xref: /openbmc/qemu/blockdev.c (revision 40f23e4e)
1 /*
2  * QEMU host block devices
3  *
4  * Copyright (c) 2003-2008 Fabrice Bellard
5  *
6  * This work is licensed under the terms of the GNU GPL, version 2 or
7  * later.  See the COPYING file in the top-level directory.
8  *
9  * This file incorporates work covered by the following copyright and
10  * permission notice:
11  *
12  * Copyright (c) 2003-2008 Fabrice Bellard
13  *
14  * Permission is hereby granted, free of charge, to any person obtaining a copy
15  * of this software and associated documentation files (the "Software"), to deal
16  * in the Software without restriction, including without limitation the rights
17  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
18  * copies of the Software, and to permit persons to whom the Software is
19  * furnished to do so, subject to the following conditions:
20  *
21  * The above copyright notice and this permission notice shall be included in
22  * all copies or substantial portions of the Software.
23  *
24  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
25  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
26  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
27  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
28  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
29  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
30  * THE SOFTWARE.
31  */
32 
33 #include "qemu/osdep.h"
34 #include "sysemu/block-backend.h"
35 #include "sysemu/blockdev.h"
36 #include "hw/block/block.h"
37 #include "block/blockjob.h"
38 #include "block/qdict.h"
39 #include "block/throttle-groups.h"
40 #include "monitor/monitor.h"
41 #include "qemu/error-report.h"
42 #include "qemu/option.h"
43 #include "qemu/qemu-print.h"
44 #include "qemu/config-file.h"
45 #include "qapi/qapi-commands-block.h"
46 #include "qapi/qapi-commands-transaction.h"
47 #include "qapi/qapi-visit-block-core.h"
48 #include "qapi/qmp/qdict.h"
49 #include "qapi/qmp/qnum.h"
50 #include "qapi/qmp/qstring.h"
51 #include "qapi/error.h"
52 #include "qapi/qmp/qerror.h"
53 #include "qapi/qmp/qlist.h"
54 #include "qapi/qobject-output-visitor.h"
55 #include "sysemu/sysemu.h"
56 #include "sysemu/iothread.h"
57 #include "block/block_int.h"
58 #include "block/trace.h"
59 #include "sysemu/arch_init.h"
60 #include "sysemu/runstate.h"
61 #include "sysemu/replay.h"
62 #include "qemu/cutils.h"
63 #include "qemu/help_option.h"
64 #include "qemu/main-loop.h"
65 #include "qemu/throttle-options.h"
66 
67 QTAILQ_HEAD(, BlockDriverState) monitor_bdrv_states =
68     QTAILQ_HEAD_INITIALIZER(monitor_bdrv_states);
69 
70 void bdrv_set_monitor_owned(BlockDriverState *bs)
71 {
72     QTAILQ_INSERT_TAIL(&monitor_bdrv_states, bs, monitor_list);
73 }
74 
75 static const char *const if_name[IF_COUNT] = {
76     [IF_NONE] = "none",
77     [IF_IDE] = "ide",
78     [IF_SCSI] = "scsi",
79     [IF_FLOPPY] = "floppy",
80     [IF_PFLASH] = "pflash",
81     [IF_MTD] = "mtd",
82     [IF_SD] = "sd",
83     [IF_VIRTIO] = "virtio",
84     [IF_XEN] = "xen",
85 };
86 
87 static int if_max_devs[IF_COUNT] = {
88     /*
89      * Do not change these numbers!  They govern how drive option
90      * index maps to unit and bus.  That mapping is ABI.
91      *
92      * All controllers used to implement if=T drives need to support
93      * if_max_devs[T] units, for any T with if_max_devs[T] != 0.
94      * Otherwise, some index values map to "impossible" bus, unit
95      * values.
96      *
97      * For instance, if you change [IF_SCSI] to 255, -drive
98      * if=scsi,index=12 no longer means bus=1,unit=5, but
99      * bus=0,unit=12.  With an lsi53c895a controller (7 units max),
100      * the drive can't be set up.  Regression.
101      */
102     [IF_IDE] = 2,
103     [IF_SCSI] = 7,
104 };
105 
106 /**
107  * Boards may call this to offer board-by-board overrides
108  * of the default, global values.
109  */
110 void override_max_devs(BlockInterfaceType type, int max_devs)
111 {
112     BlockBackend *blk;
113     DriveInfo *dinfo;
114 
115     if (max_devs <= 0) {
116         return;
117     }
118 
119     for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {
120         dinfo = blk_legacy_dinfo(blk);
121         if (dinfo->type == type) {
122             fprintf(stderr, "Cannot override units-per-bus property of"
123                     " the %s interface, because a drive of that type has"
124                     " already been added.\n", if_name[type]);
125             g_assert_not_reached();
126         }
127     }
128 
129     if_max_devs[type] = max_devs;
130 }
131 
132 /*
133  * We automatically delete the drive when a device using it gets
134  * unplugged.  Questionable feature, but we can't just drop it.
135  * Device models call blockdev_mark_auto_del() to schedule the
136  * automatic deletion, and generic qdev code calls blockdev_auto_del()
137  * when deletion is actually safe.
138  */
139 void blockdev_mark_auto_del(BlockBackend *blk)
140 {
141     DriveInfo *dinfo = blk_legacy_dinfo(blk);
142     BlockJob *job;
143 
144     if (!dinfo) {
145         return;
146     }
147 
148     for (job = block_job_next(NULL); job; job = block_job_next(job)) {
149         if (block_job_has_bdrv(job, blk_bs(blk))) {
150             AioContext *aio_context = job->job.aio_context;
151             aio_context_acquire(aio_context);
152 
153             job_cancel(&job->job, false);
154 
155             aio_context_release(aio_context);
156         }
157     }
158 
159     dinfo->auto_del = 1;
160 }
161 
162 void blockdev_auto_del(BlockBackend *blk)
163 {
164     DriveInfo *dinfo = blk_legacy_dinfo(blk);
165 
166     if (dinfo && dinfo->auto_del) {
167         monitor_remove_blk(blk);
168         blk_unref(blk);
169     }
170 }
171 
172 /**
173  * Returns the current mapping of how many units per bus
174  * a particular interface can support.
175  *
176  *  A positive integer indicates n units per bus.
177  *  0 implies the mapping has not been established.
178  * -1 indicates an invalid BlockInterfaceType was given.
179  */
180 int drive_get_max_devs(BlockInterfaceType type)
181 {
182     if (type >= IF_IDE && type < IF_COUNT) {
183         return if_max_devs[type];
184     }
185 
186     return -1;
187 }
188 
189 static int drive_index_to_bus_id(BlockInterfaceType type, int index)
190 {
191     int max_devs = if_max_devs[type];
192     return max_devs ? index / max_devs : 0;
193 }
194 
195 static int drive_index_to_unit_id(BlockInterfaceType type, int index)
196 {
197     int max_devs = if_max_devs[type];
198     return max_devs ? index % max_devs : index;
199 }
200 
201 QemuOpts *drive_def(const char *optstr)
202 {
203     return qemu_opts_parse_noisily(qemu_find_opts("drive"), optstr, false);
204 }
205 
206 QemuOpts *drive_add(BlockInterfaceType type, int index, const char *file,
207                     const char *optstr)
208 {
209     QemuOpts *opts;
210 
211     opts = drive_def(optstr);
212     if (!opts) {
213         return NULL;
214     }
215     if (type != IF_DEFAULT) {
216         qemu_opt_set(opts, "if", if_name[type], &error_abort);
217     }
218     if (index >= 0) {
219         qemu_opt_set_number(opts, "index", index, &error_abort);
220     }
221     if (file)
222         qemu_opt_set(opts, "file", file, &error_abort);
223     return opts;
224 }
225 
226 DriveInfo *drive_get(BlockInterfaceType type, int bus, int unit)
227 {
228     BlockBackend *blk;
229     DriveInfo *dinfo;
230 
231     for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {
232         dinfo = blk_legacy_dinfo(blk);
233         if (dinfo && dinfo->type == type
234             && dinfo->bus == bus && dinfo->unit == unit) {
235             return dinfo;
236         }
237     }
238 
239     return NULL;
240 }
241 
242 /*
243  * Check board claimed all -drive that are meant to be claimed.
244  * Fatal error if any remain unclaimed.
245  */
246 void drive_check_orphaned(void)
247 {
248     BlockBackend *blk;
249     DriveInfo *dinfo;
250     Location loc;
251     bool orphans = false;
252 
253     for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {
254         dinfo = blk_legacy_dinfo(blk);
255         /*
256          * Ignore default drives, because we create certain default
257          * drives unconditionally, then leave them unclaimed.  Not the
258          * users fault.
259          * Ignore IF_VIRTIO, because it gets desugared into -device,
260          * so we can leave failing to -device.
261          * Ignore IF_NONE, because leaving unclaimed IF_NONE remains
262          * available for device_add is a feature.
263          */
264         if (dinfo->is_default || dinfo->type == IF_VIRTIO
265             || dinfo->type == IF_NONE) {
266             continue;
267         }
268         if (!blk_get_attached_dev(blk)) {
269             loc_push_none(&loc);
270             qemu_opts_loc_restore(dinfo->opts);
271             error_report("machine type does not support"
272                          " if=%s,bus=%d,unit=%d",
273                          if_name[dinfo->type], dinfo->bus, dinfo->unit);
274             loc_pop(&loc);
275             orphans = true;
276         }
277     }
278 
279     if (orphans) {
280         exit(1);
281     }
282 }
283 
284 DriveInfo *drive_get_by_index(BlockInterfaceType type, int index)
285 {
286     return drive_get(type,
287                      drive_index_to_bus_id(type, index),
288                      drive_index_to_unit_id(type, index));
289 }
290 
291 int drive_get_max_bus(BlockInterfaceType type)
292 {
293     int max_bus;
294     BlockBackend *blk;
295     DriveInfo *dinfo;
296 
297     max_bus = -1;
298     for (blk = blk_next(NULL); blk; blk = blk_next(blk)) {
299         dinfo = blk_legacy_dinfo(blk);
300         if (dinfo && dinfo->type == type && dinfo->bus > max_bus) {
301             max_bus = dinfo->bus;
302         }
303     }
304     return max_bus;
305 }
306 
307 /* Get a block device.  This should only be used for single-drive devices
308    (e.g. SD/Floppy/MTD).  Multi-disk devices (scsi/ide) should use the
309    appropriate bus.  */
310 DriveInfo *drive_get_next(BlockInterfaceType type)
311 {
312     static int next_block_unit[IF_COUNT];
313 
314     return drive_get(type, 0, next_block_unit[type]++);
315 }
316 
317 static void bdrv_format_print(void *opaque, const char *name)
318 {
319     qemu_printf(" %s", name);
320 }
321 
322 typedef struct {
323     QEMUBH *bh;
324     BlockDriverState *bs;
325 } BDRVPutRefBH;
326 
327 static int parse_block_error_action(const char *buf, bool is_read, Error **errp)
328 {
329     if (!strcmp(buf, "ignore")) {
330         return BLOCKDEV_ON_ERROR_IGNORE;
331     } else if (!is_read && !strcmp(buf, "enospc")) {
332         return BLOCKDEV_ON_ERROR_ENOSPC;
333     } else if (!strcmp(buf, "stop")) {
334         return BLOCKDEV_ON_ERROR_STOP;
335     } else if (!strcmp(buf, "report")) {
336         return BLOCKDEV_ON_ERROR_REPORT;
337     } else {
338         error_setg(errp, "'%s' invalid %s error action",
339                    buf, is_read ? "read" : "write");
340         return -1;
341     }
342 }
343 
344 static bool parse_stats_intervals(BlockAcctStats *stats, QList *intervals,
345                                   Error **errp)
346 {
347     const QListEntry *entry;
348     for (entry = qlist_first(intervals); entry; entry = qlist_next(entry)) {
349         switch (qobject_type(entry->value)) {
350 
351         case QTYPE_QSTRING: {
352             unsigned long long length;
353             const char *str = qstring_get_str(qobject_to(QString,
354                                                          entry->value));
355             if (parse_uint_full(str, &length, 10) == 0 &&
356                 length > 0 && length <= UINT_MAX) {
357                 block_acct_add_interval(stats, (unsigned) length);
358             } else {
359                 error_setg(errp, "Invalid interval length: %s", str);
360                 return false;
361             }
362             break;
363         }
364 
365         case QTYPE_QNUM: {
366             int64_t length = qnum_get_int(qobject_to(QNum, entry->value));
367 
368             if (length > 0 && length <= UINT_MAX) {
369                 block_acct_add_interval(stats, (unsigned) length);
370             } else {
371                 error_setg(errp, "Invalid interval length: %" PRId64, length);
372                 return false;
373             }
374             break;
375         }
376 
377         default:
378             error_setg(errp, "The specification of stats-intervals is invalid");
379             return false;
380         }
381     }
382     return true;
383 }
384 
385 typedef enum { MEDIA_DISK, MEDIA_CDROM } DriveMediaType;
386 
387 /* All parameters but @opts are optional and may be set to NULL. */
388 static void extract_common_blockdev_options(QemuOpts *opts, int *bdrv_flags,
389     const char **throttling_group, ThrottleConfig *throttle_cfg,
390     BlockdevDetectZeroesOptions *detect_zeroes, Error **errp)
391 {
392     Error *local_error = NULL;
393     const char *aio;
394 
395     if (bdrv_flags) {
396         if (qemu_opt_get_bool(opts, "copy-on-read", false)) {
397             *bdrv_flags |= BDRV_O_COPY_ON_READ;
398         }
399 
400         if ((aio = qemu_opt_get(opts, "aio")) != NULL) {
401             if (bdrv_parse_aio(aio, bdrv_flags) < 0) {
402                 error_setg(errp, "invalid aio option");
403                 return;
404             }
405         }
406     }
407 
408     /* disk I/O throttling */
409     if (throttling_group) {
410         *throttling_group = qemu_opt_get(opts, "throttling.group");
411     }
412 
413     if (throttle_cfg) {
414         throttle_config_init(throttle_cfg);
415         throttle_cfg->buckets[THROTTLE_BPS_TOTAL].avg =
416             qemu_opt_get_number(opts, "throttling.bps-total", 0);
417         throttle_cfg->buckets[THROTTLE_BPS_READ].avg  =
418             qemu_opt_get_number(opts, "throttling.bps-read", 0);
419         throttle_cfg->buckets[THROTTLE_BPS_WRITE].avg =
420             qemu_opt_get_number(opts, "throttling.bps-write", 0);
421         throttle_cfg->buckets[THROTTLE_OPS_TOTAL].avg =
422             qemu_opt_get_number(opts, "throttling.iops-total", 0);
423         throttle_cfg->buckets[THROTTLE_OPS_READ].avg =
424             qemu_opt_get_number(opts, "throttling.iops-read", 0);
425         throttle_cfg->buckets[THROTTLE_OPS_WRITE].avg =
426             qemu_opt_get_number(opts, "throttling.iops-write", 0);
427 
428         throttle_cfg->buckets[THROTTLE_BPS_TOTAL].max =
429             qemu_opt_get_number(opts, "throttling.bps-total-max", 0);
430         throttle_cfg->buckets[THROTTLE_BPS_READ].max  =
431             qemu_opt_get_number(opts, "throttling.bps-read-max", 0);
432         throttle_cfg->buckets[THROTTLE_BPS_WRITE].max =
433             qemu_opt_get_number(opts, "throttling.bps-write-max", 0);
434         throttle_cfg->buckets[THROTTLE_OPS_TOTAL].max =
435             qemu_opt_get_number(opts, "throttling.iops-total-max", 0);
436         throttle_cfg->buckets[THROTTLE_OPS_READ].max =
437             qemu_opt_get_number(opts, "throttling.iops-read-max", 0);
438         throttle_cfg->buckets[THROTTLE_OPS_WRITE].max =
439             qemu_opt_get_number(opts, "throttling.iops-write-max", 0);
440 
441         throttle_cfg->buckets[THROTTLE_BPS_TOTAL].burst_length =
442             qemu_opt_get_number(opts, "throttling.bps-total-max-length", 1);
443         throttle_cfg->buckets[THROTTLE_BPS_READ].burst_length  =
444             qemu_opt_get_number(opts, "throttling.bps-read-max-length", 1);
445         throttle_cfg->buckets[THROTTLE_BPS_WRITE].burst_length =
446             qemu_opt_get_number(opts, "throttling.bps-write-max-length", 1);
447         throttle_cfg->buckets[THROTTLE_OPS_TOTAL].burst_length =
448             qemu_opt_get_number(opts, "throttling.iops-total-max-length", 1);
449         throttle_cfg->buckets[THROTTLE_OPS_READ].burst_length =
450             qemu_opt_get_number(opts, "throttling.iops-read-max-length", 1);
451         throttle_cfg->buckets[THROTTLE_OPS_WRITE].burst_length =
452             qemu_opt_get_number(opts, "throttling.iops-write-max-length", 1);
453 
454         throttle_cfg->op_size =
455             qemu_opt_get_number(opts, "throttling.iops-size", 0);
456 
457         if (!throttle_is_valid(throttle_cfg, errp)) {
458             return;
459         }
460     }
461 
462     if (detect_zeroes) {
463         *detect_zeroes =
464             qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup,
465                             qemu_opt_get(opts, "detect-zeroes"),
466                             BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF,
467                             &local_error);
468         if (local_error) {
469             error_propagate(errp, local_error);
470             return;
471         }
472     }
473 }
474 
475 /* Takes the ownership of bs_opts */
476 static BlockBackend *blockdev_init(const char *file, QDict *bs_opts,
477                                    Error **errp)
478 {
479     const char *buf;
480     int bdrv_flags = 0;
481     int on_read_error, on_write_error;
482     bool account_invalid, account_failed;
483     bool writethrough, read_only;
484     BlockBackend *blk;
485     BlockDriverState *bs;
486     ThrottleConfig cfg;
487     int snapshot = 0;
488     Error *error = NULL;
489     QemuOpts *opts;
490     QDict *interval_dict = NULL;
491     QList *interval_list = NULL;
492     const char *id;
493     BlockdevDetectZeroesOptions detect_zeroes =
494         BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF;
495     const char *throttling_group = NULL;
496 
497     /* Check common options by copying from bs_opts to opts, all other options
498      * stay in bs_opts for processing by bdrv_open(). */
499     id = qdict_get_try_str(bs_opts, "id");
500     opts = qemu_opts_create(&qemu_common_drive_opts, id, 1, errp);
501     if (!opts) {
502         goto err_no_opts;
503     }
504 
505     if (!qemu_opts_absorb_qdict(opts, bs_opts, errp)) {
506         goto early_err;
507     }
508 
509     if (id) {
510         qdict_del(bs_opts, "id");
511     }
512 
513     /* extract parameters */
514     snapshot = qemu_opt_get_bool(opts, "snapshot", 0);
515 
516     account_invalid = qemu_opt_get_bool(opts, "stats-account-invalid", true);
517     account_failed = qemu_opt_get_bool(opts, "stats-account-failed", true);
518 
519     writethrough = !qemu_opt_get_bool(opts, BDRV_OPT_CACHE_WB, true);
520 
521     id = qemu_opts_id(opts);
522 
523     qdict_extract_subqdict(bs_opts, &interval_dict, "stats-intervals.");
524     qdict_array_split(interval_dict, &interval_list);
525 
526     if (qdict_size(interval_dict) != 0) {
527         error_setg(errp, "Invalid option stats-intervals.%s",
528                    qdict_first(interval_dict)->key);
529         goto early_err;
530     }
531 
532     extract_common_blockdev_options(opts, &bdrv_flags, &throttling_group, &cfg,
533                                     &detect_zeroes, &error);
534     if (error) {
535         error_propagate(errp, error);
536         goto early_err;
537     }
538 
539     if ((buf = qemu_opt_get(opts, "format")) != NULL) {
540         if (is_help_option(buf)) {
541             qemu_printf("Supported formats:");
542             bdrv_iterate_format(bdrv_format_print, NULL, false);
543             qemu_printf("\nSupported formats (read-only):");
544             bdrv_iterate_format(bdrv_format_print, NULL, true);
545             qemu_printf("\n");
546             goto early_err;
547         }
548 
549         if (qdict_haskey(bs_opts, "driver")) {
550             error_setg(errp, "Cannot specify both 'driver' and 'format'");
551             goto early_err;
552         }
553         qdict_put_str(bs_opts, "driver", buf);
554     }
555 
556     on_write_error = BLOCKDEV_ON_ERROR_ENOSPC;
557     if ((buf = qemu_opt_get(opts, "werror")) != NULL) {
558         on_write_error = parse_block_error_action(buf, 0, &error);
559         if (error) {
560             error_propagate(errp, error);
561             goto early_err;
562         }
563     }
564 
565     on_read_error = BLOCKDEV_ON_ERROR_REPORT;
566     if ((buf = qemu_opt_get(opts, "rerror")) != NULL) {
567         on_read_error = parse_block_error_action(buf, 1, &error);
568         if (error) {
569             error_propagate(errp, error);
570             goto early_err;
571         }
572     }
573 
574     if (snapshot) {
575         bdrv_flags |= BDRV_O_SNAPSHOT;
576     }
577 
578     read_only = qemu_opt_get_bool(opts, BDRV_OPT_READ_ONLY, false);
579 
580     /* init */
581     if ((!file || !*file) && !qdict_size(bs_opts)) {
582         BlockBackendRootState *blk_rs;
583 
584         blk = blk_new(qemu_get_aio_context(), 0, BLK_PERM_ALL);
585         blk_rs = blk_get_root_state(blk);
586         blk_rs->open_flags    = bdrv_flags | (read_only ? 0 : BDRV_O_RDWR);
587         blk_rs->detect_zeroes = detect_zeroes;
588 
589         qobject_unref(bs_opts);
590     } else {
591         if (file && !*file) {
592             file = NULL;
593         }
594 
595         /* bdrv_open() defaults to the values in bdrv_flags (for compatibility
596          * with other callers) rather than what we want as the real defaults.
597          * Apply the defaults here instead. */
598         qdict_set_default_str(bs_opts, BDRV_OPT_CACHE_DIRECT, "off");
599         qdict_set_default_str(bs_opts, BDRV_OPT_CACHE_NO_FLUSH, "off");
600         qdict_set_default_str(bs_opts, BDRV_OPT_READ_ONLY,
601                               read_only ? "on" : "off");
602         qdict_set_default_str(bs_opts, BDRV_OPT_AUTO_READ_ONLY, "on");
603         assert((bdrv_flags & BDRV_O_CACHE_MASK) == 0);
604 
605         if (runstate_check(RUN_STATE_INMIGRATE)) {
606             bdrv_flags |= BDRV_O_INACTIVE;
607         }
608 
609         blk = blk_new_open(file, NULL, bs_opts, bdrv_flags, errp);
610         if (!blk) {
611             goto err_no_bs_opts;
612         }
613         bs = blk_bs(blk);
614 
615         bs->detect_zeroes = detect_zeroes;
616 
617         block_acct_setup(blk_get_stats(blk), account_invalid, account_failed);
618 
619         if (!parse_stats_intervals(blk_get_stats(blk), interval_list, errp)) {
620             blk_unref(blk);
621             blk = NULL;
622             goto err_no_bs_opts;
623         }
624     }
625 
626     /* disk I/O throttling */
627     if (throttle_enabled(&cfg)) {
628         if (!throttling_group) {
629             throttling_group = id;
630         }
631         blk_io_limits_enable(blk, throttling_group);
632         blk_set_io_limits(blk, &cfg);
633     }
634 
635     blk_set_enable_write_cache(blk, !writethrough);
636     blk_set_on_error(blk, on_read_error, on_write_error);
637 
638     if (!monitor_add_blk(blk, id, errp)) {
639         blk_unref(blk);
640         blk = NULL;
641         goto err_no_bs_opts;
642     }
643 
644 err_no_bs_opts:
645     qemu_opts_del(opts);
646     qobject_unref(interval_dict);
647     qobject_unref(interval_list);
648     return blk;
649 
650 early_err:
651     qemu_opts_del(opts);
652     qobject_unref(interval_dict);
653     qobject_unref(interval_list);
654 err_no_opts:
655     qobject_unref(bs_opts);
656     return NULL;
657 }
658 
659 /* Takes the ownership of bs_opts */
660 BlockDriverState *bds_tree_init(QDict *bs_opts, Error **errp)
661 {
662     int bdrv_flags = 0;
663 
664     /* bdrv_open() defaults to the values in bdrv_flags (for compatibility
665      * with other callers) rather than what we want as the real defaults.
666      * Apply the defaults here instead. */
667     qdict_set_default_str(bs_opts, BDRV_OPT_CACHE_DIRECT, "off");
668     qdict_set_default_str(bs_opts, BDRV_OPT_CACHE_NO_FLUSH, "off");
669     qdict_set_default_str(bs_opts, BDRV_OPT_READ_ONLY, "off");
670 
671     if (runstate_check(RUN_STATE_INMIGRATE)) {
672         bdrv_flags |= BDRV_O_INACTIVE;
673     }
674 
675     return bdrv_open(NULL, NULL, bs_opts, bdrv_flags, errp);
676 }
677 
678 void blockdev_close_all_bdrv_states(void)
679 {
680     BlockDriverState *bs, *next_bs;
681 
682     QTAILQ_FOREACH_SAFE(bs, &monitor_bdrv_states, monitor_list, next_bs) {
683         AioContext *ctx = bdrv_get_aio_context(bs);
684 
685         aio_context_acquire(ctx);
686         bdrv_unref(bs);
687         aio_context_release(ctx);
688     }
689 }
690 
691 /* Iterates over the list of monitor-owned BlockDriverStates */
692 BlockDriverState *bdrv_next_monitor_owned(BlockDriverState *bs)
693 {
694     return bs ? QTAILQ_NEXT(bs, monitor_list)
695               : QTAILQ_FIRST(&monitor_bdrv_states);
696 }
697 
698 static bool qemu_opt_rename(QemuOpts *opts, const char *from, const char *to,
699                             Error **errp)
700 {
701     const char *value;
702 
703     value = qemu_opt_get(opts, from);
704     if (value) {
705         if (qemu_opt_find(opts, to)) {
706             error_setg(errp, "'%s' and its alias '%s' can't be used at the "
707                        "same time", to, from);
708             return false;
709         }
710     }
711 
712     /* rename all items in opts */
713     while ((value = qemu_opt_get(opts, from))) {
714         qemu_opt_set(opts, to, value, &error_abort);
715         qemu_opt_unset(opts, from);
716     }
717     return true;
718 }
719 
720 QemuOptsList qemu_legacy_drive_opts = {
721     .name = "drive",
722     .head = QTAILQ_HEAD_INITIALIZER(qemu_legacy_drive_opts.head),
723     .desc = {
724         {
725             .name = "bus",
726             .type = QEMU_OPT_NUMBER,
727             .help = "bus number",
728         },{
729             .name = "unit",
730             .type = QEMU_OPT_NUMBER,
731             .help = "unit number (i.e. lun for scsi)",
732         },{
733             .name = "index",
734             .type = QEMU_OPT_NUMBER,
735             .help = "index number",
736         },{
737             .name = "media",
738             .type = QEMU_OPT_STRING,
739             .help = "media type (disk, cdrom)",
740         },{
741             .name = "if",
742             .type = QEMU_OPT_STRING,
743             .help = "interface (ide, scsi, sd, mtd, floppy, pflash, virtio)",
744         },{
745             .name = "file",
746             .type = QEMU_OPT_STRING,
747             .help = "file name",
748         },
749 
750         /* Options that are passed on, but have special semantics with -drive */
751         {
752             .name = BDRV_OPT_READ_ONLY,
753             .type = QEMU_OPT_BOOL,
754             .help = "open drive file as read-only",
755         },{
756             .name = "rerror",
757             .type = QEMU_OPT_STRING,
758             .help = "read error action",
759         },{
760             .name = "werror",
761             .type = QEMU_OPT_STRING,
762             .help = "write error action",
763         },{
764             .name = "copy-on-read",
765             .type = QEMU_OPT_BOOL,
766             .help = "copy read data from backing file into image file",
767         },
768 
769         { /* end of list */ }
770     },
771 };
772 
773 DriveInfo *drive_new(QemuOpts *all_opts, BlockInterfaceType block_default_type,
774                      Error **errp)
775 {
776     const char *value;
777     BlockBackend *blk;
778     DriveInfo *dinfo = NULL;
779     QDict *bs_opts;
780     QemuOpts *legacy_opts;
781     DriveMediaType media = MEDIA_DISK;
782     BlockInterfaceType type;
783     int max_devs, bus_id, unit_id, index;
784     const char *werror, *rerror;
785     bool read_only = false;
786     bool copy_on_read;
787     const char *filename;
788     int i;
789 
790     /* Change legacy command line options into QMP ones */
791     static const struct {
792         const char *from;
793         const char *to;
794     } opt_renames[] = {
795         { "iops",           "throttling.iops-total" },
796         { "iops_rd",        "throttling.iops-read" },
797         { "iops_wr",        "throttling.iops-write" },
798 
799         { "bps",            "throttling.bps-total" },
800         { "bps_rd",         "throttling.bps-read" },
801         { "bps_wr",         "throttling.bps-write" },
802 
803         { "iops_max",       "throttling.iops-total-max" },
804         { "iops_rd_max",    "throttling.iops-read-max" },
805         { "iops_wr_max",    "throttling.iops-write-max" },
806 
807         { "bps_max",        "throttling.bps-total-max" },
808         { "bps_rd_max",     "throttling.bps-read-max" },
809         { "bps_wr_max",     "throttling.bps-write-max" },
810 
811         { "iops_size",      "throttling.iops-size" },
812 
813         { "group",          "throttling.group" },
814 
815         { "readonly",       BDRV_OPT_READ_ONLY },
816     };
817 
818     for (i = 0; i < ARRAY_SIZE(opt_renames); i++) {
819         if (!qemu_opt_rename(all_opts, opt_renames[i].from,
820                              opt_renames[i].to, errp)) {
821             return NULL;
822         }
823     }
824 
825     value = qemu_opt_get(all_opts, "cache");
826     if (value) {
827         int flags = 0;
828         bool writethrough;
829 
830         if (bdrv_parse_cache_mode(value, &flags, &writethrough) != 0) {
831             error_setg(errp, "invalid cache option");
832             return NULL;
833         }
834 
835         /* Specific options take precedence */
836         if (!qemu_opt_get(all_opts, BDRV_OPT_CACHE_WB)) {
837             qemu_opt_set_bool(all_opts, BDRV_OPT_CACHE_WB,
838                               !writethrough, &error_abort);
839         }
840         if (!qemu_opt_get(all_opts, BDRV_OPT_CACHE_DIRECT)) {
841             qemu_opt_set_bool(all_opts, BDRV_OPT_CACHE_DIRECT,
842                               !!(flags & BDRV_O_NOCACHE), &error_abort);
843         }
844         if (!qemu_opt_get(all_opts, BDRV_OPT_CACHE_NO_FLUSH)) {
845             qemu_opt_set_bool(all_opts, BDRV_OPT_CACHE_NO_FLUSH,
846                               !!(flags & BDRV_O_NO_FLUSH), &error_abort);
847         }
848         qemu_opt_unset(all_opts, "cache");
849     }
850 
851     /* Get a QDict for processing the options */
852     bs_opts = qdict_new();
853     qemu_opts_to_qdict(all_opts, bs_opts);
854 
855     legacy_opts = qemu_opts_create(&qemu_legacy_drive_opts, NULL, 0,
856                                    &error_abort);
857     if (!qemu_opts_absorb_qdict(legacy_opts, bs_opts, errp)) {
858         goto fail;
859     }
860 
861     /* Media type */
862     value = qemu_opt_get(legacy_opts, "media");
863     if (value) {
864         if (!strcmp(value, "disk")) {
865             media = MEDIA_DISK;
866         } else if (!strcmp(value, "cdrom")) {
867             media = MEDIA_CDROM;
868             read_only = true;
869         } else {
870             error_setg(errp, "'%s' invalid media", value);
871             goto fail;
872         }
873     }
874 
875     /* copy-on-read is disabled with a warning for read-only devices */
876     read_only |= qemu_opt_get_bool(legacy_opts, BDRV_OPT_READ_ONLY, false);
877     copy_on_read = qemu_opt_get_bool(legacy_opts, "copy-on-read", false);
878 
879     if (read_only && copy_on_read) {
880         warn_report("disabling copy-on-read on read-only drive");
881         copy_on_read = false;
882     }
883 
884     qdict_put_str(bs_opts, BDRV_OPT_READ_ONLY, read_only ? "on" : "off");
885     qdict_put_str(bs_opts, "copy-on-read", copy_on_read ? "on" : "off");
886 
887     /* Controller type */
888     value = qemu_opt_get(legacy_opts, "if");
889     if (value) {
890         for (type = 0;
891              type < IF_COUNT && strcmp(value, if_name[type]);
892              type++) {
893         }
894         if (type == IF_COUNT) {
895             error_setg(errp, "unsupported bus type '%s'", value);
896             goto fail;
897         }
898     } else {
899         type = block_default_type;
900     }
901 
902     /* Device address specified by bus/unit or index.
903      * If none was specified, try to find the first free one. */
904     bus_id  = qemu_opt_get_number(legacy_opts, "bus", 0);
905     unit_id = qemu_opt_get_number(legacy_opts, "unit", -1);
906     index   = qemu_opt_get_number(legacy_opts, "index", -1);
907 
908     max_devs = if_max_devs[type];
909 
910     if (index != -1) {
911         if (bus_id != 0 || unit_id != -1) {
912             error_setg(errp, "index cannot be used with bus and unit");
913             goto fail;
914         }
915         bus_id = drive_index_to_bus_id(type, index);
916         unit_id = drive_index_to_unit_id(type, index);
917     }
918 
919     if (unit_id == -1) {
920        unit_id = 0;
921        while (drive_get(type, bus_id, unit_id) != NULL) {
922            unit_id++;
923            if (max_devs && unit_id >= max_devs) {
924                unit_id -= max_devs;
925                bus_id++;
926            }
927        }
928     }
929 
930     if (max_devs && unit_id >= max_devs) {
931         error_setg(errp, "unit %d too big (max is %d)", unit_id, max_devs - 1);
932         goto fail;
933     }
934 
935     if (drive_get(type, bus_id, unit_id) != NULL) {
936         error_setg(errp, "drive with bus=%d, unit=%d (index=%d) exists",
937                    bus_id, unit_id, index);
938         goto fail;
939     }
940 
941     /* no id supplied -> create one */
942     if (qemu_opts_id(all_opts) == NULL) {
943         char *new_id;
944         const char *mediastr = "";
945         if (type == IF_IDE || type == IF_SCSI) {
946             mediastr = (media == MEDIA_CDROM) ? "-cd" : "-hd";
947         }
948         if (max_devs) {
949             new_id = g_strdup_printf("%s%i%s%i", if_name[type], bus_id,
950                                      mediastr, unit_id);
951         } else {
952             new_id = g_strdup_printf("%s%s%i", if_name[type],
953                                      mediastr, unit_id);
954         }
955         qdict_put_str(bs_opts, "id", new_id);
956         g_free(new_id);
957     }
958 
959     /* Add virtio block device */
960     if (type == IF_VIRTIO) {
961         QemuOpts *devopts;
962         devopts = qemu_opts_create(qemu_find_opts("device"), NULL, 0,
963                                    &error_abort);
964         qemu_opt_set(devopts, "driver", "virtio-blk", &error_abort);
965         qemu_opt_set(devopts, "drive", qdict_get_str(bs_opts, "id"),
966                      &error_abort);
967     }
968 
969     filename = qemu_opt_get(legacy_opts, "file");
970 
971     /* Check werror/rerror compatibility with if=... */
972     werror = qemu_opt_get(legacy_opts, "werror");
973     if (werror != NULL) {
974         if (type != IF_IDE && type != IF_SCSI && type != IF_VIRTIO &&
975             type != IF_NONE) {
976             error_setg(errp, "werror is not supported by this bus type");
977             goto fail;
978         }
979         qdict_put_str(bs_opts, "werror", werror);
980     }
981 
982     rerror = qemu_opt_get(legacy_opts, "rerror");
983     if (rerror != NULL) {
984         if (type != IF_IDE && type != IF_VIRTIO && type != IF_SCSI &&
985             type != IF_NONE) {
986             error_setg(errp, "rerror is not supported by this bus type");
987             goto fail;
988         }
989         qdict_put_str(bs_opts, "rerror", rerror);
990     }
991 
992     /* Actual block device init: Functionality shared with blockdev-add */
993     blk = blockdev_init(filename, bs_opts, errp);
994     bs_opts = NULL;
995     if (!blk) {
996         goto fail;
997     }
998 
999     /* Create legacy DriveInfo */
1000     dinfo = g_malloc0(sizeof(*dinfo));
1001     dinfo->opts = all_opts;
1002 
1003     dinfo->type = type;
1004     dinfo->bus = bus_id;
1005     dinfo->unit = unit_id;
1006 
1007     blk_set_legacy_dinfo(blk, dinfo);
1008 
1009     switch(type) {
1010     case IF_IDE:
1011     case IF_SCSI:
1012     case IF_XEN:
1013     case IF_NONE:
1014         dinfo->media_cd = media == MEDIA_CDROM;
1015         break;
1016     default:
1017         break;
1018     }
1019 
1020 fail:
1021     qemu_opts_del(legacy_opts);
1022     qobject_unref(bs_opts);
1023     return dinfo;
1024 }
1025 
1026 static BlockDriverState *qmp_get_root_bs(const char *name, Error **errp)
1027 {
1028     BlockDriverState *bs;
1029 
1030     bs = bdrv_lookup_bs(name, name, errp);
1031     if (bs == NULL) {
1032         return NULL;
1033     }
1034 
1035     if (!bdrv_is_root_node(bs)) {
1036         error_setg(errp, "Need a root block node");
1037         return NULL;
1038     }
1039 
1040     if (!bdrv_is_inserted(bs)) {
1041         error_setg(errp, "Device has no medium");
1042         return NULL;
1043     }
1044 
1045     return bs;
1046 }
1047 
1048 static void blockdev_do_action(TransactionAction *action, Error **errp)
1049 {
1050     TransactionActionList list;
1051 
1052     list.value = action;
1053     list.next = NULL;
1054     qmp_transaction(&list, false, NULL, errp);
1055 }
1056 
1057 void qmp_blockdev_snapshot_sync(bool has_device, const char *device,
1058                                 bool has_node_name, const char *node_name,
1059                                 const char *snapshot_file,
1060                                 bool has_snapshot_node_name,
1061                                 const char *snapshot_node_name,
1062                                 bool has_format, const char *format,
1063                                 bool has_mode, NewImageMode mode, Error **errp)
1064 {
1065     BlockdevSnapshotSync snapshot = {
1066         .has_device = has_device,
1067         .device = (char *) device,
1068         .has_node_name = has_node_name,
1069         .node_name = (char *) node_name,
1070         .snapshot_file = (char *) snapshot_file,
1071         .has_snapshot_node_name = has_snapshot_node_name,
1072         .snapshot_node_name = (char *) snapshot_node_name,
1073         .has_format = has_format,
1074         .format = (char *) format,
1075         .has_mode = has_mode,
1076         .mode = mode,
1077     };
1078     TransactionAction action = {
1079         .type = TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC,
1080         .u.blockdev_snapshot_sync.data = &snapshot,
1081     };
1082     blockdev_do_action(&action, errp);
1083 }
1084 
1085 void qmp_blockdev_snapshot(const char *node, const char *overlay,
1086                            Error **errp)
1087 {
1088     BlockdevSnapshot snapshot_data = {
1089         .node = (char *) node,
1090         .overlay = (char *) overlay
1091     };
1092     TransactionAction action = {
1093         .type = TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT,
1094         .u.blockdev_snapshot.data = &snapshot_data,
1095     };
1096     blockdev_do_action(&action, errp);
1097 }
1098 
1099 void qmp_blockdev_snapshot_internal_sync(const char *device,
1100                                          const char *name,
1101                                          Error **errp)
1102 {
1103     BlockdevSnapshotInternal snapshot = {
1104         .device = (char *) device,
1105         .name = (char *) name
1106     };
1107     TransactionAction action = {
1108         .type = TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_INTERNAL_SYNC,
1109         .u.blockdev_snapshot_internal_sync.data = &snapshot,
1110     };
1111     blockdev_do_action(&action, errp);
1112 }
1113 
1114 SnapshotInfo *qmp_blockdev_snapshot_delete_internal_sync(const char *device,
1115                                                          bool has_id,
1116                                                          const char *id,
1117                                                          bool has_name,
1118                                                          const char *name,
1119                                                          Error **errp)
1120 {
1121     BlockDriverState *bs;
1122     AioContext *aio_context;
1123     QEMUSnapshotInfo sn;
1124     Error *local_err = NULL;
1125     SnapshotInfo *info = NULL;
1126     int ret;
1127 
1128     bs = qmp_get_root_bs(device, errp);
1129     if (!bs) {
1130         return NULL;
1131     }
1132     aio_context = bdrv_get_aio_context(bs);
1133     aio_context_acquire(aio_context);
1134 
1135     if (!has_id) {
1136         id = NULL;
1137     }
1138 
1139     if (!has_name) {
1140         name = NULL;
1141     }
1142 
1143     if (!id && !name) {
1144         error_setg(errp, "Name or id must be provided");
1145         goto out_aio_context;
1146     }
1147 
1148     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT_DELETE, errp)) {
1149         goto out_aio_context;
1150     }
1151 
1152     ret = bdrv_snapshot_find_by_id_and_name(bs, id, name, &sn, &local_err);
1153     if (local_err) {
1154         error_propagate(errp, local_err);
1155         goto out_aio_context;
1156     }
1157     if (!ret) {
1158         error_setg(errp,
1159                    "Snapshot with id '%s' and name '%s' does not exist on "
1160                    "device '%s'",
1161                    STR_OR_NULL(id), STR_OR_NULL(name), device);
1162         goto out_aio_context;
1163     }
1164 
1165     bdrv_snapshot_delete(bs, id, name, &local_err);
1166     if (local_err) {
1167         error_propagate(errp, local_err);
1168         goto out_aio_context;
1169     }
1170 
1171     aio_context_release(aio_context);
1172 
1173     info = g_new0(SnapshotInfo, 1);
1174     info->id = g_strdup(sn.id_str);
1175     info->name = g_strdup(sn.name);
1176     info->date_nsec = sn.date_nsec;
1177     info->date_sec = sn.date_sec;
1178     info->vm_state_size = sn.vm_state_size;
1179     info->vm_clock_nsec = sn.vm_clock_nsec % 1000000000;
1180     info->vm_clock_sec = sn.vm_clock_nsec / 1000000000;
1181     if (sn.icount != -1ULL) {
1182         info->icount = sn.icount;
1183         info->has_icount = true;
1184     }
1185 
1186     return info;
1187 
1188 out_aio_context:
1189     aio_context_release(aio_context);
1190     return NULL;
1191 }
1192 
1193 /* New and old BlockDriverState structs for atomic group operations */
1194 
1195 typedef struct BlkActionState BlkActionState;
1196 
1197 /**
1198  * BlkActionOps:
1199  * Table of operations that define an Action.
1200  *
1201  * @instance_size: Size of state struct, in bytes.
1202  * @prepare: Prepare the work, must NOT be NULL.
1203  * @commit: Commit the changes, can be NULL.
1204  * @abort: Abort the changes on fail, can be NULL.
1205  * @clean: Clean up resources after all transaction actions have called
1206  *         commit() or abort(). Can be NULL.
1207  *
1208  * Only prepare() may fail. In a single transaction, only one of commit() or
1209  * abort() will be called. clean() will always be called if it is present.
1210  */
1211 typedef struct BlkActionOps {
1212     size_t instance_size;
1213     void (*prepare)(BlkActionState *common, Error **errp);
1214     void (*commit)(BlkActionState *common);
1215     void (*abort)(BlkActionState *common);
1216     void (*clean)(BlkActionState *common);
1217 } BlkActionOps;
1218 
1219 /**
1220  * BlkActionState:
1221  * Describes one Action's state within a Transaction.
1222  *
1223  * @action: QAPI-defined enum identifying which Action to perform.
1224  * @ops: Table of ActionOps this Action can perform.
1225  * @block_job_txn: Transaction which this action belongs to.
1226  * @entry: List membership for all Actions in this Transaction.
1227  *
1228  * This structure must be arranged as first member in a subclassed type,
1229  * assuming that the compiler will also arrange it to the same offsets as the
1230  * base class.
1231  */
1232 struct BlkActionState {
1233     TransactionAction *action;
1234     const BlkActionOps *ops;
1235     JobTxn *block_job_txn;
1236     TransactionProperties *txn_props;
1237     QTAILQ_ENTRY(BlkActionState) entry;
1238 };
1239 
1240 /* internal snapshot private data */
1241 typedef struct InternalSnapshotState {
1242     BlkActionState common;
1243     BlockDriverState *bs;
1244     QEMUSnapshotInfo sn;
1245     bool created;
1246 } InternalSnapshotState;
1247 
1248 
1249 static int action_check_completion_mode(BlkActionState *s, Error **errp)
1250 {
1251     if (s->txn_props->completion_mode != ACTION_COMPLETION_MODE_INDIVIDUAL) {
1252         error_setg(errp,
1253                    "Action '%s' does not support Transaction property "
1254                    "completion-mode = %s",
1255                    TransactionActionKind_str(s->action->type),
1256                    ActionCompletionMode_str(s->txn_props->completion_mode));
1257         return -1;
1258     }
1259     return 0;
1260 }
1261 
1262 static void internal_snapshot_prepare(BlkActionState *common,
1263                                       Error **errp)
1264 {
1265     Error *local_err = NULL;
1266     const char *device;
1267     const char *name;
1268     BlockDriverState *bs;
1269     QEMUSnapshotInfo old_sn, *sn;
1270     bool ret;
1271     qemu_timeval tv;
1272     BlockdevSnapshotInternal *internal;
1273     InternalSnapshotState *state;
1274     AioContext *aio_context;
1275     int ret1;
1276 
1277     g_assert(common->action->type ==
1278              TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_INTERNAL_SYNC);
1279     internal = common->action->u.blockdev_snapshot_internal_sync.data;
1280     state = DO_UPCAST(InternalSnapshotState, common, common);
1281 
1282     /* 1. parse input */
1283     device = internal->device;
1284     name = internal->name;
1285 
1286     /* 2. check for validation */
1287     if (action_check_completion_mode(common, errp) < 0) {
1288         return;
1289     }
1290 
1291     bs = qmp_get_root_bs(device, errp);
1292     if (!bs) {
1293         return;
1294     }
1295 
1296     aio_context = bdrv_get_aio_context(bs);
1297     aio_context_acquire(aio_context);
1298 
1299     state->bs = bs;
1300 
1301     /* Paired with .clean() */
1302     bdrv_drained_begin(bs);
1303 
1304     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_INTERNAL_SNAPSHOT, errp)) {
1305         goto out;
1306     }
1307 
1308     if (bdrv_is_read_only(bs)) {
1309         error_setg(errp, "Device '%s' is read only", device);
1310         goto out;
1311     }
1312 
1313     if (!bdrv_can_snapshot(bs)) {
1314         error_setg(errp, "Block format '%s' used by device '%s' "
1315                    "does not support internal snapshots",
1316                    bs->drv->format_name, device);
1317         goto out;
1318     }
1319 
1320     if (!strlen(name)) {
1321         error_setg(errp, "Name is empty");
1322         goto out;
1323     }
1324 
1325     /* check whether a snapshot with name exist */
1326     ret = bdrv_snapshot_find_by_id_and_name(bs, NULL, name, &old_sn,
1327                                             &local_err);
1328     if (local_err) {
1329         error_propagate(errp, local_err);
1330         goto out;
1331     } else if (ret) {
1332         error_setg(errp,
1333                    "Snapshot with name '%s' already exists on device '%s'",
1334                    name, device);
1335         goto out;
1336     }
1337 
1338     /* 3. take the snapshot */
1339     sn = &state->sn;
1340     pstrcpy(sn->name, sizeof(sn->name), name);
1341     qemu_gettimeofday(&tv);
1342     sn->date_sec = tv.tv_sec;
1343     sn->date_nsec = tv.tv_usec * 1000;
1344     sn->vm_clock_nsec = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
1345     if (replay_mode != REPLAY_MODE_NONE) {
1346         sn->icount = replay_get_current_icount();
1347     } else {
1348         sn->icount = -1ULL;
1349     }
1350 
1351     ret1 = bdrv_snapshot_create(bs, sn);
1352     if (ret1 < 0) {
1353         error_setg_errno(errp, -ret1,
1354                          "Failed to create snapshot '%s' on device '%s'",
1355                          name, device);
1356         goto out;
1357     }
1358 
1359     /* 4. succeed, mark a snapshot is created */
1360     state->created = true;
1361 
1362 out:
1363     aio_context_release(aio_context);
1364 }
1365 
1366 static void internal_snapshot_abort(BlkActionState *common)
1367 {
1368     InternalSnapshotState *state =
1369                              DO_UPCAST(InternalSnapshotState, common, common);
1370     BlockDriverState *bs = state->bs;
1371     QEMUSnapshotInfo *sn = &state->sn;
1372     AioContext *aio_context;
1373     Error *local_error = NULL;
1374 
1375     if (!state->created) {
1376         return;
1377     }
1378 
1379     aio_context = bdrv_get_aio_context(state->bs);
1380     aio_context_acquire(aio_context);
1381 
1382     if (bdrv_snapshot_delete(bs, sn->id_str, sn->name, &local_error) < 0) {
1383         error_reportf_err(local_error,
1384                           "Failed to delete snapshot with id '%s' and "
1385                           "name '%s' on device '%s' in abort: ",
1386                           sn->id_str, sn->name,
1387                           bdrv_get_device_name(bs));
1388     }
1389 
1390     aio_context_release(aio_context);
1391 }
1392 
1393 static void internal_snapshot_clean(BlkActionState *common)
1394 {
1395     InternalSnapshotState *state = DO_UPCAST(InternalSnapshotState,
1396                                              common, common);
1397     AioContext *aio_context;
1398 
1399     if (!state->bs) {
1400         return;
1401     }
1402 
1403     aio_context = bdrv_get_aio_context(state->bs);
1404     aio_context_acquire(aio_context);
1405 
1406     bdrv_drained_end(state->bs);
1407 
1408     aio_context_release(aio_context);
1409 }
1410 
1411 /* external snapshot private data */
1412 typedef struct ExternalSnapshotState {
1413     BlkActionState common;
1414     BlockDriverState *old_bs;
1415     BlockDriverState *new_bs;
1416     bool overlay_appended;
1417 } ExternalSnapshotState;
1418 
1419 static void external_snapshot_prepare(BlkActionState *common,
1420                                       Error **errp)
1421 {
1422     int ret;
1423     int flags = 0;
1424     QDict *options = NULL;
1425     Error *local_err = NULL;
1426     /* Device and node name of the image to generate the snapshot from */
1427     const char *device;
1428     const char *node_name;
1429     /* Reference to the new image (for 'blockdev-snapshot') */
1430     const char *snapshot_ref;
1431     /* File name of the new image (for 'blockdev-snapshot-sync') */
1432     const char *new_image_file;
1433     ExternalSnapshotState *state =
1434                              DO_UPCAST(ExternalSnapshotState, common, common);
1435     TransactionAction *action = common->action;
1436     AioContext *aio_context;
1437     uint64_t perm, shared;
1438 
1439     /* 'blockdev-snapshot' and 'blockdev-snapshot-sync' have similar
1440      * purpose but a different set of parameters */
1441     switch (action->type) {
1442     case TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT:
1443         {
1444             BlockdevSnapshot *s = action->u.blockdev_snapshot.data;
1445             device = s->node;
1446             node_name = s->node;
1447             new_image_file = NULL;
1448             snapshot_ref = s->overlay;
1449         }
1450         break;
1451     case TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC:
1452         {
1453             BlockdevSnapshotSync *s = action->u.blockdev_snapshot_sync.data;
1454             device = s->has_device ? s->device : NULL;
1455             node_name = s->has_node_name ? s->node_name : NULL;
1456             new_image_file = s->snapshot_file;
1457             snapshot_ref = NULL;
1458         }
1459         break;
1460     default:
1461         g_assert_not_reached();
1462     }
1463 
1464     /* start processing */
1465     if (action_check_completion_mode(common, errp) < 0) {
1466         return;
1467     }
1468 
1469     state->old_bs = bdrv_lookup_bs(device, node_name, errp);
1470     if (!state->old_bs) {
1471         return;
1472     }
1473 
1474     aio_context = bdrv_get_aio_context(state->old_bs);
1475     aio_context_acquire(aio_context);
1476 
1477     /* Paired with .clean() */
1478     bdrv_drained_begin(state->old_bs);
1479 
1480     if (!bdrv_is_inserted(state->old_bs)) {
1481         error_setg(errp, QERR_DEVICE_HAS_NO_MEDIUM, device);
1482         goto out;
1483     }
1484 
1485     if (bdrv_op_is_blocked(state->old_bs,
1486                            BLOCK_OP_TYPE_EXTERNAL_SNAPSHOT, errp)) {
1487         goto out;
1488     }
1489 
1490     if (!bdrv_is_read_only(state->old_bs)) {
1491         if (bdrv_flush(state->old_bs)) {
1492             error_setg(errp, QERR_IO_ERROR);
1493             goto out;
1494         }
1495     }
1496 
1497     if (action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC) {
1498         BlockdevSnapshotSync *s = action->u.blockdev_snapshot_sync.data;
1499         const char *format = s->has_format ? s->format : "qcow2";
1500         enum NewImageMode mode;
1501         const char *snapshot_node_name =
1502             s->has_snapshot_node_name ? s->snapshot_node_name : NULL;
1503 
1504         if (node_name && !snapshot_node_name) {
1505             error_setg(errp, "New overlay node-name missing");
1506             goto out;
1507         }
1508 
1509         if (snapshot_node_name &&
1510             bdrv_lookup_bs(snapshot_node_name, snapshot_node_name, NULL)) {
1511             error_setg(errp, "New overlay node-name already in use");
1512             goto out;
1513         }
1514 
1515         flags = state->old_bs->open_flags;
1516         flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_COPY_ON_READ);
1517         flags |= BDRV_O_NO_BACKING;
1518 
1519         /* create new image w/backing file */
1520         mode = s->has_mode ? s->mode : NEW_IMAGE_MODE_ABSOLUTE_PATHS;
1521         if (mode != NEW_IMAGE_MODE_EXISTING) {
1522             int64_t size = bdrv_getlength(state->old_bs);
1523             if (size < 0) {
1524                 error_setg_errno(errp, -size, "bdrv_getlength failed");
1525                 goto out;
1526             }
1527             bdrv_refresh_filename(state->old_bs);
1528             bdrv_img_create(new_image_file, format,
1529                             state->old_bs->filename,
1530                             state->old_bs->drv->format_name,
1531                             NULL, size, flags, false, &local_err);
1532             if (local_err) {
1533                 error_propagate(errp, local_err);
1534                 goto out;
1535             }
1536         }
1537 
1538         options = qdict_new();
1539         if (snapshot_node_name) {
1540             qdict_put_str(options, "node-name", snapshot_node_name);
1541         }
1542         qdict_put_str(options, "driver", format);
1543     }
1544 
1545     state->new_bs = bdrv_open(new_image_file, snapshot_ref, options, flags,
1546                               errp);
1547     /* We will manually add the backing_hd field to the bs later */
1548     if (!state->new_bs) {
1549         goto out;
1550     }
1551 
1552     /*
1553      * Allow attaching a backing file to an overlay that's already in use only
1554      * if the parents don't assume that they are already seeing a valid image.
1555      * (Specifically, allow it as a mirror target, which is write-only access.)
1556      */
1557     bdrv_get_cumulative_perm(state->new_bs, &perm, &shared);
1558     if (perm & BLK_PERM_CONSISTENT_READ) {
1559         error_setg(errp, "The overlay is already in use");
1560         goto out;
1561     }
1562 
1563     if (state->new_bs->drv->is_filter) {
1564         error_setg(errp, "Filters cannot be used as overlays");
1565         goto out;
1566     }
1567 
1568     if (bdrv_cow_child(state->new_bs)) {
1569         error_setg(errp, "The overlay already has a backing image");
1570         goto out;
1571     }
1572 
1573     if (!state->new_bs->drv->supports_backing) {
1574         error_setg(errp, "The overlay does not support backing images");
1575         goto out;
1576     }
1577 
1578     ret = bdrv_append(state->new_bs, state->old_bs, errp);
1579     if (ret < 0) {
1580         goto out;
1581     }
1582     state->overlay_appended = true;
1583 
1584 out:
1585     aio_context_release(aio_context);
1586 }
1587 
1588 static void external_snapshot_commit(BlkActionState *common)
1589 {
1590     ExternalSnapshotState *state =
1591                              DO_UPCAST(ExternalSnapshotState, common, common);
1592     AioContext *aio_context;
1593 
1594     aio_context = bdrv_get_aio_context(state->old_bs);
1595     aio_context_acquire(aio_context);
1596 
1597     /* We don't need (or want) to use the transactional
1598      * bdrv_reopen_multiple() across all the entries at once, because we
1599      * don't want to abort all of them if one of them fails the reopen */
1600     if (!qatomic_read(&state->old_bs->copy_on_read)) {
1601         bdrv_reopen_set_read_only(state->old_bs, true, NULL);
1602     }
1603 
1604     aio_context_release(aio_context);
1605 }
1606 
1607 static void external_snapshot_abort(BlkActionState *common)
1608 {
1609     ExternalSnapshotState *state =
1610                              DO_UPCAST(ExternalSnapshotState, common, common);
1611     if (state->new_bs) {
1612         if (state->overlay_appended) {
1613             AioContext *aio_context;
1614             AioContext *tmp_context;
1615             int ret;
1616 
1617             aio_context = bdrv_get_aio_context(state->old_bs);
1618             aio_context_acquire(aio_context);
1619 
1620             bdrv_ref(state->old_bs);   /* we can't let bdrv_set_backind_hd()
1621                                           close state->old_bs; we need it */
1622             bdrv_set_backing_hd(state->new_bs, NULL, &error_abort);
1623 
1624             /*
1625              * The call to bdrv_set_backing_hd() above returns state->old_bs to
1626              * the main AioContext. As we're still going to be using it, return
1627              * it to the AioContext it was before.
1628              */
1629             tmp_context = bdrv_get_aio_context(state->old_bs);
1630             if (aio_context != tmp_context) {
1631                 aio_context_release(aio_context);
1632                 aio_context_acquire(tmp_context);
1633 
1634                 ret = bdrv_try_set_aio_context(state->old_bs,
1635                                                aio_context, NULL);
1636                 assert(ret == 0);
1637 
1638                 aio_context_release(tmp_context);
1639                 aio_context_acquire(aio_context);
1640             }
1641 
1642             bdrv_replace_node(state->new_bs, state->old_bs, &error_abort);
1643             bdrv_unref(state->old_bs); /* bdrv_replace_node() ref'ed old_bs */
1644 
1645             aio_context_release(aio_context);
1646         }
1647     }
1648 }
1649 
1650 static void external_snapshot_clean(BlkActionState *common)
1651 {
1652     ExternalSnapshotState *state =
1653                              DO_UPCAST(ExternalSnapshotState, common, common);
1654     AioContext *aio_context;
1655 
1656     if (!state->old_bs) {
1657         return;
1658     }
1659 
1660     aio_context = bdrv_get_aio_context(state->old_bs);
1661     aio_context_acquire(aio_context);
1662 
1663     bdrv_drained_end(state->old_bs);
1664     bdrv_unref(state->new_bs);
1665 
1666     aio_context_release(aio_context);
1667 }
1668 
1669 typedef struct DriveBackupState {
1670     BlkActionState common;
1671     BlockDriverState *bs;
1672     BlockJob *job;
1673 } DriveBackupState;
1674 
1675 static BlockJob *do_backup_common(BackupCommon *backup,
1676                                   BlockDriverState *bs,
1677                                   BlockDriverState *target_bs,
1678                                   AioContext *aio_context,
1679                                   JobTxn *txn, Error **errp);
1680 
1681 static void drive_backup_prepare(BlkActionState *common, Error **errp)
1682 {
1683     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
1684     DriveBackup *backup;
1685     BlockDriverState *bs;
1686     BlockDriverState *target_bs;
1687     BlockDriverState *source = NULL;
1688     AioContext *aio_context;
1689     AioContext *old_context;
1690     QDict *options;
1691     Error *local_err = NULL;
1692     int flags;
1693     int64_t size;
1694     bool set_backing_hd = false;
1695     int ret;
1696 
1697     assert(common->action->type == TRANSACTION_ACTION_KIND_DRIVE_BACKUP);
1698     backup = common->action->u.drive_backup.data;
1699 
1700     if (!backup->has_mode) {
1701         backup->mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
1702     }
1703 
1704     bs = bdrv_lookup_bs(backup->device, backup->device, errp);
1705     if (!bs) {
1706         return;
1707     }
1708 
1709     if (!bs->drv) {
1710         error_setg(errp, "Device has no medium");
1711         return;
1712     }
1713 
1714     aio_context = bdrv_get_aio_context(bs);
1715     aio_context_acquire(aio_context);
1716 
1717     /* Paired with .clean() */
1718     bdrv_drained_begin(bs);
1719 
1720     if (!backup->has_format) {
1721         backup->format = backup->mode == NEW_IMAGE_MODE_EXISTING ?
1722                          NULL : (char *) bs->drv->format_name;
1723     }
1724 
1725     /* Early check to avoid creating target */
1726     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_BACKUP_SOURCE, errp)) {
1727         goto out;
1728     }
1729 
1730     flags = bs->open_flags | BDRV_O_RDWR;
1731 
1732     /*
1733      * See if we have a backing HD we can use to create our new image
1734      * on top of.
1735      */
1736     if (backup->sync == MIRROR_SYNC_MODE_TOP) {
1737         /*
1738          * Backup will not replace the source by the target, so none
1739          * of the filters skipped here will be removed (in contrast to
1740          * mirror).  Therefore, we can skip all of them when looking
1741          * for the first COW relationship.
1742          */
1743         source = bdrv_cow_bs(bdrv_skip_filters(bs));
1744         if (!source) {
1745             backup->sync = MIRROR_SYNC_MODE_FULL;
1746         }
1747     }
1748     if (backup->sync == MIRROR_SYNC_MODE_NONE) {
1749         source = bs;
1750         flags |= BDRV_O_NO_BACKING;
1751         set_backing_hd = true;
1752     }
1753 
1754     size = bdrv_getlength(bs);
1755     if (size < 0) {
1756         error_setg_errno(errp, -size, "bdrv_getlength failed");
1757         goto out;
1758     }
1759 
1760     if (backup->mode != NEW_IMAGE_MODE_EXISTING) {
1761         assert(backup->format);
1762         if (source) {
1763             /* Implicit filters should not appear in the filename */
1764             BlockDriverState *explicit_backing =
1765                 bdrv_skip_implicit_filters(source);
1766 
1767             bdrv_refresh_filename(explicit_backing);
1768             bdrv_img_create(backup->target, backup->format,
1769                             explicit_backing->filename,
1770                             explicit_backing->drv->format_name, NULL,
1771                             size, flags, false, &local_err);
1772         } else {
1773             bdrv_img_create(backup->target, backup->format, NULL, NULL, NULL,
1774                             size, flags, false, &local_err);
1775         }
1776     }
1777 
1778     if (local_err) {
1779         error_propagate(errp, local_err);
1780         goto out;
1781     }
1782 
1783     options = qdict_new();
1784     qdict_put_str(options, "discard", "unmap");
1785     qdict_put_str(options, "detect-zeroes", "unmap");
1786     if (backup->format) {
1787         qdict_put_str(options, "driver", backup->format);
1788     }
1789 
1790     target_bs = bdrv_open(backup->target, NULL, options, flags, errp);
1791     if (!target_bs) {
1792         goto out;
1793     }
1794 
1795     /* Honor bdrv_try_set_aio_context() context acquisition requirements. */
1796     old_context = bdrv_get_aio_context(target_bs);
1797     aio_context_release(aio_context);
1798     aio_context_acquire(old_context);
1799 
1800     ret = bdrv_try_set_aio_context(target_bs, aio_context, errp);
1801     if (ret < 0) {
1802         bdrv_unref(target_bs);
1803         aio_context_release(old_context);
1804         return;
1805     }
1806 
1807     aio_context_release(old_context);
1808     aio_context_acquire(aio_context);
1809 
1810     if (set_backing_hd) {
1811         if (bdrv_set_backing_hd(target_bs, source, errp) < 0) {
1812             goto unref;
1813         }
1814     }
1815 
1816     state->bs = bs;
1817 
1818     state->job = do_backup_common(qapi_DriveBackup_base(backup),
1819                                   bs, target_bs, aio_context,
1820                                   common->block_job_txn, errp);
1821 
1822 unref:
1823     bdrv_unref(target_bs);
1824 out:
1825     aio_context_release(aio_context);
1826 }
1827 
1828 static void drive_backup_commit(BlkActionState *common)
1829 {
1830     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
1831     AioContext *aio_context;
1832 
1833     aio_context = bdrv_get_aio_context(state->bs);
1834     aio_context_acquire(aio_context);
1835 
1836     assert(state->job);
1837     job_start(&state->job->job);
1838 
1839     aio_context_release(aio_context);
1840 }
1841 
1842 static void drive_backup_abort(BlkActionState *common)
1843 {
1844     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
1845 
1846     if (state->job) {
1847         AioContext *aio_context;
1848 
1849         aio_context = bdrv_get_aio_context(state->bs);
1850         aio_context_acquire(aio_context);
1851 
1852         job_cancel_sync(&state->job->job);
1853 
1854         aio_context_release(aio_context);
1855     }
1856 }
1857 
1858 static void drive_backup_clean(BlkActionState *common)
1859 {
1860     DriveBackupState *state = DO_UPCAST(DriveBackupState, common, common);
1861     AioContext *aio_context;
1862 
1863     if (!state->bs) {
1864         return;
1865     }
1866 
1867     aio_context = bdrv_get_aio_context(state->bs);
1868     aio_context_acquire(aio_context);
1869 
1870     bdrv_drained_end(state->bs);
1871 
1872     aio_context_release(aio_context);
1873 }
1874 
1875 typedef struct BlockdevBackupState {
1876     BlkActionState common;
1877     BlockDriverState *bs;
1878     BlockJob *job;
1879 } BlockdevBackupState;
1880 
1881 static void blockdev_backup_prepare(BlkActionState *common, Error **errp)
1882 {
1883     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
1884     BlockdevBackup *backup;
1885     BlockDriverState *bs;
1886     BlockDriverState *target_bs;
1887     AioContext *aio_context;
1888     AioContext *old_context;
1889     int ret;
1890 
1891     assert(common->action->type == TRANSACTION_ACTION_KIND_BLOCKDEV_BACKUP);
1892     backup = common->action->u.blockdev_backup.data;
1893 
1894     bs = bdrv_lookup_bs(backup->device, backup->device, errp);
1895     if (!bs) {
1896         return;
1897     }
1898 
1899     target_bs = bdrv_lookup_bs(backup->target, backup->target, errp);
1900     if (!target_bs) {
1901         return;
1902     }
1903 
1904     /* Honor bdrv_try_set_aio_context() context acquisition requirements. */
1905     aio_context = bdrv_get_aio_context(bs);
1906     old_context = bdrv_get_aio_context(target_bs);
1907     aio_context_acquire(old_context);
1908 
1909     ret = bdrv_try_set_aio_context(target_bs, aio_context, errp);
1910     if (ret < 0) {
1911         aio_context_release(old_context);
1912         return;
1913     }
1914 
1915     aio_context_release(old_context);
1916     aio_context_acquire(aio_context);
1917     state->bs = bs;
1918 
1919     /* Paired with .clean() */
1920     bdrv_drained_begin(state->bs);
1921 
1922     state->job = do_backup_common(qapi_BlockdevBackup_base(backup),
1923                                   bs, target_bs, aio_context,
1924                                   common->block_job_txn, errp);
1925 
1926     aio_context_release(aio_context);
1927 }
1928 
1929 static void blockdev_backup_commit(BlkActionState *common)
1930 {
1931     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
1932     AioContext *aio_context;
1933 
1934     aio_context = bdrv_get_aio_context(state->bs);
1935     aio_context_acquire(aio_context);
1936 
1937     assert(state->job);
1938     job_start(&state->job->job);
1939 
1940     aio_context_release(aio_context);
1941 }
1942 
1943 static void blockdev_backup_abort(BlkActionState *common)
1944 {
1945     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
1946 
1947     if (state->job) {
1948         AioContext *aio_context;
1949 
1950         aio_context = bdrv_get_aio_context(state->bs);
1951         aio_context_acquire(aio_context);
1952 
1953         job_cancel_sync(&state->job->job);
1954 
1955         aio_context_release(aio_context);
1956     }
1957 }
1958 
1959 static void blockdev_backup_clean(BlkActionState *common)
1960 {
1961     BlockdevBackupState *state = DO_UPCAST(BlockdevBackupState, common, common);
1962     AioContext *aio_context;
1963 
1964     if (!state->bs) {
1965         return;
1966     }
1967 
1968     aio_context = bdrv_get_aio_context(state->bs);
1969     aio_context_acquire(aio_context);
1970 
1971     bdrv_drained_end(state->bs);
1972 
1973     aio_context_release(aio_context);
1974 }
1975 
1976 typedef struct BlockDirtyBitmapState {
1977     BlkActionState common;
1978     BdrvDirtyBitmap *bitmap;
1979     BlockDriverState *bs;
1980     HBitmap *backup;
1981     bool prepared;
1982     bool was_enabled;
1983 } BlockDirtyBitmapState;
1984 
1985 static void block_dirty_bitmap_add_prepare(BlkActionState *common,
1986                                            Error **errp)
1987 {
1988     Error *local_err = NULL;
1989     BlockDirtyBitmapAdd *action;
1990     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
1991                                              common, common);
1992 
1993     if (action_check_completion_mode(common, errp) < 0) {
1994         return;
1995     }
1996 
1997     action = common->action->u.block_dirty_bitmap_add.data;
1998     /* AIO context taken and released within qmp_block_dirty_bitmap_add */
1999     qmp_block_dirty_bitmap_add(action->node, action->name,
2000                                action->has_granularity, action->granularity,
2001                                action->has_persistent, action->persistent,
2002                                action->has_disabled, action->disabled,
2003                                &local_err);
2004 
2005     if (!local_err) {
2006         state->prepared = true;
2007     } else {
2008         error_propagate(errp, local_err);
2009     }
2010 }
2011 
2012 static void block_dirty_bitmap_add_abort(BlkActionState *common)
2013 {
2014     BlockDirtyBitmapAdd *action;
2015     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2016                                              common, common);
2017 
2018     action = common->action->u.block_dirty_bitmap_add.data;
2019     /* Should not be able to fail: IF the bitmap was added via .prepare(),
2020      * then the node reference and bitmap name must have been valid.
2021      */
2022     if (state->prepared) {
2023         qmp_block_dirty_bitmap_remove(action->node, action->name, &error_abort);
2024     }
2025 }
2026 
2027 static void block_dirty_bitmap_clear_prepare(BlkActionState *common,
2028                                              Error **errp)
2029 {
2030     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2031                                              common, common);
2032     BlockDirtyBitmap *action;
2033 
2034     if (action_check_completion_mode(common, errp) < 0) {
2035         return;
2036     }
2037 
2038     action = common->action->u.block_dirty_bitmap_clear.data;
2039     state->bitmap = block_dirty_bitmap_lookup(action->node,
2040                                               action->name,
2041                                               &state->bs,
2042                                               errp);
2043     if (!state->bitmap) {
2044         return;
2045     }
2046 
2047     if (bdrv_dirty_bitmap_check(state->bitmap, BDRV_BITMAP_DEFAULT, errp)) {
2048         return;
2049     }
2050 
2051     bdrv_clear_dirty_bitmap(state->bitmap, &state->backup);
2052 }
2053 
2054 static void block_dirty_bitmap_restore(BlkActionState *common)
2055 {
2056     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2057                                              common, common);
2058 
2059     if (state->backup) {
2060         bdrv_restore_dirty_bitmap(state->bitmap, state->backup);
2061     }
2062 }
2063 
2064 static void block_dirty_bitmap_free_backup(BlkActionState *common)
2065 {
2066     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2067                                              common, common);
2068 
2069     hbitmap_free(state->backup);
2070 }
2071 
2072 static void block_dirty_bitmap_enable_prepare(BlkActionState *common,
2073                                               Error **errp)
2074 {
2075     BlockDirtyBitmap *action;
2076     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2077                                              common, common);
2078 
2079     if (action_check_completion_mode(common, errp) < 0) {
2080         return;
2081     }
2082 
2083     action = common->action->u.block_dirty_bitmap_enable.data;
2084     state->bitmap = block_dirty_bitmap_lookup(action->node,
2085                                               action->name,
2086                                               NULL,
2087                                               errp);
2088     if (!state->bitmap) {
2089         return;
2090     }
2091 
2092     if (bdrv_dirty_bitmap_check(state->bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
2093         return;
2094     }
2095 
2096     state->was_enabled = bdrv_dirty_bitmap_enabled(state->bitmap);
2097     bdrv_enable_dirty_bitmap(state->bitmap);
2098 }
2099 
2100 static void block_dirty_bitmap_enable_abort(BlkActionState *common)
2101 {
2102     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2103                                              common, common);
2104 
2105     if (!state->was_enabled) {
2106         bdrv_disable_dirty_bitmap(state->bitmap);
2107     }
2108 }
2109 
2110 static void block_dirty_bitmap_disable_prepare(BlkActionState *common,
2111                                                Error **errp)
2112 {
2113     BlockDirtyBitmap *action;
2114     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2115                                              common, common);
2116 
2117     if (action_check_completion_mode(common, errp) < 0) {
2118         return;
2119     }
2120 
2121     action = common->action->u.block_dirty_bitmap_disable.data;
2122     state->bitmap = block_dirty_bitmap_lookup(action->node,
2123                                               action->name,
2124                                               NULL,
2125                                               errp);
2126     if (!state->bitmap) {
2127         return;
2128     }
2129 
2130     if (bdrv_dirty_bitmap_check(state->bitmap, BDRV_BITMAP_ALLOW_RO, errp)) {
2131         return;
2132     }
2133 
2134     state->was_enabled = bdrv_dirty_bitmap_enabled(state->bitmap);
2135     bdrv_disable_dirty_bitmap(state->bitmap);
2136 }
2137 
2138 static void block_dirty_bitmap_disable_abort(BlkActionState *common)
2139 {
2140     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2141                                              common, common);
2142 
2143     if (state->was_enabled) {
2144         bdrv_enable_dirty_bitmap(state->bitmap);
2145     }
2146 }
2147 
2148 static void block_dirty_bitmap_merge_prepare(BlkActionState *common,
2149                                              Error **errp)
2150 {
2151     BlockDirtyBitmapMerge *action;
2152     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2153                                              common, common);
2154 
2155     if (action_check_completion_mode(common, errp) < 0) {
2156         return;
2157     }
2158 
2159     action = common->action->u.block_dirty_bitmap_merge.data;
2160 
2161     state->bitmap = block_dirty_bitmap_merge(action->node, action->target,
2162                                              action->bitmaps, &state->backup,
2163                                              errp);
2164 }
2165 
2166 static void block_dirty_bitmap_remove_prepare(BlkActionState *common,
2167                                               Error **errp)
2168 {
2169     BlockDirtyBitmap *action;
2170     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2171                                              common, common);
2172 
2173     if (action_check_completion_mode(common, errp) < 0) {
2174         return;
2175     }
2176 
2177     action = common->action->u.block_dirty_bitmap_remove.data;
2178 
2179     state->bitmap = block_dirty_bitmap_remove(action->node, action->name,
2180                                               false, &state->bs, errp);
2181     if (state->bitmap) {
2182         bdrv_dirty_bitmap_skip_store(state->bitmap, true);
2183         bdrv_dirty_bitmap_set_busy(state->bitmap, true);
2184     }
2185 }
2186 
2187 static void block_dirty_bitmap_remove_abort(BlkActionState *common)
2188 {
2189     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2190                                              common, common);
2191 
2192     if (state->bitmap) {
2193         bdrv_dirty_bitmap_skip_store(state->bitmap, false);
2194         bdrv_dirty_bitmap_set_busy(state->bitmap, false);
2195     }
2196 }
2197 
2198 static void block_dirty_bitmap_remove_commit(BlkActionState *common)
2199 {
2200     BlockDirtyBitmapState *state = DO_UPCAST(BlockDirtyBitmapState,
2201                                              common, common);
2202 
2203     bdrv_dirty_bitmap_set_busy(state->bitmap, false);
2204     bdrv_release_dirty_bitmap(state->bitmap);
2205 }
2206 
2207 static void abort_prepare(BlkActionState *common, Error **errp)
2208 {
2209     error_setg(errp, "Transaction aborted using Abort action");
2210 }
2211 
2212 static void abort_commit(BlkActionState *common)
2213 {
2214     g_assert_not_reached(); /* this action never succeeds */
2215 }
2216 
2217 static const BlkActionOps actions[] = {
2218     [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT] = {
2219         .instance_size = sizeof(ExternalSnapshotState),
2220         .prepare  = external_snapshot_prepare,
2221         .commit   = external_snapshot_commit,
2222         .abort = external_snapshot_abort,
2223         .clean = external_snapshot_clean,
2224     },
2225     [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_SYNC] = {
2226         .instance_size = sizeof(ExternalSnapshotState),
2227         .prepare  = external_snapshot_prepare,
2228         .commit   = external_snapshot_commit,
2229         .abort = external_snapshot_abort,
2230         .clean = external_snapshot_clean,
2231     },
2232     [TRANSACTION_ACTION_KIND_DRIVE_BACKUP] = {
2233         .instance_size = sizeof(DriveBackupState),
2234         .prepare = drive_backup_prepare,
2235         .commit = drive_backup_commit,
2236         .abort = drive_backup_abort,
2237         .clean = drive_backup_clean,
2238     },
2239     [TRANSACTION_ACTION_KIND_BLOCKDEV_BACKUP] = {
2240         .instance_size = sizeof(BlockdevBackupState),
2241         .prepare = blockdev_backup_prepare,
2242         .commit = blockdev_backup_commit,
2243         .abort = blockdev_backup_abort,
2244         .clean = blockdev_backup_clean,
2245     },
2246     [TRANSACTION_ACTION_KIND_ABORT] = {
2247         .instance_size = sizeof(BlkActionState),
2248         .prepare = abort_prepare,
2249         .commit = abort_commit,
2250     },
2251     [TRANSACTION_ACTION_KIND_BLOCKDEV_SNAPSHOT_INTERNAL_SYNC] = {
2252         .instance_size = sizeof(InternalSnapshotState),
2253         .prepare  = internal_snapshot_prepare,
2254         .abort = internal_snapshot_abort,
2255         .clean = internal_snapshot_clean,
2256     },
2257     [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_ADD] = {
2258         .instance_size = sizeof(BlockDirtyBitmapState),
2259         .prepare = block_dirty_bitmap_add_prepare,
2260         .abort = block_dirty_bitmap_add_abort,
2261     },
2262     [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_CLEAR] = {
2263         .instance_size = sizeof(BlockDirtyBitmapState),
2264         .prepare = block_dirty_bitmap_clear_prepare,
2265         .commit = block_dirty_bitmap_free_backup,
2266         .abort = block_dirty_bitmap_restore,
2267     },
2268     [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_ENABLE] = {
2269         .instance_size = sizeof(BlockDirtyBitmapState),
2270         .prepare = block_dirty_bitmap_enable_prepare,
2271         .abort = block_dirty_bitmap_enable_abort,
2272     },
2273     [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_DISABLE] = {
2274         .instance_size = sizeof(BlockDirtyBitmapState),
2275         .prepare = block_dirty_bitmap_disable_prepare,
2276         .abort = block_dirty_bitmap_disable_abort,
2277     },
2278     [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_MERGE] = {
2279         .instance_size = sizeof(BlockDirtyBitmapState),
2280         .prepare = block_dirty_bitmap_merge_prepare,
2281         .commit = block_dirty_bitmap_free_backup,
2282         .abort = block_dirty_bitmap_restore,
2283     },
2284     [TRANSACTION_ACTION_KIND_BLOCK_DIRTY_BITMAP_REMOVE] = {
2285         .instance_size = sizeof(BlockDirtyBitmapState),
2286         .prepare = block_dirty_bitmap_remove_prepare,
2287         .commit = block_dirty_bitmap_remove_commit,
2288         .abort = block_dirty_bitmap_remove_abort,
2289     },
2290     /* Where are transactions for MIRROR, COMMIT and STREAM?
2291      * Although these blockjobs use transaction callbacks like the backup job,
2292      * these jobs do not necessarily adhere to transaction semantics.
2293      * These jobs may not fully undo all of their actions on abort, nor do they
2294      * necessarily work in transactions with more than one job in them.
2295      */
2296 };
2297 
2298 /**
2299  * Allocate a TransactionProperties structure if necessary, and fill
2300  * that structure with desired defaults if they are unset.
2301  */
2302 static TransactionProperties *get_transaction_properties(
2303     TransactionProperties *props)
2304 {
2305     if (!props) {
2306         props = g_new0(TransactionProperties, 1);
2307     }
2308 
2309     if (!props->has_completion_mode) {
2310         props->has_completion_mode = true;
2311         props->completion_mode = ACTION_COMPLETION_MODE_INDIVIDUAL;
2312     }
2313 
2314     return props;
2315 }
2316 
2317 /*
2318  * 'Atomic' group operations.  The operations are performed as a set, and if
2319  * any fail then we roll back all operations in the group.
2320  */
2321 void qmp_transaction(TransactionActionList *dev_list,
2322                      bool has_props,
2323                      struct TransactionProperties *props,
2324                      Error **errp)
2325 {
2326     TransactionActionList *dev_entry = dev_list;
2327     JobTxn *block_job_txn = NULL;
2328     BlkActionState *state, *next;
2329     Error *local_err = NULL;
2330 
2331     QTAILQ_HEAD(, BlkActionState) snap_bdrv_states;
2332     QTAILQ_INIT(&snap_bdrv_states);
2333 
2334     /* Does this transaction get canceled as a group on failure?
2335      * If not, we don't really need to make a JobTxn.
2336      */
2337     props = get_transaction_properties(props);
2338     if (props->completion_mode != ACTION_COMPLETION_MODE_INDIVIDUAL) {
2339         block_job_txn = job_txn_new();
2340     }
2341 
2342     /* drain all i/o before any operations */
2343     bdrv_drain_all();
2344 
2345     /* We don't do anything in this loop that commits us to the operations */
2346     while (NULL != dev_entry) {
2347         TransactionAction *dev_info = NULL;
2348         const BlkActionOps *ops;
2349 
2350         dev_info = dev_entry->value;
2351         dev_entry = dev_entry->next;
2352 
2353         assert(dev_info->type < ARRAY_SIZE(actions));
2354 
2355         ops = &actions[dev_info->type];
2356         assert(ops->instance_size > 0);
2357 
2358         state = g_malloc0(ops->instance_size);
2359         state->ops = ops;
2360         state->action = dev_info;
2361         state->block_job_txn = block_job_txn;
2362         state->txn_props = props;
2363         QTAILQ_INSERT_TAIL(&snap_bdrv_states, state, entry);
2364 
2365         state->ops->prepare(state, &local_err);
2366         if (local_err) {
2367             error_propagate(errp, local_err);
2368             goto delete_and_fail;
2369         }
2370     }
2371 
2372     QTAILQ_FOREACH(state, &snap_bdrv_states, entry) {
2373         if (state->ops->commit) {
2374             state->ops->commit(state);
2375         }
2376     }
2377 
2378     /* success */
2379     goto exit;
2380 
2381 delete_and_fail:
2382     /* failure, and it is all-or-none; roll back all operations */
2383     QTAILQ_FOREACH_REVERSE(state, &snap_bdrv_states, entry) {
2384         if (state->ops->abort) {
2385             state->ops->abort(state);
2386         }
2387     }
2388 exit:
2389     QTAILQ_FOREACH_SAFE(state, &snap_bdrv_states, entry, next) {
2390         if (state->ops->clean) {
2391             state->ops->clean(state);
2392         }
2393         g_free(state);
2394     }
2395     if (!has_props) {
2396         qapi_free_TransactionProperties(props);
2397     }
2398     job_txn_unref(block_job_txn);
2399 }
2400 
2401 BlockDirtyBitmapSha256 *qmp_x_debug_block_dirty_bitmap_sha256(const char *node,
2402                                                               const char *name,
2403                                                               Error **errp)
2404 {
2405     BdrvDirtyBitmap *bitmap;
2406     BlockDriverState *bs;
2407     BlockDirtyBitmapSha256 *ret = NULL;
2408     char *sha256;
2409 
2410     bitmap = block_dirty_bitmap_lookup(node, name, &bs, errp);
2411     if (!bitmap || !bs) {
2412         return NULL;
2413     }
2414 
2415     sha256 = bdrv_dirty_bitmap_sha256(bitmap, errp);
2416     if (sha256 == NULL) {
2417         return NULL;
2418     }
2419 
2420     ret = g_new(BlockDirtyBitmapSha256, 1);
2421     ret->sha256 = sha256;
2422 
2423     return ret;
2424 }
2425 
2426 void coroutine_fn qmp_block_resize(bool has_device, const char *device,
2427                                    bool has_node_name, const char *node_name,
2428                                    int64_t size, Error **errp)
2429 {
2430     Error *local_err = NULL;
2431     BlockBackend *blk;
2432     BlockDriverState *bs;
2433     AioContext *old_ctx;
2434 
2435     bs = bdrv_lookup_bs(has_device ? device : NULL,
2436                         has_node_name ? node_name : NULL,
2437                         &local_err);
2438     if (local_err) {
2439         error_propagate(errp, local_err);
2440         return;
2441     }
2442 
2443     if (size < 0) {
2444         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "size", "a >0 size");
2445         return;
2446     }
2447 
2448     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_RESIZE, NULL)) {
2449         error_setg(errp, QERR_DEVICE_IN_USE, device);
2450         return;
2451     }
2452 
2453     blk = blk_new_with_bs(bs, BLK_PERM_RESIZE, BLK_PERM_ALL, errp);
2454     if (!blk) {
2455         return;
2456     }
2457 
2458     bdrv_co_lock(bs);
2459     bdrv_drained_begin(bs);
2460     bdrv_co_unlock(bs);
2461 
2462     old_ctx = bdrv_co_enter(bs);
2463     blk_truncate(blk, size, false, PREALLOC_MODE_OFF, 0, errp);
2464     bdrv_co_leave(bs, old_ctx);
2465 
2466     bdrv_co_lock(bs);
2467     bdrv_drained_end(bs);
2468     blk_unref(blk);
2469     bdrv_co_unlock(bs);
2470 }
2471 
2472 void qmp_block_stream(bool has_job_id, const char *job_id, const char *device,
2473                       bool has_base, const char *base,
2474                       bool has_base_node, const char *base_node,
2475                       bool has_backing_file, const char *backing_file,
2476                       bool has_bottom, const char *bottom,
2477                       bool has_speed, int64_t speed,
2478                       bool has_on_error, BlockdevOnError on_error,
2479                       bool has_filter_node_name, const char *filter_node_name,
2480                       bool has_auto_finalize, bool auto_finalize,
2481                       bool has_auto_dismiss, bool auto_dismiss,
2482                       Error **errp)
2483 {
2484     BlockDriverState *bs, *iter, *iter_end;
2485     BlockDriverState *base_bs = NULL;
2486     BlockDriverState *bottom_bs = NULL;
2487     AioContext *aio_context;
2488     Error *local_err = NULL;
2489     int job_flags = JOB_DEFAULT;
2490 
2491     if (has_base && has_base_node) {
2492         error_setg(errp, "'base' and 'base-node' cannot be specified "
2493                    "at the same time");
2494         return;
2495     }
2496 
2497     if (has_base && has_bottom) {
2498         error_setg(errp, "'base' and 'bottom' cannot be specified "
2499                    "at the same time");
2500         return;
2501     }
2502 
2503     if (has_bottom && has_base_node) {
2504         error_setg(errp, "'bottom' and 'base-node' cannot be specified "
2505                    "at the same time");
2506         return;
2507     }
2508 
2509     if (!has_on_error) {
2510         on_error = BLOCKDEV_ON_ERROR_REPORT;
2511     }
2512 
2513     bs = bdrv_lookup_bs(device, device, errp);
2514     if (!bs) {
2515         return;
2516     }
2517 
2518     aio_context = bdrv_get_aio_context(bs);
2519     aio_context_acquire(aio_context);
2520 
2521     if (has_base) {
2522         base_bs = bdrv_find_backing_image(bs, base);
2523         if (base_bs == NULL) {
2524             error_setg(errp, "Can't find '%s' in the backing chain", base);
2525             goto out;
2526         }
2527         assert(bdrv_get_aio_context(base_bs) == aio_context);
2528     }
2529 
2530     if (has_base_node) {
2531         base_bs = bdrv_lookup_bs(NULL, base_node, errp);
2532         if (!base_bs) {
2533             goto out;
2534         }
2535         if (bs == base_bs || !bdrv_chain_contains(bs, base_bs)) {
2536             error_setg(errp, "Node '%s' is not a backing image of '%s'",
2537                        base_node, device);
2538             goto out;
2539         }
2540         assert(bdrv_get_aio_context(base_bs) == aio_context);
2541         bdrv_refresh_filename(base_bs);
2542     }
2543 
2544     if (has_bottom) {
2545         bottom_bs = bdrv_lookup_bs(NULL, bottom, errp);
2546         if (!bottom_bs) {
2547             goto out;
2548         }
2549         if (!bottom_bs->drv) {
2550             error_setg(errp, "Node '%s' is not open", bottom);
2551             goto out;
2552         }
2553         if (bottom_bs->drv->is_filter) {
2554             error_setg(errp, "Node '%s' is a filter, use a non-filter node "
2555                        "as 'bottom'", bottom);
2556             goto out;
2557         }
2558         if (!bdrv_chain_contains(bs, bottom_bs)) {
2559             error_setg(errp, "Node '%s' is not in a chain starting from '%s'",
2560                        bottom, device);
2561             goto out;
2562         }
2563         assert(bdrv_get_aio_context(bottom_bs) == aio_context);
2564     }
2565 
2566     /*
2567      * Check for op blockers in the whole chain between bs and base (or bottom)
2568      */
2569     iter_end = has_bottom ? bdrv_filter_or_cow_bs(bottom_bs) : base_bs;
2570     for (iter = bs; iter && iter != iter_end;
2571          iter = bdrv_filter_or_cow_bs(iter))
2572     {
2573         if (bdrv_op_is_blocked(iter, BLOCK_OP_TYPE_STREAM, errp)) {
2574             goto out;
2575         }
2576     }
2577 
2578     /* if we are streaming the entire chain, the result will have no backing
2579      * file, and specifying one is therefore an error */
2580     if (base_bs == NULL && has_backing_file) {
2581         error_setg(errp, "backing file specified, but streaming the "
2582                          "entire chain");
2583         goto out;
2584     }
2585 
2586     if (has_auto_finalize && !auto_finalize) {
2587         job_flags |= JOB_MANUAL_FINALIZE;
2588     }
2589     if (has_auto_dismiss && !auto_dismiss) {
2590         job_flags |= JOB_MANUAL_DISMISS;
2591     }
2592 
2593     stream_start(has_job_id ? job_id : NULL, bs, base_bs, backing_file,
2594                  bottom_bs, job_flags, has_speed ? speed : 0, on_error,
2595                  filter_node_name, &local_err);
2596     if (local_err) {
2597         error_propagate(errp, local_err);
2598         goto out;
2599     }
2600 
2601     trace_qmp_block_stream(bs);
2602 
2603 out:
2604     aio_context_release(aio_context);
2605 }
2606 
2607 void qmp_block_commit(bool has_job_id, const char *job_id, const char *device,
2608                       bool has_base_node, const char *base_node,
2609                       bool has_base, const char *base,
2610                       bool has_top_node, const char *top_node,
2611                       bool has_top, const char *top,
2612                       bool has_backing_file, const char *backing_file,
2613                       bool has_speed, int64_t speed,
2614                       bool has_on_error, BlockdevOnError on_error,
2615                       bool has_filter_node_name, const char *filter_node_name,
2616                       bool has_auto_finalize, bool auto_finalize,
2617                       bool has_auto_dismiss, bool auto_dismiss,
2618                       Error **errp)
2619 {
2620     BlockDriverState *bs;
2621     BlockDriverState *iter;
2622     BlockDriverState *base_bs, *top_bs;
2623     AioContext *aio_context;
2624     Error *local_err = NULL;
2625     int job_flags = JOB_DEFAULT;
2626     uint64_t top_perm, top_shared;
2627 
2628     if (!has_speed) {
2629         speed = 0;
2630     }
2631     if (!has_on_error) {
2632         on_error = BLOCKDEV_ON_ERROR_REPORT;
2633     }
2634     if (!has_filter_node_name) {
2635         filter_node_name = NULL;
2636     }
2637     if (has_auto_finalize && !auto_finalize) {
2638         job_flags |= JOB_MANUAL_FINALIZE;
2639     }
2640     if (has_auto_dismiss && !auto_dismiss) {
2641         job_flags |= JOB_MANUAL_DISMISS;
2642     }
2643 
2644     /* Important Note:
2645      *  libvirt relies on the DeviceNotFound error class in order to probe for
2646      *  live commit feature versions; for this to work, we must make sure to
2647      *  perform the device lookup before any generic errors that may occur in a
2648      *  scenario in which all optional arguments are omitted. */
2649     bs = qmp_get_root_bs(device, &local_err);
2650     if (!bs) {
2651         bs = bdrv_lookup_bs(device, device, NULL);
2652         if (!bs) {
2653             error_free(local_err);
2654             error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
2655                       "Device '%s' not found", device);
2656         } else {
2657             error_propagate(errp, local_err);
2658         }
2659         return;
2660     }
2661 
2662     aio_context = bdrv_get_aio_context(bs);
2663     aio_context_acquire(aio_context);
2664 
2665     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_COMMIT_SOURCE, errp)) {
2666         goto out;
2667     }
2668 
2669     /* default top_bs is the active layer */
2670     top_bs = bs;
2671 
2672     if (has_top_node && has_top) {
2673         error_setg(errp, "'top-node' and 'top' are mutually exclusive");
2674         goto out;
2675     } else if (has_top_node) {
2676         top_bs = bdrv_lookup_bs(NULL, top_node, errp);
2677         if (top_bs == NULL) {
2678             goto out;
2679         }
2680         if (!bdrv_chain_contains(bs, top_bs)) {
2681             error_setg(errp, "'%s' is not in this backing file chain",
2682                        top_node);
2683             goto out;
2684         }
2685     } else if (has_top && top) {
2686         /* This strcmp() is just a shortcut, there is no need to
2687          * refresh @bs's filename.  If it mismatches,
2688          * bdrv_find_backing_image() will do the refresh and may still
2689          * return @bs. */
2690         if (strcmp(bs->filename, top) != 0) {
2691             top_bs = bdrv_find_backing_image(bs, top);
2692         }
2693     }
2694 
2695     if (top_bs == NULL) {
2696         error_setg(errp, "Top image file %s not found", top ? top : "NULL");
2697         goto out;
2698     }
2699 
2700     assert(bdrv_get_aio_context(top_bs) == aio_context);
2701 
2702     if (has_base_node && has_base) {
2703         error_setg(errp, "'base-node' and 'base' are mutually exclusive");
2704         goto out;
2705     } else if (has_base_node) {
2706         base_bs = bdrv_lookup_bs(NULL, base_node, errp);
2707         if (base_bs == NULL) {
2708             goto out;
2709         }
2710         if (!bdrv_chain_contains(top_bs, base_bs)) {
2711             error_setg(errp, "'%s' is not in this backing file chain",
2712                        base_node);
2713             goto out;
2714         }
2715     } else if (has_base && base) {
2716         base_bs = bdrv_find_backing_image(top_bs, base);
2717         if (base_bs == NULL) {
2718             error_setg(errp, "Can't find '%s' in the backing chain", base);
2719             goto out;
2720         }
2721     } else {
2722         base_bs = bdrv_find_base(top_bs);
2723         if (base_bs == NULL) {
2724             error_setg(errp, "There is no backimg image");
2725             goto out;
2726         }
2727     }
2728 
2729     assert(bdrv_get_aio_context(base_bs) == aio_context);
2730 
2731     for (iter = top_bs; iter != bdrv_filter_or_cow_bs(base_bs);
2732          iter = bdrv_filter_or_cow_bs(iter))
2733     {
2734         if (bdrv_op_is_blocked(iter, BLOCK_OP_TYPE_COMMIT_TARGET, errp)) {
2735             goto out;
2736         }
2737     }
2738 
2739     /* Do not allow attempts to commit an image into itself */
2740     if (top_bs == base_bs) {
2741         error_setg(errp, "cannot commit an image into itself");
2742         goto out;
2743     }
2744 
2745     /*
2746      * Active commit is required if and only if someone has taken a
2747      * WRITE permission on the top node.  Historically, we have always
2748      * used active commit for top nodes, so continue that practice
2749      * lest we possibly break clients that rely on this behavior, e.g.
2750      * to later attach this node to a writing parent.
2751      * (Active commit is never really wrong.)
2752      */
2753     bdrv_get_cumulative_perm(top_bs, &top_perm, &top_shared);
2754     if (top_perm & BLK_PERM_WRITE ||
2755         bdrv_skip_filters(top_bs) == bdrv_skip_filters(bs))
2756     {
2757         if (has_backing_file) {
2758             if (bdrv_skip_filters(top_bs) == bdrv_skip_filters(bs)) {
2759                 error_setg(errp, "'backing-file' specified,"
2760                                  " but 'top' is the active layer");
2761             } else {
2762                 error_setg(errp, "'backing-file' specified, but 'top' has a "
2763                                  "writer on it");
2764             }
2765             goto out;
2766         }
2767         if (!has_job_id) {
2768             /*
2769              * Emulate here what block_job_create() does, because it
2770              * is possible that @bs != @top_bs (the block job should
2771              * be named after @bs, even if @top_bs is the actual
2772              * source)
2773              */
2774             job_id = bdrv_get_device_name(bs);
2775         }
2776         commit_active_start(job_id, top_bs, base_bs, job_flags, speed, on_error,
2777                             filter_node_name, NULL, NULL, false, &local_err);
2778     } else {
2779         BlockDriverState *overlay_bs = bdrv_find_overlay(bs, top_bs);
2780         if (bdrv_op_is_blocked(overlay_bs, BLOCK_OP_TYPE_COMMIT_TARGET, errp)) {
2781             goto out;
2782         }
2783         commit_start(has_job_id ? job_id : NULL, bs, base_bs, top_bs, job_flags,
2784                      speed, on_error, has_backing_file ? backing_file : NULL,
2785                      filter_node_name, &local_err);
2786     }
2787     if (local_err != NULL) {
2788         error_propagate(errp, local_err);
2789         goto out;
2790     }
2791 
2792 out:
2793     aio_context_release(aio_context);
2794 }
2795 
2796 /* Common QMP interface for drive-backup and blockdev-backup */
2797 static BlockJob *do_backup_common(BackupCommon *backup,
2798                                   BlockDriverState *bs,
2799                                   BlockDriverState *target_bs,
2800                                   AioContext *aio_context,
2801                                   JobTxn *txn, Error **errp)
2802 {
2803     BlockJob *job = NULL;
2804     BdrvDirtyBitmap *bmap = NULL;
2805     BackupPerf perf = { .max_workers = 64 };
2806     int job_flags = JOB_DEFAULT;
2807 
2808     if (!backup->has_speed) {
2809         backup->speed = 0;
2810     }
2811     if (!backup->has_on_source_error) {
2812         backup->on_source_error = BLOCKDEV_ON_ERROR_REPORT;
2813     }
2814     if (!backup->has_on_target_error) {
2815         backup->on_target_error = BLOCKDEV_ON_ERROR_REPORT;
2816     }
2817     if (!backup->has_job_id) {
2818         backup->job_id = NULL;
2819     }
2820     if (!backup->has_auto_finalize) {
2821         backup->auto_finalize = true;
2822     }
2823     if (!backup->has_auto_dismiss) {
2824         backup->auto_dismiss = true;
2825     }
2826     if (!backup->has_compress) {
2827         backup->compress = false;
2828     }
2829 
2830     if (backup->x_perf) {
2831         if (backup->x_perf->has_use_copy_range) {
2832             perf.use_copy_range = backup->x_perf->use_copy_range;
2833         }
2834         if (backup->x_perf->has_max_workers) {
2835             perf.max_workers = backup->x_perf->max_workers;
2836         }
2837         if (backup->x_perf->has_max_chunk) {
2838             perf.max_chunk = backup->x_perf->max_chunk;
2839         }
2840     }
2841 
2842     if ((backup->sync == MIRROR_SYNC_MODE_BITMAP) ||
2843         (backup->sync == MIRROR_SYNC_MODE_INCREMENTAL)) {
2844         /* done before desugaring 'incremental' to print the right message */
2845         if (!backup->has_bitmap) {
2846             error_setg(errp, "must provide a valid bitmap name for "
2847                        "'%s' sync mode", MirrorSyncMode_str(backup->sync));
2848             return NULL;
2849         }
2850     }
2851 
2852     if (backup->sync == MIRROR_SYNC_MODE_INCREMENTAL) {
2853         if (backup->has_bitmap_mode &&
2854             backup->bitmap_mode != BITMAP_SYNC_MODE_ON_SUCCESS) {
2855             error_setg(errp, "Bitmap sync mode must be '%s' "
2856                        "when using sync mode '%s'",
2857                        BitmapSyncMode_str(BITMAP_SYNC_MODE_ON_SUCCESS),
2858                        MirrorSyncMode_str(backup->sync));
2859             return NULL;
2860         }
2861         backup->has_bitmap_mode = true;
2862         backup->sync = MIRROR_SYNC_MODE_BITMAP;
2863         backup->bitmap_mode = BITMAP_SYNC_MODE_ON_SUCCESS;
2864     }
2865 
2866     if (backup->has_bitmap) {
2867         bmap = bdrv_find_dirty_bitmap(bs, backup->bitmap);
2868         if (!bmap) {
2869             error_setg(errp, "Bitmap '%s' could not be found", backup->bitmap);
2870             return NULL;
2871         }
2872         if (!backup->has_bitmap_mode) {
2873             error_setg(errp, "Bitmap sync mode must be given "
2874                        "when providing a bitmap");
2875             return NULL;
2876         }
2877         if (bdrv_dirty_bitmap_check(bmap, BDRV_BITMAP_ALLOW_RO, errp)) {
2878             return NULL;
2879         }
2880 
2881         /* This does not produce a useful bitmap artifact: */
2882         if (backup->sync == MIRROR_SYNC_MODE_NONE) {
2883             error_setg(errp, "sync mode '%s' does not produce meaningful bitmap"
2884                        " outputs", MirrorSyncMode_str(backup->sync));
2885             return NULL;
2886         }
2887 
2888         /* If the bitmap isn't used for input or output, this is useless: */
2889         if (backup->bitmap_mode == BITMAP_SYNC_MODE_NEVER &&
2890             backup->sync != MIRROR_SYNC_MODE_BITMAP) {
2891             error_setg(errp, "Bitmap sync mode '%s' has no meaningful effect"
2892                        " when combined with sync mode '%s'",
2893                        BitmapSyncMode_str(backup->bitmap_mode),
2894                        MirrorSyncMode_str(backup->sync));
2895             return NULL;
2896         }
2897     }
2898 
2899     if (!backup->has_bitmap && backup->has_bitmap_mode) {
2900         error_setg(errp, "Cannot specify bitmap sync mode without a bitmap");
2901         return NULL;
2902     }
2903 
2904     if (!backup->auto_finalize) {
2905         job_flags |= JOB_MANUAL_FINALIZE;
2906     }
2907     if (!backup->auto_dismiss) {
2908         job_flags |= JOB_MANUAL_DISMISS;
2909     }
2910 
2911     job = backup_job_create(backup->job_id, bs, target_bs, backup->speed,
2912                             backup->sync, bmap, backup->bitmap_mode,
2913                             backup->compress,
2914                             backup->filter_node_name,
2915                             &perf,
2916                             backup->on_source_error,
2917                             backup->on_target_error,
2918                             job_flags, NULL, NULL, txn, errp);
2919     return job;
2920 }
2921 
2922 void qmp_drive_backup(DriveBackup *backup, Error **errp)
2923 {
2924     TransactionAction action = {
2925         .type = TRANSACTION_ACTION_KIND_DRIVE_BACKUP,
2926         .u.drive_backup.data = backup,
2927     };
2928     blockdev_do_action(&action, errp);
2929 }
2930 
2931 BlockDeviceInfoList *qmp_query_named_block_nodes(bool has_flat,
2932                                                  bool flat,
2933                                                  Error **errp)
2934 {
2935     bool return_flat = has_flat && flat;
2936 
2937     return bdrv_named_nodes_list(return_flat, errp);
2938 }
2939 
2940 XDbgBlockGraph *qmp_x_debug_query_block_graph(Error **errp)
2941 {
2942     return bdrv_get_xdbg_block_graph(errp);
2943 }
2944 
2945 void qmp_blockdev_backup(BlockdevBackup *backup, Error **errp)
2946 {
2947     TransactionAction action = {
2948         .type = TRANSACTION_ACTION_KIND_BLOCKDEV_BACKUP,
2949         .u.blockdev_backup.data = backup,
2950     };
2951     blockdev_do_action(&action, errp);
2952 }
2953 
2954 /* Parameter check and block job starting for drive mirroring.
2955  * Caller should hold @device and @target's aio context (must be the same).
2956  **/
2957 static void blockdev_mirror_common(const char *job_id, BlockDriverState *bs,
2958                                    BlockDriverState *target,
2959                                    bool has_replaces, const char *replaces,
2960                                    enum MirrorSyncMode sync,
2961                                    BlockMirrorBackingMode backing_mode,
2962                                    bool zero_target,
2963                                    bool has_speed, int64_t speed,
2964                                    bool has_granularity, uint32_t granularity,
2965                                    bool has_buf_size, int64_t buf_size,
2966                                    bool has_on_source_error,
2967                                    BlockdevOnError on_source_error,
2968                                    bool has_on_target_error,
2969                                    BlockdevOnError on_target_error,
2970                                    bool has_unmap, bool unmap,
2971                                    bool has_filter_node_name,
2972                                    const char *filter_node_name,
2973                                    bool has_copy_mode, MirrorCopyMode copy_mode,
2974                                    bool has_auto_finalize, bool auto_finalize,
2975                                    bool has_auto_dismiss, bool auto_dismiss,
2976                                    Error **errp)
2977 {
2978     BlockDriverState *unfiltered_bs;
2979     int job_flags = JOB_DEFAULT;
2980 
2981     if (!has_speed) {
2982         speed = 0;
2983     }
2984     if (!has_on_source_error) {
2985         on_source_error = BLOCKDEV_ON_ERROR_REPORT;
2986     }
2987     if (!has_on_target_error) {
2988         on_target_error = BLOCKDEV_ON_ERROR_REPORT;
2989     }
2990     if (!has_granularity) {
2991         granularity = 0;
2992     }
2993     if (!has_buf_size) {
2994         buf_size = 0;
2995     }
2996     if (!has_unmap) {
2997         unmap = true;
2998     }
2999     if (!has_filter_node_name) {
3000         filter_node_name = NULL;
3001     }
3002     if (!has_copy_mode) {
3003         copy_mode = MIRROR_COPY_MODE_BACKGROUND;
3004     }
3005     if (has_auto_finalize && !auto_finalize) {
3006         job_flags |= JOB_MANUAL_FINALIZE;
3007     }
3008     if (has_auto_dismiss && !auto_dismiss) {
3009         job_flags |= JOB_MANUAL_DISMISS;
3010     }
3011 
3012     if (granularity != 0 && (granularity < 512 || granularity > 1048576 * 64)) {
3013         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "granularity",
3014                    "a value in range [512B, 64MB]");
3015         return;
3016     }
3017     if (granularity & (granularity - 1)) {
3018         error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "granularity",
3019                    "a power of 2");
3020         return;
3021     }
3022 
3023     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_MIRROR_SOURCE, errp)) {
3024         return;
3025     }
3026     if (bdrv_op_is_blocked(target, BLOCK_OP_TYPE_MIRROR_TARGET, errp)) {
3027         return;
3028     }
3029 
3030     if (!bdrv_backing_chain_next(bs) && sync == MIRROR_SYNC_MODE_TOP) {
3031         sync = MIRROR_SYNC_MODE_FULL;
3032     }
3033 
3034     if (!has_replaces) {
3035         /* We want to mirror from @bs, but keep implicit filters on top */
3036         unfiltered_bs = bdrv_skip_implicit_filters(bs);
3037         if (unfiltered_bs != bs) {
3038             replaces = unfiltered_bs->node_name;
3039             has_replaces = true;
3040         }
3041     }
3042 
3043     if (has_replaces) {
3044         BlockDriverState *to_replace_bs;
3045         AioContext *replace_aio_context;
3046         int64_t bs_size, replace_size;
3047 
3048         bs_size = bdrv_getlength(bs);
3049         if (bs_size < 0) {
3050             error_setg_errno(errp, -bs_size, "Failed to query device's size");
3051             return;
3052         }
3053 
3054         to_replace_bs = check_to_replace_node(bs, replaces, errp);
3055         if (!to_replace_bs) {
3056             return;
3057         }
3058 
3059         replace_aio_context = bdrv_get_aio_context(to_replace_bs);
3060         aio_context_acquire(replace_aio_context);
3061         replace_size = bdrv_getlength(to_replace_bs);
3062         aio_context_release(replace_aio_context);
3063 
3064         if (replace_size < 0) {
3065             error_setg_errno(errp, -replace_size,
3066                              "Failed to query the replacement node's size");
3067             return;
3068         }
3069         if (bs_size != replace_size) {
3070             error_setg(errp, "cannot replace image with a mirror image of "
3071                              "different size");
3072             return;
3073         }
3074     }
3075 
3076     /* pass the node name to replace to mirror start since it's loose coupling
3077      * and will allow to check whether the node still exist at mirror completion
3078      */
3079     mirror_start(job_id, bs, target,
3080                  has_replaces ? replaces : NULL, job_flags,
3081                  speed, granularity, buf_size, sync, backing_mode, zero_target,
3082                  on_source_error, on_target_error, unmap, filter_node_name,
3083                  copy_mode, errp);
3084 }
3085 
3086 void qmp_drive_mirror(DriveMirror *arg, Error **errp)
3087 {
3088     BlockDriverState *bs;
3089     BlockDriverState *target_backing_bs, *target_bs;
3090     AioContext *aio_context;
3091     AioContext *old_context;
3092     BlockMirrorBackingMode backing_mode;
3093     Error *local_err = NULL;
3094     QDict *options = NULL;
3095     int flags;
3096     int64_t size;
3097     const char *format = arg->format;
3098     bool zero_target;
3099     int ret;
3100 
3101     bs = qmp_get_root_bs(arg->device, errp);
3102     if (!bs) {
3103         return;
3104     }
3105 
3106     /* Early check to avoid creating target */
3107     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_MIRROR_SOURCE, errp)) {
3108         return;
3109     }
3110 
3111     aio_context = bdrv_get_aio_context(bs);
3112     aio_context_acquire(aio_context);
3113 
3114     if (!arg->has_mode) {
3115         arg->mode = NEW_IMAGE_MODE_ABSOLUTE_PATHS;
3116     }
3117 
3118     if (!arg->has_format) {
3119         format = (arg->mode == NEW_IMAGE_MODE_EXISTING
3120                   ? NULL : bs->drv->format_name);
3121     }
3122 
3123     flags = bs->open_flags | BDRV_O_RDWR;
3124     target_backing_bs = bdrv_cow_bs(bdrv_skip_filters(bs));
3125     if (!target_backing_bs && arg->sync == MIRROR_SYNC_MODE_TOP) {
3126         arg->sync = MIRROR_SYNC_MODE_FULL;
3127     }
3128     if (arg->sync == MIRROR_SYNC_MODE_NONE) {
3129         target_backing_bs = bs;
3130     }
3131 
3132     size = bdrv_getlength(bs);
3133     if (size < 0) {
3134         error_setg_errno(errp, -size, "bdrv_getlength failed");
3135         goto out;
3136     }
3137 
3138     if (arg->has_replaces) {
3139         if (!arg->has_node_name) {
3140             error_setg(errp, "a node-name must be provided when replacing a"
3141                              " named node of the graph");
3142             goto out;
3143         }
3144     }
3145 
3146     if (arg->mode == NEW_IMAGE_MODE_ABSOLUTE_PATHS) {
3147         backing_mode = MIRROR_SOURCE_BACKING_CHAIN;
3148     } else {
3149         backing_mode = MIRROR_OPEN_BACKING_CHAIN;
3150     }
3151 
3152     /* Don't open backing image in create() */
3153     flags |= BDRV_O_NO_BACKING;
3154 
3155     if ((arg->sync == MIRROR_SYNC_MODE_FULL || !target_backing_bs)
3156         && arg->mode != NEW_IMAGE_MODE_EXISTING)
3157     {
3158         /* create new image w/o backing file */
3159         assert(format);
3160         bdrv_img_create(arg->target, format,
3161                         NULL, NULL, NULL, size, flags, false, &local_err);
3162     } else {
3163         /* Implicit filters should not appear in the filename */
3164         BlockDriverState *explicit_backing =
3165             bdrv_skip_implicit_filters(target_backing_bs);
3166 
3167         switch (arg->mode) {
3168         case NEW_IMAGE_MODE_EXISTING:
3169             break;
3170         case NEW_IMAGE_MODE_ABSOLUTE_PATHS:
3171             /* create new image with backing file */
3172             bdrv_refresh_filename(explicit_backing);
3173             bdrv_img_create(arg->target, format,
3174                             explicit_backing->filename,
3175                             explicit_backing->drv->format_name,
3176                             NULL, size, flags, false, &local_err);
3177             break;
3178         default:
3179             abort();
3180         }
3181     }
3182 
3183     if (local_err) {
3184         error_propagate(errp, local_err);
3185         goto out;
3186     }
3187 
3188     options = qdict_new();
3189     if (arg->has_node_name) {
3190         qdict_put_str(options, "node-name", arg->node_name);
3191     }
3192     if (format) {
3193         qdict_put_str(options, "driver", format);
3194     }
3195 
3196     /* Mirroring takes care of copy-on-write using the source's backing
3197      * file.
3198      */
3199     target_bs = bdrv_open(arg->target, NULL, options, flags, errp);
3200     if (!target_bs) {
3201         goto out;
3202     }
3203 
3204     zero_target = (arg->sync == MIRROR_SYNC_MODE_FULL &&
3205                    (arg->mode == NEW_IMAGE_MODE_EXISTING ||
3206                     !bdrv_has_zero_init(target_bs)));
3207 
3208 
3209     /* Honor bdrv_try_set_aio_context() context acquisition requirements. */
3210     old_context = bdrv_get_aio_context(target_bs);
3211     aio_context_release(aio_context);
3212     aio_context_acquire(old_context);
3213 
3214     ret = bdrv_try_set_aio_context(target_bs, aio_context, errp);
3215     if (ret < 0) {
3216         bdrv_unref(target_bs);
3217         aio_context_release(old_context);
3218         return;
3219     }
3220 
3221     aio_context_release(old_context);
3222     aio_context_acquire(aio_context);
3223 
3224     blockdev_mirror_common(arg->has_job_id ? arg->job_id : NULL, bs, target_bs,
3225                            arg->has_replaces, arg->replaces, arg->sync,
3226                            backing_mode, zero_target,
3227                            arg->has_speed, arg->speed,
3228                            arg->has_granularity, arg->granularity,
3229                            arg->has_buf_size, arg->buf_size,
3230                            arg->has_on_source_error, arg->on_source_error,
3231                            arg->has_on_target_error, arg->on_target_error,
3232                            arg->has_unmap, arg->unmap,
3233                            false, NULL,
3234                            arg->has_copy_mode, arg->copy_mode,
3235                            arg->has_auto_finalize, arg->auto_finalize,
3236                            arg->has_auto_dismiss, arg->auto_dismiss,
3237                            errp);
3238     bdrv_unref(target_bs);
3239 out:
3240     aio_context_release(aio_context);
3241 }
3242 
3243 void qmp_blockdev_mirror(bool has_job_id, const char *job_id,
3244                          const char *device, const char *target,
3245                          bool has_replaces, const char *replaces,
3246                          MirrorSyncMode sync,
3247                          bool has_speed, int64_t speed,
3248                          bool has_granularity, uint32_t granularity,
3249                          bool has_buf_size, int64_t buf_size,
3250                          bool has_on_source_error,
3251                          BlockdevOnError on_source_error,
3252                          bool has_on_target_error,
3253                          BlockdevOnError on_target_error,
3254                          bool has_filter_node_name,
3255                          const char *filter_node_name,
3256                          bool has_copy_mode, MirrorCopyMode copy_mode,
3257                          bool has_auto_finalize, bool auto_finalize,
3258                          bool has_auto_dismiss, bool auto_dismiss,
3259                          Error **errp)
3260 {
3261     BlockDriverState *bs;
3262     BlockDriverState *target_bs;
3263     AioContext *aio_context;
3264     AioContext *old_context;
3265     BlockMirrorBackingMode backing_mode = MIRROR_LEAVE_BACKING_CHAIN;
3266     bool zero_target;
3267     int ret;
3268 
3269     bs = qmp_get_root_bs(device, errp);
3270     if (!bs) {
3271         return;
3272     }
3273 
3274     target_bs = bdrv_lookup_bs(target, target, errp);
3275     if (!target_bs) {
3276         return;
3277     }
3278 
3279     zero_target = (sync == MIRROR_SYNC_MODE_FULL);
3280 
3281     /* Honor bdrv_try_set_aio_context() context acquisition requirements. */
3282     old_context = bdrv_get_aio_context(target_bs);
3283     aio_context = bdrv_get_aio_context(bs);
3284     aio_context_acquire(old_context);
3285 
3286     ret = bdrv_try_set_aio_context(target_bs, aio_context, errp);
3287 
3288     aio_context_release(old_context);
3289     aio_context_acquire(aio_context);
3290 
3291     if (ret < 0) {
3292         goto out;
3293     }
3294 
3295     blockdev_mirror_common(has_job_id ? job_id : NULL, bs, target_bs,
3296                            has_replaces, replaces, sync, backing_mode,
3297                            zero_target, has_speed, speed,
3298                            has_granularity, granularity,
3299                            has_buf_size, buf_size,
3300                            has_on_source_error, on_source_error,
3301                            has_on_target_error, on_target_error,
3302                            true, true,
3303                            has_filter_node_name, filter_node_name,
3304                            has_copy_mode, copy_mode,
3305                            has_auto_finalize, auto_finalize,
3306                            has_auto_dismiss, auto_dismiss,
3307                            errp);
3308 out:
3309     aio_context_release(aio_context);
3310 }
3311 
3312 /* Get a block job using its ID and acquire its AioContext */
3313 static BlockJob *find_block_job(const char *id, AioContext **aio_context,
3314                                 Error **errp)
3315 {
3316     BlockJob *job;
3317 
3318     assert(id != NULL);
3319 
3320     *aio_context = NULL;
3321 
3322     job = block_job_get(id);
3323 
3324     if (!job) {
3325         error_set(errp, ERROR_CLASS_DEVICE_NOT_ACTIVE,
3326                   "Block job '%s' not found", id);
3327         return NULL;
3328     }
3329 
3330     *aio_context = blk_get_aio_context(job->blk);
3331     aio_context_acquire(*aio_context);
3332 
3333     return job;
3334 }
3335 
3336 void qmp_block_job_set_speed(const char *device, int64_t speed, Error **errp)
3337 {
3338     AioContext *aio_context;
3339     BlockJob *job = find_block_job(device, &aio_context, errp);
3340 
3341     if (!job) {
3342         return;
3343     }
3344 
3345     block_job_set_speed(job, speed, errp);
3346     aio_context_release(aio_context);
3347 }
3348 
3349 void qmp_block_job_cancel(const char *device,
3350                           bool has_force, bool force, Error **errp)
3351 {
3352     AioContext *aio_context;
3353     BlockJob *job = find_block_job(device, &aio_context, errp);
3354 
3355     if (!job) {
3356         return;
3357     }
3358 
3359     if (!has_force) {
3360         force = false;
3361     }
3362 
3363     if (job_user_paused(&job->job) && !force) {
3364         error_setg(errp, "The block job for device '%s' is currently paused",
3365                    device);
3366         goto out;
3367     }
3368 
3369     trace_qmp_block_job_cancel(job);
3370     job_user_cancel(&job->job, force, errp);
3371 out:
3372     aio_context_release(aio_context);
3373 }
3374 
3375 void qmp_block_job_pause(const char *device, Error **errp)
3376 {
3377     AioContext *aio_context;
3378     BlockJob *job = find_block_job(device, &aio_context, errp);
3379 
3380     if (!job) {
3381         return;
3382     }
3383 
3384     trace_qmp_block_job_pause(job);
3385     job_user_pause(&job->job, errp);
3386     aio_context_release(aio_context);
3387 }
3388 
3389 void qmp_block_job_resume(const char *device, Error **errp)
3390 {
3391     AioContext *aio_context;
3392     BlockJob *job = find_block_job(device, &aio_context, errp);
3393 
3394     if (!job) {
3395         return;
3396     }
3397 
3398     trace_qmp_block_job_resume(job);
3399     job_user_resume(&job->job, errp);
3400     aio_context_release(aio_context);
3401 }
3402 
3403 void qmp_block_job_complete(const char *device, Error **errp)
3404 {
3405     AioContext *aio_context;
3406     BlockJob *job = find_block_job(device, &aio_context, errp);
3407 
3408     if (!job) {
3409         return;
3410     }
3411 
3412     trace_qmp_block_job_complete(job);
3413     job_complete(&job->job, errp);
3414     aio_context_release(aio_context);
3415 }
3416 
3417 void qmp_block_job_finalize(const char *id, Error **errp)
3418 {
3419     AioContext *aio_context;
3420     BlockJob *job = find_block_job(id, &aio_context, errp);
3421 
3422     if (!job) {
3423         return;
3424     }
3425 
3426     trace_qmp_block_job_finalize(job);
3427     job_ref(&job->job);
3428     job_finalize(&job->job, errp);
3429 
3430     /*
3431      * Job's context might have changed via job_finalize (and job_txn_apply
3432      * automatically acquires the new one), so make sure we release the correct
3433      * one.
3434      */
3435     aio_context = blk_get_aio_context(job->blk);
3436     job_unref(&job->job);
3437     aio_context_release(aio_context);
3438 }
3439 
3440 void qmp_block_job_dismiss(const char *id, Error **errp)
3441 {
3442     AioContext *aio_context;
3443     BlockJob *bjob = find_block_job(id, &aio_context, errp);
3444     Job *job;
3445 
3446     if (!bjob) {
3447         return;
3448     }
3449 
3450     trace_qmp_block_job_dismiss(bjob);
3451     job = &bjob->job;
3452     job_dismiss(&job, errp);
3453     aio_context_release(aio_context);
3454 }
3455 
3456 void qmp_change_backing_file(const char *device,
3457                              const char *image_node_name,
3458                              const char *backing_file,
3459                              Error **errp)
3460 {
3461     BlockDriverState *bs = NULL;
3462     AioContext *aio_context;
3463     BlockDriverState *image_bs = NULL;
3464     Error *local_err = NULL;
3465     bool ro;
3466     int ret;
3467 
3468     bs = qmp_get_root_bs(device, errp);
3469     if (!bs) {
3470         return;
3471     }
3472 
3473     aio_context = bdrv_get_aio_context(bs);
3474     aio_context_acquire(aio_context);
3475 
3476     image_bs = bdrv_lookup_bs(NULL, image_node_name, &local_err);
3477     if (local_err) {
3478         error_propagate(errp, local_err);
3479         goto out;
3480     }
3481 
3482     if (!image_bs) {
3483         error_setg(errp, "image file not found");
3484         goto out;
3485     }
3486 
3487     if (bdrv_find_base(image_bs) == image_bs) {
3488         error_setg(errp, "not allowing backing file change on an image "
3489                          "without a backing file");
3490         goto out;
3491     }
3492 
3493     /* even though we are not necessarily operating on bs, we need it to
3494      * determine if block ops are currently prohibited on the chain */
3495     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_CHANGE, errp)) {
3496         goto out;
3497     }
3498 
3499     /* final sanity check */
3500     if (!bdrv_chain_contains(bs, image_bs)) {
3501         error_setg(errp, "'%s' and image file are not in the same chain",
3502                    device);
3503         goto out;
3504     }
3505 
3506     /* if not r/w, reopen to make r/w */
3507     ro = bdrv_is_read_only(image_bs);
3508 
3509     if (ro) {
3510         if (bdrv_reopen_set_read_only(image_bs, false, errp) != 0) {
3511             goto out;
3512         }
3513     }
3514 
3515     ret = bdrv_change_backing_file(image_bs, backing_file,
3516                                    image_bs->drv ? image_bs->drv->format_name : "",
3517                                    false);
3518 
3519     if (ret < 0) {
3520         error_setg_errno(errp, -ret, "Could not change backing file to '%s'",
3521                          backing_file);
3522         /* don't exit here, so we can try to restore open flags if
3523          * appropriate */
3524     }
3525 
3526     if (ro) {
3527         bdrv_reopen_set_read_only(image_bs, true, errp);
3528     }
3529 
3530 out:
3531     aio_context_release(aio_context);
3532 }
3533 
3534 void qmp_blockdev_add(BlockdevOptions *options, Error **errp)
3535 {
3536     BlockDriverState *bs;
3537     QObject *obj;
3538     Visitor *v = qobject_output_visitor_new(&obj);
3539     QDict *qdict;
3540 
3541     visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3542     visit_complete(v, &obj);
3543     qdict = qobject_to(QDict, obj);
3544 
3545     qdict_flatten(qdict);
3546 
3547     if (!qdict_get_try_str(qdict, "node-name")) {
3548         error_setg(errp, "'node-name' must be specified for the root node");
3549         goto fail;
3550     }
3551 
3552     bs = bds_tree_init(qdict, errp);
3553     if (!bs) {
3554         goto fail;
3555     }
3556 
3557     bdrv_set_monitor_owned(bs);
3558 
3559 fail:
3560     visit_free(v);
3561 }
3562 
3563 void qmp_x_blockdev_reopen(BlockdevOptions *options, Error **errp)
3564 {
3565     BlockDriverState *bs;
3566     AioContext *ctx;
3567     QObject *obj;
3568     Visitor *v = qobject_output_visitor_new(&obj);
3569     BlockReopenQueue *queue;
3570     QDict *qdict;
3571 
3572     /* Check for the selected node name */
3573     if (!options->has_node_name) {
3574         error_setg(errp, "node-name not specified");
3575         goto fail;
3576     }
3577 
3578     bs = bdrv_find_node(options->node_name);
3579     if (!bs) {
3580         error_setg(errp, "Failed to find node with node-name='%s'",
3581                    options->node_name);
3582         goto fail;
3583     }
3584 
3585     /* Put all options in a QDict and flatten it */
3586     visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3587     visit_complete(v, &obj);
3588     qdict = qobject_to(QDict, obj);
3589 
3590     qdict_flatten(qdict);
3591 
3592     /* Perform the reopen operation */
3593     ctx = bdrv_get_aio_context(bs);
3594     aio_context_acquire(ctx);
3595     bdrv_subtree_drained_begin(bs);
3596     queue = bdrv_reopen_queue(NULL, bs, qdict, false);
3597     bdrv_reopen_multiple(queue, errp);
3598     bdrv_subtree_drained_end(bs);
3599     aio_context_release(ctx);
3600 
3601 fail:
3602     visit_free(v);
3603 }
3604 
3605 void qmp_blockdev_del(const char *node_name, Error **errp)
3606 {
3607     AioContext *aio_context;
3608     BlockDriverState *bs;
3609 
3610     bs = bdrv_find_node(node_name);
3611     if (!bs) {
3612         error_setg(errp, "Failed to find node with node-name='%s'", node_name);
3613         return;
3614     }
3615     if (bdrv_has_blk(bs)) {
3616         error_setg(errp, "Node %s is in use", node_name);
3617         return;
3618     }
3619     aio_context = bdrv_get_aio_context(bs);
3620     aio_context_acquire(aio_context);
3621 
3622     if (bdrv_op_is_blocked(bs, BLOCK_OP_TYPE_DRIVE_DEL, errp)) {
3623         goto out;
3624     }
3625 
3626     if (!QTAILQ_IN_USE(bs, monitor_list)) {
3627         error_setg(errp, "Node %s is not owned by the monitor",
3628                    bs->node_name);
3629         goto out;
3630     }
3631 
3632     if (bs->refcnt > 1) {
3633         error_setg(errp, "Block device %s is in use",
3634                    bdrv_get_device_or_node_name(bs));
3635         goto out;
3636     }
3637 
3638     QTAILQ_REMOVE(&monitor_bdrv_states, bs, monitor_list);
3639     bdrv_unref(bs);
3640 
3641 out:
3642     aio_context_release(aio_context);
3643 }
3644 
3645 static BdrvChild *bdrv_find_child(BlockDriverState *parent_bs,
3646                                   const char *child_name)
3647 {
3648     BdrvChild *child;
3649 
3650     QLIST_FOREACH(child, &parent_bs->children, next) {
3651         if (strcmp(child->name, child_name) == 0) {
3652             return child;
3653         }
3654     }
3655 
3656     return NULL;
3657 }
3658 
3659 void qmp_x_blockdev_change(const char *parent, bool has_child,
3660                            const char *child, bool has_node,
3661                            const char *node, Error **errp)
3662 {
3663     BlockDriverState *parent_bs, *new_bs = NULL;
3664     BdrvChild *p_child;
3665 
3666     parent_bs = bdrv_lookup_bs(parent, parent, errp);
3667     if (!parent_bs) {
3668         return;
3669     }
3670 
3671     if (has_child == has_node) {
3672         if (has_child) {
3673             error_setg(errp, "The parameters child and node are in conflict");
3674         } else {
3675             error_setg(errp, "Either child or node must be specified");
3676         }
3677         return;
3678     }
3679 
3680     if (has_child) {
3681         p_child = bdrv_find_child(parent_bs, child);
3682         if (!p_child) {
3683             error_setg(errp, "Node '%s' does not have child '%s'",
3684                        parent, child);
3685             return;
3686         }
3687         bdrv_del_child(parent_bs, p_child, errp);
3688     }
3689 
3690     if (has_node) {
3691         new_bs = bdrv_find_node(node);
3692         if (!new_bs) {
3693             error_setg(errp, "Node '%s' not found", node);
3694             return;
3695         }
3696         bdrv_add_child(parent_bs, new_bs, errp);
3697     }
3698 }
3699 
3700 BlockJobInfoList *qmp_query_block_jobs(Error **errp)
3701 {
3702     BlockJobInfoList *head = NULL, **tail = &head;
3703     BlockJob *job;
3704 
3705     for (job = block_job_next(NULL); job; job = block_job_next(job)) {
3706         BlockJobInfo *value;
3707         AioContext *aio_context;
3708 
3709         if (block_job_is_internal(job)) {
3710             continue;
3711         }
3712         aio_context = blk_get_aio_context(job->blk);
3713         aio_context_acquire(aio_context);
3714         value = block_job_query(job, errp);
3715         aio_context_release(aio_context);
3716         if (!value) {
3717             qapi_free_BlockJobInfoList(head);
3718             return NULL;
3719         }
3720         QAPI_LIST_APPEND(tail, value);
3721     }
3722 
3723     return head;
3724 }
3725 
3726 void qmp_x_blockdev_set_iothread(const char *node_name, StrOrNull *iothread,
3727                                  bool has_force, bool force, Error **errp)
3728 {
3729     AioContext *old_context;
3730     AioContext *new_context;
3731     BlockDriverState *bs;
3732 
3733     bs = bdrv_find_node(node_name);
3734     if (!bs) {
3735         error_setg(errp, "Failed to find node with node-name='%s'", node_name);
3736         return;
3737     }
3738 
3739     /* Protects against accidents. */
3740     if (!(has_force && force) && bdrv_has_blk(bs)) {
3741         error_setg(errp, "Node %s is associated with a BlockBackend and could "
3742                          "be in use (use force=true to override this check)",
3743                          node_name);
3744         return;
3745     }
3746 
3747     if (iothread->type == QTYPE_QSTRING) {
3748         IOThread *obj = iothread_by_id(iothread->u.s);
3749         if (!obj) {
3750             error_setg(errp, "Cannot find iothread %s", iothread->u.s);
3751             return;
3752         }
3753 
3754         new_context = iothread_get_aio_context(obj);
3755     } else {
3756         new_context = qemu_get_aio_context();
3757     }
3758 
3759     old_context = bdrv_get_aio_context(bs);
3760     aio_context_acquire(old_context);
3761 
3762     bdrv_try_set_aio_context(bs, new_context, errp);
3763 
3764     aio_context_release(old_context);
3765 }
3766 
3767 QemuOptsList qemu_common_drive_opts = {
3768     .name = "drive",
3769     .head = QTAILQ_HEAD_INITIALIZER(qemu_common_drive_opts.head),
3770     .desc = {
3771         {
3772             .name = "snapshot",
3773             .type = QEMU_OPT_BOOL,
3774             .help = "enable/disable snapshot mode",
3775         },{
3776             .name = "aio",
3777             .type = QEMU_OPT_STRING,
3778             .help = "host AIO implementation (threads, native, io_uring)",
3779         },{
3780             .name = BDRV_OPT_CACHE_WB,
3781             .type = QEMU_OPT_BOOL,
3782             .help = "Enable writeback mode",
3783         },{
3784             .name = "format",
3785             .type = QEMU_OPT_STRING,
3786             .help = "disk format (raw, qcow2, ...)",
3787         },{
3788             .name = "rerror",
3789             .type = QEMU_OPT_STRING,
3790             .help = "read error action",
3791         },{
3792             .name = "werror",
3793             .type = QEMU_OPT_STRING,
3794             .help = "write error action",
3795         },{
3796             .name = BDRV_OPT_READ_ONLY,
3797             .type = QEMU_OPT_BOOL,
3798             .help = "open drive file as read-only",
3799         },
3800 
3801         THROTTLE_OPTS,
3802 
3803         {
3804             .name = "throttling.group",
3805             .type = QEMU_OPT_STRING,
3806             .help = "name of the block throttling group",
3807         },{
3808             .name = "copy-on-read",
3809             .type = QEMU_OPT_BOOL,
3810             .help = "copy read data from backing file into image file",
3811         },{
3812             .name = "detect-zeroes",
3813             .type = QEMU_OPT_STRING,
3814             .help = "try to optimize zero writes (off, on, unmap)",
3815         },{
3816             .name = "stats-account-invalid",
3817             .type = QEMU_OPT_BOOL,
3818             .help = "whether to account for invalid I/O operations "
3819                     "in the statistics",
3820         },{
3821             .name = "stats-account-failed",
3822             .type = QEMU_OPT_BOOL,
3823             .help = "whether to account for failed I/O operations "
3824                     "in the statistics",
3825         },
3826         { /* end of list */ }
3827     },
3828 };
3829 
3830 QemuOptsList qemu_drive_opts = {
3831     .name = "drive",
3832     .head = QTAILQ_HEAD_INITIALIZER(qemu_drive_opts.head),
3833     .desc = {
3834         /*
3835          * no elements => accept any params
3836          * validation will happen later
3837          */
3838         { /* end of list */ }
3839     },
3840 };
3841