv_graph_readable();
5698     if (bs->drv == NULL) {
5699         return -ENOMEDIUM;
5700     }
5701     if (bs->drv->bdrv_co_check == NULL) {
5702         return -ENOTSUP;
5703     }
5704 
5705     memset(res, 0, sizeof(*res));
5706     return bs->drv->bdrv_co_check(bs, res, fix);
5707 }
5708 
5709 /*
5710  * Return values:
5711  * 0        - success
5712  * -EINVAL  - backing format specified, but no file
5713  * -ENOSPC  - can't update the backing file because no space is left in the
5714  *            image file header
5715  * -ENOTSUP - format driver doesn't support changing the backing file
5716  */
5717 int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
5718                              const char *backing_fmt, bool require)
5719 {
5720     BlockDriver *drv = bs->drv;
5721     int ret;
5722 
5723     GLOBAL_STATE_CODE();
5724 
5725     if (!drv) {
5726         return -ENOMEDIUM;
5727     }
5728 
5729     /* Backing file format doesn't make sense without a backing file */
5730     if (backing_fmt && !backing_file) {
5731         return -EINVAL;
5732     }
5733 
5734     if (require && backing_file && !backing_fmt) {
5735         return -EINVAL;
5736     }
5737 
5738     if (drv->bdrv_change_backing_file != NULL) {
5739         ret = drv->bdrv_change_backing_file(bs, backing_file, backing_fmt);
5740     } else {
5741         ret = -ENOTSUP;
5742     }
5743 
5744     if (ret == 0) {
5745         pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
5746         pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
5747         pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
5748                 backing_file ?: "");
5749     }
5750     return ret;
5751 }
5752 
5753 /*
5754  * Finds the first non-filter node above bs in the chain between
5755  * active and bs.  The returned node is either an immediate parent of
5756  * bs, or there are only filter nodes between the two.
5757  *
5758  * Returns NULL if bs is not found in active's image chain,
5759  * or if active == bs.
5760  *
5761  * Returns the bottommost base image if bs == NULL.
5762  */
5763 BlockDriverState *bdrv_find_overlay(BlockDriverState *active,
5764                                     BlockDriverState *bs)
5765 {
5766 
5767     GLOBAL_STATE_CODE();
5768 
5769     bs = bdrv_skip_filters(bs);
5770     active = bdrv_skip_filters(active);
5771 
5772     while (active) {
5773         BlockDriverState *next = bdrv_backing_chain_next(active);
5774         if (bs == next) {
5775             return active;
5776         }
5777         active = next;
5778     }
5779 
5780     return NULL;
5781 }
5782 
5783 /* Given a BDS, searches for the base layer. */
5784 BlockDriverState *bdrv_find_base(BlockDriverState *bs)
5785 {
5786     GLOBAL_STATE_CODE();
5787 
5788     return bdrv_find_overlay(bs, NULL);
5789 }
5790 
5791 /*
5792  * Return true if at least one of the COW (backing) and filter links
5793  * between @bs and @base is frozen. @errp is set if that's the case.
5794  * @base must be reachable from @bs, or NULL.
5795  */
5796 bool bdrv_is_backing_chain_frozen(BlockDriverState *bs, BlockDriverState *base,
5797                                   Error **errp)
5798 {
5799     BlockDriverState *i;
5800     BdrvChild *child;
5801 
5802     GLOBAL_STATE_CODE();
5803 
5804     for (i = bs; i != base; i = child_bs(child)) {
5805         child = bdrv_filter_or_cow_child(i);
5806 
5807         if (child && child->frozen) {
5808             error_setg(errp, "Cannot change '%s' link from '%s' to '%s'",
5809                        child->name, i->node_name, child->bs->node_name);
5810             return true;
5811         }
5812     }
5813 
5814     return false;
5815 }
5816 
5817 /*
5818  * Freeze all COW (backing) and filter links between @bs and @base.
5819  * If any of the links is already frozen the operation is aborted and
5820  * none of the links are modified.
5821  * @base must be reachable from @bs, or NULL.
5822  * Returns 0 on success. On failure returns < 0 and sets @errp.
5823  */
5824 int bdrv_freeze_backing_chain(BlockDriverState *bs, BlockDriverState *base,
5825                               Error **errp)
5826 {
5827     BlockDriverState *i;
5828     BdrvChild *child;
5829 
5830     GLOBAL_STATE_CODE();
5831 
5832     if (bdrv_is_backing_chain_frozen(bs, base, errp)) {
5833         return -EPERM;
5834     }
5835 
5836     for (i = bs; i != base; i = child_bs(child)) {
5837         child = bdrv_filter_or_cow_child(i);
5838         if (child && child->bs->never_freeze) {
5839             error_setg(errp, "Cannot freeze '%s' link to '%s'",
5840                        child->name, child->bs->node_name);
5841             return -EPERM;
5842         }
5843     }
5844 
5845     for (i = bs; i != base; i = child_bs(child)) {
5846         child = bdrv_filter_or_cow_child(i);
5847         if (child) {
5848             child->frozen = true;
5849         }
5850     }
5851 
5852     return 0;
5853 }
5854 
5855 /*
5856  * Unfreeze all COW (backing) and filter links between @bs and @base.
5857  * The caller must ensure that all links are frozen before using this
5858  * function.
5859  * @base must be reachable from @bs, or NULL.
5860  */
5861 void bdrv_unfreeze_backing_chain(BlockDriverState *bs, BlockDriverState *base)
5862 {
5863     BlockDriverState *i;
5864     BdrvChild *child;
5865 
5866     GLOBAL_STATE_CODE();
5867 
5868     for (i = bs; i != base; i = child_bs(child)) {
5869         child = bdrv_filter_or_cow_child(i);
5870         if (child) {
5871             assert(child->frozen);
5872             child->frozen = false;
5873         }
5874     }
5875 }
5876 
5877 /*
5878  * Drops images above 'base' up to and including 'top', and sets the image
5879  * above 'top' to have base as its backing file.
5880  *
5881  * Requires that the overlay to 'top' is opened r/w, so that the backing file
5882  * information in 'bs' can be properly updated.
5883  *
5884  * E.g., this will convert the following chain:
5885  * bottom <- base <- intermediate <- top <- active
5886  *
5887  * to
5888  *
5889  * bottom <- base <- active
5890  *
5891  * It is allowed for bottom==base, in which case it converts:
5892  *
5893  * base <- intermediate <- top <- active
5894  *
5895  * to
5896  *
5897  * base <- active
5898  *
5899  * If backing_file_str is non-NULL, it will be used when modifying top's
5900  * overlay image metadata.
5901  *
5902  * Error conditions:
5903  *  if active == top, that is considered an error
5904  *
5905  */
5906 int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
5907                            const char *backing_file_str)
5908 {
5909     BlockDriverState *explicit_top = top;
5910     bool update_inherits_from;
5911     BdrvChild *c;
5912     Error *local_err = NULL;
5913     int ret = -EIO;
5914     g_autoptr(GSList) updated_children = NULL;
5915     GSList *p;
5916 
5917     GLOBAL_STATE_CODE();
5918 
5919     bdrv_ref(top);
5920     bdrv_drained_begin(base);
5921 
5922     if (!top->drv || !base->drv) {
5923         goto exit;
5924     }
5925 
5926     /* Make sure that base is in the backing chain of top */
5927     if (!bdrv_chain_contains(top, base)) {
5928         goto exit;
5929     }
5930 
5931     /* If 'base' recursively inherits from 'top' then we should set
5932      * base->inherits_from to top->inherits_from after 'top' and all
5933      * other intermediate nodes have been dropped.
5934      * If 'top' is an implicit node (e.g. "commit_top") we should skip
5935      * it because no one inherits from it. We use explicit_top for that. */
5936     explicit_top = bdrv_skip_implicit_filters(explicit_top);
5937     update_inherits_from = bdrv_inherits_from_recursive(base, explicit_top);
5938 
5939     /* success - we can delete the intermediate states, and link top->base */
5940     if (!backing_file_str) {
5941         bdrv_refresh_filename(base);
5942         backing_file_str = base->filename;
5943     }
5944 
5945     bdrv_graph_rdlock_main_loop();
5946     QLIST_FOREACH(c, &top->parents, next_parent) {
5947         updated_children = g_slist_prepend(updated_children, c);
5948     }
5949     bdrv_graph_rdunlock_main_loop();
5950 
5951     /*
5952      * It seems correct to pass detach_subchain=true here, but it triggers
5953      * one more yet not fixed bug, when due to nested aio_poll loop we switch to
5954      * another drained section, which modify the graph (for example, removing
5955      * the child, which we keep in updated_children list). So, it's a TODO.
5956      *
5957      * Note, bug triggered if pass detach_subchain=true here and run
5958      * test-bdrv-drain. test_drop_intermediate_poll() test-case will crash.
5959      * That's a FIXME.
5960      */
5961     bdrv_replace_node_common(top, base, false, false, &local_err);
5962     if (local_err) {
5963         error_report_err(local_err);
5964         goto exit;
5965     }
5966 
5967     for (p = updated_children; p; p = p->next) {
5968         c = p->data;
5969 
5970         if (c->klass->update_filename) {
5971             ret = c->klass->update_filename(c, base, backing_file_str,
5972                                             &local_err);
5973             if (ret < 0) {
5974                 /*
5975                  * TODO: Actually, we want to rollback all previous iterations
5976                  * of this loop, and (which is almost impossible) previous
5977                  * bdrv_replace_node()...
5978                  *
5979                  * Note, that c->klass->update_filename may lead to permission
5980                  * update, so it's a bad idea to call it inside permission
5981                  * update transaction of bdrv_replace_node.
5982                  */
5983                 error_report_err(local_err);
5984                 goto exit;
5985             }
5986         }
5987     }
5988 
5989     if (update_inherits_from) {
5990         base->inherits_from = explicit_top->inherits_from;
5991     }
5992 
5993     ret = 0;
5994 exit:
5995     bdrv_drained_end(base);
5996     bdrv_unref(top);
5997     return ret;
5998 }
5999 
6000 /**
6001  * Implementation of BlockDriver.bdrv_co_get_allocated_file_size() that
6002  * sums the size of all data-bearing children.  (This excludes backing
6003  * children.)
6004  */
6005 static int64_t coroutine_fn GRAPH_RDLOCK
6006 bdrv_sum_allocated_file_size(BlockDriverState *bs)
6007 {
6008     BdrvChild *child;
6009     int64_t child_size, sum = 0;
6010 
6011     QLIST_FOREACH(child, &bs->children, next) {
6012         if (child->role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
6013                            BDRV_CHILD_FILTERED))
6014         {
6015             child_size = bdrv_co_get_allocated_file_size(child->bs);
6016             if (child_size < 0) {
6017                 return child_size;
6018             }
6019             sum += child_size;
6020         }
6021     }
6022 
6023     return sum;
6024 }
6025 
6026 /**
6027  * Length of a allocated file in bytes. Sparse files are counted by actual
6028  * allocated space. Return < 0 if error or unknown.
6029  */
6030 int64_t coroutine_fn bdrv_co_get_allocated_file_size(BlockDriverState *bs)
6031 {
6032     BlockDriver *drv = bs->drv;
6033     IO_CODE();
6034     assert_bdrv_graph_readable();
6035 
6036     if (!drv) {
6037         return -ENOMEDIUM;
6038     }
6039     if (drv->bdrv_co_get_allocated_file_size) {
6040         return drv->bdrv_co_get_allocated_file_size(bs);
6041     }
6042 
6043     if (drv->bdrv_file_open) {
6044         /*
6045          * Protocol drivers default to -ENOTSUP (most of their data is
6046          * not stored in any of their children (if they even have any),
6047          * so there is no generic way to figure it out).
6048          */
6049         return -ENOTSUP;
6050     } else if (drv->is_filter) {
6051         /* Filter drivers default to the size of their filtered child */
6052         return bdrv_co_get_allocated_file_size(bdrv_filter_bs(bs));
6053     } else {
6054         /* Other drivers default to summing their children's sizes */
6055         return bdrv_sum_allocated_file_size(bs);
6056     }
6057 }
6058 
6059 /*
6060  * bdrv_measure:
6061  * @drv: Format driver
6062  * @opts: Creation options for new image
6063  * @in_bs: Existing image containing data for new image (may be NULL)
6064  * @errp: Error object
6065  * Returns: A #BlockMeasureInfo (free using qapi_free_BlockMeasureInfo())
6066  *          or NULL on error
6067  *
6068  * Calculate file size required to create a new image.
6069  *
6070  * If @in_bs is given then space for allocated clusters and zero clusters
6071  * from that image are included in the calculation.  If @opts contains a
6072  * backing file that is shared by @in_bs then backing clusters may be omitted
6073  * from the calculation.
6074  *
6075  * If @in_bs is NULL then the calculation includes no allocated clusters
6076  * unless a preallocation option is given in @opts.
6077  *
6078  * Note that @in_bs may use a different BlockDriver from @drv.
6079  *
6080  * If an error occurs the @errp pointer is set.
6081  */
6082 BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
6083                                BlockDriverState *in_bs, Error **errp)
6084 {
6085     IO_CODE();
6086     if (!drv->bdrv_measure) {
6087         error_setg(errp, "Block driver '%s' does not support size measurement",
6088                    drv->format_name);
6089         return NULL;
6090     }
6091 
6092     return drv->bdrv_measure(opts, in_bs, errp);
6093 }
6094 
6095 /**
6096  * Return number of sectors on success, -errno on error.
6097  */
6098 int64_t coroutine_fn bdrv_co_nb_sectors(BlockDriverState *bs)
6099 {
6100     BlockDriver *drv = bs->drv;
6101     IO_CODE();
6102     assert_bdrv_graph_readable();
6103 
6104     if (!drv)
6105         return -ENOMEDIUM;
6106 
6107     if (bs->bl.has_variable_length) {
6108         int ret = bdrv_co_refresh_total_sectors(bs, bs->total_sectors);
6109         if (ret < 0) {
6110             return ret;
6111         }
6112     }
6113     return bs->total_sectors;
6114 }
6115 
6116 /*
6117  * This wrapper is written by hand because this function is in the hot I/O path,
6118  * via blk_get_geometry.
6119  */
6120 int64_t coroutine_mixed_fn bdrv_nb_sectors(BlockDriverState *bs)
6121 {
6122     BlockDriver *drv = bs->drv;
6123     IO_CODE();
6124 
6125     if (!drv)
6126         return -ENOMEDIUM;
6127 
6128     if (bs->bl.has_variable_length) {
6129         int ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
6130         if (ret < 0) {
6131             return ret;
6132         }
6133     }
6134 
6135     return bs->total_sectors;
6136 }
6137 
6138 /**
6139  * Return length in bytes on success, -errno on error.
6140  * The length is always a multiple of BDRV_SECTOR_SIZE.
6141  */
6142 int64_t coroutine_fn bdrv_co_getlength(BlockDriverState *bs)
6143 {
6144     int64_t ret;
6145     IO_CODE();
6146     assert_bdrv_graph_readable();
6147 
6148     ret = bdrv_co_nb_sectors(bs);
6149     if (ret < 0) {
6150         return ret;
6151     }
6152     if (ret > INT64_MAX / BDRV_SECTOR_SIZE) {
6153         return -EFBIG;
6154     }
6155     return ret * BDRV_SECTOR_SIZE;
6156 }
6157 
6158 bool bdrv_is_sg(BlockDriverState *bs)
6159 {
6160     IO_CODE();
6161     return bs->sg;
6162 }
6163 
6164 /**
6165  * Return whether the given node supports compressed writes.
6166  */
6167 bool bdrv_supports_compressed_writes(BlockDriverState *bs)
6168 {
6169     BlockDriverState *filtered;
6170     IO_CODE();
6171 
6172     if (!bs->drv || !block_driver_can_compress(bs->drv)) {
6173         return false;
6174     }
6175 
6176     filtered = bdrv_filter_bs(bs);
6177     if (filtered) {
6178         /*
6179          * Filters can only forward compressed writes, so we have to
6180          * check the child.
6181          */
6182         return bdrv_supports_compressed_writes(filtered);
6183     }
6184 
6185     return true;
6186 }
6187 
6188 const char *bdrv_get_format_name(BlockDriverState *bs)
6189 {
6190     IO_CODE();
6191     return bs->drv ? bs->drv->format_name : NULL;
6192 }
6193 
6194 static int qsort_strcmp(const void *a, const void *b)
6195 {
6196     return strcmp(*(char *const *)a, *(char *const *)b);
6197 }
6198 
6199 void bdrv_iterate_format(void (*it)(void *opaque, const char *name),
6200                          void *opaque, bool read_only)
6201 {
6202     BlockDriver *drv;
6203     int count = 0;
6204     int i;
6205     const char **formats = NULL;
6206 
6207     GLOBAL_STATE_CODE();
6208 
6209     QLIST_FOREACH(drv, &bdrv_drivers, list) {
6210         if (drv->format_name) {
6211             bool found = false;
6212 
6213             if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, read_only)) {
6214                 continue;
6215             }
6216 
6217             i = count;
6218             while (formats && i && !found) {
6219                 found = !strcmp(formats[--i], drv->format_name);
6220             }
6221 
6222             if (!found) {
6223                 formats = g_renew(const char *, formats, count + 1);
6224                 formats[count++] = drv->format_name;
6225             }
6226         }
6227     }
6228 
6229     for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); i++) {
6230         const char *format_name = block_driver_modules[i].format_name;
6231 
6232         if (format_name) {
6233             bool found = false;
6234             int j = count;
6235 
6236             if (use_bdrv_whitelist &&
6237                 !bdrv_format_is_whitelisted(format_name, read_only)) {
6238                 continue;
6239             }
6240 
6241             while (formats && j && !found) {
6242                 found = !strcmp(formats[--j], format_name);
6243             }
6244 
6245             if (!found) {
6246                 formats = g_renew(const char *, formats, count + 1);
6247                 formats[count++] = format_name;
6248             }
6249         }
6250     }
6251 
6252     qsort(formats, count, sizeof(formats[0]), qsort_strcmp);
6253 
6254     for (i = 0; i < count; i++) {
6255         it(opaque, formats[i]);
6256     }
6257 
6258     g_free(formats);
6259 }
6260 
6261 /* This function is to find a node in the bs graph */
6262 BlockDriverState *bdrv_find_node(const char *node_name)
6263 {
6264     BlockDriverState *bs;
6265 
6266     assert(node_name);
6267     GLOBAL_STATE_CODE();
6268 
6269     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
6270         if (!strcmp(node_name, bs->node_name)) {
6271             return bs;
6272         }
6273     }
6274     return NULL;
6275 }
6276 
6277 /* Put this QMP function here so it can access the static graph_bdrv_states. */
6278 BlockDeviceInfoList *bdrv_named_nodes_list(bool flat,
6279                                            Error **errp)
6280 {
6281     BlockDeviceInfoList *list;
6282     BlockDriverState *bs;
6283 
6284     GLOBAL_STATE_CODE();
6285 
6286     list = NULL;
6287     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
6288         BlockDeviceInfo *info = bdrv_block_device_info(NULL, bs, flat, errp);
6289         if (!info) {
6290             qapi_free_BlockDeviceInfoList(list);
6291             return NULL;
6292         }
6293         QAPI_LIST_PREPEND(list, info);
6294     }
6295 
6296     return list;
6297 }
6298 
6299 typedef struct XDbgBlockGraphConstructor {
6300     XDbgBlockGraph *graph;
6301     GHashTable *graph_nodes;
6302 } XDbgBlockGraphConstructor;
6303 
6304 static XDbgBlockGraphConstructor *xdbg_graph_new(void)
6305 {
6306     XDbgBlockGraphConstructor *gr = g_new(XDbgBlockGraphConstructor, 1);
6307 
6308     gr->graph = g_new0(XDbgBlockGraph, 1);
6309     gr->graph_nodes = g_hash_table_new(NULL, NULL);
6310 
6311     return gr;
6312 }
6313 
6314 static XDbgBlockGraph *xdbg_graph_finalize(XDbgBlockGraphConstructor *gr)
6315 {
6316     XDbgBlockGraph *graph = gr->graph;
6317 
6318     g_hash_table_destroy(gr->graph_nodes);
6319     g_free(gr);
6320 
6321     return graph;
6322 }
6323 
6324 static uintptr_t xdbg_graph_node_num(XDbgBlockGraphConstructor *gr, void *node)
6325 {
6326     uintptr_t ret = (uintptr_t)g_hash_table_lookup(gr->graph_nodes, node);
6327 
6328     if (ret != 0) {
6329         return ret;
6330     }
6331 
6332     /*
6333      * Start counting from 1, not 0, because 0 interferes with not-found (NULL)
6334      * answer of g_hash_table_lookup.
6335      */
6336     ret = g_hash_table_size(gr->graph_nodes) + 1;
6337     g_hash_table_insert(gr->graph_nodes, node, (void *)ret);
6338 
6339     return ret;
6340 }
6341 
6342 static void xdbg_graph_add_node(XDbgBlockGraphConstructor *gr, void *node,
6343                                 XDbgBlockGraphNodeType type, const char *name)
6344 {
6345     XDbgBlockGraphNode *n;
6346 
6347     n = g_new0(XDbgBlockGraphNode, 1);
6348 
6349     n->id = xdbg_graph_node_num(gr, node);
6350     n->type = type;
6351     n->name = g_strdup(name);
6352 
6353     QAPI_LIST_PREPEND(gr->graph->nodes, n);
6354 }
6355 
6356 static void xdbg_graph_add_edge(XDbgBlockGraphConstructor *gr, void *parent,
6357                                 const BdrvChild *child)
6358 {
6359     BlockPermission qapi_perm;
6360     XDbgBlockGraphEdge *edge;
6361     GLOBAL_STATE_CODE();
6362 
6363     edge = g_new0(XDbgBlockGraphEdge, 1);
6364 
6365     edge->parent = xdbg_graph_node_num(gr, parent);
6366     edge->child = xdbg_graph_node_num(gr, child->bs);
6367     edge->name = g_strdup(child->name);
6368 
6369     for (qapi_perm = 0; qapi_perm < BLOCK_PERMISSION__MAX; qapi_perm++) {
6370         uint64_t flag = bdrv_qapi_perm_to_blk_perm(qapi_perm);
6371 
6372         if (flag & child->perm) {
6373             QAPI_LIST_PREPEND(edge->perm, qapi_perm);
6374         }
6375         if (flag & child->shared_perm) {
6376             QAPI_LIST_PREPEND(edge->shared_perm, qapi_perm);
6377         }
6378     }
6379 
6380     QAPI_LIST_PREPEND(gr->graph->edges, edge);
6381 }
6382 
6383 
6384 XDbgBlockGraph *bdrv_get_xdbg_block_graph(Error **errp)
6385 {
6386     BlockBackend *blk;
6387     BlockJob *job;
6388     BlockDriverState *bs;
6389     BdrvChild *child;
6390     XDbgBlockGraphConstructor *gr = xdbg_graph_new();
6391 
6392     GLOBAL_STATE_CODE();
6393 
6394     for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
6395         char *allocated_name = NULL;
6396         const char *name = blk_name(blk);
6397 
6398         if (!*name) {
6399             name = allocated_name = blk_get_attached_dev_id(blk);
6400         }
6401         xdbg_graph_add_node(gr, blk, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_BACKEND,
6402                            name);
6403         g_free(allocated_name);
6404         if (blk_root(blk)) {
6405             xdbg_graph_add_edge(gr, blk, blk_root(blk));
6406         }
6407     }
6408 
6409     WITH_JOB_LOCK_GUARD() {
6410         for (job = block_job_next_locked(NULL); job;
6411              job = block_job_next_locked(job)) {
6412             GSList *el;
6413 
6414             xdbg_graph_add_node(gr, job, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_JOB,
6415                                 job->job.id);
6416             for (el = job->nodes; el; el = el->next) {
6417                 xdbg_graph_add_edge(gr, job, (BdrvChild *)el->data);
6418             }
6419         }
6420     }
6421 
6422     QTAILQ_FOREACH(bs, &graph_bdrv_states, node_list) {
6423         xdbg_graph_add_node(gr, bs, X_DBG_BLOCK_GRAPH_NODE_TYPE_BLOCK_DRIVER,
6424                            bs->node_name);
6425         QLIST_FOREACH(child, &bs->children, next) {
6426             xdbg_graph_add_edge(gr, bs, child);
6427         }
6428     }
6429 
6430     return xdbg_graph_finalize(gr);
6431 }
6432 
6433 BlockDriverState *bdrv_lookup_bs(const char *device,
6434                                  const char *node_name,
6435                                  Error **errp)
6436 {
6437     BlockBackend *blk;
6438     BlockDriverState *bs;
6439 
6440     GLOBAL_STATE_CODE();
6441 
6442     if (device) {
6443         blk = blk_by_name(device);
6444 
6445         if (blk) {
6446             bs = blk_bs(blk);
6447             if (!bs) {
6448                 error_setg(errp, "Device '%s' has no medium", device);
6449             }
6450 
6451             return bs;
6452         }
6453     }
6454 
6455     if (node_name) {
6456         bs = bdrv_find_node(node_name);
6457 
6458         if (bs) {
6459             return bs;
6460         }
6461     }
6462 
6463     error_setg(errp, "Cannot find device=\'%s\' nor node-name=\'%s\'",
6464                      device ? device : "",
6465                      node_name ? node_name : "");
6466     return NULL;
6467 }
6468 
6469 /* If 'base' is in the same chain as 'top', return true. Otherwise,
6470  * return false.  If either argument is NULL, return false. */
6471 bool bdrv_chain_contains(BlockDriverState *top, BlockDriverState *base)
6472 {
6473 
6474     GLOBAL_STATE_CODE();
6475 
6476     while (top && top != base) {
6477         top = bdrv_filter_or_cow_bs(top);
6478     }
6479 
6480     return top != NULL;
6481 }
6482 
6483 BlockDriverState *bdrv_next_node(BlockDriverState *bs)
6484 {
6485     GLOBAL_STATE_CODE();
6486     if (!bs) {
6487         return QTAILQ_FIRST(&graph_bdrv_states);
6488     }
6489     return QTAILQ_NEXT(bs, node_list);
6490 }
6491 
6492 BlockDriverState *bdrv_next_all_states(BlockDriverState *bs)
6493 {
6494     GLOBAL_STATE_CODE();
6495     if (!bs) {
6496         return QTAILQ_FIRST(&all_bdrv_states);
6497     }
6498     return QTAILQ_NEXT(bs, bs_list);
6499 }
6500 
6501 const char *bdrv_get_node_name(const BlockDriverState *bs)
6502 {
6503     IO_CODE();
6504     return bs->node_name;
6505 }
6506 
6507 const char *bdrv_get_parent_name(const BlockDriverState *bs)
6508 {
6509     BdrvChild *c;
6510     const char *name;
6511     IO_CODE();
6512 
6513     /* If multiple parents have a name, just pick the first one. */
6514     QLIST_FOREACH(c, &bs->parents, next_parent) {
6515         if (c->klass->get_name) {
6516             name = c->klass->get_name(c);
6517             if (name && *name) {
6518                 return name;
6519             }
6520         }
6521     }
6522 
6523     return NULL;
6524 }
6525 
6526 /* TODO check what callers really want: bs->node_name or blk_name() */
6527 const char *bdrv_get_device_name(const BlockDriverState *bs)
6528 {
6529     IO_CODE();
6530     return bdrv_get_parent_name(bs) ?: "";
6531 }
6532 
6533 /* This can be used to identify nodes that might not have a device
6534  * name associated. Since node and device names live in the same
6535  * namespace, the result is unambiguous. The exception is if both are
6536  * absent, then this returns an empty (non-null) string. */
6537 const char *bdrv_get_device_or_node_name(const BlockDriverState *bs)
6538 {
6539     IO_CODE();
6540     return bdrv_get_parent_name(bs) ?: bs->node_name;
6541 }
6542 
6543 int bdrv_get_flags(BlockDriverState *bs)
6544 {
6545     IO_CODE();
6546     return bs->open_flags;
6547 }
6548 
6549 int bdrv_has_zero_init_1(BlockDriverState *bs)
6550 {
6551     GLOBAL_STATE_CODE();
6552     return 1;
6553 }
6554 
6555 int bdrv_has_zero_init(BlockDriverState *bs)
6556 {
6557     BlockDriverState *filtered;
6558     GLOBAL_STATE_CODE();
6559 
6560     if (!bs->drv) {
6561         return 0;
6562     }
6563 
6564     /* If BS is a copy on write image, it is initialized to
6565        the contents of the base image, which may not be zeroes.  */
6566     if (bdrv_cow_child(bs)) {
6567         return 0;
6568     }
6569     if (bs->drv->bdrv_has_zero_init) {
6570         return bs->drv->bdrv_has_zero_init(bs);
6571     }
6572 
6573     filtered = bdrv_filter_bs(bs);
6574     if (filtered) {
6575         return bdrv_has_zero_init(filtered);
6576     }
6577 
6578     /* safe default */
6579     return 0;
6580 }
6581 
6582 bool bdrv_can_write_zeroes_with_unmap(BlockDriverState *bs)
6583 {
6584     IO_CODE();
6585     if (!(bs->open_flags & BDRV_O_UNMAP)) {
6586         return false;
6587     }
6588 
6589     return bs->supported_zero_flags & BDRV_REQ_MAY_UNMAP;
6590 }
6591 
6592 void bdrv_get_backing_filename(BlockDriverState *bs,
6593                                char *filename, int filename_size)
6594 {
6595     IO_CODE();
6596     pstrcpy(filename, filename_size, bs->backing_file);
6597 }
6598 
6599 int coroutine_fn bdrv_co_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
6600 {
6601     int ret;
6602     BlockDriver *drv = bs->drv;
6603     IO_CODE();
6604     assert_bdrv_graph_readable();
6605 
6606     /* if bs->drv == NULL, bs is closed, so there's nothing to do here */
6607     if (!drv) {
6608         return -ENOMEDIUM;
6609     }
6610     if (!drv->bdrv_co_get_info) {
6611         BlockDriverState *filtered = bdrv_filter_bs(bs);
6612         if (filtered) {
6613             return bdrv_co_get_info(filtered, bdi);
6614         }
6615         return -ENOTSUP;
6616     }
6617     memset(bdi, 0, sizeof(*bdi));
6618     ret = drv->bdrv_co_get_info(bs, bdi);
6619     if (bdi->subcluster_size == 0) {
6620         /*
6621          * If the driver left this unset, subclusters are not supported.
6622          * Then it is safe to treat each cluster as having only one subcluster.
6623          */
6624         bdi->subcluster_size = bdi->cluster_size;
6625     }
6626     if (ret < 0) {
6627         return ret;
6628     }
6629 
6630     if (bdi->cluster_size > BDRV_MAX_ALIGNMENT) {
6631         return -EINVAL;
6632     }
6633 
6634     return 0;
6635 }
6636 
6637 ImageInfoSpecific *bdrv_get_specific_info(BlockDriverState *bs,
6638                                           Error **errp)
6639 {
6640     BlockDriver *drv = bs->drv;
6641     IO_CODE();
6642     if (drv && drv->bdrv_get_specific_info) {
6643         return drv->bdrv_get_specific_info(bs, errp);
6644     }
6645     return NULL;
6646 }
6647 
6648 BlockStatsSpecific *bdrv_get_specific_stats(BlockDriverState *bs)
6649 {
6650     BlockDriver *drv = bs->drv;
6651     IO_CODE();
6652     if (!drv || !drv->bdrv_get_specific_stats) {
6653         return NULL;
6654     }
6655     return drv->bdrv_get_specific_stats(bs);
6656 }
6657 
6658 void coroutine_fn bdrv_co_debug_event(BlockDriverState *bs, BlkdebugEvent event)
6659 {
6660     IO_CODE();
6661     assert_bdrv_graph_readable();
6662 
6663     if (!bs || !bs->drv || !bs->drv->bdrv_co_debug_event) {
6664         return;
6665     }
6666 
6667     bs->drv->bdrv_co_debug_event(bs, event);
6668 }
6669 
6670 static BlockDriverState *bdrv_find_debug_node(BlockDriverState *bs)
6671 {
6672     GLOBAL_STATE_CODE();
6673     while (bs && bs->drv && !bs->drv->bdrv_debug_breakpoint) {
6674         bs = bdrv_primary_bs(bs);
6675     }
6676 
6677     if (bs && bs->drv && bs->drv->bdrv_debug_breakpoint) {
6678         assert(bs->drv->bdrv_debug_remove_breakpoint);
6679         return bs;
6680     }
6681 
6682     return NULL;
6683 }
6684 
6685 int bdrv_debug_breakpoint(BlockDriverState *bs, const char *event,
6686                           const char *tag)
6687 {
6688     GLOBAL_STATE_CODE();
6689     bs = bdrv_find_debug_node(bs);
6690     if (bs) {
6691         return bs->drv->bdrv_debug_breakpoint(bs, event, tag);
6692     }
6693 
6694     return -ENOTSUP;
6695 }
6696 
6697 int bdrv_debug_remove_breakpoint(BlockDriverState *bs, const char *tag)
6698 {
6699     GLOBAL_STATE_CODE();
6700     bs = bdrv_find_debug_node(bs);
6701     if (bs) {
6702         return bs->drv->bdrv_debug_remove_breakpoint(bs, tag);
6703     }
6704 
6705     return -ENOTSUP;
6706 }
6707 
6708 int bdrv_debug_resume(BlockDriverState *bs, const char *tag)
6709 {
6710     GLOBAL_STATE_CODE();
6711     while (bs && (!bs->drv || !bs->drv->bdrv_debug_resume)) {
6712         bs = bdrv_primary_bs(bs);
6713     }
6714 
6715     if (bs && bs->drv && bs->drv->bdrv_debug_resume) {
6716         return bs->drv->bdrv_debug_resume(bs, tag);
6717     }
6718 
6719     return -ENOTSUP;
6720 }
6721 
6722 bool bdrv_debug_is_suspended(BlockDriverState *bs, const char *tag)
6723 {
6724     GLOBAL_STATE_CODE();
6725     while (bs && bs->drv && !bs->drv->bdrv_debug_is_suspended) {
6726         bs = bdrv_primary_bs(bs);
6727     }
6728 
6729     if (bs && bs->drv && bs->drv->bdrv_debug_is_suspended) {
6730         return bs->drv->bdrv_debug_is_suspended(bs, tag);
6731     }
6732 
6733     return false;
6734 }
6735 
6736 /* backing_file can either be relative, or absolute, or a protocol.  If it is
6737  * relative, it must be relative to the chain.  So, passing in bs->filename
6738  * from a BDS as backing_file should not be done, as that may be relative to
6739  * the CWD rather than the chain. */
6740 BlockDriverState *bdrv_find_backing_image(BlockDriverState *bs,
6741         const char *backing_file)
6742 {
6743     char *filename_full = NULL;
6744     char *backing_file_full = NULL;
6745     char *filename_tmp = NULL;
6746     int is_protocol = 0;
6747     bool filenames_refreshed = false;
6748     BlockDriverState *curr_bs = NULL;
6749     BlockDriverState *retval = NULL;
6750     BlockDriverState *bs_below;
6751 
6752     GLOBAL_STATE_CODE();
6753 
6754     if (!bs || !bs->drv || !backing_file) {
6755         return NULL;
6756     }
6757 
6758     filename_full     = g_malloc(PATH_MAX);
6759     backing_file_full = g_malloc(PATH_MAX);
6760 
6761     is_protocol = path_has_protocol(backing_file);
6762 
6763     /*
6764      * Being largely a legacy function, skip any filters here
6765      * (because filters do not have normal filenames, so they cannot
6766      * match anyway; and allowing json:{} filenames is a bit out of
6767      * scope).
6768      */
6769     for (curr_bs = bdrv_skip_filters(bs);
6770          bdrv_cow_child(curr_bs) != NULL;
6771          curr_bs = bs_below)
6772     {
6773         bs_below = bdrv_backing_chain_next(curr_bs);
6774 
6775         if (bdrv_backing_overridden(curr_bs)) {
6776             /*
6777              * If the backing file was overridden, we can only compare
6778              * directly against the backing node's filename.
6779              */
6780 
6781             if (!filenames_refreshed) {
6782                 /*
6783                  * This will automatically refresh all of the
6784                  * filenames in the rest of the backing chain, so we
6785                  * only need to do this once.
6786                  */
6787                 bdrv_refresh_filename(bs_below);
6788                 filenames_refreshed = true;
6789             }
6790 
6791             if (strcmp(backing_file, bs_below->filename) == 0) {
6792                 retval = bs_below;
6793                 break;
6794             }
6795         } else if (is_protocol || path_has_protocol(curr_bs->backing_file)) {
6796             /*
6797              * If either of the filename paths is actually a protocol, then
6798              * compare unmodified paths; otherwise make paths relative.
6799              */
6800             char *backing_file_full_ret;
6801 
6802             if (strcmp(backing_file, curr_bs->backing_file) == 0) {
6803                 retval = bs_below;
6804                 break;
6805             }
6806             /* Also check against the full backing filename for the image */
6807             backing_file_full_ret = bdrv_get_full_backing_filename(curr_bs,
6808                                                                    NULL);
6809             if (backing_file_full_ret) {
6810                 bool equal = strcmp(backing_file, backing_file_full_ret) == 0;
6811                 g_free(backing_file_full_ret);
6812                 if (equal) {
6813                     retval = bs_below;
6814                     break;
6815                 }
6816             }
6817         } else {
6818             /* If not an absolute filename path, make it relative to the current
6819              * image's filename path */
6820             filename_tmp = bdrv_make_absolute_filename(curr_bs, backing_file,
6821                                                        NULL);
6822             /* We are going to compare canonicalized absolute pathnames */
6823             if (!filename_tmp || !realpath(filename_tmp, filename_full)) {
6824                 g_free(filename_tmp);
6825                 continue;
6826             }
6827             g_free(filename_tmp);
6828 
6829             /* We need to make sure the backing filename we are comparing against
6830              * is relative to the current image filename (or absolute) */
6831             filename_tmp = bdrv_get_full_backing_filename(curr_bs, NULL);
6832             if (!filename_tmp || !realpath(filename_tmp, backing_file_full)) {
6833                 g_free(filename_tmp);
6834                 continue;
6835             }
6836             g_free(filename_tmp);
6837 
6838             if (strcmp(backing_file_full, filename_full) == 0) {
6839                 retval = bs_below;
6840                 break;
6841             }
6842         }
6843     }
6844 
6845     g_free(filename_full);
6846     g_free(backing_file_full);
6847     return retval;
6848 }
6849 
6850 void bdrv_init(void)
6851 {
6852 #ifdef CONFIG_BDRV_WHITELIST_TOOLS
6853     use_bdrv_whitelist = 1;
6854 #endif
6855     module_call_init(MODULE_INIT_BLOCK);
6856 }
6857 
6858 void bdrv_init_with_whitelist(void)
6859 {
6860     use_bdrv_whitelist = 1;
6861     bdrv_init();
6862 }
6863 
6864 int bdrv_activate(BlockDriverState *bs, Error **errp)
6865 {
6866     BdrvChild *child, *parent;
6867     Error *local_err = NULL;
6868     int ret;
6869     BdrvDirtyBitmap *bm;
6870 
6871     GLOBAL_STATE_CODE();
6872     GRAPH_RDLOCK_GUARD_MAINLOOP();
6873 
6874     if (!bs->drv)  {
6875         return -ENOMEDIUM;
6876     }
6877 
6878     QLIST_FOREACH(child, &bs->children, next) {
6879         bdrv_activate(child->bs, &local_err);
6880         if (local_err) {
6881             error_propagate(errp, local_err);
6882             return -EINVAL;
6883         }
6884     }
6885 
6886     /*
6887      * Update permissions, they may differ for inactive nodes.
6888      *
6889      * Note that the required permissions of inactive images are always a
6890      * subset of the permissions required after activating the image. This
6891      * allows us to just get the permissions upfront without restricting
6892      * bdrv_co_invalidate_cache().
6893      *
6894      * It also means that in error cases, we don't have to try and revert to
6895      * the old permissions (which is an operation that could fail, too). We can
6896      * just keep the extended permissions for the next time that an activation
6897      * of the image is tried.
6898      */
6899     if (bs->open_flags & BDRV_O_INACTIVE) {
6900         bs->open_flags &= ~BDRV_O_INACTIVE;
6901         ret = bdrv_refresh_perms(bs, NULL, errp);
6902         if (ret < 0) {
6903             bs->open_flags |= BDRV_O_INACTIVE;
6904             return ret;
6905         }
6906 
6907         ret = bdrv_invalidate_cache(bs, errp);
6908         if (ret < 0) {
6909             bs->open_flags |= BDRV_O_INACTIVE;
6910             return ret;
6911         }
6912 
6913         FOR_EACH_DIRTY_BITMAP(bs, bm) {
6914             bdrv_dirty_bitmap_skip_store(bm, false);
6915         }
6916 
6917         ret = bdrv_refresh_total_sectors(bs, bs->total_sectors);
6918         if (ret < 0) {
6919             bs->open_flags |= BDRV_O_INACTIVE;
6920             error_setg_errno(errp, -ret, "Could not refresh total sector count");
6921             return ret;
6922         }
6923     }
6924 
6925     QLIST_FOREACH(parent, &bs->parents, next_parent) {
6926         if (parent->klass->activate) {
6927             parent->klass->activate(parent, &local_err);
6928             if (local_err) {
6929                 bs->open_flags |= BDRV_O_INACTIVE;
6930                 error_propagate(errp, local_err);
6931                 return -EINVAL;
6932             }
6933         }
6934     }
6935 
6936     return 0;
6937 }
6938 
6939 int coroutine_fn bdrv_co_invalidate_cache(BlockDriverState *bs, Error **errp)
6940 {
6941     Error *local_err = NULL;
6942     IO_CODE();
6943 
6944     assert(!(bs->open_flags & BDRV_O_INACTIVE));
6945     assert_bdrv_graph_readable();
6946 
6947     if (bs->drv->bdrv_co_invalidate_cache) {
6948         bs->drv->bdrv_co_invalidate_cache(bs, &local_err);
6949         if (local_err) {
6950             error_propagate(errp, local_err);
6951             return -EINVAL;
6952         }
6953     }
6954 
6955     return 0;
6956 }
6957 
6958 void bdrv_activate_all(Error **errp)
6959 {
6960     BlockDriverState *bs;
6961     BdrvNextIterator it;
6962 
6963     GLOBAL_STATE_CODE();
6964 
6965     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
6966         AioContext *aio_context = bdrv_get_aio_context(bs);
6967         int ret;
6968 
6969         aio_context_acquire(aio_context);
6970         ret = bdrv_activate(bs, errp);
6971         aio_context_release(aio_context);
6972         if (ret < 0) {
6973             bdrv_next_cleanup(&it);
6974             return;
6975         }
6976     }
6977 }
6978 
6979 static bool bdrv_has_bds_parent(BlockDriverState *bs, bool only_active)
6980 {
6981     BdrvChild *parent;
6982     GLOBAL_STATE_CODE();
6983 
6984     QLIST_FOREACH(parent, &bs->parents, next_parent) {
6985         if (parent->klass->parent_is_bds) {
6986             BlockDriverState *parent_bs = parent->opaque;
6987             if (!only_active || !(parent_bs->open_flags & BDRV_O_INACTIVE)) {
6988                 return true;
6989             }
6990         }
6991     }
6992 
6993     return false;
6994 }
6995 
6996 static int bdrv_inactivate_recurse(BlockDriverState *bs)
6997 {
6998     BdrvChild *child, *parent;
6999     int ret;
7000     uint64_t cumulative_perms, cumulative_shared_perms;
7001 
7002     GLOBAL_STATE_CODE();
7003     GRAPH_RDLOCK_GUARD_MAINLOOP();
7004 
7005     if (!bs->drv) {
7006         return -ENOMEDIUM;
7007     }
7008 
7009     /* Make sure that we don't inactivate a child before its parent.
7010      * It will be covered by recursion from the yet active parent. */
7011     if (bdrv_has_bds_parent(bs, true)) {
7012         return 0;
7013     }
7014 
7015     assert(!(bs->open_flags & BDRV_O_INACTIVE));
7016 
7017     /* Inactivate this node */
7018     if (bs->drv->bdrv_inactivate) {
7019         ret = bs->drv->bdrv_inactivate(bs);
7020         if (ret < 0) {
7021             return ret;
7022         }
7023     }
7024 
7025     QLIST_FOREACH(parent, &bs->parents, next_parent) {
7026         if (parent->klass->inactivate) {
7027             ret = parent->klass->inactivate(parent);
7028             if (ret < 0) {
7029                 return ret;
7030             }
7031         }
7032     }
7033 
7034     bdrv_get_cumulative_perm(bs, &cumulative_perms,
7035                              &cumulative_shared_perms);
7036     if (cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
7037         /* Our inactive parents still need write access. Inactivation failed. */
7038         return -EPERM;
7039     }
7040 
7041     bs->open_flags |= BDRV_O_INACTIVE;
7042 
7043     /*
7044      * Update permissions, they may differ for inactive nodes.
7045      * We only tried to loosen restrictions, so errors are not fatal, ignore
7046      * them.
7047      */
7048     bdrv_refresh_perms(bs, NULL, NULL);
7049 
7050     /* Recursively inactivate children */
7051     QLIST_FOREACH(child, &bs->children, next) {
7052         ret = bdrv_inactivate_recurse(child->bs);
7053         if (ret < 0) {
7054             return ret;
7055         }
7056     }
7057 
7058     return 0;
7059 }
7060 
7061 int bdrv_inactivate_all(void)
7062 {
7063     BlockDriverState *bs = NULL;
7064     BdrvNextIterator it;
7065     int ret = 0;
7066     GSList *aio_ctxs = NULL, *ctx;
7067 
7068     GLOBAL_STATE_CODE();
7069 
7070     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
7071         AioContext *aio_context = bdrv_get_aio_context(bs);
7072 
7073         if (!g_slist_find(aio_ctxs, aio_context)) {
7074             aio_ctxs = g_slist_prepend(aio_ctxs, aio_context);
7075             aio_context_acquire(aio_context);
7076         }
7077     }
7078 
7079     for (bs = bdrv_first(&it); bs; bs = bdrv_next(&it)) {
7080         /* Nodes with BDS parents are covered by recursion from the last
7081          * parent that gets inactivated. Don't inactivate them a second
7082          * time if that has already happened. */
7083         if (bdrv_has_bds_parent(bs, false)) {
7084             continue;
7085         }
7086         ret = bdrv_inactivate_recurse(bs);
7087         if (ret < 0) {
7088             bdrv_next_cleanup(&it);
7089             goto out;
7090         }
7091     }
7092 
7093 out:
7094     for (ctx = aio_ctxs; ctx != NULL; ctx = ctx->next) {
7095         AioContext *aio_context = ctx->data;
7096         aio_context_release(aio_context);
7097     }
7098     g_slist_free(aio_ctxs);
7099 
7100     return ret;
7101 }
7102 
7103 /**************************************************************/
7104 /* removable device support */
7105 
7106 /**
7107  * Return TRUE if the media is present
7108  */
7109 bool coroutine_fn bdrv_co_is_inserted(BlockDriverState *bs)
7110 {
7111     BlockDriver *drv = bs->drv;
7112     BdrvChild *child;
7113     IO_CODE();
7114     assert_bdrv_graph_readable();
7115 
7116     if (!drv) {
7117         return false;
7118     }
7119     if (drv->bdrv_co_is_inserted) {
7120         return drv->bdrv_co_is_inserted(bs);
7121     }
7122     QLIST_FOREACH(child, &bs->children, next) {
7123         if (!bdrv_co_is_inserted(child->bs)) {
7124             return false;
7125         }
7126     }
7127     return true;
7128 }
7129 
7130 /**
7131  * If eject_flag is TRUE, eject the media. Otherwise, close the tray
7132  */
7133 void coroutine_fn bdrv_co_eject(BlockDriverState *bs, bool eject_flag)
7134 {
7135     BlockDriver *drv = bs->drv;
7136     IO_CODE();
7137     assert_bdrv_graph_readable();
7138 
7139     if (drv && drv->bdrv_co_eject) {
7140         drv->bdrv_co_eject(bs, eject_flag);
7141     }
7142 }
7143 
7144 /**
7145  * Lock or unlock the media (if it is locked, the user won't be able
7146  * to eject it manually).
7147  */
7148 void coroutine_fn bdrv_co_lock_medium(BlockDriverState *bs, bool locked)
7149 {
7150     BlockDriver *drv = bs->drv;
7151     IO_CODE();
7152     assert_bdrv_graph_readable();
7153     trace_bdrv_lock_medium(bs, locked);
7154 
7155     if (drv && drv->bdrv_co_lock_medium) {
7156         drv->bdrv_co_lock_medium(bs, locked);
7157     }
7158 }
7159 
7160 /* Get a reference to bs */
7161 void bdrv_ref(BlockDriverState *bs)
7162 {
7163     GLOBAL_STATE_CODE();
7164     bs->refcnt++;
7165 }
7166 
7167 /* Release a previously grabbed reference to bs.
7168  * If after releasing, reference count is zero, the BlockDriverState is
7169  * deleted. */
7170 void bdrv_unref(BlockDriverState *bs)
7171 {
7172     GLOBAL_STATE_CODE();
7173     if (!bs) {
7174         return;
7175     }
7176     assert(bs->refcnt > 0);
7177     if (--bs->refcnt == 0) {
7178         bdrv_delete(bs);
7179     }
7180 }
7181 
7182 /*
7183  * Release a BlockDriverState reference while holding the graph write lock.
7184  *
7185  * Calling bdrv_unref() directly is forbidden while holding the graph lock
7186  * because bdrv_close() both involves polling and taking the graph lock
7187  * internally. bdrv_schedule_unref() instead delays decreasing the refcount and
7188  * possibly closing @bs until the graph lock is released.
7189  */
7190 void bdrv_schedule_unref(BlockDriverState *bs)
7191 {
7192     if (!bs) {
7193         return;
7194     }
7195     aio_bh_schedule_oneshot(qemu_get_aio_context(),
7196                             (QEMUBHFunc *) bdrv_unref, bs);
7197 }
7198 
7199 struct BdrvOpBlocker {
7200     Error *reason;
7201     QLIST_ENTRY(BdrvOpBlocker) list;
7202 };
7203 
7204 bool bdrv_op_is_blocked(BlockDriverState *bs, BlockOpType op, Error **errp)
7205 {
7206     BdrvOpBlocker *blocker;
7207     GLOBAL_STATE_CODE();
7208     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
7209     if (!QLIST_EMPTY(&bs->op_blockers[op])) {
7210         blocker = QLIST_FIRST(&bs->op_blockers[op]);
7211         error_propagate_prepend(errp, error_copy(blocker->reason),
7212                                 "Node '%s' is busy: ",
7213                                 bdrv_get_device_or_node_name(bs));
7214         return true;
7215     }
7216     return false;
7217 }
7218 
7219 void bdrv_op_block(BlockDriverState *bs, BlockOpType op, Error *reason)
7220 {
7221     BdrvOpBlocker *blocker;
7222     GLOBAL_STATE_CODE();
7223     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
7224 
7225     blocker = g_new0(BdrvOpBlocker, 1);
7226     blocker->reason = reason;
7227     QLIST_INSERT_HEAD(&bs->op_blockers[op], blocker, list);
7228 }
7229 
7230 void bdrv_op_unblock(BlockDriverState *bs, BlockOpType op, Error *reason)
7231 {
7232     BdrvOpBlocker *blocker, *next;
7233     GLOBAL_STATE_CODE();
7234     assert((int) op >= 0 && op < BLOCK_OP_TYPE_MAX);
7235     QLIST_FOREACH_SAFE(blocker, &bs->op_blockers[op], list, next) {
7236         if (blocker->reason == reason) {
7237             QLIST_REMOVE(blocker, list);
7238             g_free(blocker);
7239         }
7240     }
7241 }
7242 
7243 void bdrv_op_block_all(BlockDriverState *bs, Error *reason)
7244 {
7245     int i;
7246     GLOBAL_STATE_CODE();
7247     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
7248         bdrv_op_block(bs, i, reason);
7249     }
7250 }
7251 
7252 void bdrv_op_unblock_all(BlockDriverState *bs, Error *reason)
7253 {
7254     int i;
7255     GLOBAL_STATE_CODE();
7256     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
7257         bdrv_op_unblock(bs, i, reason);
7258     }
7259 }
7260 
7261 bool bdrv_op_blocker_is_empty(BlockDriverState *bs)
7262 {
7263     int i;
7264     GLOBAL_STATE_CODE();
7265     for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
7266         if (!QLIST_EMPTY(&bs->op_blockers[i])) {
7267             return false;
7268         }
7269     }
7270     return true;
7271 }
7272 
7273 /*
7274  * Must not be called while holding the lock of an AioContext other than the
7275  * current one.
7276  */
7277 void bdrv_img_create(const char *filename, const char *fmt,
7278                      const char *base_filename, const char *base_fmt,
7279                      char *options, uint64_t img_size, int flags, bool quiet,
7280                      Error **errp)
7281 {
7282     QemuOptsList *create_opts = NULL;
7283     QemuOpts *opts = NULL;
7284     const char *backing_fmt, *backing_file;
7285     int64_t size;
7286     BlockDriver *drv, *proto_drv;
7287     Error *local_err = NULL;
7288     int ret = 0;
7289 
7290     GLOBAL_STATE_CODE();
7291 
7292     /* Find driver and parse its options */
7293     drv = bdrv_find_format(fmt);
7294     if (!drv) {
7295         error_setg(errp, "Unknown file format '%s'", fmt);
7296         return;
7297     }
7298 
7299     proto_drv = bdrv_find_protocol(filename, true, errp);
7300     if (!proto_drv) {
7301         return;
7302     }
7303 
7304     if (!drv->create_opts) {
7305         error_setg(errp, "Format driver '%s' does not support image creation",
7306                    drv->format_name);
7307         return;
7308     }
7309 
7310     if (!proto_drv->create_opts) {
7311         error_setg(errp, "Protocol driver '%s' does not support image creation",
7312                    proto_drv->format_name);
7313         return;
7314     }
7315 
7316     aio_context_acquire(qemu_get_aio_context());
7317 
7318     /* Create parameter list */
7319     create_opts = qemu_opts_append(create_opts, drv->create_opts);
7320     create_opts = qemu_opts_append(create_opts, proto_drv->create_opts);
7321 
7322     opts = qemu_opts_create(create_opts, NULL, 0, &error_abort);
7323 
7324     /* Parse -o options */
7325     if (options) {
7326         if (!qemu_opts_do_parse(opts, options, NULL, errp)) {
7327             goto out;
7328         }
7329     }
7330 
7331     if (!qemu_opt_get(opts, BLOCK_OPT_SIZE)) {
7332         qemu_opt_set_number(opts, BLOCK_OPT_SIZE, img_size, &error_abort);
7333     } else if (img_size != UINT64_C(-1)) {
7334         error_setg(errp, "The image size must be specified only once");
7335         goto out;
7336     }
7337 
7338     if (base_filename) {
7339         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FILE, base_filename,
7340                           NULL)) {
7341             error_setg(errp, "Backing file not supported for file format '%s'",
7342                        fmt);
7343             goto out;
7344         }
7345     }
7346 
7347     if (base_fmt) {
7348         if (!qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, base_fmt, NULL)) {
7349             error_setg(errp, "Backing file format not supported for file "
7350                              "format '%s'", fmt);
7351             goto out;
7352         }
7353     }
7354 
7355     backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
7356     if (backing_file) {
7357         if (!strcmp(filename, backing_file)) {
7358             error_setg(errp, "Error: Trying to create an image with the "
7359                              "same filename as the backing file");
7360             goto out;
7361         }
7362         if (backing_file[0] == '\0') {
7363             error_setg(errp, "Expected backing file name, got empty string");
7364             goto out;
7365         }
7366     }
7367 
7368     backing_fmt = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
7369 
7370     /* The size for the image must always be specified, unless we have a backing
7371      * file and we have not been forbidden from opening it. */
7372     size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, img_size);
7373     if (backing_file && !(flags & BDRV_O_NO_BACKING)) {
7374         BlockDriverState *bs;
7375         char *full_backing;
7376         int back_flags;
7377         QDict *backing_options = NULL;
7378 
7379         full_backing =
7380             bdrv_get_full_backing_filename_from_filename(filename, backing_file,
7381                                                          &local_err);
7382         if (local_err) {
7383             goto out;
7384         }
7385         assert(full_backing);
7386 
7387         /*
7388          * No need to do I/O here, which allows us to open encrypted
7389          * backing images without needing the secret
7390          */
7391         back_flags = flags;
7392         back_flags &= ~(BDRV_O_RDWR | BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING);
7393         back_flags |= BDRV_O_NO_IO;
7394 
7395         backing_options = qdict_new();
7396         if (backing_fmt) {
7397             qdict_put_str(backing_options, "driver", backing_fmt);
7398         }
7399         qdict_put_bool(backing_options, BDRV_OPT_FORCE_SHARE, true);
7400 
7401         bs = bdrv_open(full_backing, NULL, backing_options, back_flags,
7402                        &local_err);
7403         g_free(full_backing);
7404         if (!bs) {
7405             error_append_hint(&local_err, "Could not open backing image.\n");
7406             goto out;
7407         } else {
7408             if (!backing_fmt) {
7409                 error_setg(&local_err,
7410                            "Backing file specified without backing format");
7411                 error_append_hint(&local_err, "Detected format of %s.\n",
7412                                   bs->drv->format_name);
7413                 goto out;
7414             }
7415             if (size == -1) {
7416                 /* Opened BS, have no size */
7417                 size = bdrv_getlength(bs);
7418                 if (size < 0) {
7419                     error_setg_errno(errp, -size, "Could not get size of '%s'",
7420                                      backing_file);
7421                     bdrv_unref(bs);
7422                     goto out;
7423                 }
7424                 qemu_opt_set_number(opts, BLOCK_OPT_SIZE, size, &error_abort);
7425             }
7426             bdrv_unref(bs);
7427         }
7428         /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
7429     } else if (backing_file && !backing_fmt) {
7430         error_setg(&local_err,
7431                    "Backing file specified without backing format");
7432         goto out;
7433     }
7434 
7435     if (size == -1) {
7436         error_setg(errp, "Image creation needs a size parameter");
7437         goto out;
7438     }
7439 
7440     if (!quiet) {
7441         printf("Formatting '%s', fmt=%s ", filename, fmt);
7442         qemu_opts_print(opts, " ");
7443         puts("");
7444         fflush(stdout);
7445     }
7446 
7447     ret = bdrv_create(drv, filename, opts, &local_err);
7448 
7449     if (ret == -EFBIG) {
7450         /* This is generally a better message than whatever the driver would
7451          * deliver (especially because of the cluster_size_hint), since that
7452          * is most probably not much different from "image too large". */
7453         const char *cluster_size_hint = "";
7454         if (qemu_opt_get_size(opts, BLOCK_OPT_CLUSTER_SIZE, 0)) {
7455             cluster_size_hint = " (try using a larger cluster size)";
7456         }
7457         error_setg(errp, "The image size is too large for file format '%s'"
7458                    "%s", fmt, cluster_size_hint);
7459         error_free(local_err);
7460         local_err = NULL;
7461     }
7462 
7463 out:
7464     qemu_opts_del(opts);
7465     qemu_opts_free(create_opts);
7466     error_propagate(errp, local_err);
7467     aio_context_release(qemu_get_aio_context());
7468 }
7469 
7470 AioContext *bdrv_get_aio_context(BlockDriverState *bs)
7471 {
7472     IO_CODE();
7473     return bs ? bs->aio_context : qemu_get_aio_context();
7474 }
7475 
7476 AioContext *coroutine_fn bdrv_co_enter(BlockDriverState *bs)
7477 {
7478     Coroutine *self = qemu_coroutine_self();
7479     AioContext *old_ctx = qemu_coroutine_get_aio_context(self);
7480     AioContext *new_ctx;
7481     IO_CODE();
7482 
7483     /*
7484      * Increase bs->in_flight to ensure that this operation is completed before
7485      * moving the node to a different AioContext. Read new_ctx only afterwards.
7486      */
7487     bdrv_inc_in_flight(bs);
7488 
7489     new_ctx = bdrv_get_aio_context(bs);
7490     aio_co_reschedule_self(new_ctx);
7491     return old_ctx;
7492 }
7493 
7494 void coroutine_fn bdrv_co_leave(BlockDriverState *bs, AioContext *old_ctx)
7495 {
7496     IO_CODE();
7497     aio_co_reschedule_self(old_ctx);
7498     bdrv_dec_in_flight(bs);
7499 }
7500 
7501 void coroutine_fn bdrv_co_lock(BlockDriverState *bs)
7502 {
7503     AioContext *ctx = bdrv_get_aio_context(bs);
7504 
7505     /* In the main thread, bs->aio_context won't change concurrently */
7506     assert(qemu_get_current_aio_context() == qemu_get_aio_context());
7507 
7508     /*
7509      * We're in coroutine context, so we already hold the lock of the main
7510      * loop AioContext. Don't lock it twice to avoid deadlocks.
7511      */
7512     assert(qemu_in_coroutine());
7513     if (ctx != qemu_get_aio_context()) {
7514         aio_context_acquire(ctx);
7515     }
7516 }
7517 
7518 void coroutine_fn bdrv_co_unlock(BlockDriverState *bs)
7519 {
7520     AioContext *ctx = bdrv_get_aio_context(bs);
7521 
7522     assert(qemu_in_coroutine());
7523     if (ctx != qemu_get_aio_context()) {
7524         aio_context_release(ctx);
7525     }
7526 }
7527 
7528 static void bdrv_do_remove_aio_context_notifier(BdrvAioNotifier *ban)
7529 {
7530     GLOBAL_STATE_CODE();
7531     QLIST_REMOVE(ban, list);
7532     g_free(ban);
7533 }
7534 
7535 static void bdrv_detach_aio_context(BlockDriverState *bs)
7536 {
7537     BdrvAioNotifier *baf, *baf_tmp;
7538 
7539     assert(!bs->walking_aio_notifiers);
7540     GLOBAL_STATE_CODE();
7541     bs->walking_aio_notifiers = true;
7542     QLIST_FOREACH_SAFE(baf, &bs->aio_notifiers, list, baf_tmp) {
7543         if (baf->deleted) {
7544             bdrv_do_remove_aio_context_notifier(baf);
7545         } else {
7546             baf->detach_aio_context(baf->opaque);
7547         }
7548     }
7549     /* Never mind iterating again to check for ->deleted.  bdrv_close() will
7550      * remove remaining aio notifiers if we aren't called again.
7551      */
7552     bs->walking_aio_notifiers = false;
7553 
7554     if (bs->drv && bs->drv->bdrv_detach_aio_context) {
7555         bs->drv->bdrv_detach_aio_context(bs);
7556     }
7557 
7558     bs->aio_context = NULL;
7559 }
7560 
7561 static void bdrv_attach_aio_context(BlockDriverState *bs,
7562                                     AioContext *new_context)
7563 {
7564     BdrvAioNotifier *ban, *ban_tmp;
7565     GLOBAL_STATE_CODE();
7566 
7567     bs->aio_context = new_context;
7568 
7569     if (bs->drv && bs->drv->bdrv_attach_aio_context) {
7570         bs->drv->bdrv_attach_aio_context(bs, new_context);
7571     }
7572 
7573     assert(!bs->walking_aio_notifiers);
7574     bs->walking_aio_notifiers = true;
7575     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_tmp) {
7576         if (ban->deleted) {
7577             bdrv_do_remove_aio_context_notifier(ban);
7578         } else {
7579             ban->attached_aio_context(new_context, ban->opaque);
7580         }
7581     }
7582     bs->walking_aio_notifiers = false;
7583 }
7584 
7585 typedef struct BdrvStateSetAioContext {
7586     AioContext *new_ctx;
7587     BlockDriverState *bs;
7588 } BdrvStateSetAioContext;
7589 
7590 static bool bdrv_parent_change_aio_context(BdrvChild *c, AioContext *ctx,
7591                                            GHashTable *visited,
7592                                            Transaction *tran,
7593                                            Error **errp)
7594 {
7595     GLOBAL_STATE_CODE();
7596     if (g_hash_table_contains(visited, c)) {
7597         return true;
7598     }
7599     g_hash_table_add(visited, c);
7600 
7601     /*
7602      * A BdrvChildClass that doesn't handle AioContext changes cannot
7603      * tolerate any AioContext changes
7604      */
7605     if (!c->klass->change_aio_ctx) {
7606         char *user = bdrv_child_user_desc(c);
7607         error_setg(errp, "Changing iothreads is not supported by %s", user);
7608         g_free(user);
7609         return false;
7610     }
7611     if (!c->klass->change_aio_ctx(c, ctx, visited, tran, errp)) {
7612         assert(!errp || *errp);
7613         return false;
7614     }
7615     return true;
7616 }
7617 
7618 bool bdrv_child_change_aio_context(BdrvChild *c, AioContext *ctx,
7619                                    GHashTable *visited, Transaction *tran,
7620                                    Error **errp)
7621 {
7622     GLOBAL_STATE_CODE();
7623     if (g_hash_table_contains(visited, c)) {
7624         return true;
7625     }
7626     g_hash_table_add(visited, c);
7627     return bdrv_change_aio_context(c->bs, ctx, visited, tran, errp);
7628 }
7629 
7630 static void bdrv_set_aio_context_clean(void *opaque)
7631 {
7632     BdrvStateSetAioContext *state = (BdrvStateSetAioContext *) opaque;
7633     BlockDriverState *bs = (BlockDriverState *) state->bs;
7634 
7635     /* Paired with bdrv_drained_begin in bdrv_change_aio_context() */
7636     bdrv_drained_end(bs);
7637 
7638     g_free(state);
7639 }
7640 
7641 static void bdrv_set_aio_context_commit(void *opaque)
7642 {
7643     BdrvStateSetAioContext *state = (BdrvStateSetAioContext *) opaque;
7644     BlockDriverState *bs = (BlockDriverState *) state->bs;
7645     AioContext *new_context = state->new_ctx;
7646     AioContext *old_context = bdrv_get_aio_context(bs);
7647 
7648     /*
7649      * Take the old AioContex when detaching it from bs.
7650      * At this point, new_context lock is already acquired, and we are now
7651      * also taking old_context. This is safe as long as bdrv_detach_aio_context
7652      * does not call AIO_POLL_WHILE().
7653      */
7654     if (old_context != qemu_get_aio_context()) {
7655         aio_context_acquire(old_context);
7656     }
7657     bdrv_detach_aio_context(bs);
7658     if (old_context != qemu_get_aio_context()) {
7659         aio_context_release(old_context);
7660     }
7661     bdrv_attach_aio_context(bs, new_context);
7662 }
7663 
7664 static TransactionActionDrv set_aio_context = {
7665     .commit = bdrv_set_aio_context_commit,
7666     .clean = bdrv_set_aio_context_clean,
7667 };
7668 
7669 /*
7670  * Changes the AioContext used for fd handlers, timers, and BHs by this
7671  * BlockDriverState and all its children and parents.
7672  *
7673  * Must be called from the main AioContext.
7674  *
7675  * The caller must own the AioContext lock for the old AioContext of bs, but it
7676  * must not own the AioContext lock for new_context (unless new_context is the
7677  * same as the current context of bs).
7678  *
7679  * @visited will accumulate all visited BdrvChild objects. The caller is
7680  * responsible for freeing the list afterwards.
7681  */
7682 static bool bdrv_change_aio_context(BlockDriverState *bs, AioContext *ctx,
7683                                     GHashTable *visited, Transaction *tran,
7684                                     Error **errp)
7685 {
7686     BdrvChild *c;
7687     BdrvStateSetAioContext *state;
7688 
7689     GLOBAL_STATE_CODE();
7690 
7691     if (bdrv_get_aio_context(bs) == ctx) {
7692         return true;
7693     }
7694 
7695     bdrv_graph_rdlock_main_loop();
7696     QLIST_FOREACH(c, &bs->parents, next_parent) {
7697         if (!bdrv_parent_change_aio_context(c, ctx, visited, tran, errp)) {
7698             bdrv_graph_rdunlock_main_loop();
7699             return false;
7700         }
7701     }
7702 
7703     QLIST_FOREACH(c, &bs->children, next) {
7704         if (!bdrv_child_change_aio_context(c, ctx, visited, tran, errp)) {
7705             bdrv_graph_rdunlock_main_loop();
7706             return false;
7707         }
7708     }
7709     bdrv_graph_rdunlock_main_loop();
7710 
7711     state = g_new(BdrvStateSetAioContext, 1);
7712     *state = (BdrvStateSetAioContext) {
7713         .new_ctx = ctx,
7714         .bs = bs,
7715     };
7716 
7717     /* Paired with bdrv_drained_end in bdrv_set_aio_context_clean() */
7718     bdrv_drained_begin(bs);
7719 
7720     tran_add(tran, &set_aio_context, state);
7721 
7722     return true;
7723 }
7724 
7725 /*
7726  * Change bs's and recursively all of its parents' and children's AioContext
7727  * to the given new context, returning an error if that isn't possible.
7728  *
7729  * If ignore_child is not NULL, that child (and its subgraph) will not
7730  * be touched.
7731  *
7732  * This function still requires the caller to take the bs current
7733  * AioContext lock, otherwise draining will fail since AIO_WAIT_WHILE
7734  * assumes the lock is always held if bs is in another AioContext.
7735  * For the same reason, it temporarily also holds the new AioContext, since
7736  * bdrv_drained_end calls BDRV_POLL_WHILE that assumes the lock is taken too.
7737  * Therefore the new AioContext lock must not be taken by the caller.
7738  */
7739 int bdrv_try_change_aio_context(BlockDriverState *bs, AioContext *ctx,
7740                                 BdrvChild *ignore_child, Error **errp)
7741 {
7742     Transaction *tran;
7743     GHashTable *visited;
7744     int ret;
7745     AioContext *old_context = bdrv_get_aio_context(bs);
7746     GLOBAL_STATE_CODE();
7747 
7748     /*
7749      * Recursion phase: go through all nodes of the graph.
7750      * Take care of checking that all nodes support changing AioContext
7751      * and drain them, building a linear list of callbacks to run if everything
7752      * is successful (the transaction itself).
7753      */
7754     tran = tran_new();
7755     visited = g_hash_table_new(NULL, NULL);
7756     if (ignore_child) {
7757         g_hash_table_add(visited, ignore_child);
7758     }
7759     ret = bdrv_change_aio_context(bs, ctx, visited, tran, errp);
7760     g_hash_table_destroy(visited);
7761 
7762     /*
7763      * Linear phase: go through all callbacks collected in the transaction.
7764      * Run all callbacks collected in the recursion to switch all nodes
7765      * AioContext lock (transaction commit), or undo all changes done in the
7766      * recursion (transaction abort).
7767      */
7768 
7769     if (!ret) {
7770         /* Just run clean() callbacks. No AioContext changed. */
7771         tran_abort(tran);
7772         return -EPERM;
7773     }
7774 
7775     /*
7776      * Release old AioContext, it won't be needed anymore, as all
7777      * bdrv_drained_begin() have been called already.
7778      */
7779     if (qemu_get_aio_context() != old_context) {
7780         aio_context_release(old_context);
7781     }
7782 
7783     /*
7784      * Acquire new AioContext since bdrv_drained_end() is going to be called
7785      * after we switched all nodes in the new AioContext, and the function
7786      * assumes that the lock of the bs is always taken.
7787      */
7788     if (qemu_get_aio_context() != ctx) {
7789         aio_context_acquire(ctx);
7790     }
7791 
7792     tran_commit(tran);
7793 
7794     if (qemu_get_aio_context() != ctx) {
7795         aio_context_release(ctx);
7796     }
7797 
7798     /* Re-acquire the old AioContext, since the caller takes and releases it. */
7799     if (qemu_get_aio_context() != old_context) {
7800         aio_context_acquire(old_context);
7801     }
7802 
7803     return 0;
7804 }
7805 
7806 void bdrv_add_aio_context_notifier(BlockDriverState *bs,
7807         void (*attached_aio_context)(AioContext *new_context, void *opaque),
7808         void (*detach_aio_context)(void *opaque), void *opaque)
7809 {
7810     BdrvAioNotifier *ban = g_new(BdrvAioNotifier, 1);
7811     *ban = (BdrvAioNotifier){
7812         .attached_aio_context = attached_aio_context,
7813         .detach_aio_context   = detach_aio_context,
7814         .opaque               = opaque
7815     };
7816     GLOBAL_STATE_CODE();
7817 
7818     QLIST_INSERT_HEAD(&bs->aio_notifiers, ban, list);
7819 }
7820 
7821 void bdrv_remove_aio_context_notifier(BlockDriverState *bs,
7822                                       void (*attached_aio_context)(AioContext *,
7823                                                                    void *),
7824                                       void (*detach_aio_context)(void *),
7825                                       void *opaque)
7826 {
7827     BdrvAioNotifier *ban, *ban_next;
7828     GLOBAL_STATE_CODE();
7829 
7830     QLIST_FOREACH_SAFE(ban, &bs->aio_notifiers, list, ban_next) {
7831         if (ban->attached_aio_context == attached_aio_context &&
7832             ban->detach_aio_context   == detach_aio_context   &&
7833             ban->opaque               == opaque               &&
7834             ban->deleted              == false)
7835         {
7836             if (bs->walking_aio_notifiers) {
7837                 ban->deleted = true;
7838             } else {
7839                 bdrv_do_remove_aio_context_notifier(ban);
7840             }
7841             return;
7842         }
7843     }
7844 
7845     abort();
7846 }
7847 
7848 int bdrv_amend_options(BlockDriverState *bs, QemuOpts *opts,
7849                        BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
7850                        bool force,
7851                        Error **errp)
7852 {
7853     GLOBAL_STATE_CODE();
7854     if (!bs->drv) {
7855         error_setg(errp, "Node is ejected");
7856         return -ENOMEDIUM;
7857     }
7858     if (!bs->drv->bdrv_amend_options) {
7859         error_setg(errp, "Block driver '%s' does not support option amendment",
7860                    bs->drv->format_name);
7861         return -ENOTSUP;
7862     }
7863     return bs->drv->bdrv_amend_options(bs, opts, status_cb,
7864                                        cb_opaque, force, errp);
7865 }
7866 
7867 /*
7868  * This function checks whether the given @to_replace is allowed to be
7869  * replaced by a node that always shows the same data as @bs.  This is
7870  * used for example to verify whether the mirror job can replace
7871  * @to_replace by the target mirrored from @bs.
7872  * To be replaceable, @bs and @to_replace may either be guaranteed to
7873  * always show the same data (because they are only connected through
7874  * filters), or some driver may allow replacing one of its children
7875  * because it can guarantee that this child's data is not visible at
7876  * all (for example, for dissenting quorum children that have no other
7877  * parents).
7878  */
7879 bool bdrv_recurse_can_replace(BlockDriverState *bs,
7880                               BlockDriverState *to_replace)
7881 {
7882     BlockDriverState *filtered;
7883 
7884     GLOBAL_STATE_CODE();
7885 
7886     if (!bs || !bs->drv) {
7887         return false;
7888     }
7889 
7890     if (bs == to_replace) {
7891         return true;
7892     }
7893 
7894     /* See what the driver can do */
7895     if (bs->drv->bdrv_recurse_can_replace) {
7896         return bs->drv->bdrv_recurse_can_replace(bs, to_replace);
7897     }
7898 
7899     /* For filters without an own implementation, we can recurse on our own */
7900     filtered = bdrv_filter_bs(bs);
7901     if (filtered) {
7902         return bdrv_recurse_can_replace(filtered, to_replace);
7903     }
7904 
7905     /* Safe default */
7906     return false;
7907 }
7908 
7909 /*
7910  * Check whether the given @node_name can be replaced by a node that
7911  * has the same data as @parent_bs.  If so, return @node_name's BDS;
7912  * NULL otherwise.
7913  *
7914  * @node_name must be a (recursive) *child of @parent_bs (or this
7915  * function will return NULL).
7916  *
7917  * The result (whether the node can be replaced or not) is only valid
7918  * for as long as no graph or permission changes occur.
7919  */
7920 BlockDriverState *check_to_replace_node(BlockDriverState *parent_bs,
7921                                         const char *node_name, Error **errp)
7922 {
7923     BlockDriverState *to_replace_bs = bdrv_find_node(node_name);
7924     AioContext *aio_context;
7925 
7926     GLOBAL_STATE_CODE();
7927 
7928     if (!to_replace_bs) {
7929         error_setg(errp, "Failed to find node with node-name='%s'", node_name);
7930         return NULL;
7931     }
7932 
7933     aio_context = bdrv_get_aio_context(to_replace_bs);
7934     aio_context_acquire(aio_context);
7935 
7936     if (bdrv_op_is_blocked(to_replace_bs, BLOCK_OP_TYPE_REPLACE, errp)) {
7937         to_replace_bs = NULL;
7938         goto out;
7939     }
7940 
7941     /* We don't want arbitrary node of the BDS chain to be replaced only the top
7942      * most non filter in order to prevent data corruption.
7943      * Another benefit is that this tests exclude backing files which are
7944      * blocked by the backing blockers.
7945      */
7946     if (!bdrv_recurse_can_replace(parent_bs, to_replace_bs)) {
7947         error_setg(errp, "Cannot replace '%s' by a node mirrored from '%s', "
7948                    "because it cannot be guaranteed that doing so would not "
7949                    "lead to an abrupt change of visible data",
7950                    node_name, parent_bs->node_name);
7951         to_replace_bs = NULL;
7952         goto out;
7953     }
7954 
7955 out:
7956     aio_context_release(aio_context);
7957     return to_replace_bs;
7958 }
7959 
7960 /**
7961  * Iterates through the list of runtime option keys that are said to
7962  * be "strong" for a BDS.  An option is called "strong" if it changes
7963  * a BDS's data.  For example, the null block driver's "size" and
7964  * "read-zeroes" options are strong, but its "latency-ns" option is
7965  * not.
7966  *
7967  * If a key returned by this function ends with a dot, all options
7968  * starting with that prefix are strong.
7969  */
7970 static const char *const *strong_options(BlockDriverState *bs,
7971                                          const char *const *curopt)
7972 {
7973     static const char *const global_options[] = {
7974         "driver", "filename", NULL
7975     };
7976 
7977     if (!curopt) {
7978         return &global_options[0];
7979     }
7980 
7981     curopt++;
7982     if (curopt == &global_options[ARRAY_SIZE(global_options) - 1] && bs->drv) {
7983         curopt = bs->drv->strong_runtime_opts;
7984     }
7985 
7986     return (curopt && *curopt) ? curopt : NULL;
7987 }
7988 
7989 /**
7990  * Copies all strong runtime options from bs->options to the given
7991  * QDict.  The set of strong option keys is determined by invoking
7992  * strong_options().
7993  *
7994  * Returns true iff any strong option was present in bs->options (and
7995  * thus copied to the target QDict) with the exception of "filename"
7996  * and "driver".  The caller is expected to use this value to decide
7997  * whether the existence of strong options prevents the generation of
7998  * a plain filename.
7999  */
8000 static bool append_strong_runtime_options(QDict *d, BlockDriverState *bs)
8001 {
8002     bool found_any = false;
8003     const char *const *option_name = NULL;
8004 
8005     if (!bs->drv) {
8006         return false;
8007     }
8008 
8009     while ((option_name = strong_options(bs, option_name))) {
8010         bool option_given = false;
8011 
8012         assert(strlen(*option_name) > 0);
8013         if ((*option_name)[strlen(*option_name) - 1] != '.') {
8014             QObject *entry = qdict_get(bs->options, *option_name);
8015             if (!entry) {
8016                 continue;
8017             }
8018 
8019             qdict_put_obj(d, *option_name, qobject_ref(entry));
8020             option_given = true;
8021         } else {
8022             const QDictEntry *entry;
8023             for (entry = qdict_first(bs->options); entry;
8024                  entry = qdict_next(bs->options, entry))
8025             {
8026                 if (strstart(qdict_entry_key(entry), *option_name, NULL)) {
8027                     qdict_put_obj(d, qdict_entry_key(entry),
8028                                   qobject_ref(qdict_entry_value(entry)));
8029                     option_given = true;
8030                 }
8031             }
8032         }
8033 
8034         /* While "driver" and "filename" need to be included in a JSON filename,
8035          * their existence does not prohibit generation of a plain filename. */
8036         if (!found_any && option_given &&
8037             strcmp(*option_name, "driver") && strcmp(*option_name, "filename"))
8038         {
8039             found_any = true;
8040         }
8041     }
8042 
8043     if (!qdict_haskey(d, "driver")) {
8044         /* Drivers created with bdrv_new_open_driver() may not have a
8045          * @driver option.  Add it here. */
8046         qdict_put_str(d, "driver", bs->drv->format_name);
8047     }
8048 
8049     return found_any;
8050 }
8051 
8052 /* Note: This function may return false positives; it may return true
8053  * even if opening the backing file specified by bs's image header
8054  * would result in exactly bs->backing. */
8055 static bool bdrv_backing_overridden(BlockDriverState *bs)
8056 {
8057     GLOBAL_STATE_CODE();
8058     if (bs->backing) {
8059         return strcmp(bs->auto_backing_file,
8060                       bs->backing->bs->filename);
8061     } else {
8062         /* No backing BDS, so if the image header reports any backing
8063          * file, it must have been suppressed */
8064         return bs->auto_backing_file[0] != '\0';
8065     }
8066 }
8067 
8068 /* Updates the following BDS fields:
8069  *  - exact_filename: A filename which may be used for opening a block device
8070  *                    which (mostly) equals the given BDS (even without any
8071  *                    other options; so reading and writing must return the same
8072  *                    results, but caching etc. may be different)
8073  *  - full_open_options: Options which, when given when opening a block device
8074  *                       (without a filename), result in a BDS (mostly)
8075  *                       equalling the given one
8076  *  - filename: If exact_filename is set, it is copied here. Otherwise,
8077  *              full_open_options is converted to a JSON object, prefixed with
8078  *              "json:" (for use through the JSON pseudo protocol) and put here.
8079  */
8080 void bdrv_refresh_filename(BlockDriverState *bs)
8081 {
8082     BlockDriver *drv = bs->drv;
8083     BdrvChild *child;
8084     BlockDriverState *primary_child_bs;
8085     QDict *opts;
8086     bool backing_overridden;
8087     bool generate_json_filename; /* Whether our default implementation should
8088                                     fill exact_filename (false) or not (true) */
8089 
8090     GLOBAL_STATE_CODE();
8091 
8092     if (!drv) {
8093         return;
8094     }
8095 
8096     /* This BDS's file name may depend on any of its children's file names, so
8097      * refresh those first */
8098     QLIST_FOREACH(child, &bs->children, next) {
8099         bdrv_refresh_filename(child->bs);
8100     }
8101 
8102     if (bs->implicit) {
8103         /* For implicit nodes, just copy everything from the single child */
8104         child = QLIST_FIRST(&bs->children);
8105         assert(QLIST_NEXT(child, next) == NULL);
8106 
8107         pstrcpy(bs->exact_filename, sizeof(bs->exact_filename),
8108                 child->bs->exact_filename);
8109         pstrcpy(bs->filename, sizeof(bs->filename), child->bs->filename);
8110 
8111         qobject_unref(bs->full_open_options);
8112         bs->full_open_options = qobject_ref(child->bs->full_open_options);
8113 
8114         return;
8115     }
8116 
8117     backing_overridden = bdrv_backing_overridden(bs);
8118 
8119     if (bs->open_flags & BDRV_O_NO_IO) {
8120         /* Without I/O, the backing file does not change anything.
8121          * Therefore, in such a case (primarily qemu-img), we can
8122          * pretend the backing file has not been overridden even if
8123          * it technically has been. */
8124         backing_overridden = false;
8125     }
8126 
8127     /* Gather the options QDict */
8128     opts = qdict_new();
8129     generate_json_filename = append_strong_runtime_options(opts, bs);
8130     generate_json_filename |= backing_overridden;
8131 
8132     if (drv->bdrv_gather_child_options) {
8133         /* Some block drivers may not want to present all of their children's
8134          * options, or name them differently from BdrvChild.name */
8135         drv->bdrv_gather_child_options(bs, opts, backing_overridden);
8136     } else {
8137         QLIST_FOREACH(child, &bs->children, next) {
8138             if (child == bs->backing && !backing_overridden) {
8139                 /* We can skip the backing BDS if it has not been overridden */
8140                 continue;
8141             }
8142 
8143             qdict_put(opts, child->name,
8144                       qobject_ref(child->bs->full_open_options));
8145         }
8146 
8147         if (backing_overridden && !bs->backing) {
8148             /* Force no backing file */
8149             qdict_put_null(opts, "backing");
8150         }
8151     }
8152 
8153     qobject_unref(bs->full_open_options);
8154     bs->full_open_options = opts;
8155 
8156     primary_child_bs = bdrv_primary_bs(bs);
8157 
8158     if (drv->bdrv_refresh_filename) {
8159         /* Obsolete information is of no use here, so drop the old file name
8160          * information before refreshing it */
8161         bs->exact_filename[0] = '\0';
8162 
8163         drv->bdrv_refresh_filename(bs);
8164     } else if (primary_child_bs) {
8165         /*
8166          * Try to reconstruct valid information from the underlying
8167          * file -- this only works for format nodes (filter nodes
8168          * cannot be probed and as such must be selected by the user
8169          * either through an options dict, or through a special
8170          * filename which the filter driver must construct in its
8171          * .bdrv_refresh_filename() implementation).
8172          */
8173 
8174         bs->exact_filename[0] = '\0';
8175 
8176         /*
8177          * We can use the underlying file's filename if:
8178          * - it has a filename,
8179          * - the current BDS is not a filter,
8180          * - the file is a protocol BDS, and
8181          * - opening that file (as this BDS's format) will automatically create
8182          *   the BDS tree we have right now, that is:
8183          *   - the user did not significantly change this BDS's behavior with
8184          *     some explicit (strong) options
8185          *   - no non-file child of this BDS has been overridden by the user
8186          *   Both of these conditions are represented by generate_json_filename.
8187          */
8188         if (primary_child_bs->exact_filename[0] &&
8189             primary_child_bs->drv->bdrv_file_open &&
8190             !drv->is_filter && !generate_json_filename)
8191         {
8192             strcpy(bs->exact_filename, primary_child_bs->exact_filename);
8193         }
8194     }
8195 
8196     if (bs->exact_filename[0]) {
8197         pstrcpy(bs->filename, sizeof(bs->filename), bs->exact_filename);
8198     } else {
8199         GString *json = qobject_to_json(QOBJECT(bs->full_open_options));
8200         if (snprintf(bs->filename, sizeof(bs->filename), "json:%s",
8201                      json->str) >= sizeof(bs->filename)) {
8202             /* Give user a hint if we truncated things. */
8203             strcpy(bs->filename + sizeof(bs->filename) - 4, "...");
8204         }
8205         g_string_free(json, true);
8206     }
8207 }
8208 
8209 char *bdrv_dirname(BlockDriverState *bs, Error **errp)
8210 {
8211     BlockDriver *drv = bs->drv;
8212     BlockDriverState *child_bs;
8213 
8214     GLOBAL_STATE_CODE();
8215 
8216     if (!drv) {
8217         error_setg(errp, "Node '%s' is ejected", bs->node_name);
8218         return NULL;
8219     }
8220 
8221     if (drv->bdrv_dirname) {
8222         return drv->bdrv_dirname(bs, errp);
8223     }
8224 
8225     child_bs = bdrv_primary_bs(bs);
8226     if (child_bs) {
8227         return bdrv_dirname(child_bs, errp);
8228     }
8229 
8230     bdrv_refresh_filename(bs);
8231     if (bs->exact_filename[0] != '\0') {
8232         return path_combine(bs->exact_filename, "");
8233     }
8234 
8235     error_setg(errp, "Cannot generate a base directory for %s nodes",
8236                drv->format_name);
8237     return NULL;
8238 }
8239 
8240 /*
8241  * Hot add/remove a BDS's child. So the user can take a child offline when
8242  * it is broken and take a new child online
8243  */
8244 void bdrv_add_child(BlockDriverState *parent_bs, BlockDriverState *child_bs,
8245                     Error **errp)
8246 {
8247     GLOBAL_STATE_CODE();
8248     if (!parent_bs->drv || !parent_bs->drv->bdrv_add_child) {
8249         error_setg(errp, "The node %s does not support adding a child",
8250                    bdrv_get_device_or_node_name(parent_bs));
8251         return;
8252     }
8253 
8254     /*
8255      * Non-zoned block drivers do not follow zoned storage constraints
8256      * (i.e. sequential writes to zones). Refuse mixing zoned and non-zoned
8257      * drivers in a graph.
8258      */
8259     if (!parent_bs->drv->supports_zoned_children &&
8260         child_bs->bl.zoned == BLK_Z_HM) {
8261         /*
8262          * The host-aware model allows zoned storage constraints and random
8263          * write. Allow mixing host-aware and non-zoned drivers. Using
8264          * host-aware device as a regular device.
8265          */
8266         error_setg(errp, "Cannot add a %s child to a %s parent",
8267                    child_bs->bl.zoned == BLK_Z_HM ? "zoned" : "non-zoned",
8268                    parent_bs->drv->supports_zoned_children ?
8269                    "support zoned children" : "not support zoned children");
8270         return;
8271     }
8272 
8273     if (!QLIST_EMPTY(&child_bs->parents)) {
8274         error_setg(errp, "The node %s already has a parent",
8275                    child_bs->node_name);
8276         return;
8277     }
8278 
8279     parent_bs->drv->bdrv_add_child(parent_bs, child_bs, errp);
8280 }
8281 
8282 void bdrv_del_child(BlockDriverState *parent_bs, BdrvChild *child, Error **errp)
8283 {
8284     BdrvChild *tmp;
8285 
8286     GLOBAL_STATE_CODE();
8287     if (!parent_bs->drv || !parent_bs->drv->bdrv_del_child) {
8288         error_setg(errp, "The node %s does not support removing a child",
8289                    bdrv_get_device_or_node_name(parent_bs));
8290         return;
8291     }
8292 
8293     QLIST_FOREACH(tmp, &parent_bs->children, next) {
8294         if (tmp == child) {
8295             break;
8296         }
8297     }
8298 
8299     if (!tmp) {
8300         error_setg(errp, "The node %s does not have a child named %s",
8301                    bdrv_get_device_or_node_name(parent_bs),
8302                    bdrv_get_device_or_node_name(child->bs));
8303         return;
8304     }
8305 
8306     parent_bs->drv->bdrv_del_child(parent_bs, child, errp);
8307 }
8308 
8309 int bdrv_make_empty(BdrvChild *c, Error **errp)
8310 {
8311     BlockDriver *drv = c->bs->drv;
8312     int ret;
8313 
8314     GLOBAL_STATE_CODE();
8315     assert(c->perm & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED));
8316 
8317     if (!drv->bdrv_make_empty) {
8318         error_setg(errp, "%s does not support emptying nodes",
8319                    drv->format_name);
8320         return -ENOTSUP;
8321     }
8322 
8323     ret = drv->bdrv_make_empty(c->bs);
8324     if (ret < 0) {
8325         error_setg_errno(errp, -ret, "Failed to empty %s",
8326                          c->bs->filename);
8327         return ret;
8328     }
8329 
8330     return 0;
8331 }
8332 
8333 /*
8334  * Return the child that @bs acts as an overlay for, and from which data may be
8335  * copied in COW or COR operations.  Usually this is the backing file.
8336  */
8337 BdrvChild *bdrv_cow_child(BlockDriverState *bs)
8338 {
8339     IO_CODE();
8340 
8341     if (!bs || !bs->drv) {
8342         return NULL;
8343     }
8344 
8345     if (bs->drv->is_filter) {
8346         return NULL;
8347     }
8348 
8349     if (!bs->backing) {
8350         return NULL;
8351     }
8352 
8353     assert(bs->backing->role & BDRV_CHILD_COW);
8354     return bs->backing;
8355 }
8356 
8357 /*
8358  * If @bs acts as a filter for exactly one of its children, return
8359  * that child.
8360  */
8361 BdrvChild *bdrv_filter_child(BlockDriverState *bs)
8362 {
8363     BdrvChild *c;
8364     IO_CODE();
8365 
8366     if (!bs || !bs->drv) {
8367         return NULL;
8368     }
8369 
8370     if (!bs->drv->is_filter) {
8371         return NULL;
8372     }
8373 
8374     /* Only one of @backing or @file may be used */
8375     assert(!(bs->backing && bs->file));
8376 
8377     c = bs->backing ?: bs->file;
8378     if (!c) {
8379         return NULL;
8380     }
8381 
8382     assert(c->role & BDRV_CHILD_FILTERED);
8383     return c;
8384 }
8385 
8386 /*
8387  * Return either the result of bdrv_cow_child() or bdrv_filter_child(),
8388  * whichever is non-NULL.
8389  *
8390  * Return NULL if both are NULL.
8391  */
8392 BdrvChild *bdrv_filter_or_cow_child(BlockDriverState *bs)
8393 {
8394     BdrvChild *cow_child = bdrv_cow_child(bs);
8395     BdrvChild *filter_child = bdrv_filter_child(bs);
8396     IO_CODE();
8397 
8398     /* Filter nodes cannot have COW backing files */
8399     assert(!(cow_child && filter_child));
8400 
8401     return cow_child ?: filter_child;
8402 }
8403 
8404 /*
8405  * Return the primary child of this node: For filters, that is the
8406  * filtered child.  For other nodes, that is usually the child storing
8407  * metadata.
8408  * (A generally more helpful description is that this is (usually) the
8409  * child that has the same filename as @bs.)
8410  *
8411  * Drivers do not necessarily have a primary child; for example quorum
8412  * does not.
8413  */
8414 BdrvChild *bdrv_primary_child(BlockDriverState *bs)
8415 {
8416     BdrvChild *c, *found = NULL;
8417     IO_CODE();
8418 
8419     QLIST_FOREACH(c, &bs->children, next) {
8420         if (c->role & BDRV_CHILD_PRIMARY) {
8421             assert(!found);
8422             found = c;
8423         }
8424     }
8425 
8426     return found;
8427 }
8428 
8429 static BlockDriverState *bdrv_do_skip_filters(BlockDriverState *bs,
8430                                               bool stop_on_explicit_filter)
8431 {
8432     BdrvChild *c;
8433 
8434     if (!bs) {
8435         return NULL;
8436     }
8437 
8438     while (!(stop_on_explicit_filter && !bs->implicit)) {
8439         c = bdrv_filter_child(bs);
8440         if (!c) {
8441             /*
8442              * A filter that is embedded in a working block graph must
8443              * have a child.  Assert this here so this function does
8444              * not return a filter node that is not expected by the
8445              * caller.
8446              */
8447             assert(!bs->drv || !bs->drv->is_filter);
8448             break;
8449         }
8450         bs = c->bs;
8451     }
8452     /*
8453      * Note that this treats nodes with bs->drv == NULL as not being
8454      * filters (bs->drv == NULL should be replaced by something else
8455      * anyway).
8456      * The advantage of this behavior is that this function will thus
8457      * always return a non-NULL value (given a non-NULL @bs).
8458      */
8459 
8460     return bs;
8461 }
8462 
8463 /*
8464  * Return the first BDS that has not been added implicitly or that
8465  * does not have a filtered child down the chain starting from @bs
8466  * (including @bs itself).
8467  */
8468 BlockDriverState *bdrv_skip_implicit_filters(BlockDriverState *bs)
8469 {
8470     GLOBAL_STATE_CODE();
8471     return bdrv_do_skip_filters(bs, true);
8472 }
8473 
8474 /*
8475  * Return the first BDS that does not have a filtered child down the
8476  * chain starting from @bs (including @bs itself).
8477  */
8478 BlockDriverState *bdrv_skip_filters(BlockDriverState *bs)
8479 {
8480     IO_CODE();
8481     return bdrv_do_skip_filters(bs, false);
8482 }
8483 
8484 /*
8485  * For a backing chain, return the first non-filter backing image of
8486  * the first non-filter image.
8487  */
8488 BlockDriverState *bdrv_backing_chain_next(BlockDriverState *bs)
8489 {
8490     IO_CODE();
8491     return bdrv_skip_filters(bdrv_cow_bs(bdrv_skip_filters(bs)));
8492 }
8493 
8494 /**
8495  * Check whether [offset, offset + bytes) overlaps with the cached
8496  * block-status data region.
8497  *
8498  * If so, and @pnum is not NULL, set *pnum to `bsc.data_end - offset`,
8499  * which is what bdrv_bsc_is_data()'s interface needs.
8500  * Otherwise, *pnum is not touched.
8501  */
8502 static bool bdrv_bsc_range_overlaps_locked(BlockDriverState *bs,
8503                                            int64_t offset, int64_t bytes,
8504                                            int64_t *pnum)
8505 {
8506     BdrvBlockStatusCache *bsc = qatomic_rcu_read(&bs->block_status_cache);
8507     bool overlaps;
8508 
8509     overlaps =
8510         qatomic_read(&bsc->valid) &&
8511         ranges_overlap(offset, bytes, bsc->data_start,
8512                        bsc->data_end - bsc->data_start);
8513 
8514     if (overlaps && pnum) {
8515         *pnum = bsc->data_end - offset;
8516     }
8517 
8518     return overlaps;
8519 }
8520 
8521 /**
8522  * See block_int.h for this function's documentation.
8523  */
8524 bool bdrv_bsc_is_data(BlockDriverState *bs, int64_t offset, int64_t *pnum)
8525 {
8526     IO_CODE();
8527     RCU_READ_LOCK_GUARD();
8528     return bdrv_bsc_range_overlaps_locked(bs, offset, 1, pnum);
8529 }
8530 
8531 /**
8532  * See block_int.h for this function's documentation.
8533  */
8534 void bdrv_bsc_invalidate_range(BlockDriverState *bs,
8535                                int64_t offset, int64_t bytes)
8536 {
8537     IO_CODE();
8538     RCU_READ_LOCK_GUARD();
8539 
8540     if (bdrv_bsc_range_overlaps_locked(bs, offset, bytes, NULL)) {
8541         qatomic_set(&bs->block_status_cache->valid, false);
8542     }
8543 }
8544 
8545 /**
8546  * See block_int.h for this function's documentation.
8547  */
8548 void bdrv_bsc_fill(BlockDriverState *bs, int64_t offset, int64_t bytes)
8549 {
8550     BdrvBlockStatusCache *new_bsc = g_new(BdrvBlockStatusCache, 1);
8551     BdrvBlockStatusCache *old_bsc;
8552     IO_CODE();
8553 
8554     *new_bsc = (BdrvBlockStatusCache) {
8555         .valid = true,
8556         .data_start = offset,
8557         .data_end = offset + bytes,
8558     };
8559 
8560     QEMU_LOCK_GUARD(&bs->bsc_modify_lock);
8561 
8562     old_bsc = qatomic_rcu_read(&bs->block_status_cache);
8563     qatomic_rcu_set(&bs->block_status_cache, new_bsc);
8564     if (old_bsc) {
8565         g_free_rcu(old_bsc, rcu);
8566     }
8567 }
8568