block: fix bdrv_root_attach_child forget to unref child_bs
[qemu.git] / block.c
1 /*
2 * QEMU System Emulator block driver
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24
25 #include "qemu/osdep.h"
26 #include "block/trace.h"
27 #include "block/block_int.h"
28 #include "block/blockjob.h"
29 #include "block/nbd.h"
30 #include "block/qdict.h"
31 #include "qemu/error-report.h"
32 #include "module_block.h"
33 #include "qemu/main-loop.h"
34 #include "qemu/module.h"
35 #include "qapi/error.h"
36 #include "qapi/qmp/qdict.h"
37 #include "qapi/qmp/qjson.h"
38 #include "qapi/qmp/qnull.h"
39 #include "qapi/qmp/qstring.h"
40 #include "qapi/qobject-output-visitor.h"
41 #include "qapi/qapi-visit-block-core.h"
42 #include "sysemu/block-backend.h"
43 #include "sysemu/sysemu.h"
44 #include "qemu/notify.h"
45 #include "qemu/option.h"
46 #include "qemu/coroutine.h"
47 #include "block/qapi.h"
48 #include "qemu/timer.h"
49 #include "qemu/cutils.h"
50 #include "qemu/id.h"
51
52 #ifdef CONFIG_BSD
53 #include <sys/ioctl.h>
54 #include <sys/queue.h>
55 #ifndef __DragonFly__
56 #include <sys/disk.h>
57 #endif
58 #endif
59
60 #ifdef _WIN32
61 #include <windows.h>
62 #endif
63
64 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
65
66 static QTAILQ_HEAD(, BlockDriverState) graph_bdrv_states =
67 QTAILQ_HEAD_INITIALIZER(graph_bdrv_states);
68
69 static QTAILQ_HEAD(, BlockDriverState) all_bdrv_states =
70 QTAILQ_HEAD_INITIALIZER(all_bdrv_states);
71
72 static QLIST_HEAD(, BlockDriver) bdrv_drivers =
73 QLIST_HEAD_INITIALIZER(bdrv_drivers);
74
75 static BlockDriverState *bdrv_open_inherit(const char *filename,
76 const char *reference,
77 QDict *options, int flags,
78 BlockDriverState *parent,
79 const BdrvChildRole *child_role,
80 Error **errp);
81
82 /* If non-zero, use only whitelisted block drivers */
83 static int use_bdrv_whitelist;
84
85 #ifdef _WIN32
86 static int is_windows_drive_prefix(const char *filename)
87 {
88 return (((filename[0] >= 'a' && filename[0] <= 'z') ||
89 (filename[0] >= 'A' && filename[0] <= 'Z')) &&
90 filename[1] == ':');
91 }
92
93 int is_windows_drive(const char *filename)
94 {
95 if (is_windows_drive_prefix(filename) &&
96 filename[2] == '\0')
97 return 1;
98 if (strstart(filename, "\\\\.\\", NULL) ||
99 strstart(filename, "//./", NULL))
100 return 1;
101 return 0;
102 }
103 #endif
104
105 size_t bdrv_opt_mem_align(BlockDriverState *bs)
106 {
107 if (!bs || !bs->drv) {
108 /* page size or 4k (hdd sector size) should be on the safe side */
109 return MAX(4096, qemu_real_host_page_size);
110 }
111
112 return bs->bl.opt_mem_alignment;
113 }
114
115 size_t bdrv_min_mem_align(BlockDriverState *bs)
116 {
117 if (!bs || !bs->drv) {
118 /* page size or 4k (hdd sector size) should be on the safe side */
119 return MAX(4096, qemu_real_host_page_size);
120 }
121
122 return bs->bl.min_mem_alignment;
123 }
124
125 /* check if the path starts with "<protocol>:" */
126 int path_has_protocol(const char *path)
127 {
128 const char *p;
129
130 #ifdef _WIN32
131 if (is_windows_drive(path) ||
132 is_windows_drive_prefix(path)) {
133 return 0;
134 }
135 p = path + strcspn(path, ":/\\");
136 #else
137 p = path + strcspn(path, ":/");
138 #endif
139
140 return *p == ':';
141 }
142
143 int path_is_absolute(const char *path)
144 {
145 #ifdef _WIN32
146 /* specific case for names like: "\\.\d:" */
147 if (is_windows_drive(path) || is_windows_drive_prefix(path)) {
148 return 1;
149 }
150 return (*path == '/' || *path == '\\');
151 #else
152 return (*path == '/');
153 #endif
154 }
155
156 /* if filename is absolute, just return its duplicate. Otherwise, build a
157 path to it by considering it is relative to base_path. URL are
158 supported. */
159 char *path_combine(const char *base_path, const char *filename)
160 {
161 const char *protocol_stripped = NULL;
162 const char *p, *p1;
163 char *result;
164 int len;
165
166 if (path_is_absolute(filename)) {
167 return g_strdup(filename);
168 }
169
170 if (path_has_protocol(base_path)) {
171 protocol_stripped = strchr(base_path, ':');
172 if (protocol_stripped) {
173 protocol_stripped++;
174 }
175 }
176 p = protocol_stripped ?: base_path;
177
178 p1 = strrchr(base_path, '/');
179 #ifdef _WIN32
180 {
181 const char *p2;
182 p2 = strrchr(base_path, '\\');
183 if (!p1 || p2 > p1) {
184 p1 = p2;
185 }
186 }
187 #endif
188 if (p1) {
189 p1++;
190 } else {
191 p1 = base_path;
192 }
193 if (p1 > p) {
194 p = p1;
195 }
196 len = p - base_path;
197
198 result = g_malloc(len + strlen(filename) + 1);
199 memcpy(result, base_path, len);
200 strcpy(result + len, filename);
201
202 return result;
203 }
204
205 /*
206 * Helper function for bdrv_parse_filename() implementations to remove optional
207 * protocol prefixes (especially "file:") from a filename and for putting the
208 * stripped filename into the options QDict if there is such a prefix.
209 */
210 void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
211 QDict *options)
212 {
213 if (strstart(filename, prefix, &filename)) {
214 /* Stripping the explicit protocol prefix may result in a protocol
215 * prefix being (wrongly) detected (if the filename contains a colon) */
216 if (path_has_protocol(filename)) {
217 QString *fat_filename;
218
219 /* This means there is some colon before the first slash; therefore,
220 * this cannot be an absolute path */
221 assert(!path_is_absolute(filename));
222
223 /* And we can thus fix the protocol detection issue by prefixing it
224 * by "./" */
225 fat_filename = qstring_from_str("./");
226 qstring_append(fat_filename, filename);
227
228 assert(!path_has_protocol(qstring_get_str(fat_filename)));
229
230 qdict_put(options, "filename", fat_filename);
231 } else {
232 /* If no protocol prefix was detected, we can use the shortened
233 * filename as-is */
234 qdict_put_str(options, "filename", filename);
235 }
236 }
237 }
238
239
240 /* Returns whether the image file is opened as read-only. Note that this can
241 * return false and writing to the image file is still not possible because the
242 * image is inactivated. */
243 bool bdrv_is_read_only(BlockDriverState *bs)
244 {
245 return bs->read_only;
246 }
247
248 int bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
249 bool ignore_allow_rdw, Error **errp)
250 {
251 /* Do not set read_only if copy_on_read is enabled */
252 if (bs->copy_on_read && read_only) {
253 error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
254 bdrv_get_device_or_node_name(bs));
255 return -EINVAL;
256 }
257
258 /* Do not clear read_only if it is prohibited */
259 if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
260 !ignore_allow_rdw)
261 {
262 error_setg(errp, "Node '%s' is read only",
263 bdrv_get_device_or_node_name(bs));
264 return -EPERM;
265 }
266
267 return 0;
268 }
269
270 /*
271 * Called by a driver that can only provide a read-only image.
272 *
273 * Returns 0 if the node is already read-only or it could switch the node to
274 * read-only because BDRV_O_AUTO_RDONLY is set.
275 *
276 * Returns -EACCES if the node is read-write and BDRV_O_AUTO_RDONLY is not set
277 * or bdrv_can_set_read_only() forbids making the node read-only. If @errmsg
278 * is not NULL, it is used as the error message for the Error object.
279 */
280 int bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
281 Error **errp)
282 {
283 int ret = 0;
284
285 if (!(bs->open_flags & BDRV_O_RDWR)) {
286 return 0;
287 }
288 if (!(bs->open_flags & BDRV_O_AUTO_RDONLY)) {
289 goto fail;
290 }
291
292 ret = bdrv_can_set_read_only(bs, true, false, NULL);
293 if (ret < 0) {
294 goto fail;
295 }
296
297 bs->read_only = true;
298 bs->open_flags &= ~BDRV_O_RDWR;
299
300 return 0;
301
302 fail:
303 error_setg(errp, "%s", errmsg ?: "Image is read-only");
304 return -EACCES;
305 }
306
307 /*
308 * If @backing is empty, this function returns NULL without setting
309 * @errp. In all other cases, NULL will only be returned with @errp
310 * set.
311 *
312 * Therefore, a return value of NULL without @errp set means that
313 * there is no backing file; if @errp is set, there is one but its
314 * absolute filename cannot be generated.
315 */
316 char *bdrv_get_full_backing_filename_from_filename(const char *backed,
317 const char *backing,
318 Error **errp)
319 {
320 if (backing[0] == '\0') {
321 return NULL;
322 } else if (path_has_protocol(backing) || path_is_absolute(backing)) {
323 return g_strdup(backing);
324 } else if (backed[0] == '\0' || strstart(backed, "json:", NULL)) {
325 error_setg(errp, "Cannot use relative backing file names for '%s'",
326 backed);
327 return NULL;
328 } else {
329 return path_combine(backed, backing);
330 }
331 }
332
333 /*
334 * If @filename is empty or NULL, this function returns NULL without
335 * setting @errp. In all other cases, NULL will only be returned with
336 * @errp set.
337 */
338 static char *bdrv_make_absolute_filename(BlockDriverState *relative_to,
339 const char *filename, Error **errp)
340 {
341 char *dir, *full_name;
342
343 if (!filename || filename[0] == '\0') {
344 return NULL;
345 } else if (path_has_protocol(filename) || path_is_absolute(filename)) {
346 return g_strdup(filename);
347 }
348
349 dir = bdrv_dirname(relative_to, errp);
350 if (!dir) {
351 return NULL;
352 }
353
354 full_name = g_strconcat(dir, filename, NULL);
355 g_free(dir);
356 return full_name;
357 }
358
359 char *bdrv_get_full_backing_filename(BlockDriverState *bs, Error **errp)
360 {
361 return bdrv_make_absolute_filename(bs, bs->backing_file, errp);
362 }
363
364 void bdrv_register(BlockDriver *bdrv)
365 {
366 assert(bdrv->format_name);
367 QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
368 }
369
370 BlockDriverState *bdrv_new(void)
371 {
372 BlockDriverState *bs;
373 int i;
374
375 bs = g_new0(BlockDriverState, 1);
376 QLIST_INIT(&bs->dirty_bitmaps);
377 for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
378 QLIST_INIT(&bs->op_blockers[i]);
379 }
380 notifier_with_return_list_init(&bs->before_write_notifiers);
381 qemu_co_mutex_init(&bs->reqs_lock);
382 qemu_mutex_init(&bs->dirty_bitmap_mutex);
383 bs->refcnt = 1;
384 bs->aio_context = qemu_get_aio_context();
385
386 qemu_co_queue_init(&bs->flush_queue);
387
388 for (i = 0; i < bdrv_drain_all_count; i++) {
389 bdrv_drained_begin(bs);
390 }
391
392 QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);
393
394 return bs;
395 }
396
397 static BlockDriver *bdrv_do_find_format(const char *format_name)
398 {
399 BlockDriver *drv1;
400
401 QLIST_FOREACH(drv1, &bdrv_drivers, list) {
402 if (!strcmp(drv1->format_name, format_name)) {
403 return drv1;
404 }
405 }
406
407 return NULL;
408 }
409
410 BlockDriver *bdrv_find_format(const char *format_name)
411 {
412 BlockDriver *drv1;
413 int i;
414
415 drv1 = bdrv_do_find_format(format_name);
416 if (drv1) {
417 return drv1;
418 }
419
420 /* The driver isn't registered, maybe we need to load a module */
421 for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
422 if (!strcmp(block_driver_modules[i].format_name, format_name)) {
423 block_module_load_one(block_driver_modules[i].library_name);
424 break;
425 }
426 }
427
428 return bdrv_do_find_format(format_name);
429 }
430
431 static int bdrv_format_is_whitelisted(const char *format_name, bool read_only)
432 {
433 static const char *whitelist_rw[] = {
434 CONFIG_BDRV_RW_WHITELIST
435 };
436 static const char *whitelist_ro[] = {
437 CONFIG_BDRV_RO_WHITELIST
438 };
439 const char **p;
440
441 if (!whitelist_rw[0] && !whitelist_ro[0]) {
442 return 1; /* no whitelist, anything goes */
443 }
444
445 for (p = whitelist_rw; *p; p++) {
446 if (!strcmp(format_name, *p)) {
447 return 1;
448 }
449 }
450 if (read_only) {
451 for (p = whitelist_ro; *p; p++) {
452 if (!strcmp(format_name, *p)) {
453 return 1;
454 }
455 }
456 }
457 return 0;
458 }
459
460 int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
461 {
462 return bdrv_format_is_whitelisted(drv->format_name, read_only);
463 }
464
465 bool bdrv_uses_whitelist(void)
466 {
467 return use_bdrv_whitelist;
468 }
469
470 typedef struct CreateCo {
471 BlockDriver *drv;
472 char *filename;
473 QemuOpts *opts;
474 int ret;
475 Error *err;
476 } CreateCo;
477
478 static void coroutine_fn bdrv_create_co_entry(void *opaque)
479 {
480 Error *local_err = NULL;
481 int ret;
482
483 CreateCo *cco = opaque;
484 assert(cco->drv);
485
486 ret = cco->drv->bdrv_co_create_opts(cco->drv,
487 cco->filename, cco->opts, &local_err);
488 error_propagate(&cco->err, local_err);
489 cco->ret = ret;
490 }
491
492 int bdrv_create(BlockDriver *drv, const char* filename,
493 QemuOpts *opts, Error **errp)
494 {
495 int ret;
496
497 Coroutine *co;
498 CreateCo cco = {
499 .drv = drv,
500 .filename = g_strdup(filename),
501 .opts = opts,
502 .ret = NOT_DONE,
503 .err = NULL,
504 };
505
506 if (!drv->bdrv_co_create_opts) {
507 error_setg(errp, "Driver '%s' does not support image creation", drv->format_name);
508 ret = -ENOTSUP;
509 goto out;
510 }
511
512 if (qemu_in_coroutine()) {
513 /* Fast-path if already in coroutine context */
514 bdrv_create_co_entry(&cco);
515 } else {
516 co = qemu_coroutine_create(bdrv_create_co_entry, &cco);
517 qemu_coroutine_enter(co);
518 while (cco.ret == NOT_DONE) {
519 aio_poll(qemu_get_aio_context(), true);
520 }
521 }
522
523 ret = cco.ret;
524 if (ret < 0) {
525 if (cco.err) {
526 error_propagate(errp, cco.err);
527 } else {
528 error_setg_errno(errp, -ret, "Could not create image");
529 }
530 }
531
532 out:
533 g_free(cco.filename);
534 return ret;
535 }
536
537 /**
538 * Helper function for bdrv_create_file_fallback(): Resize @blk to at
539 * least the given @minimum_size.
540 *
541 * On success, return @blk's actual length.
542 * Otherwise, return -errno.
543 */
544 static int64_t create_file_fallback_truncate(BlockBackend *blk,
545 int64_t minimum_size, Error **errp)
546 {
547 Error *local_err = NULL;
548 int64_t size;
549 int ret;
550
551 ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, &local_err);
552 if (ret < 0 && ret != -ENOTSUP) {
553 error_propagate(errp, local_err);
554 return ret;
555 }
556
557 size = blk_getlength(blk);
558 if (size < 0) {
559 error_free(local_err);
560 error_setg_errno(errp, -size,
561 "Failed to inquire the new image file's length");
562 return size;
563 }
564
565 if (size < minimum_size) {
566 /* Need to grow the image, but we failed to do that */
567 error_propagate(errp, local_err);
568 return -ENOTSUP;
569 }
570
571 error_free(local_err);
572 local_err = NULL;
573
574 return size;
575 }
576
577 /**
578 * Helper function for bdrv_create_file_fallback(): Zero the first
579 * sector to remove any potentially pre-existing image header.
580 */
581 static int create_file_fallback_zero_first_sector(BlockBackend *blk,
582 int64_t current_size,
583 Error **errp)
584 {
585 int64_t bytes_to_clear;
586 int ret;
587
588 bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
589 if (bytes_to_clear) {
590 ret = blk_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
591 if (ret < 0) {
592 error_setg_errno(errp, -ret,
593 "Failed to clear the new image's first sector");
594 return ret;
595 }
596 }
597
598 return 0;
599 }
600
601 /**
602 * Simple implementation of bdrv_co_create_opts for protocol drivers
603 * which only support creation via opening a file
604 * (usually existing raw storage device)
605 */
606 int coroutine_fn bdrv_co_create_opts_simple(BlockDriver *drv,
607 const char *filename,
608 QemuOpts *opts,
609 Error **errp)
610 {
611 BlockBackend *blk;
612 QDict *options;
613 int64_t size = 0;
614 char *buf = NULL;
615 PreallocMode prealloc;
616 Error *local_err = NULL;
617 int ret;
618
619 size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
620 buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
621 prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
622 PREALLOC_MODE_OFF, &local_err);
623 g_free(buf);
624 if (local_err) {
625 error_propagate(errp, local_err);
626 return -EINVAL;
627 }
628
629 if (prealloc != PREALLOC_MODE_OFF) {
630 error_setg(errp, "Unsupported preallocation mode '%s'",
631 PreallocMode_str(prealloc));
632 return -ENOTSUP;
633 }
634
635 options = qdict_new();
636 qdict_put_str(options, "driver", drv->format_name);
637
638 blk = blk_new_open(filename, NULL, options,
639 BDRV_O_RDWR | BDRV_O_RESIZE, errp);
640 if (!blk) {
641 error_prepend(errp, "Protocol driver '%s' does not support image "
642 "creation, and opening the image failed: ",
643 drv->format_name);
644 return -EINVAL;
645 }
646
647 size = create_file_fallback_truncate(blk, size, errp);
648 if (size < 0) {
649 ret = size;
650 goto out;
651 }
652
653 ret = create_file_fallback_zero_first_sector(blk, size, errp);
654 if (ret < 0) {
655 goto out;
656 }
657
658 ret = 0;
659 out:
660 blk_unref(blk);
661 return ret;
662 }
663
664 int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp)
665 {
666 BlockDriver *drv;
667
668 drv = bdrv_find_protocol(filename, true, errp);
669 if (drv == NULL) {
670 return -ENOENT;
671 }
672
673 return bdrv_create(drv, filename, opts, errp);
674 }
675
676 int coroutine_fn bdrv_co_delete_file(BlockDriverState *bs, Error **errp)
677 {
678 Error *local_err = NULL;
679 int ret;
680
681 assert(bs != NULL);
682
683 if (!bs->drv) {
684 error_setg(errp, "Block node '%s' is not opened", bs->filename);
685 return -ENOMEDIUM;
686 }
687
688 if (!bs->drv->bdrv_co_delete_file) {
689 error_setg(errp, "Driver '%s' does not support image deletion",
690 bs->drv->format_name);
691 return -ENOTSUP;
692 }
693
694 ret = bs->drv->bdrv_co_delete_file(bs, &local_err);
695 if (ret < 0) {
696 error_propagate(errp, local_err);
697 }
698
699 return ret;
700 }
701
702 /**
703 * Try to get @bs's logical and physical block size.
704 * On success, store them in @bsz struct and return 0.
705 * On failure return -errno.
706 * @bs must not be empty.
707 */
708 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
709 {
710 BlockDriver *drv = bs->drv;
711
712 if (drv && drv->bdrv_probe_blocksizes) {
713 return drv->bdrv_probe_blocksizes(bs, bsz);
714 } else if (drv && drv->is_filter && bs->file) {
715 return bdrv_probe_blocksizes(bs->file->bs, bsz);
716 }
717
718 return -ENOTSUP;
719 }
720
721 /**
722 * Try to get @bs's geometry (cyls, heads, sectors).
723 * On success, store them in @geo struct and return 0.
724 * On failure return -errno.
725 * @bs must not be empty.
726 */
727 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
728 {
729 BlockDriver *drv = bs->drv;
730
731 if (drv && drv->bdrv_probe_geometry) {
732 return drv->bdrv_probe_geometry(bs, geo);
733 } else if (drv && drv->is_filter && bs->file) {
734 return bdrv_probe_geometry(bs->file->bs, geo);
735 }
736
737 return -ENOTSUP;
738 }
739
740 /*
741 * Create a uniquely-named empty temporary file.
742 * Return 0 upon success, otherwise a negative errno value.
743 */
744 int get_tmp_filename(char *filename, int size)
745 {
746 #ifdef _WIN32
747 char temp_dir[MAX_PATH];
748 /* GetTempFileName requires that its output buffer (4th param)
749 have length MAX_PATH or greater. */
750 assert(size >= MAX_PATH);
751 return (GetTempPath(MAX_PATH, temp_dir)
752 && GetTempFileName(temp_dir, "qem", 0, filename)
753 ? 0 : -GetLastError());
754 #else
755 int fd;
756 const char *tmpdir;
757 tmpdir = getenv("TMPDIR");
758 if (!tmpdir) {
759 tmpdir = "/var/tmp";
760 }
761 if (snprintf(filename, size, "%s/vl.XXXXXX", tmpdir) >= size) {
762 return -EOVERFLOW;
763 }
764 fd = mkstemp(filename);
765 if (fd < 0) {
766 return -errno;
767 }
768 if (close(fd) != 0) {
769 unlink(filename);
770 return -errno;
771 }
772 return 0;
773 #endif
774 }
775
776 /*
777 * Detect host devices. By convention, /dev/cdrom[N] is always
778 * recognized as a host CDROM.
779 */
780 static BlockDriver *find_hdev_driver(const char *filename)
781 {
782 int score_max = 0, score;
783 BlockDriver *drv = NULL, *d;
784
785 QLIST_FOREACH(d, &bdrv_drivers, list) {
786 if (d->bdrv_probe_device) {
787 score = d->bdrv_probe_device(filename);
788 if (score > score_max) {
789 score_max = score;
790 drv = d;
791 }
792 }
793 }
794
795 return drv;
796 }
797
798 static BlockDriver *bdrv_do_find_protocol(const char *protocol)
799 {
800 BlockDriver *drv1;
801
802 QLIST_FOREACH(drv1, &bdrv_drivers, list) {
803 if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
804 return drv1;
805 }
806 }
807
808 return NULL;
809 }
810
811 BlockDriver *bdrv_find_protocol(const char *filename,
812 bool allow_protocol_prefix,
813 Error **errp)
814 {
815 BlockDriver *drv1;
816 char protocol[128];
817 int len;
818 const char *p;
819 int i;
820
821 /* TODO Drivers without bdrv_file_open must be specified explicitly */
822
823 /*
824 * XXX(hch): we really should not let host device detection
825 * override an explicit protocol specification, but moving this
826 * later breaks access to device names with colons in them.
827 * Thanks to the brain-dead persistent naming schemes on udev-
828 * based Linux systems those actually are quite common.
829 */
830 drv1 = find_hdev_driver(filename);
831 if (drv1) {
832 return drv1;
833 }
834
835 if (!path_has_protocol(filename) || !allow_protocol_prefix) {
836 return &bdrv_file;
837 }
838
839 p = strchr(filename, ':');
840 assert(p != NULL);
841 len = p - filename;
842 if (len > sizeof(protocol) - 1)
843 len = sizeof(protocol) - 1;
844 memcpy(protocol, filename, len);
845 protocol[len] = '\0';
846
847 drv1 = bdrv_do_find_protocol(protocol);
848 if (drv1) {
849 return drv1;
850 }
851
852 for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
853 if (block_driver_modules[i].protocol_name &&
854 !strcmp(block_driver_modules[i].protocol_name, protocol)) {
855 block_module_load_one(block_driver_modules[i].library_name);
856 break;
857 }
858 }
859
860 drv1 = bdrv_do_find_protocol(protocol);
861 if (!drv1) {
862 error_setg(errp, "Unknown protocol '%s'", protocol);
863 }
864 return drv1;
865 }
866
867 /*
868 * Guess image format by probing its contents.
869 * This is not a good idea when your image is raw (CVE-2008-2004), but
870 * we do it anyway for backward compatibility.
871 *
872 * @buf contains the image's first @buf_size bytes.
873 * @buf_size is the buffer size in bytes (generally BLOCK_PROBE_BUF_SIZE,
874 * but can be smaller if the image file is smaller)
875 * @filename is its filename.
876 *
877 * For all block drivers, call the bdrv_probe() method to get its
878 * probing score.
879 * Return the first block driver with the highest probing score.
880 */
881 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
882 const char *filename)
883 {
884 int score_max = 0, score;
885 BlockDriver *drv = NULL, *d;
886
887 QLIST_FOREACH(d, &bdrv_drivers, list) {
888 if (d->bdrv_probe) {
889 score = d->bdrv_probe(buf, buf_size, filename);
890 if (score > score_max) {
891 score_max = score;
892 drv = d;
893 }
894 }
895 }
896
897 return drv;
898 }
899
900 static int find_image_format(BlockBackend *file, const char *filename,
901 BlockDriver **pdrv, Error **errp)
902 {
903 BlockDriver *drv;
904 uint8_t buf[BLOCK_PROBE_BUF_SIZE];
905 int ret = 0;
906
907 /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
908 if (blk_is_sg(file) || !blk_is_inserted(file) || blk_getlength(file) == 0) {
909 *pdrv = &bdrv_raw;
910 return ret;
911 }
912
913 ret = blk_pread(file, 0, buf, sizeof(buf));
914 if (ret < 0) {
915 error_setg_errno(errp, -ret, "Could not read image for determining its "
916 "format");
917 *pdrv = NULL;
918 return ret;
919 }
920
921 drv = bdrv_probe_all(buf, ret, filename);
922 if (!drv) {
923 error_setg(errp, "Could not determine image format: No compatible "
924 "driver found");
925 ret = -ENOENT;
926 }
927 *pdrv = drv;
928 return ret;
929 }
930
931 /**
932 * Set the current 'total_sectors' value
933 * Return 0 on success, -errno on error.
934 */
935 int refresh_total_sectors(BlockDriverState *bs, int64_t hint)
936 {
937 BlockDriver *drv = bs->drv;
938
939 if (!drv) {
940 return -ENOMEDIUM;
941 }
942
943 /* Do not attempt drv->bdrv_getlength() on scsi-generic devices */
944 if (bdrv_is_sg(bs))
945 return 0;
946
947 /* query actual device if possible, otherwise just trust the hint */
948 if (drv->bdrv_getlength) {
949 int64_t length = drv->bdrv_getlength(bs);
950 if (length < 0) {
951 return length;
952 }
953 hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
954 }
955
956 bs->total_sectors = hint;
957 return 0;
958 }
959
960 /**
961 * Combines a QDict of new block driver @options with any missing options taken
962 * from @old_options, so that leaving out an option defaults to its old value.
963 */
964 static void bdrv_join_options(BlockDriverState *bs, QDict *options,
965 QDict *old_options)
966 {
967 if (bs->drv && bs->drv->bdrv_join_options) {
968 bs->drv->bdrv_join_options(options, old_options);
969 } else {
970 qdict_join(options, old_options, false);
971 }
972 }
973
974 static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
975 int open_flags,
976 Error **errp)
977 {
978 Error *local_err = NULL;
979 char *value = qemu_opt_get_del(opts, "detect-zeroes");
980 BlockdevDetectZeroesOptions detect_zeroes =
981 qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
982 BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
983 g_free(value);
984 if (local_err) {
985 error_propagate(errp, local_err);
986 return detect_zeroes;
987 }
988
989 if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
990 !(open_flags & BDRV_O_UNMAP))
991 {
992 error_setg(errp, "setting detect-zeroes to unmap is not allowed "
993 "without setting discard operation to unmap");
994 }
995
996 return detect_zeroes;
997 }
998
999 /**
1000 * Set open flags for aio engine
1001 *
1002 * Return 0 on success, -1 if the engine specified is invalid
1003 */
1004 int bdrv_parse_aio(const char *mode, int *flags)
1005 {
1006 if (!strcmp(mode, "threads")) {
1007 /* do nothing, default */
1008 } else if (!strcmp(mode, "native")) {
1009 *flags |= BDRV_O_NATIVE_AIO;
1010 #ifdef CONFIG_LINUX_IO_URING
1011 } else if (!strcmp(mode, "io_uring")) {
1012 *flags |= BDRV_O_IO_URING;
1013 #endif
1014 } else {
1015 return -1;
1016 }
1017
1018 return 0;
1019 }
1020
1021 /**
1022 * Set open flags for a given discard mode
1023 *
1024 * Return 0 on success, -1 if the discard mode was invalid.
1025 */
1026 int bdrv_parse_discard_flags(const char *mode, int *flags)
1027 {
1028 *flags &= ~BDRV_O_UNMAP;
1029
1030 if (!strcmp(mode, "off") || !strcmp(mode, "ignore")) {
1031 /* do nothing */
1032 } else if (!strcmp(mode, "on") || !strcmp(mode, "unmap")) {
1033 *flags |= BDRV_O_UNMAP;
1034 } else {
1035 return -1;
1036 }
1037
1038 return 0;
1039 }
1040
1041 /**
1042 * Set open flags for a given cache mode
1043 *
1044 * Return 0 on success, -1 if the cache mode was invalid.
1045 */
1046 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough)
1047 {
1048 *flags &= ~BDRV_O_CACHE_MASK;
1049
1050 if (!strcmp(mode, "off") || !strcmp(mode, "none")) {
1051 *writethrough = false;
1052 *flags |= BDRV_O_NOCACHE;
1053 } else if (!strcmp(mode, "directsync")) {
1054 *writethrough = true;
1055 *flags |= BDRV_O_NOCACHE;
1056 } else if (!strcmp(mode, "writeback")) {
1057 *writethrough = false;
1058 } else if (!strcmp(mode, "unsafe")) {
1059 *writethrough = false;
1060 *flags |= BDRV_O_NO_FLUSH;
1061 } else if (!strcmp(mode, "writethrough")) {
1062 *writethrough = true;
1063 } else {
1064 return -1;
1065 }
1066
1067 return 0;
1068 }
1069
1070 static char *bdrv_child_get_parent_desc(BdrvChild *c)
1071 {
1072 BlockDriverState *parent = c->opaque;
1073 return g_strdup(bdrv_get_device_or_node_name(parent));
1074 }
1075
1076 static void bdrv_child_cb_drained_begin(BdrvChild *child)
1077 {
1078 BlockDriverState *bs = child->opaque;
1079 bdrv_do_drained_begin_quiesce(bs, NULL, false);
1080 }
1081
1082 static bool bdrv_child_cb_drained_poll(BdrvChild *child)
1083 {
1084 BlockDriverState *bs = child->opaque;
1085 return bdrv_drain_poll(bs, false, NULL, false);
1086 }
1087
1088 static void bdrv_child_cb_drained_end(BdrvChild *child,
1089 int *drained_end_counter)
1090 {
1091 BlockDriverState *bs = child->opaque;
1092 bdrv_drained_end_no_poll(bs, drained_end_counter);
1093 }
1094
1095 static void bdrv_child_cb_attach(BdrvChild *child)
1096 {
1097 BlockDriverState *bs = child->opaque;
1098 bdrv_apply_subtree_drain(child, bs);
1099 }
1100
1101 static void bdrv_child_cb_detach(BdrvChild *child)
1102 {
1103 BlockDriverState *bs = child->opaque;
1104 bdrv_unapply_subtree_drain(child, bs);
1105 }
1106
1107 static int bdrv_child_cb_inactivate(BdrvChild *child)
1108 {
1109 BlockDriverState *bs = child->opaque;
1110 assert(bs->open_flags & BDRV_O_INACTIVE);
1111 return 0;
1112 }
1113
1114 static bool bdrv_child_cb_can_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1115 GSList **ignore, Error **errp)
1116 {
1117 BlockDriverState *bs = child->opaque;
1118 return bdrv_can_set_aio_context(bs, ctx, ignore, errp);
1119 }
1120
1121 static void bdrv_child_cb_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1122 GSList **ignore)
1123 {
1124 BlockDriverState *bs = child->opaque;
1125 return bdrv_set_aio_context_ignore(bs, ctx, ignore);
1126 }
1127
1128 /*
1129 * Returns the options and flags that a temporary snapshot should get, based on
1130 * the originally requested flags (the originally requested image will have
1131 * flags like a backing file)
1132 */
1133 static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
1134 int parent_flags, QDict *parent_options)
1135 {
1136 *child_flags = (parent_flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
1137
1138 /* For temporary files, unconditional cache=unsafe is fine */
1139 qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
1140 qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
1141
1142 /* Copy the read-only and discard options from the parent */
1143 qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1144 qdict_copy_default(child_options, parent_options, BDRV_OPT_DISCARD);
1145
1146 /* aio=native doesn't work for cache.direct=off, so disable it for the
1147 * temporary snapshot */
1148 *child_flags &= ~BDRV_O_NATIVE_AIO;
1149 }
1150
1151 /*
1152 * Returns the options and flags that bs->file should get if a protocol driver
1153 * is expected, based on the given options and flags for the parent BDS
1154 */
1155 static void bdrv_inherited_options(int *child_flags, QDict *child_options,
1156 int parent_flags, QDict *parent_options)
1157 {
1158 int flags = parent_flags;
1159
1160 /* Enable protocol handling, disable format probing for bs->file */
1161 flags |= BDRV_O_PROTOCOL;
1162
1163 /* If the cache mode isn't explicitly set, inherit direct and no-flush from
1164 * the parent. */
1165 qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1166 qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1167 qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1168
1169 /* Inherit the read-only option from the parent if it's not set */
1170 qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1171 qdict_copy_default(child_options, parent_options, BDRV_OPT_AUTO_READ_ONLY);
1172
1173 /* Our block drivers take care to send flushes and respect unmap policy,
1174 * so we can default to enable both on lower layers regardless of the
1175 * corresponding parent options. */
1176 qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
1177
1178 /* Clear flags that only apply to the top layer */
1179 flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ |
1180 BDRV_O_NO_IO);
1181
1182 *child_flags = flags;
1183 }
1184
1185 const BdrvChildRole child_file = {
1186 .parent_is_bds = true,
1187 .get_parent_desc = bdrv_child_get_parent_desc,
1188 .inherit_options = bdrv_inherited_options,
1189 .drained_begin = bdrv_child_cb_drained_begin,
1190 .drained_poll = bdrv_child_cb_drained_poll,
1191 .drained_end = bdrv_child_cb_drained_end,
1192 .attach = bdrv_child_cb_attach,
1193 .detach = bdrv_child_cb_detach,
1194 .inactivate = bdrv_child_cb_inactivate,
1195 .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
1196 .set_aio_ctx = bdrv_child_cb_set_aio_ctx,
1197 };
1198
1199 /*
1200 * Returns the options and flags that bs->file should get if the use of formats
1201 * (and not only protocols) is permitted for it, based on the given options and
1202 * flags for the parent BDS
1203 */
1204 static void bdrv_inherited_fmt_options(int *child_flags, QDict *child_options,
1205 int parent_flags, QDict *parent_options)
1206 {
1207 child_file.inherit_options(child_flags, child_options,
1208 parent_flags, parent_options);
1209
1210 *child_flags &= ~(BDRV_O_PROTOCOL | BDRV_O_NO_IO);
1211 }
1212
1213 const BdrvChildRole child_format = {
1214 .parent_is_bds = true,
1215 .get_parent_desc = bdrv_child_get_parent_desc,
1216 .inherit_options = bdrv_inherited_fmt_options,
1217 .drained_begin = bdrv_child_cb_drained_begin,
1218 .drained_poll = bdrv_child_cb_drained_poll,
1219 .drained_end = bdrv_child_cb_drained_end,
1220 .attach = bdrv_child_cb_attach,
1221 .detach = bdrv_child_cb_detach,
1222 .inactivate = bdrv_child_cb_inactivate,
1223 .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
1224 .set_aio_ctx = bdrv_child_cb_set_aio_ctx,
1225 };
1226
1227 static void bdrv_backing_attach(BdrvChild *c)
1228 {
1229 BlockDriverState *parent = c->opaque;
1230 BlockDriverState *backing_hd = c->bs;
1231
1232 assert(!parent->backing_blocker);
1233 error_setg(&parent->backing_blocker,
1234 "node is used as backing hd of '%s'",
1235 bdrv_get_device_or_node_name(parent));
1236
1237 bdrv_refresh_filename(backing_hd);
1238
1239 parent->open_flags &= ~BDRV_O_NO_BACKING;
1240 pstrcpy(parent->backing_file, sizeof(parent->backing_file),
1241 backing_hd->filename);
1242 pstrcpy(parent->backing_format, sizeof(parent->backing_format),
1243 backing_hd->drv ? backing_hd->drv->format_name : "");
1244
1245 bdrv_op_block_all(backing_hd, parent->backing_blocker);
1246 /* Otherwise we won't be able to commit or stream */
1247 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
1248 parent->backing_blocker);
1249 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
1250 parent->backing_blocker);
1251 /*
1252 * We do backup in 3 ways:
1253 * 1. drive backup
1254 * The target bs is new opened, and the source is top BDS
1255 * 2. blockdev backup
1256 * Both the source and the target are top BDSes.
1257 * 3. internal backup(used for block replication)
1258 * Both the source and the target are backing file
1259 *
1260 * In case 1 and 2, neither the source nor the target is the backing file.
1261 * In case 3, we will block the top BDS, so there is only one block job
1262 * for the top BDS and its backing chain.
1263 */
1264 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
1265 parent->backing_blocker);
1266 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
1267 parent->backing_blocker);
1268
1269 bdrv_child_cb_attach(c);
1270 }
1271
1272 static void bdrv_backing_detach(BdrvChild *c)
1273 {
1274 BlockDriverState *parent = c->opaque;
1275
1276 assert(parent->backing_blocker);
1277 bdrv_op_unblock_all(c->bs, parent->backing_blocker);
1278 error_free(parent->backing_blocker);
1279 parent->backing_blocker = NULL;
1280
1281 bdrv_child_cb_detach(c);
1282 }
1283
1284 /*
1285 * Returns the options and flags that bs->backing should get, based on the
1286 * given options and flags for the parent BDS
1287 */
1288 static void bdrv_backing_options(int *child_flags, QDict *child_options,
1289 int parent_flags, QDict *parent_options)
1290 {
1291 int flags = parent_flags;
1292
1293 /* The cache mode is inherited unmodified for backing files; except WCE,
1294 * which is only applied on the top level (BlockBackend) */
1295 qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1296 qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1297 qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1298
1299 /* backing files always opened read-only */
1300 qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
1301 qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
1302 flags &= ~BDRV_O_COPY_ON_READ;
1303
1304 /* snapshot=on is handled on the top layer */
1305 flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_TEMPORARY);
1306
1307 *child_flags = flags;
1308 }
1309
1310 static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
1311 const char *filename, Error **errp)
1312 {
1313 BlockDriverState *parent = c->opaque;
1314 bool read_only = bdrv_is_read_only(parent);
1315 int ret;
1316
1317 if (read_only) {
1318 ret = bdrv_reopen_set_read_only(parent, false, errp);
1319 if (ret < 0) {
1320 return ret;
1321 }
1322 }
1323
1324 ret = bdrv_change_backing_file(parent, filename,
1325 base->drv ? base->drv->format_name : "");
1326 if (ret < 0) {
1327 error_setg_errno(errp, -ret, "Could not update backing file link");
1328 }
1329
1330 if (read_only) {
1331 bdrv_reopen_set_read_only(parent, true, NULL);
1332 }
1333
1334 return ret;
1335 }
1336
1337 const BdrvChildRole child_backing = {
1338 .parent_is_bds = true,
1339 .get_parent_desc = bdrv_child_get_parent_desc,
1340 .attach = bdrv_backing_attach,
1341 .detach = bdrv_backing_detach,
1342 .inherit_options = bdrv_backing_options,
1343 .drained_begin = bdrv_child_cb_drained_begin,
1344 .drained_poll = bdrv_child_cb_drained_poll,
1345 .drained_end = bdrv_child_cb_drained_end,
1346 .inactivate = bdrv_child_cb_inactivate,
1347 .update_filename = bdrv_backing_update_filename,
1348 .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
1349 .set_aio_ctx = bdrv_child_cb_set_aio_ctx,
1350 };
1351
1352 static int bdrv_open_flags(BlockDriverState *bs, int flags)
1353 {
1354 int open_flags = flags;
1355
1356 /*
1357 * Clear flags that are internal to the block layer before opening the
1358 * image.
1359 */
1360 open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_PROTOCOL);
1361
1362 return open_flags;
1363 }
1364
1365 static void update_flags_from_options(int *flags, QemuOpts *opts)
1366 {
1367 *flags &= ~(BDRV_O_CACHE_MASK | BDRV_O_RDWR | BDRV_O_AUTO_RDONLY);
1368
1369 if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
1370 *flags |= BDRV_O_NO_FLUSH;
1371 }
1372
1373 if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
1374 *flags |= BDRV_O_NOCACHE;
1375 }
1376
1377 if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
1378 *flags |= BDRV_O_RDWR;
1379 }
1380
1381 if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
1382 *flags |= BDRV_O_AUTO_RDONLY;
1383 }
1384 }
1385
1386 static void update_options_from_flags(QDict *options, int flags)
1387 {
1388 if (!qdict_haskey(options, BDRV_OPT_CACHE_DIRECT)) {
1389 qdict_put_bool(options, BDRV_OPT_CACHE_DIRECT, flags & BDRV_O_NOCACHE);
1390 }
1391 if (!qdict_haskey(options, BDRV_OPT_CACHE_NO_FLUSH)) {
1392 qdict_put_bool(options, BDRV_OPT_CACHE_NO_FLUSH,
1393 flags & BDRV_O_NO_FLUSH);
1394 }
1395 if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
1396 qdict_put_bool(options, BDRV_OPT_READ_ONLY, !(flags & BDRV_O_RDWR));
1397 }
1398 if (!qdict_haskey(options, BDRV_OPT_AUTO_READ_ONLY)) {
1399 qdict_put_bool(options, BDRV_OPT_AUTO_READ_ONLY,
1400 flags & BDRV_O_AUTO_RDONLY);
1401 }
1402 }
1403
1404 static void bdrv_assign_node_name(BlockDriverState *bs,
1405 const char *node_name,
1406 Error **errp)
1407 {
1408 char *gen_node_name = NULL;
1409
1410 if (!node_name) {
1411 node_name = gen_node_name = id_generate(ID_BLOCK);
1412 } else if (!id_wellformed(node_name)) {
1413 /*
1414 * Check for empty string or invalid characters, but not if it is
1415 * generated (generated names use characters not available to the user)
1416 */
1417 error_setg(errp, "Invalid node name");
1418 return;
1419 }
1420
1421 /* takes care of avoiding namespaces collisions */
1422 if (blk_by_name(node_name)) {
1423 error_setg(errp, "node-name=%s is conflicting with a device id",
1424 node_name);
1425 goto out;
1426 }
1427
1428 /* takes care of avoiding duplicates node names */
1429 if (bdrv_find_node(node_name)) {
1430 error_setg(errp, "Duplicate node name");
1431 goto out;
1432 }
1433
1434 /* Make sure that the node name isn't truncated */
1435 if (strlen(node_name) >= sizeof(bs->node_name)) {
1436 error_setg(errp, "Node name too long");
1437 goto out;
1438 }
1439
1440 /* copy node name into the bs and insert it into the graph list */
1441 pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
1442 QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
1443 out:
1444 g_free(gen_node_name);
1445 }
1446
1447 static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
1448 const char *node_name, QDict *options,
1449 int open_flags, Error **errp)
1450 {
1451 Error *local_err = NULL;
1452 int i, ret;
1453
1454 bdrv_assign_node_name(bs, node_name, &local_err);
1455 if (local_err) {
1456 error_propagate(errp, local_err);
1457 return -EINVAL;
1458 }
1459
1460 bs->drv = drv;
1461 bs->read_only = !(bs->open_flags & BDRV_O_RDWR);
1462 bs->opaque = g_malloc0(drv->instance_size);
1463
1464 if (drv->bdrv_file_open) {
1465 assert(!drv->bdrv_needs_filename || bs->filename[0]);
1466 ret = drv->bdrv_file_open(bs, options, open_flags, &local_err);
1467 } else if (drv->bdrv_open) {
1468 ret = drv->bdrv_open(bs, options, open_flags, &local_err);
1469 } else {
1470 ret = 0;
1471 }
1472
1473 if (ret < 0) {
1474 if (local_err) {
1475 error_propagate(errp, local_err);
1476 } else if (bs->filename[0]) {
1477 error_setg_errno(errp, -ret, "Could not open '%s'", bs->filename);
1478 } else {
1479 error_setg_errno(errp, -ret, "Could not open image");
1480 }
1481 goto open_failed;
1482 }
1483
1484 ret = refresh_total_sectors(bs, bs->total_sectors);
1485 if (ret < 0) {
1486 error_setg_errno(errp, -ret, "Could not refresh total sector count");
1487 return ret;
1488 }
1489
1490 bdrv_refresh_limits(bs, &local_err);
1491 if (local_err) {
1492 error_propagate(errp, local_err);
1493 return -EINVAL;
1494 }
1495
1496 assert(bdrv_opt_mem_align(bs) != 0);
1497 assert(bdrv_min_mem_align(bs) != 0);
1498 assert(is_power_of_2(bs->bl.request_alignment));
1499
1500 for (i = 0; i < bs->quiesce_counter; i++) {
1501 if (drv->bdrv_co_drain_begin) {
1502 drv->bdrv_co_drain_begin(bs);
1503 }
1504 }
1505
1506 return 0;
1507 open_failed:
1508 bs->drv = NULL;
1509 if (bs->file != NULL) {
1510 bdrv_unref_child(bs, bs->file);
1511 bs->file = NULL;
1512 }
1513 g_free(bs->opaque);
1514 bs->opaque = NULL;
1515 return ret;
1516 }
1517
1518 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
1519 int flags, Error **errp)
1520 {
1521 BlockDriverState *bs;
1522 int ret;
1523
1524 bs = bdrv_new();
1525 bs->open_flags = flags;
1526 bs->explicit_options = qdict_new();
1527 bs->options = qdict_new();
1528 bs->opaque = NULL;
1529
1530 update_options_from_flags(bs->options, flags);
1531
1532 ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
1533 if (ret < 0) {
1534 qobject_unref(bs->explicit_options);
1535 bs->explicit_options = NULL;
1536 qobject_unref(bs->options);
1537 bs->options = NULL;
1538 bdrv_unref(bs);
1539 return NULL;
1540 }
1541
1542 return bs;
1543 }
1544
1545 QemuOptsList bdrv_runtime_opts = {
1546 .name = "bdrv_common",
1547 .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
1548 .desc = {
1549 {
1550 .name = "node-name",
1551 .type = QEMU_OPT_STRING,
1552 .help = "Node name of the block device node",
1553 },
1554 {
1555 .name = "driver",
1556 .type = QEMU_OPT_STRING,
1557 .help = "Block driver to use for the node",
1558 },
1559 {
1560 .name = BDRV_OPT_CACHE_DIRECT,
1561 .type = QEMU_OPT_BOOL,
1562 .help = "Bypass software writeback cache on the host",
1563 },
1564 {
1565 .name = BDRV_OPT_CACHE_NO_FLUSH,
1566 .type = QEMU_OPT_BOOL,
1567 .help = "Ignore flush requests",
1568 },
1569 {
1570 .name = BDRV_OPT_READ_ONLY,
1571 .type = QEMU_OPT_BOOL,
1572 .help = "Node is opened in read-only mode",
1573 },
1574 {
1575 .name = BDRV_OPT_AUTO_READ_ONLY,
1576 .type = QEMU_OPT_BOOL,
1577 .help = "Node can become read-only if opening read-write fails",
1578 },
1579 {
1580 .name = "detect-zeroes",
1581 .type = QEMU_OPT_STRING,
1582 .help = "try to optimize zero writes (off, on, unmap)",
1583 },
1584 {
1585 .name = BDRV_OPT_DISCARD,
1586 .type = QEMU_OPT_STRING,
1587 .help = "discard operation (ignore/off, unmap/on)",
1588 },
1589 {
1590 .name = BDRV_OPT_FORCE_SHARE,
1591 .type = QEMU_OPT_BOOL,
1592 .help = "always accept other writers (default: off)",
1593 },
1594 { /* end of list */ }
1595 },
1596 };
1597
1598 QemuOptsList bdrv_create_opts_simple = {
1599 .name = "simple-create-opts",
1600 .head = QTAILQ_HEAD_INITIALIZER(bdrv_create_opts_simple.head),
1601 .desc = {
1602 {
1603 .name = BLOCK_OPT_SIZE,
1604 .type = QEMU_OPT_SIZE,
1605 .help = "Virtual disk size"
1606 },
1607 {
1608 .name = BLOCK_OPT_PREALLOC,
1609 .type = QEMU_OPT_STRING,
1610 .help = "Preallocation mode (allowed values: off)"
1611 },
1612 { /* end of list */ }
1613 }
1614 };
1615
1616 /*
1617 * Common part for opening disk images and files
1618 *
1619 * Removes all processed options from *options.
1620 */
1621 static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
1622 QDict *options, Error **errp)
1623 {
1624 int ret, open_flags;
1625 const char *filename;
1626 const char *driver_name = NULL;
1627 const char *node_name = NULL;
1628 const char *discard;
1629 QemuOpts *opts;
1630 BlockDriver *drv;
1631 Error *local_err = NULL;
1632
1633 assert(bs->file == NULL);
1634 assert(options != NULL && bs->options != options);
1635
1636 opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
1637 qemu_opts_absorb_qdict(opts, options, &local_err);
1638 if (local_err) {
1639 error_propagate(errp, local_err);
1640 ret = -EINVAL;
1641 goto fail_opts;
1642 }
1643
1644 update_flags_from_options(&bs->open_flags, opts);
1645
1646 driver_name = qemu_opt_get(opts, "driver");
1647 drv = bdrv_find_format(driver_name);
1648 assert(drv != NULL);
1649
1650 bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
1651
1652 if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
1653 error_setg(errp,
1654 BDRV_OPT_FORCE_SHARE
1655 "=on can only be used with read-only images");
1656 ret = -EINVAL;
1657 goto fail_opts;
1658 }
1659
1660 if (file != NULL) {
1661 bdrv_refresh_filename(blk_bs(file));
1662 filename = blk_bs(file)->filename;
1663 } else {
1664 /*
1665 * Caution: while qdict_get_try_str() is fine, getting
1666 * non-string types would require more care. When @options
1667 * come from -blockdev or blockdev_add, its members are typed
1668 * according to the QAPI schema, but when they come from
1669 * -drive, they're all QString.
1670 */
1671 filename = qdict_get_try_str(options, "filename");
1672 }
1673
1674 if (drv->bdrv_needs_filename && (!filename || !filename[0])) {
1675 error_setg(errp, "The '%s' block driver requires a file name",
1676 drv->format_name);
1677 ret = -EINVAL;
1678 goto fail_opts;
1679 }
1680
1681 trace_bdrv_open_common(bs, filename ?: "", bs->open_flags,
1682 drv->format_name);
1683
1684 bs->read_only = !(bs->open_flags & BDRV_O_RDWR);
1685
1686 if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, bs->read_only)) {
1687 if (!bs->read_only && bdrv_is_whitelisted(drv, true)) {
1688 ret = bdrv_apply_auto_read_only(bs, NULL, NULL);
1689 } else {
1690 ret = -ENOTSUP;
1691 }
1692 if (ret < 0) {
1693 error_setg(errp,
1694 !bs->read_only && bdrv_is_whitelisted(drv, true)
1695 ? "Driver '%s' can only be used for read-only devices"
1696 : "Driver '%s' is not whitelisted",
1697 drv->format_name);
1698 goto fail_opts;
1699 }
1700 }
1701
1702 /* bdrv_new() and bdrv_close() make it so */
1703 assert(atomic_read(&bs->copy_on_read) == 0);
1704
1705 if (bs->open_flags & BDRV_O_COPY_ON_READ) {
1706 if (!bs->read_only) {
1707 bdrv_enable_copy_on_read(bs);
1708 } else {
1709 error_setg(errp, "Can't use copy-on-read on read-only device");
1710 ret = -EINVAL;
1711 goto fail_opts;
1712 }
1713 }
1714
1715 discard = qemu_opt_get(opts, BDRV_OPT_DISCARD);
1716 if (discard != NULL) {
1717 if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
1718 error_setg(errp, "Invalid discard option");
1719 ret = -EINVAL;
1720 goto fail_opts;
1721 }
1722 }
1723
1724 bs->detect_zeroes =
1725 bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
1726 if (local_err) {
1727 error_propagate(errp, local_err);
1728 ret = -EINVAL;
1729 goto fail_opts;
1730 }
1731
1732 if (filename != NULL) {
1733 pstrcpy(bs->filename, sizeof(bs->filename), filename);
1734 } else {
1735 bs->filename[0] = '\0';
1736 }
1737 pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), bs->filename);
1738
1739 /* Open the image, either directly or using a protocol */
1740 open_flags = bdrv_open_flags(bs, bs->open_flags);
1741 node_name = qemu_opt_get(opts, "node-name");
1742
1743 assert(!drv->bdrv_file_open || file == NULL);
1744 ret = bdrv_open_driver(bs, drv, node_name, options, open_flags, errp);
1745 if (ret < 0) {
1746 goto fail_opts;
1747 }
1748
1749 qemu_opts_del(opts);
1750 return 0;
1751
1752 fail_opts:
1753 qemu_opts_del(opts);
1754 return ret;
1755 }
1756
1757 static QDict *parse_json_filename(const char *filename, Error **errp)
1758 {
1759 QObject *options_obj;
1760 QDict *options;
1761 int ret;
1762
1763 ret = strstart(filename, "json:", &filename);
1764 assert(ret);
1765
1766 options_obj = qobject_from_json(filename, errp);
1767 if (!options_obj) {
1768 error_prepend(errp, "Could not parse the JSON options: ");
1769 return NULL;
1770 }
1771
1772 options = qobject_to(QDict, options_obj);
1773 if (!options) {
1774 qobject_unref(options_obj);
1775 error_setg(errp, "Invalid JSON object given");
1776 return NULL;
1777 }
1778
1779 qdict_flatten(options);
1780
1781 return options;
1782 }
1783
1784 static void parse_json_protocol(QDict *options, const char **pfilename,
1785 Error **errp)
1786 {
1787 QDict *json_options;
1788 Error *local_err = NULL;
1789
1790 /* Parse json: pseudo-protocol */
1791 if (!*pfilename || !g_str_has_prefix(*pfilename, "json:")) {
1792 return;
1793 }
1794
1795 json_options = parse_json_filename(*pfilename, &local_err);
1796 if (local_err) {
1797 error_propagate(errp, local_err);
1798 return;
1799 }
1800
1801 /* Options given in the filename have lower priority than options
1802 * specified directly */
1803 qdict_join(options, json_options, false);
1804 qobject_unref(json_options);
1805 *pfilename = NULL;
1806 }
1807
1808 /*
1809 * Fills in default options for opening images and converts the legacy
1810 * filename/flags pair to option QDict entries.
1811 * The BDRV_O_PROTOCOL flag in *flags will be set or cleared accordingly if a
1812 * block driver has been specified explicitly.
1813 */
1814 static int bdrv_fill_options(QDict **options, const char *filename,
1815 int *flags, Error **errp)
1816 {
1817 const char *drvname;
1818 bool protocol = *flags & BDRV_O_PROTOCOL;
1819 bool parse_filename = false;
1820 BlockDriver *drv = NULL;
1821 Error *local_err = NULL;
1822
1823 /*
1824 * Caution: while qdict_get_try_str() is fine, getting non-string
1825 * types would require more care. When @options come from
1826 * -blockdev or blockdev_add, its members are typed according to
1827 * the QAPI schema, but when they come from -drive, they're all
1828 * QString.
1829 */
1830 drvname = qdict_get_try_str(*options, "driver");
1831 if (drvname) {
1832 drv = bdrv_find_format(drvname);
1833 if (!drv) {
1834 error_setg(errp, "Unknown driver '%s'", drvname);
1835 return -ENOENT;
1836 }
1837 /* If the user has explicitly specified the driver, this choice should
1838 * override the BDRV_O_PROTOCOL flag */
1839 protocol = drv->bdrv_file_open;
1840 }
1841
1842 if (protocol) {
1843 *flags |= BDRV_O_PROTOCOL;
1844 } else {
1845 *flags &= ~BDRV_O_PROTOCOL;
1846 }
1847
1848 /* Translate cache options from flags into options */
1849 update_options_from_flags(*options, *flags);
1850
1851 /* Fetch the file name from the options QDict if necessary */
1852 if (protocol && filename) {
1853 if (!qdict_haskey(*options, "filename")) {
1854 qdict_put_str(*options, "filename", filename);
1855 parse_filename = true;
1856 } else {
1857 error_setg(errp, "Can't specify 'file' and 'filename' options at "
1858 "the same time");
1859 return -EINVAL;
1860 }
1861 }
1862
1863 /* Find the right block driver */
1864 /* See cautionary note on accessing @options above */
1865 filename = qdict_get_try_str(*options, "filename");
1866
1867 if (!drvname && protocol) {
1868 if (filename) {
1869 drv = bdrv_find_protocol(filename, parse_filename, errp);
1870 if (!drv) {
1871 return -EINVAL;
1872 }
1873
1874 drvname = drv->format_name;
1875 qdict_put_str(*options, "driver", drvname);
1876 } else {
1877 error_setg(errp, "Must specify either driver or file");
1878 return -EINVAL;
1879 }
1880 }
1881
1882 assert(drv || !protocol);
1883
1884 /* Driver-specific filename parsing */
1885 if (drv && drv->bdrv_parse_filename && parse_filename) {
1886 drv->bdrv_parse_filename(filename, *options, &local_err);
1887 if (local_err) {
1888 error_propagate(errp, local_err);
1889 return -EINVAL;
1890 }
1891
1892 if (!drv->bdrv_needs_filename) {
1893 qdict_del(*options, "filename");
1894 }
1895 }
1896
1897 return 0;
1898 }
1899
1900 static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
1901 uint64_t perm, uint64_t shared,
1902 GSList *ignore_children,
1903 bool *tighten_restrictions, Error **errp);
1904 static void bdrv_child_abort_perm_update(BdrvChild *c);
1905 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared);
1906
1907 typedef struct BlockReopenQueueEntry {
1908 bool prepared;
1909 bool perms_checked;
1910 BDRVReopenState state;
1911 QTAILQ_ENTRY(BlockReopenQueueEntry) entry;
1912 } BlockReopenQueueEntry;
1913
1914 /*
1915 * Return the flags that @bs will have after the reopens in @q have
1916 * successfully completed. If @q is NULL (or @bs is not contained in @q),
1917 * return the current flags.
1918 */
1919 static int bdrv_reopen_get_flags(BlockReopenQueue *q, BlockDriverState *bs)
1920 {
1921 BlockReopenQueueEntry *entry;
1922
1923 if (q != NULL) {
1924 QTAILQ_FOREACH(entry, q, entry) {
1925 if (entry->state.bs == bs) {
1926 return entry->state.flags;
1927 }
1928 }
1929 }
1930
1931 return bs->open_flags;
1932 }
1933
1934 /* Returns whether the image file can be written to after the reopen queue @q
1935 * has been successfully applied, or right now if @q is NULL. */
1936 static bool bdrv_is_writable_after_reopen(BlockDriverState *bs,
1937 BlockReopenQueue *q)
1938 {
1939 int flags = bdrv_reopen_get_flags(q, bs);
1940
1941 return (flags & (BDRV_O_RDWR | BDRV_O_INACTIVE)) == BDRV_O_RDWR;
1942 }
1943
1944 /*
1945 * Return whether the BDS can be written to. This is not necessarily
1946 * the same as !bdrv_is_read_only(bs), as inactivated images may not
1947 * be written to but do not count as read-only images.
1948 */
1949 bool bdrv_is_writable(BlockDriverState *bs)
1950 {
1951 return bdrv_is_writable_after_reopen(bs, NULL);
1952 }
1953
1954 static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
1955 BdrvChild *c, const BdrvChildRole *role,
1956 BlockReopenQueue *reopen_queue,
1957 uint64_t parent_perm, uint64_t parent_shared,
1958 uint64_t *nperm, uint64_t *nshared)
1959 {
1960 assert(bs->drv && bs->drv->bdrv_child_perm);
1961 bs->drv->bdrv_child_perm(bs, c, role, reopen_queue,
1962 parent_perm, parent_shared,
1963 nperm, nshared);
1964 /* TODO Take force_share from reopen_queue */
1965 if (child_bs && child_bs->force_share) {
1966 *nshared = BLK_PERM_ALL;
1967 }
1968 }
1969
1970 /*
1971 * Check whether permissions on this node can be changed in a way that
1972 * @cumulative_perms and @cumulative_shared_perms are the new cumulative
1973 * permissions of all its parents. This involves checking whether all necessary
1974 * permission changes to child nodes can be performed.
1975 *
1976 * Will set *tighten_restrictions to true if and only if new permissions have to
1977 * be taken or currently shared permissions are to be unshared. Otherwise,
1978 * errors are not fatal as long as the caller accepts that the restrictions
1979 * remain tighter than they need to be. The caller still has to abort the
1980 * transaction.
1981 * @tighten_restrictions cannot be used together with @q: When reopening, we may
1982 * encounter fatal errors even though no restrictions are to be tightened. For
1983 * example, changing a node from RW to RO will fail if the WRITE permission is
1984 * to be kept.
1985 *
1986 * A call to this function must always be followed by a call to bdrv_set_perm()
1987 * or bdrv_abort_perm_update().
1988 */
1989 static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
1990 uint64_t cumulative_perms,
1991 uint64_t cumulative_shared_perms,
1992 GSList *ignore_children,
1993 bool *tighten_restrictions, Error **errp)
1994 {
1995 BlockDriver *drv = bs->drv;
1996 BdrvChild *c;
1997 int ret;
1998
1999 assert(!q || !tighten_restrictions);
2000
2001 if (tighten_restrictions) {
2002 uint64_t current_perms, current_shared;
2003 uint64_t added_perms, removed_shared_perms;
2004
2005 bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
2006
2007 added_perms = cumulative_perms & ~current_perms;
2008 removed_shared_perms = current_shared & ~cumulative_shared_perms;
2009
2010 *tighten_restrictions = added_perms || removed_shared_perms;
2011 }
2012
2013 /* Write permissions never work with read-only images */
2014 if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2015 !bdrv_is_writable_after_reopen(bs, q))
2016 {
2017 if (!bdrv_is_writable_after_reopen(bs, NULL)) {
2018 error_setg(errp, "Block node is read-only");
2019 } else {
2020 uint64_t current_perms, current_shared;
2021 bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
2022 if (current_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
2023 error_setg(errp, "Cannot make block node read-only, there is "
2024 "a writer on it");
2025 } else {
2026 error_setg(errp, "Cannot make block node read-only and create "
2027 "a writer on it");
2028 }
2029 }
2030
2031 return -EPERM;
2032 }
2033
2034 /* Check this node */
2035 if (!drv) {
2036 return 0;
2037 }
2038
2039 if (drv->bdrv_check_perm) {
2040 return drv->bdrv_check_perm(bs, cumulative_perms,
2041 cumulative_shared_perms, errp);
2042 }
2043
2044 /* Drivers that never have children can omit .bdrv_child_perm() */
2045 if (!drv->bdrv_child_perm) {
2046 assert(QLIST_EMPTY(&bs->children));
2047 return 0;
2048 }
2049
2050 /* Check all children */
2051 QLIST_FOREACH(c, &bs->children, next) {
2052 uint64_t cur_perm, cur_shared;
2053 bool child_tighten_restr;
2054
2055 bdrv_child_perm(bs, c->bs, c, c->role, q,
2056 cumulative_perms, cumulative_shared_perms,
2057 &cur_perm, &cur_shared);
2058 ret = bdrv_child_check_perm(c, q, cur_perm, cur_shared, ignore_children,
2059 tighten_restrictions ? &child_tighten_restr
2060 : NULL,
2061 errp);
2062 if (tighten_restrictions) {
2063 *tighten_restrictions |= child_tighten_restr;
2064 }
2065 if (ret < 0) {
2066 return ret;
2067 }
2068 }
2069
2070 return 0;
2071 }
2072
2073 /*
2074 * Notifies drivers that after a previous bdrv_check_perm() call, the
2075 * permission update is not performed and any preparations made for it (e.g.
2076 * taken file locks) need to be undone.
2077 *
2078 * This function recursively notifies all child nodes.
2079 */
2080 static void bdrv_abort_perm_update(BlockDriverState *bs)
2081 {
2082 BlockDriver *drv = bs->drv;
2083 BdrvChild *c;
2084
2085 if (!drv) {
2086 return;
2087 }
2088
2089 if (drv->bdrv_abort_perm_update) {
2090 drv->bdrv_abort_perm_update(bs);
2091 }
2092
2093 QLIST_FOREACH(c, &bs->children, next) {
2094 bdrv_child_abort_perm_update(c);
2095 }
2096 }
2097
2098 static void bdrv_set_perm(BlockDriverState *bs, uint64_t cumulative_perms,
2099 uint64_t cumulative_shared_perms)
2100 {
2101 BlockDriver *drv = bs->drv;
2102 BdrvChild *c;
2103
2104 if (!drv) {
2105 return;
2106 }
2107
2108 /* Update this node */
2109 if (drv->bdrv_set_perm) {
2110 drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
2111 }
2112
2113 /* Drivers that never have children can omit .bdrv_child_perm() */
2114 if (!drv->bdrv_child_perm) {
2115 assert(QLIST_EMPTY(&bs->children));
2116 return;
2117 }
2118
2119 /* Update all children */
2120 QLIST_FOREACH(c, &bs->children, next) {
2121 uint64_t cur_perm, cur_shared;
2122 bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2123 cumulative_perms, cumulative_shared_perms,
2124 &cur_perm, &cur_shared);
2125 bdrv_child_set_perm(c, cur_perm, cur_shared);
2126 }
2127 }
2128
2129 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
2130 uint64_t *shared_perm)
2131 {
2132 BdrvChild *c;
2133 uint64_t cumulative_perms = 0;
2134 uint64_t cumulative_shared_perms = BLK_PERM_ALL;
2135
2136 QLIST_FOREACH(c, &bs->parents, next_parent) {
2137 cumulative_perms |= c->perm;
2138 cumulative_shared_perms &= c->shared_perm;
2139 }
2140
2141 *perm = cumulative_perms;
2142 *shared_perm = cumulative_shared_perms;
2143 }
2144
2145 static char *bdrv_child_user_desc(BdrvChild *c)
2146 {
2147 if (c->role->get_parent_desc) {
2148 return c->role->get_parent_desc(c);
2149 }
2150
2151 return g_strdup("another user");
2152 }
2153
2154 char *bdrv_perm_names(uint64_t perm)
2155 {
2156 struct perm_name {
2157 uint64_t perm;
2158 const char *name;
2159 } permissions[] = {
2160 { BLK_PERM_CONSISTENT_READ, "consistent read" },
2161 { BLK_PERM_WRITE, "write" },
2162 { BLK_PERM_WRITE_UNCHANGED, "write unchanged" },
2163 { BLK_PERM_RESIZE, "resize" },
2164 { BLK_PERM_GRAPH_MOD, "change children" },
2165 { 0, NULL }
2166 };
2167
2168 GString *result = g_string_sized_new(30);
2169 struct perm_name *p;
2170
2171 for (p = permissions; p->name; p++) {
2172 if (perm & p->perm) {
2173 if (result->len > 0) {
2174 g_string_append(result, ", ");
2175 }
2176 g_string_append(result, p->name);
2177 }
2178 }
2179
2180 return g_string_free(result, FALSE);
2181 }
2182
2183 /*
2184 * Checks whether a new reference to @bs can be added if the new user requires
2185 * @new_used_perm/@new_shared_perm as its permissions. If @ignore_children is
2186 * set, the BdrvChild objects in this list are ignored in the calculations;
2187 * this allows checking permission updates for an existing reference.
2188 *
2189 * See bdrv_check_perm() for the semantics of @tighten_restrictions.
2190 *
2191 * Needs to be followed by a call to either bdrv_set_perm() or
2192 * bdrv_abort_perm_update(). */
2193 static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
2194 uint64_t new_used_perm,
2195 uint64_t new_shared_perm,
2196 GSList *ignore_children,
2197 bool *tighten_restrictions,
2198 Error **errp)
2199 {
2200 BdrvChild *c;
2201 uint64_t cumulative_perms = new_used_perm;
2202 uint64_t cumulative_shared_perms = new_shared_perm;
2203
2204 assert(!q || !tighten_restrictions);
2205
2206 /* There is no reason why anyone couldn't tolerate write_unchanged */
2207 assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
2208
2209 QLIST_FOREACH(c, &bs->parents, next_parent) {
2210 if (g_slist_find(ignore_children, c)) {
2211 continue;
2212 }
2213
2214 if ((new_used_perm & c->shared_perm) != new_used_perm) {
2215 char *user = bdrv_child_user_desc(c);
2216 char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
2217
2218 if (tighten_restrictions) {
2219 *tighten_restrictions = true;
2220 }
2221
2222 error_setg(errp, "Conflicts with use by %s as '%s', which does not "
2223 "allow '%s' on %s",
2224 user, c->name, perm_names, bdrv_get_node_name(c->bs));
2225 g_free(user);
2226 g_free(perm_names);
2227 return -EPERM;
2228 }
2229
2230 if ((c->perm & new_shared_perm) != c->perm) {
2231 char *user = bdrv_child_user_desc(c);
2232 char *perm_names = bdrv_perm_names(c->perm & ~new_shared_perm);
2233
2234 if (tighten_restrictions) {
2235 *tighten_restrictions = true;
2236 }
2237
2238 error_setg(errp, "Conflicts with use by %s as '%s', which uses "
2239 "'%s' on %s",
2240 user, c->name, perm_names, bdrv_get_node_name(c->bs));
2241 g_free(user);
2242 g_free(perm_names);
2243 return -EPERM;
2244 }
2245
2246 cumulative_perms |= c->perm;
2247 cumulative_shared_perms &= c->shared_perm;
2248 }
2249
2250 return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
2251 ignore_children, tighten_restrictions, errp);
2252 }
2253
2254 /* Needs to be followed by a call to either bdrv_child_set_perm() or
2255 * bdrv_child_abort_perm_update(). */
2256 static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
2257 uint64_t perm, uint64_t shared,
2258 GSList *ignore_children,
2259 bool *tighten_restrictions, Error **errp)
2260 {
2261 int ret;
2262
2263 ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
2264 ret = bdrv_check_update_perm(c->bs, q, perm, shared, ignore_children,
2265 tighten_restrictions, errp);
2266 g_slist_free(ignore_children);
2267
2268 if (ret < 0) {
2269 return ret;
2270 }
2271
2272 if (!c->has_backup_perm) {
2273 c->has_backup_perm = true;
2274 c->backup_perm = c->perm;
2275 c->backup_shared_perm = c->shared_perm;
2276 }
2277 /*
2278 * Note: it's OK if c->has_backup_perm was already set, as we can find the
2279 * same child twice during check_perm procedure
2280 */
2281
2282 c->perm = perm;
2283 c->shared_perm = shared;
2284
2285 return 0;
2286 }
2287
2288 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared)
2289 {
2290 uint64_t cumulative_perms, cumulative_shared_perms;
2291
2292 c->has_backup_perm = false;
2293
2294 c->perm = perm;
2295 c->shared_perm = shared;
2296
2297 bdrv_get_cumulative_perm(c->bs, &cumulative_perms,
2298 &cumulative_shared_perms);
2299 bdrv_set_perm(c->bs, cumulative_perms, cumulative_shared_perms);
2300 }
2301
2302 static void bdrv_child_abort_perm_update(BdrvChild *c)
2303 {
2304 if (c->has_backup_perm) {
2305 c->perm = c->backup_perm;
2306 c->shared_perm = c->backup_shared_perm;
2307 c->has_backup_perm = false;
2308 }
2309
2310 bdrv_abort_perm_update(c->bs);
2311 }
2312
2313 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
2314 Error **errp)
2315 {
2316 Error *local_err = NULL;
2317 int ret;
2318 bool tighten_restrictions;
2319
2320 ret = bdrv_child_check_perm(c, NULL, perm, shared, NULL,
2321 &tighten_restrictions, &local_err);
2322 if (ret < 0) {
2323 bdrv_child_abort_perm_update(c);
2324 if (tighten_restrictions) {
2325 error_propagate(errp, local_err);
2326 } else {
2327 /*
2328 * Our caller may intend to only loosen restrictions and
2329 * does not expect this function to fail. Errors are not
2330 * fatal in such a case, so we can just hide them from our
2331 * caller.
2332 */
2333 error_free(local_err);
2334 ret = 0;
2335 }
2336 return ret;
2337 }
2338
2339 bdrv_child_set_perm(c, perm, shared);
2340
2341 return 0;
2342 }
2343
2344 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
2345 {
2346 uint64_t parent_perms, parent_shared;
2347 uint64_t perms, shared;
2348
2349 bdrv_get_cumulative_perm(bs, &parent_perms, &parent_shared);
2350 bdrv_child_perm(bs, c->bs, c, c->role, NULL, parent_perms, parent_shared,
2351 &perms, &shared);
2352
2353 return bdrv_child_try_set_perm(c, perms, shared, errp);
2354 }
2355
2356 void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
2357 const BdrvChildRole *role,
2358 BlockReopenQueue *reopen_queue,
2359 uint64_t perm, uint64_t shared,
2360 uint64_t *nperm, uint64_t *nshared)
2361 {
2362 *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
2363 *nshared = (shared & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
2364 }
2365
2366 void bdrv_format_default_perms(BlockDriverState *bs, BdrvChild *c,
2367 const BdrvChildRole *role,
2368 BlockReopenQueue *reopen_queue,
2369 uint64_t perm, uint64_t shared,
2370 uint64_t *nperm, uint64_t *nshared)
2371 {
2372 bool backing = (role == &child_backing);
2373 assert(role == &child_backing || role == &child_file);
2374
2375 if (!backing) {
2376 int flags = bdrv_reopen_get_flags(reopen_queue, bs);
2377
2378 /* Apart from the modifications below, the same permissions are
2379 * forwarded and left alone as for filters */
2380 bdrv_filter_default_perms(bs, c, role, reopen_queue, perm, shared,
2381 &perm, &shared);
2382
2383 /* Format drivers may touch metadata even if the guest doesn't write */
2384 if (bdrv_is_writable_after_reopen(bs, reopen_queue)) {
2385 perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2386 }
2387
2388 /* bs->file always needs to be consistent because of the metadata. We
2389 * can never allow other users to resize or write to it. */
2390 if (!(flags & BDRV_O_NO_IO)) {
2391 perm |= BLK_PERM_CONSISTENT_READ;
2392 }
2393 shared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
2394 } else {
2395 /* We want consistent read from backing files if the parent needs it.
2396 * No other operations are performed on backing files. */
2397 perm &= BLK_PERM_CONSISTENT_READ;
2398
2399 /* If the parent can deal with changing data, we're okay with a
2400 * writable and resizable backing file. */
2401 /* TODO Require !(perm & BLK_PERM_CONSISTENT_READ), too? */
2402 if (shared & BLK_PERM_WRITE) {
2403 shared = BLK_PERM_WRITE | BLK_PERM_RESIZE;
2404 } else {
2405 shared = 0;
2406 }
2407
2408 shared |= BLK_PERM_CONSISTENT_READ | BLK_PERM_GRAPH_MOD |
2409 BLK_PERM_WRITE_UNCHANGED;
2410 }
2411
2412 if (bs->open_flags & BDRV_O_INACTIVE) {
2413 shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2414 }
2415
2416 *nperm = perm;
2417 *nshared = shared;
2418 }
2419
2420 uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
2421 {
2422 static const uint64_t permissions[] = {
2423 [BLOCK_PERMISSION_CONSISTENT_READ] = BLK_PERM_CONSISTENT_READ,
2424 [BLOCK_PERMISSION_WRITE] = BLK_PERM_WRITE,
2425 [BLOCK_PERMISSION_WRITE_UNCHANGED] = BLK_PERM_WRITE_UNCHANGED,
2426 [BLOCK_PERMISSION_RESIZE] = BLK_PERM_RESIZE,
2427 [BLOCK_PERMISSION_GRAPH_MOD] = BLK_PERM_GRAPH_MOD,
2428 };
2429
2430 QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
2431 QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
2432
2433 assert(qapi_perm < BLOCK_PERMISSION__MAX);
2434
2435 return permissions[qapi_perm];
2436 }
2437
2438 static void bdrv_replace_child_noperm(BdrvChild *child,
2439 BlockDriverState *new_bs)
2440 {
2441 BlockDriverState *old_bs = child->bs;
2442 int new_bs_quiesce_counter;
2443 int drain_saldo;
2444
2445 assert(!child->frozen);
2446
2447 if (old_bs && new_bs) {
2448 assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
2449 }
2450
2451 new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
2452 drain_saldo = new_bs_quiesce_counter - child->parent_quiesce_counter;
2453
2454 /*
2455 * If the new child node is drained but the old one was not, flush
2456 * all outstanding requests to the old child node.
2457 */
2458 while (drain_saldo > 0 && child->role->drained_begin) {
2459 bdrv_parent_drained_begin_single(child, true);
2460 drain_saldo--;
2461 }
2462
2463 if (old_bs) {
2464 /* Detach first so that the recursive drain sections coming from @child
2465 * are already gone and we only end the drain sections that came from
2466 * elsewhere. */
2467 if (child->role->detach) {
2468 child->role->detach(child);
2469 }
2470 QLIST_REMOVE(child, next_parent);
2471 }
2472
2473 child->bs = new_bs;
2474
2475 if (new_bs) {
2476 QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
2477
2478 /*
2479 * Detaching the old node may have led to the new node's
2480 * quiesce_counter having been decreased. Not a problem, we
2481 * just need to recognize this here and then invoke
2482 * drained_end appropriately more often.
2483 */
2484 assert(new_bs->quiesce_counter <= new_bs_quiesce_counter);
2485 drain_saldo += new_bs->quiesce_counter - new_bs_quiesce_counter;
2486
2487 /* Attach only after starting new drained sections, so that recursive
2488 * drain sections coming from @child don't get an extra .drained_begin
2489 * callback. */
2490 if (child->role->attach) {
2491 child->role->attach(child);
2492 }
2493 }
2494
2495 /*
2496 * If the old child node was drained but the new one is not, allow
2497 * requests to come in only after the new node has been attached.
2498 */
2499 while (drain_saldo < 0 && child->role->drained_end) {
2500 bdrv_parent_drained_end_single(child);
2501 drain_saldo++;
2502 }
2503 }
2504
2505 /*
2506 * Updates @child to change its reference to point to @new_bs, including
2507 * checking and applying the necessary permisson updates both to the old node
2508 * and to @new_bs.
2509 *
2510 * NULL is passed as @new_bs for removing the reference before freeing @child.
2511 *
2512 * If @new_bs is not NULL, bdrv_check_perm() must be called beforehand, as this
2513 * function uses bdrv_set_perm() to update the permissions according to the new
2514 * reference that @new_bs gets.
2515 */
2516 static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
2517 {
2518 BlockDriverState *old_bs = child->bs;
2519 uint64_t perm, shared_perm;
2520
2521 bdrv_replace_child_noperm(child, new_bs);
2522
2523 /*
2524 * Start with the new node's permissions. If @new_bs is a (direct
2525 * or indirect) child of @old_bs, we must complete the permission
2526 * update on @new_bs before we loosen the restrictions on @old_bs.
2527 * Otherwise, bdrv_check_perm() on @old_bs would re-initiate
2528 * updating the permissions of @new_bs, and thus not purely loosen
2529 * restrictions.
2530 */
2531 if (new_bs) {
2532 bdrv_get_cumulative_perm(new_bs, &perm, &shared_perm);
2533 bdrv_set_perm(new_bs, perm, shared_perm);
2534 }
2535
2536 if (old_bs) {
2537 /* Update permissions for old node. This is guaranteed to succeed
2538 * because we're just taking a parent away, so we're loosening
2539 * restrictions. */
2540 bool tighten_restrictions;
2541 int ret;
2542
2543 bdrv_get_cumulative_perm(old_bs, &perm, &shared_perm);
2544 ret = bdrv_check_perm(old_bs, NULL, perm, shared_perm, NULL,
2545 &tighten_restrictions, NULL);
2546 assert(tighten_restrictions == false);
2547 if (ret < 0) {
2548 /* We only tried to loosen restrictions, so errors are not fatal */
2549 bdrv_abort_perm_update(old_bs);
2550 } else {
2551 bdrv_set_perm(old_bs, perm, shared_perm);
2552 }
2553
2554 /* When the parent requiring a non-default AioContext is removed, the
2555 * node moves back to the main AioContext */
2556 bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
2557 }
2558 }
2559
2560 /*
2561 * This function steals the reference to child_bs from the caller.
2562 * That reference is later dropped by bdrv_root_unref_child().
2563 *
2564 * On failure NULL is returned, errp is set and the reference to
2565 * child_bs is also dropped.
2566 *
2567 * The caller must hold the AioContext lock @child_bs, but not that of @ctx
2568 * (unless @child_bs is already in @ctx).
2569 */
2570 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
2571 const char *child_name,
2572 const BdrvChildRole *child_role,
2573 AioContext *ctx,
2574 uint64_t perm, uint64_t shared_perm,
2575 void *opaque, Error **errp)
2576 {
2577 BdrvChild *child;
2578 Error *local_err = NULL;
2579 int ret;
2580
2581 ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, NULL,
2582 errp);
2583 if (ret < 0) {
2584 bdrv_abort_perm_update(child_bs);
2585 bdrv_unref(child_bs);
2586 return NULL;
2587 }
2588
2589 child = g_new(BdrvChild, 1);
2590 *child = (BdrvChild) {
2591 .bs = NULL,
2592 .name = g_strdup(child_name),
2593 .role = child_role,
2594 .perm = perm,
2595 .shared_perm = shared_perm,
2596 .opaque = opaque,
2597 };
2598
2599 /* If the AioContexts don't match, first try to move the subtree of
2600 * child_bs into the AioContext of the new parent. If this doesn't work,
2601 * try moving the parent into the AioContext of child_bs instead. */
2602 if (bdrv_get_aio_context(child_bs) != ctx) {
2603 ret = bdrv_try_set_aio_context(child_bs, ctx, &local_err);
2604 if (ret < 0 && child_role->can_set_aio_ctx) {
2605 GSList *ignore = g_slist_prepend(NULL, child);
2606 ctx = bdrv_get_aio_context(child_bs);
2607 if (child_role->can_set_aio_ctx(child, ctx, &ignore, NULL)) {
2608 error_free(local_err);
2609 ret = 0;
2610 g_slist_free(ignore);
2611 ignore = g_slist_prepend(NULL, child);
2612 child_role->set_aio_ctx(child, ctx, &ignore);
2613 }
2614 g_slist_free(ignore);
2615 }
2616 if (ret < 0) {
2617 error_propagate(errp, local_err);
2618 g_free(child);
2619 bdrv_abort_perm_update(child_bs);
2620 bdrv_unref(child_bs);
2621 return NULL;
2622 }
2623 }
2624
2625 /* This performs the matching bdrv_set_perm() for the above check. */
2626 bdrv_replace_child(child, child_bs);
2627
2628 return child;
2629 }
2630
2631 /*
2632 * This function transfers the reference to child_bs from the caller
2633 * to parent_bs. That reference is later dropped by parent_bs on
2634 * bdrv_close() or if someone calls bdrv_unref_child().
2635 *
2636 * On failure NULL is returned, errp is set and the reference to
2637 * child_bs is also dropped.
2638 *
2639 * If @parent_bs and @child_bs are in different AioContexts, the caller must
2640 * hold the AioContext lock for @child_bs, but not for @parent_bs.
2641 */
2642 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
2643 BlockDriverState *child_bs,
2644 const char *child_name,
2645 const BdrvChildRole *child_role,
2646 Error **errp)
2647 {
2648 BdrvChild *child;
2649 uint64_t perm, shared_perm;
2650
2651 bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
2652
2653 assert(parent_bs->drv);
2654 bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
2655 perm, shared_perm, &perm, &shared_perm);
2656
2657 child = bdrv_root_attach_child(child_bs, child_name, child_role,
2658 bdrv_get_aio_context(parent_bs),
2659 perm, shared_perm, parent_bs, errp);
2660 if (child == NULL) {
2661 return NULL;
2662 }
2663
2664 QLIST_INSERT_HEAD(&parent_bs->children, child, next);
2665 return child;
2666 }
2667
2668 static void bdrv_detach_child(BdrvChild *child)
2669 {
2670 QLIST_SAFE_REMOVE(child, next);
2671
2672 bdrv_replace_child(child, NULL);
2673
2674 g_free(child->name);
2675 g_free(child);
2676 }
2677
2678 void bdrv_root_unref_child(BdrvChild *child)
2679 {
2680 BlockDriverState *child_bs;
2681
2682 child_bs = child->bs;
2683 bdrv_detach_child(child);
2684 bdrv_unref(child_bs);
2685 }
2686
2687 /**
2688 * Clear all inherits_from pointers from children and grandchildren of
2689 * @root that point to @root, where necessary.
2690 */
2691 static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
2692 {
2693 BdrvChild *c;
2694
2695 if (child->bs->inherits_from == root) {
2696 /*
2697 * Remove inherits_from only when the last reference between root and
2698 * child->bs goes away.
2699 */
2700 QLIST_FOREACH(c, &root->children, next) {
2701 if (c != child && c->bs == child->bs) {
2702 break;
2703 }
2704 }
2705 if (c == NULL) {
2706 child->bs->inherits_from = NULL;
2707 }
2708 }
2709
2710 QLIST_FOREACH(c, &child->bs->children, next) {
2711 bdrv_unset_inherits_from(root, c);
2712 }
2713 }
2714
2715 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
2716 {
2717 if (child == NULL) {
2718 return;
2719 }
2720
2721 bdrv_unset_inherits_from(parent, child);
2722 bdrv_root_unref_child(child);
2723 }
2724
2725
2726 static void bdrv_parent_cb_change_media(BlockDriverState *bs, bool load)
2727 {
2728 BdrvChild *c;
2729 QLIST_FOREACH(c, &bs->parents, next_parent) {
2730 if (c->role->change_media) {
2731 c->role->change_media(c, load);
2732 }
2733 }
2734 }
2735
2736 /* Return true if you can reach parent going through child->inherits_from
2737 * recursively. If parent or child are NULL, return false */
2738 static bool bdrv_inherits_from_recursive(BlockDriverState *child,
2739 BlockDriverState *parent)
2740 {
2741 while (child && child != parent) {
2742 child = child->inherits_from;
2743 }
2744
2745 return child != NULL;
2746 }
2747
2748 /*
2749 * Sets the backing file link of a BDS. A new reference is created; callers
2750 * which don't need their own reference any more must call bdrv_unref().
2751 */
2752 void bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
2753 Error **errp)
2754 {
2755 bool update_inherits_from = bdrv_chain_contains(bs, backing_hd) &&
2756 bdrv_inherits_from_recursive(backing_hd, bs);
2757
2758 if (bdrv_is_backing_chain_frozen(bs, backing_bs(bs), errp)) {
2759 return;
2760 }
2761
2762 if (backing_hd) {
2763 bdrv_ref(backing_hd);
2764 }
2765
2766 if (bs->backing) {
2767 bdrv_unref_child(bs, bs->backing);
2768 bs->backing = NULL;
2769 }
2770
2771 if (!backing_hd) {
2772 goto out;
2773 }
2774
2775 bs->backing = bdrv_attach_child(bs, backing_hd, "backing", &child_backing,
2776 errp);
2777 /* If backing_hd was already part of bs's backing chain, and
2778 * inherits_from pointed recursively to bs then let's update it to
2779 * point directly to bs (else it will become NULL). */
2780 if (bs->backing && update_inherits_from) {
2781 backing_hd->inherits_from = bs;
2782 }
2783
2784 out:
2785 bdrv_refresh_limits(bs, NULL);
2786 }
2787
2788 /*
2789 * Opens the backing file for a BlockDriverState if not yet open
2790 *
2791 * bdref_key specifies the key for the image's BlockdevRef in the options QDict.
2792 * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
2793 * itself, all options starting with "${bdref_key}." are considered part of the
2794 * BlockdevRef.
2795 *
2796 * TODO Can this be unified with bdrv_open_image()?
2797 */
2798 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
2799 const char *bdref_key, Error **errp)
2800 {
2801 char *backing_filename = NULL;
2802 char *bdref_key_dot;
2803 const char *reference = NULL;
2804 int ret = 0;
2805 bool implicit_backing = false;
2806 BlockDriverState *backing_hd;
2807 QDict *options;
2808 QDict *tmp_parent_options = NULL;
2809 Error *local_err = NULL;
2810
2811 if (bs->backing != NULL) {
2812 goto free_exit;
2813 }
2814
2815 /* NULL means an empty set of options */
2816 if (parent_options == NULL) {
2817 tmp_parent_options = qdict_new();
2818 parent_options = tmp_parent_options;
2819 }
2820
2821 bs->open_flags &= ~BDRV_O_NO_BACKING;
2822
2823 bdref_key_dot = g_strdup_printf("%s.", bdref_key);
2824 qdict_extract_subqdict(parent_options, &options, bdref_key_dot);
2825 g_free(bdref_key_dot);
2826
2827 /*
2828 * Caution: while qdict_get_try_str() is fine, getting non-string
2829 * types would require more care. When @parent_options come from
2830 * -blockdev or blockdev_add, its members are typed according to
2831 * the QAPI schema, but when they come from -drive, they're all
2832 * QString.
2833 */
2834 reference = qdict_get_try_str(parent_options, bdref_key);
2835 if (reference || qdict_haskey(options, "file.filename")) {
2836 /* keep backing_filename NULL */
2837 } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
2838 qobject_unref(options);
2839 goto free_exit;
2840 } else {
2841 if (qdict_size(options) == 0) {
2842 /* If the user specifies options that do not modify the
2843 * backing file's behavior, we might still consider it the
2844 * implicit backing file. But it's easier this way, and
2845 * just specifying some of the backing BDS's options is
2846 * only possible with -drive anyway (otherwise the QAPI
2847 * schema forces the user to specify everything). */
2848 implicit_backing = !strcmp(bs->auto_backing_file, bs->backing_file);
2849 }
2850
2851 backing_filename = bdrv_get_full_backing_filename(bs, &local_err);
2852 if (local_err) {
2853 ret = -EINVAL;
2854 error_propagate(errp, local_err);
2855 qobject_unref(options);
2856 goto free_exit;
2857 }
2858 }
2859
2860 if (!bs->drv || !bs->drv->supports_backing) {
2861 ret = -EINVAL;
2862 error_setg(errp, "Driver doesn't support backing files");
2863 qobject_unref(options);
2864 goto free_exit;
2865 }
2866
2867 if (!reference &&
2868 bs->backing_format[0] != '\0' && !qdict_haskey(options, "driver")) {
2869 qdict_put_str(options, "driver", bs->backing_format);
2870 }
2871
2872 backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
2873 &child_backing, errp);
2874 if (!backing_hd) {
2875 bs->open_flags |= BDRV_O_NO_BACKING;
2876 error_prepend(errp, "Could not open backing file: ");
2877 ret = -EINVAL;
2878 goto free_exit;
2879 }
2880
2881 if (implicit_backing) {
2882 bdrv_refresh_filename(backing_hd);
2883 pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
2884 backing_hd->filename);
2885 }
2886
2887 /* Hook up the backing file link; drop our reference, bs owns the
2888 * backing_hd reference now */
2889 bdrv_set_backing_hd(bs, backing_hd, &local_err);
2890 bdrv_unref(backing_hd);
2891 if (local_err) {
2892 error_propagate(errp, local_err);
2893 ret = -EINVAL;
2894 goto free_exit;
2895 }
2896
2897 qdict_del(parent_options, bdref_key);
2898
2899 free_exit:
2900 g_free(backing_filename);
2901 qobject_unref(tmp_parent_options);
2902 return ret;
2903 }
2904
2905 static BlockDriverState *
2906 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
2907 BlockDriverState *parent, const BdrvChildRole *child_role,
2908 bool allow_none, Error **errp)
2909 {
2910 BlockDriverState *bs = NULL;
2911 QDict *image_options;
2912 char *bdref_key_dot;
2913 const char *reference;
2914
2915 assert(child_role != NULL);
2916
2917 bdref_key_dot = g_strdup_printf("%s.", bdref_key);
2918 qdict_extract_subqdict(options, &image_options, bdref_key_dot);
2919 g_free(bdref_key_dot);
2920
2921 /*
2922 * Caution: while qdict_get_try_str() is fine, getting non-string
2923 * types would require more care. When @options come from
2924 * -blockdev or blockdev_add, its members are typed according to
2925 * the QAPI schema, but when they come from -drive, they're all
2926 * QString.
2927 */
2928 reference = qdict_get_try_str(options, bdref_key);
2929 if (!filename && !reference && !qdict_size(image_options)) {
2930 if (!allow_none) {
2931 error_setg(errp, "A block device must be specified for \"%s\"",
2932 bdref_key);
2933 }
2934 qobject_unref(image_options);
2935 goto done;
2936 }
2937
2938 bs = bdrv_open_inherit(filename, reference, image_options, 0,
2939 parent, child_role, errp);
2940 if (!bs) {
2941 goto done;
2942 }
2943
2944 done:
2945 qdict_del(options, bdref_key);
2946 return bs;
2947 }
2948
2949 /*
2950 * Opens a disk image whose options are given as BlockdevRef in another block
2951 * device's options.
2952 *
2953 * If allow_none is true, no image will be opened if filename is false and no
2954 * BlockdevRef is given. NULL will be returned, but errp remains unset.
2955 *
2956 * bdrev_key specifies the key for the image's BlockdevRef in the options QDict.
2957 * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
2958 * itself, all options starting with "${bdref_key}." are considered part of the
2959 * BlockdevRef.
2960 *
2961 * The BlockdevRef will be removed from the options QDict.
2962 */
2963 BdrvChild *bdrv_open_child(const char *filename,
2964 QDict *options, const char *bdref_key,
2965 BlockDriverState *parent,
2966 const BdrvChildRole *child_role,
2967 bool allow_none, Error **errp)
2968 {
2969 BlockDriverState *bs;
2970
2971 bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_role,
2972 allow_none, errp);
2973 if (bs == NULL) {
2974 return NULL;
2975 }
2976
2977 return bdrv_attach_child(parent, bs, bdref_key, child_role, errp);
2978 }
2979
2980 /* TODO Future callers may need to specify parent/child_role in order for
2981 * option inheritance to work. Existing callers use it for the root node. */
2982 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
2983 {
2984 BlockDriverState *bs = NULL;
2985 Error *local_err = NULL;
2986 QObject *obj = NULL;
2987 QDict *qdict = NULL;
2988 const char *reference = NULL;
2989 Visitor *v = NULL;
2990
2991 if (ref->type == QTYPE_QSTRING) {
2992 reference = ref->u.reference;
2993 } else {
2994 BlockdevOptions *options = &ref->u.definition;
2995 assert(ref->type == QTYPE_QDICT);
2996
2997 v = qobject_output_visitor_new(&obj);
2998 visit_type_BlockdevOptions(v, NULL, &options, &local_err);
2999 if (local_err) {
3000 error_propagate(errp, local_err);
3001 goto fail;
3002 }
3003 visit_complete(v, &obj);
3004
3005 qdict = qobject_to(QDict, obj);
3006 qdict_flatten(qdict);
3007
3008 /* bdrv_open_inherit() defaults to the values in bdrv_flags (for
3009 * compatibility with other callers) rather than what we want as the
3010 * real defaults. Apply the defaults here instead. */
3011 qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
3012 qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
3013 qdict_set_default_str(qdict, BDRV_OPT_READ_ONLY, "off");
3014 qdict_set_default_str(qdict, BDRV_OPT_AUTO_READ_ONLY, "off");
3015
3016 }
3017
3018 bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, errp);
3019 obj = NULL;
3020
3021 fail:
3022 qobject_unref(obj);
3023 visit_free(v);
3024 return bs;
3025 }
3026
3027 static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
3028 int flags,
3029 QDict *snapshot_options,
3030 Error **errp)
3031 {
3032 /* TODO: extra byte is a hack to ensure MAX_PATH space on Windows. */
3033 char *tmp_filename = g_malloc0(PATH_MAX + 1);
3034 int64_t total_size;
3035 QemuOpts *opts = NULL;
3036 BlockDriverState *bs_snapshot = NULL;
3037 Error *local_err = NULL;
3038 int ret;
3039
3040 /* if snapshot, we create a temporary backing file and open it
3041 instead of opening 'filename' directly */
3042
3043 /* Get the required size from the image */
3044 total_size = bdrv_getlength(bs);
3045 if (total_size < 0) {
3046 error_setg_errno(errp, -total_size, "Could not get image size");
3047 goto out;
3048 }
3049
3050 /* Create the temporary image */
3051 ret = get_tmp_filename(tmp_filename, PATH_MAX + 1);
3052 if (ret < 0) {
3053 error_setg_errno(errp, -ret, "Could not get temporary filename");
3054 goto out;
3055 }
3056
3057 opts = qemu_opts_create(bdrv_qcow2.create_opts, NULL, 0,
3058 &error_abort);
3059 qemu_opt_set_number(opts, BLOCK_OPT_SIZE, total_size, &error_abort);
3060 ret = bdrv_create(&bdrv_qcow2, tmp_filename, opts, errp);
3061 qemu_opts_del(opts);
3062 if (ret < 0) {
3063 error_prepend(errp, "Could not create temporary overlay '%s': ",
3064 tmp_filename);
3065 goto out;
3066 }
3067
3068 /* Prepare options QDict for the temporary file */
3069 qdict_put_str(snapshot_options, "file.driver", "file");
3070 qdict_put_str(snapshot_options, "file.filename", tmp_filename);
3071 qdict_put_str(snapshot_options, "driver", "qcow2");
3072
3073 bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
3074 snapshot_options = NULL;
3075 if (!bs_snapshot) {
3076 goto out;
3077 }
3078
3079 /* bdrv_append() consumes a strong reference to bs_snapshot
3080 * (i.e. it will call bdrv_unref() on it) even on error, so in
3081 * order to be able to return one, we have to increase
3082 * bs_snapshot's refcount here */
3083 bdrv_ref(bs_snapshot);
3084 bdrv_append(bs_snapshot, bs, &local_err);
3085 if (local_err) {
3086 error_propagate(errp, local_err);
3087 bs_snapshot = NULL;
3088 goto out;
3089 }
3090
3091 out:
3092 qobject_unref(snapshot_options);
3093 g_free(tmp_filename);
3094 return bs_snapshot;
3095 }
3096
3097 /*
3098 * Opens a disk image (raw, qcow2, vmdk, ...)
3099 *
3100 * options is a QDict of options to pass to the block drivers, or NULL for an
3101 * empty set of options. The reference to the QDict belongs to the block layer
3102 * after the call (even on failure), so if the caller intends to reuse the
3103 * dictionary, it needs to use qobject_ref() before calling bdrv_open.
3104 *
3105 * If *pbs is NULL, a new BDS will be created with a pointer to it stored there.
3106 * If it is not NULL, the referenced BDS will be reused.
3107 *
3108 * The reference parameter may be used to specify an existing block device which
3109 * should be opened. If specified, neither options nor a filename may be given,
3110 * nor can an existing BDS be reused (that is, *pbs has to be NULL).
3111 */
3112 static BlockDriverState *bdrv_open_inherit(const char *filename,
3113 const char *reference,
3114 QDict *options, int flags,
3115 BlockDriverState *parent,
3116 const BdrvChildRole *child_role,
3117 Error **errp)
3118 {
3119 int ret;
3120 BlockBackend *file = NULL;
3121 BlockDriverState *bs;
3122 BlockDriver *drv = NULL;
3123 BdrvChild *child;
3124 const char *drvname;
3125 const char *backing;
3126 Error *local_err = NULL;
3127 QDict *snapshot_options = NULL;
3128 int snapshot_flags = 0;
3129
3130 assert(!child_role || !flags);
3131 assert(!child_role == !parent);
3132
3133 if (reference) {
3134 bool options_non_empty = options ? qdict_size(options) : false;
3135 qobject_unref(options);
3136
3137 if (filename || options_non_empty) {
3138 error_setg(errp, "Cannot reference an existing block device with "
3139 "additional options or a new filename");
3140 return NULL;
3141 }
3142
3143 bs = bdrv_lookup_bs(reference, reference, errp);
3144 if (!bs) {
3145 return NULL;
3146 }
3147
3148 bdrv_ref(bs);
3149 return bs;
3150 }
3151
3152 bs = bdrv_new();
3153
3154 /* NULL means an empty set of options */
3155 if (options == NULL) {
3156 options = qdict_new();
3157 }
3158
3159 /* json: syntax counts as explicit options, as if in the QDict */
3160 parse_json_protocol(options, &filename, &local_err);
3161 if (local_err) {
3162 goto fail;
3163 }
3164
3165 bs->explicit_options = qdict_clone_shallow(options);
3166
3167 if (child_role) {
3168 bs->inherits_from = parent;
3169 child_role->inherit_options(&flags, options,
3170 parent->open_flags, parent->options);
3171 }
3172
3173 ret = bdrv_fill_options(&options, filename, &flags, &local_err);
3174 if (local_err) {
3175 goto fail;
3176 }
3177
3178 /*
3179 * Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
3180 * Caution: getting a boolean member of @options requires care.
3181 * When @options come from -blockdev or blockdev_add, members are
3182 * typed according to the QAPI schema, but when they come from
3183 * -drive, they're all QString.
3184 */
3185 if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
3186 !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
3187 flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
3188 } else {
3189 flags &= ~BDRV_O_RDWR;
3190 }
3191
3192 if (flags & BDRV_O_SNAPSHOT) {
3193 snapshot_options = qdict_new();
3194 bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
3195 flags, options);
3196 /* Let bdrv_backing_options() override "read-only" */
3197 qdict_del(options, BDRV_OPT_READ_ONLY);
3198 bdrv_backing_options(&flags, options, flags, options);
3199 }
3200
3201 bs->open_flags = flags;
3202 bs->options = options;
3203 options = qdict_clone_shallow(options);
3204
3205 /* Find the right image format driver */
3206 /* See cautionary note on accessing @options above */
3207 drvname = qdict_get_try_str(options, "driver");
3208 if (drvname) {
3209 drv = bdrv_find_format(drvname);
3210 if (!drv) {
3211 error_setg(errp, "Unknown driver: '%s'", drvname);
3212 goto fail;
3213 }
3214 }
3215
3216 assert(drvname || !(flags & BDRV_O_PROTOCOL));
3217
3218 /* See cautionary note on accessing @options above */
3219 backing = qdict_get_try_str(options, "backing");
3220 if (qobject_to(QNull, qdict_get(options, "backing")) != NULL ||
3221 (backing && *backing == '\0'))
3222 {
3223 if (backing) {
3224 warn_report("Use of \"backing\": \"\" is deprecated; "
3225 "use \"backing\": null instead");
3226 }
3227 flags |= BDRV_O_NO_BACKING;
3228 qdict_del(bs->explicit_options, "backing");
3229 qdict_del(bs->options, "backing");
3230 qdict_del(options, "backing");
3231 }
3232
3233 /* Open image file without format layer. This BlockBackend is only used for
3234 * probing, the block drivers will do their own bdrv_open_child() for the
3235 * same BDS, which is why we put the node name back into options. */
3236 if ((flags & BDRV_O_PROTOCOL) == 0) {
3237 BlockDriverState *file_bs;
3238
3239 file_bs = bdrv_open_child_bs(filename, options, "file", bs,
3240 &child_file, true, &local_err);
3241 if (local_err) {
3242 goto fail;
3243 }
3244 if (file_bs != NULL) {
3245 /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
3246 * looking at the header to guess the image format. This works even
3247 * in cases where a guest would not see a consistent state. */
3248 file = blk_new(bdrv_get_aio_context(file_bs), 0, BLK_PERM_ALL);
3249 blk_insert_bs(file, file_bs, &local_err);
3250 bdrv_unref(file_bs);
3251 if (local_err) {
3252 goto fail;
3253 }
3254
3255 qdict_put_str(options, "file", bdrv_get_node_name(file_bs));
3256 }
3257 }
3258
3259 /* Image format probing */
3260 bs->probed = !drv;
3261 if (!drv && file) {
3262 ret = find_image_format(file, filename, &drv, &local_err);
3263 if (ret < 0) {
3264 goto fail;
3265 }
3266 /*
3267 * This option update would logically belong in bdrv_fill_options(),
3268 * but we first need to open bs->file for the probing to work, while
3269 * opening bs->file already requires the (mostly) final set of options
3270 * so that cache mode etc. can be inherited.
3271 *
3272 * Adding the driver later is somewhat ugly, but it's not an option
3273 * that would ever be inherited, so it's correct. We just need to make
3274 * sure to update both bs->options (which has the full effective
3275 * options for bs) and options (which has file.* already removed).
3276 */
3277 qdict_put_str(bs->options, "driver", drv->format_name);
3278 qdict_put_str(options, "driver", drv->format_name);
3279 } else if (!drv) {
3280 error_setg(errp, "Must specify either driver or file");
3281 goto fail;
3282 }
3283
3284 /* BDRV_O_PROTOCOL must be set iff a protocol BDS is about to be created */
3285 assert(!!(flags & BDRV_O_PROTOCOL) == !!drv->bdrv_file_open);
3286 /* file must be NULL if a protocol BDS is about to be created
3287 * (the inverse results in an error message from bdrv_open_common()) */
3288 assert(!(flags & BDRV_O_PROTOCOL) || !file);
3289
3290 /* Open the image */
3291 ret = bdrv_open_common(bs, file, options, &local_err);
3292 if (ret < 0) {
3293 goto fail;
3294 }
3295
3296 if (file) {
3297 blk_unref(file);
3298 file = NULL;
3299 }
3300
3301 /* If there is a backing file, use it */
3302 if ((flags & BDRV_O_NO_BACKING) == 0) {
3303 ret = bdrv_open_backing_file(bs, options, "backing", &local_err);
3304 if (ret < 0) {
3305 goto close_and_fail;
3306 }
3307 }
3308
3309 /* Remove all children options and references
3310 * from bs->options and bs->explicit_options */
3311 QLIST_FOREACH(child, &bs->children, next) {
3312 char *child_key_dot;
3313 child_key_dot = g_strdup_printf("%s.", child->name);
3314 qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
3315 qdict_extract_subqdict(bs->options, NULL, child_key_dot);
3316 qdict_del(bs->explicit_options, child->name);
3317 qdict_del(bs->options, child->name);
3318 g_free(child_key_dot);
3319 }
3320
3321 /* Check if any unknown options were used */
3322 if (qdict_size(options) != 0) {
3323 const QDictEntry *entry = qdict_first(options);
3324 if (flags & BDRV_O_PROTOCOL) {
3325 error_setg(errp, "Block protocol '%s' doesn't support the option "
3326 "'%s'", drv->format_name, entry->key);
3327 } else {
3328 error_setg(errp,
3329 "Block format '%s' does not support the option '%s'",
3330 drv->format_name, entry->key);
3331 }
3332
3333 goto close_and_fail;
3334 }
3335
3336 bdrv_parent_cb_change_media(bs, true);
3337
3338 qobject_unref(options);
3339 options = NULL;
3340
3341 /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
3342 * temporary snapshot afterwards. */
3343 if (snapshot_flags) {
3344 BlockDriverState *snapshot_bs;
3345 snapshot_bs = bdrv_append_temp_snapshot(bs, snapshot_flags,
3346 snapshot_options, &local_err);
3347 snapshot_options = NULL;
3348 if (local_err) {
3349 goto close_and_fail;
3350 }
3351 /* We are not going to return bs but the overlay on top of it
3352 * (snapshot_bs); thus, we have to drop the strong reference to bs
3353 * (which we obtained by calling bdrv_new()). bs will not be deleted,
3354 * though, because the overlay still has a reference to it. */
3355 bdrv_unref(bs);
3356 bs = snapshot_bs;
3357 }
3358
3359 return bs;
3360
3361 fail:
3362 blk_unref(file);
3363 qobject_unref(snapshot_options);
3364 qobject_unref(bs->explicit_options);
3365 qobject_unref(bs->options);
3366 qobject_unref(options);
3367 bs->options = NULL;
3368 bs->explicit_options = NULL;
3369 bdrv_unref(bs);
3370 error_propagate(errp, local_err);
3371 return NULL;
3372
3373 close_and_fail:
3374 bdrv_unref(bs);
3375 qobject_unref(snapshot_options);
3376 qobject_unref(options);
3377 error_propagate(errp, local_err);
3378 return NULL;
3379 }
3380
3381 BlockDriverState *bdrv_open(const char *filename, const char *reference,
3382 QDict *options, int flags, Error **errp)
3383 {
3384 return bdrv_open_inherit(filename, reference, options, flags, NULL,
3385 NULL, errp);
3386 }
3387
3388 /* Return true if the NULL-terminated @list contains @str */
3389 static bool is_str_in_list(const char *str, const char *const *list)
3390 {
3391 if (str && list) {
3392 int i;
3393 for (i = 0; list[i] != NULL; i++) {
3394 if (!strcmp(str, list[i])) {
3395 return true;
3396 }
3397 }
3398 }
3399 return false;
3400 }
3401
3402 /*
3403 * Check that every option set in @bs->options is also set in
3404 * @new_opts.
3405 *
3406 * Options listed in the common_options list and in
3407 * @bs->drv->mutable_opts are skipped.
3408 *
3409 * Return 0 on success, otherwise return -EINVAL and set @errp.
3410 */
3411 static int bdrv_reset_options_allowed(BlockDriverState *bs,
3412 const QDict *new_opts, Error **errp)
3413 {
3414 const QDictEntry *e;
3415 /* These options are common to all block drivers and are handled
3416 * in bdrv_reopen_prepare() so they can be left out of @new_opts */
3417 const char *const common_options[] = {
3418 "node-name", "discard", "cache.direct", "cache.no-flush",
3419 "read-only", "auto-read-only", "detect-zeroes", NULL
3420 };
3421
3422 for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
3423 if (!qdict_haskey(new_opts, e->key) &&
3424 !is_str_in_list(e->key, common_options) &&
3425 !is_str_in_list(e->key, bs->drv->mutable_opts)) {
3426 error_setg(errp, "Option '%s' cannot be reset "
3427 "to its default value", e->key);
3428 return -EINVAL;
3429 }
3430 }
3431
3432 return 0;
3433 }
3434
3435 /*
3436 * Returns true if @child can be reached recursively from @bs
3437 */
3438 static bool bdrv_recurse_has_child(BlockDriverState *bs,
3439 BlockDriverState *child)
3440 {
3441 BdrvChild *c;
3442
3443 if (bs == child) {
3444 return true;
3445 }
3446
3447 QLIST_FOREACH(c, &bs->children, next) {
3448 if (bdrv_recurse_has_child(c->bs, child)) {
3449 return true;
3450 }
3451 }
3452
3453 return false;
3454 }
3455
3456 /*
3457 * Adds a BlockDriverState to a simple queue for an atomic, transactional
3458 * reopen of multiple devices.
3459 *
3460 * bs_queue can either be an existing BlockReopenQueue that has had QTAILQ_INIT
3461 * already performed, or alternatively may be NULL a new BlockReopenQueue will
3462 * be created and initialized. This newly created BlockReopenQueue should be
3463 * passed back in for subsequent calls that are intended to be of the same
3464 * atomic 'set'.
3465 *
3466 * bs is the BlockDriverState to add to the reopen queue.
3467 *
3468 * options contains the changed options for the associated bs
3469 * (the BlockReopenQueue takes ownership)
3470 *
3471 * flags contains the open flags for the associated bs
3472 *
3473 * returns a pointer to bs_queue, which is either the newly allocated
3474 * bs_queue, or the existing bs_queue being used.
3475 *
3476 * bs must be drained between bdrv_reopen_queue() and bdrv_reopen_multiple().
3477 */
3478 static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
3479 BlockDriverState *bs,
3480 QDict *options,
3481 const BdrvChildRole *role,
3482 QDict *parent_options,
3483 int parent_flags,
3484 bool keep_old_opts)
3485 {
3486 assert(bs != NULL);
3487
3488 BlockReopenQueueEntry *bs_entry;
3489 BdrvChild *child;
3490 QDict *old_options, *explicit_options, *options_copy;
3491 int flags;
3492 QemuOpts *opts;
3493
3494 /* Make sure that the caller remembered to use a drained section. This is
3495 * important to avoid graph changes between the recursive queuing here and
3496 * bdrv_reopen_multiple(). */
3497 assert(bs->quiesce_counter > 0);
3498
3499 if (bs_queue == NULL) {
3500 bs_queue = g_new0(BlockReopenQueue, 1);
3501 QTAILQ_INIT(bs_queue);
3502 }
3503
3504 if (!options) {
3505 options = qdict_new();
3506 }
3507
3508 /* Check if this BlockDriverState is already in the queue */
3509 QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3510 if (bs == bs_entry->state.bs) {
3511 break;
3512 }
3513 }
3514
3515 /*
3516 * Precedence of options:
3517 * 1. Explicitly passed in options (highest)
3518 * 2. Retained from explicitly set options of bs
3519 * 3. Inherited from parent node
3520 * 4. Retained from effective options of bs
3521 */
3522
3523 /* Old explicitly set values (don't overwrite by inherited value) */
3524 if (bs_entry || keep_old_opts) {
3525 old_options = qdict_clone_shallow(bs_entry ?
3526 bs_entry->state.explicit_options :
3527 bs->explicit_options);
3528 bdrv_join_options(bs, options, old_options);
3529 qobject_unref(old_options);
3530 }
3531
3532 explicit_options = qdict_clone_shallow(options);
3533
3534 /* Inherit from parent node */
3535 if (parent_options) {
3536 flags = 0;
3537 role->inherit_options(&flags, options, parent_flags, parent_options);
3538 } else {
3539 flags = bdrv_get_flags(bs);
3540 }
3541
3542 if (keep_old_opts) {
3543 /* Old values are used for options that aren't set yet */
3544 old_options = qdict_clone_shallow(bs->options);
3545 bdrv_join_options(bs, options, old_options);
3546 qobject_unref(old_options);
3547 }
3548
3549 /* We have the final set of options so let's update the flags */
3550 options_copy = qdict_clone_shallow(options);
3551 opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
3552 qemu_opts_absorb_qdict(opts, options_copy, NULL);
3553 update_flags_from_options(&flags, opts);
3554 qemu_opts_del(opts);
3555 qobject_unref(options_copy);