Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-6.2-pull-request...
[qemu.git] / block.c
1 /*
2 * QEMU System Emulator block driver
3 *
4 * Copyright (c) 2003 Fabrice Bellard
5 * Copyright (c) 2020 Virtuozzo International GmbH.
6 *
7 * Permission is hereby granted, free of charge, to any person obtaining a copy
8 * of this software and associated documentation files (the "Software"), to deal
9 * in the Software without restriction, including without limitation the rights
10 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
11 * copies of the Software, and to permit persons to whom the Software is
12 * furnished to do so, subject to the following conditions:
13 *
14 * The above copyright notice and this permission notice shall be included in
15 * all copies or substantial portions of the Software.
16 *
17 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
18 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
19 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
20 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
21 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
22 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
23 * THE SOFTWARE.
24 */
25
26 #include "qemu/osdep.h"
27 #include "block/trace.h"
28 #include "block/block_int.h"
29 #include "block/blockjob.h"
30 #include "block/fuse.h"
31 #include "block/nbd.h"
32 #include "block/qdict.h"
33 #include "qemu/error-report.h"
34 #include "block/module_block.h"
35 #include "qemu/main-loop.h"
36 #include "qemu/module.h"
37 #include "qapi/error.h"
38 #include "qapi/qmp/qdict.h"
39 #include "qapi/qmp/qjson.h"
40 #include "qapi/qmp/qnull.h"
41 #include "qapi/qmp/qstring.h"
42 #include "qapi/qobject-output-visitor.h"
43 #include "qapi/qapi-visit-block-core.h"
44 #include "sysemu/block-backend.h"
45 #include "qemu/notify.h"
46 #include "qemu/option.h"
47 #include "qemu/coroutine.h"
48 #include "block/qapi.h"
49 #include "qemu/timer.h"
50 #include "qemu/cutils.h"
51 #include "qemu/id.h"
52 #include "block/coroutines.h"
53
54 #ifdef CONFIG_BSD
55 #include <sys/ioctl.h>
56 #include <sys/queue.h>
57 #ifndef __DragonFly__
58 #include <sys/disk.h>
59 #endif
60 #endif
61
62 #ifdef _WIN32
63 #include <windows.h>
64 #endif
65
66 #define NOT_DONE 0x7fffffff /* used while emulated sync operation in progress */
67
68 static QTAILQ_HEAD(, BlockDriverState) graph_bdrv_states =
69 QTAILQ_HEAD_INITIALIZER(graph_bdrv_states);
70
71 static QTAILQ_HEAD(, BlockDriverState) all_bdrv_states =
72 QTAILQ_HEAD_INITIALIZER(all_bdrv_states);
73
74 static QLIST_HEAD(, BlockDriver) bdrv_drivers =
75 QLIST_HEAD_INITIALIZER(bdrv_drivers);
76
77 static BlockDriverState *bdrv_open_inherit(const char *filename,
78 const char *reference,
79 QDict *options, int flags,
80 BlockDriverState *parent,
81 const BdrvChildClass *child_class,
82 BdrvChildRole child_role,
83 Error **errp);
84
85 static void bdrv_replace_child_noperm(BdrvChild *child,
86 BlockDriverState *new_bs);
87 static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
88 Transaction *tran);
89
90 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
91 BlockReopenQueue *queue,
92 Transaction *set_backings_tran, Error **errp);
93 static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
94 static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
95
96 /* If non-zero, use only whitelisted block drivers */
97 static int use_bdrv_whitelist;
98
99 #ifdef _WIN32
100 static int is_windows_drive_prefix(const char *filename)
101 {
102 return (((filename[0] >= 'a' && filename[0] <= 'z') ||
103 (filename[0] >= 'A' && filename[0] <= 'Z')) &&
104 filename[1] == ':');
105 }
106
107 int is_windows_drive(const char *filename)
108 {
109 if (is_windows_drive_prefix(filename) &&
110 filename[2] == '\0')
111 return 1;
112 if (strstart(filename, "\\\\.\\", NULL) ||
113 strstart(filename, "//./", NULL))
114 return 1;
115 return 0;
116 }
117 #endif
118
119 size_t bdrv_opt_mem_align(BlockDriverState *bs)
120 {
121 if (!bs || !bs->drv) {
122 /* page size or 4k (hdd sector size) should be on the safe side */
123 return MAX(4096, qemu_real_host_page_size);
124 }
125
126 return bs->bl.opt_mem_alignment;
127 }
128
129 size_t bdrv_min_mem_align(BlockDriverState *bs)
130 {
131 if (!bs || !bs->drv) {
132 /* page size or 4k (hdd sector size) should be on the safe side */
133 return MAX(4096, qemu_real_host_page_size);
134 }
135
136 return bs->bl.min_mem_alignment;
137 }
138
139 /* check if the path starts with "<protocol>:" */
140 int path_has_protocol(const char *path)
141 {
142 const char *p;
143
144 #ifdef _WIN32
145 if (is_windows_drive(path) ||
146 is_windows_drive_prefix(path)) {
147 return 0;
148 }
149 p = path + strcspn(path, ":/\\");
150 #else
151 p = path + strcspn(path, ":/");
152 #endif
153
154 return *p == ':';
155 }
156
157 int path_is_absolute(const char *path)
158 {
159 #ifdef _WIN32
160 /* specific case for names like: "\\.\d:" */
161 if (is_windows_drive(path) || is_windows_drive_prefix(path)) {
162 return 1;
163 }
164 return (*path == '/' || *path == '\\');
165 #else
166 return (*path == '/');
167 #endif
168 }
169
170 /* if filename is absolute, just return its duplicate. Otherwise, build a
171 path to it by considering it is relative to base_path. URL are
172 supported. */
173 char *path_combine(const char *base_path, const char *filename)
174 {
175 const char *protocol_stripped = NULL;
176 const char *p, *p1;
177 char *result;
178 int len;
179
180 if (path_is_absolute(filename)) {
181 return g_strdup(filename);
182 }
183
184 if (path_has_protocol(base_path)) {
185 protocol_stripped = strchr(base_path, ':');
186 if (protocol_stripped) {
187 protocol_stripped++;
188 }
189 }
190 p = protocol_stripped ?: base_path;
191
192 p1 = strrchr(base_path, '/');
193 #ifdef _WIN32
194 {
195 const char *p2;
196 p2 = strrchr(base_path, '\\');
197 if (!p1 || p2 > p1) {
198 p1 = p2;
199 }
200 }
201 #endif
202 if (p1) {
203 p1++;
204 } else {
205 p1 = base_path;
206 }
207 if (p1 > p) {
208 p = p1;
209 }
210 len = p - base_path;
211
212 result = g_malloc(len + strlen(filename) + 1);
213 memcpy(result, base_path, len);
214 strcpy(result + len, filename);
215
216 return result;
217 }
218
219 /*
220 * Helper function for bdrv_parse_filename() implementations to remove optional
221 * protocol prefixes (especially "file:") from a filename and for putting the
222 * stripped filename into the options QDict if there is such a prefix.
223 */
224 void bdrv_parse_filename_strip_prefix(const char *filename, const char *prefix,
225 QDict *options)
226 {
227 if (strstart(filename, prefix, &filename)) {
228 /* Stripping the explicit protocol prefix may result in a protocol
229 * prefix being (wrongly) detected (if the filename contains a colon) */
230 if (path_has_protocol(filename)) {
231 GString *fat_filename;
232
233 /* This means there is some colon before the first slash; therefore,
234 * this cannot be an absolute path */
235 assert(!path_is_absolute(filename));
236
237 /* And we can thus fix the protocol detection issue by prefixing it
238 * by "./" */
239 fat_filename = g_string_new("./");
240 g_string_append(fat_filename, filename);
241
242 assert(!path_has_protocol(fat_filename->str));
243
244 qdict_put(options, "filename",
245 qstring_from_gstring(fat_filename));
246 } else {
247 /* If no protocol prefix was detected, we can use the shortened
248 * filename as-is */
249 qdict_put_str(options, "filename", filename);
250 }
251 }
252 }
253
254
255 /* Returns whether the image file is opened as read-only. Note that this can
256 * return false and writing to the image file is still not possible because the
257 * image is inactivated. */
258 bool bdrv_is_read_only(BlockDriverState *bs)
259 {
260 return !(bs->open_flags & BDRV_O_RDWR);
261 }
262
263 int bdrv_can_set_read_only(BlockDriverState *bs, bool read_only,
264 bool ignore_allow_rdw, Error **errp)
265 {
266 /* Do not set read_only if copy_on_read is enabled */
267 if (bs->copy_on_read && read_only) {
268 error_setg(errp, "Can't set node '%s' to r/o with copy-on-read enabled",
269 bdrv_get_device_or_node_name(bs));
270 return -EINVAL;
271 }
272
273 /* Do not clear read_only if it is prohibited */
274 if (!read_only && !(bs->open_flags & BDRV_O_ALLOW_RDWR) &&
275 !ignore_allow_rdw)
276 {
277 error_setg(errp, "Node '%s' is read only",
278 bdrv_get_device_or_node_name(bs));
279 return -EPERM;
280 }
281
282 return 0;
283 }
284
285 /*
286 * Called by a driver that can only provide a read-only image.
287 *
288 * Returns 0 if the node is already read-only or it could switch the node to
289 * read-only because BDRV_O_AUTO_RDONLY is set.
290 *
291 * Returns -EACCES if the node is read-write and BDRV_O_AUTO_RDONLY is not set
292 * or bdrv_can_set_read_only() forbids making the node read-only. If @errmsg
293 * is not NULL, it is used as the error message for the Error object.
294 */
295 int bdrv_apply_auto_read_only(BlockDriverState *bs, const char *errmsg,
296 Error **errp)
297 {
298 int ret = 0;
299
300 if (!(bs->open_flags & BDRV_O_RDWR)) {
301 return 0;
302 }
303 if (!(bs->open_flags & BDRV_O_AUTO_RDONLY)) {
304 goto fail;
305 }
306
307 ret = bdrv_can_set_read_only(bs, true, false, NULL);
308 if (ret < 0) {
309 goto fail;
310 }
311
312 bs->open_flags &= ~BDRV_O_RDWR;
313
314 return 0;
315
316 fail:
317 error_setg(errp, "%s", errmsg ?: "Image is read-only");
318 return -EACCES;
319 }
320
321 /*
322 * If @backing is empty, this function returns NULL without setting
323 * @errp. In all other cases, NULL will only be returned with @errp
324 * set.
325 *
326 * Therefore, a return value of NULL without @errp set means that
327 * there is no backing file; if @errp is set, there is one but its
328 * absolute filename cannot be generated.
329 */
330 char *bdrv_get_full_backing_filename_from_filename(const char *backed,
331 const char *backing,
332 Error **errp)
333 {
334 if (backing[0] == '\0') {
335 return NULL;
336 } else if (path_has_protocol(backing) || path_is_absolute(backing)) {
337 return g_strdup(backing);
338 } else if (backed[0] == '\0' || strstart(backed, "json:", NULL)) {
339 error_setg(errp, "Cannot use relative backing file names for '%s'",
340 backed);
341 return NULL;
342 } else {
343 return path_combine(backed, backing);
344 }
345 }
346
347 /*
348 * If @filename is empty or NULL, this function returns NULL without
349 * setting @errp. In all other cases, NULL will only be returned with
350 * @errp set.
351 */
352 static char *bdrv_make_absolute_filename(BlockDriverState *relative_to,
353 const char *filename, Error **errp)
354 {
355 char *dir, *full_name;
356
357 if (!filename || filename[0] == '\0') {
358 return NULL;
359 } else if (path_has_protocol(filename) || path_is_absolute(filename)) {
360 return g_strdup(filename);
361 }
362
363 dir = bdrv_dirname(relative_to, errp);
364 if (!dir) {
365 return NULL;
366 }
367
368 full_name = g_strconcat(dir, filename, NULL);
369 g_free(dir);
370 return full_name;
371 }
372
373 char *bdrv_get_full_backing_filename(BlockDriverState *bs, Error **errp)
374 {
375 return bdrv_make_absolute_filename(bs, bs->backing_file, errp);
376 }
377
378 void bdrv_register(BlockDriver *bdrv)
379 {
380 assert(bdrv->format_name);
381 QLIST_INSERT_HEAD(&bdrv_drivers, bdrv, list);
382 }
383
384 BlockDriverState *bdrv_new(void)
385 {
386 BlockDriverState *bs;
387 int i;
388
389 bs = g_new0(BlockDriverState, 1);
390 QLIST_INIT(&bs->dirty_bitmaps);
391 for (i = 0; i < BLOCK_OP_TYPE_MAX; i++) {
392 QLIST_INIT(&bs->op_blockers[i]);
393 }
394 qemu_co_mutex_init(&bs->reqs_lock);
395 qemu_mutex_init(&bs->dirty_bitmap_mutex);
396 bs->refcnt = 1;
397 bs->aio_context = qemu_get_aio_context();
398
399 qemu_co_queue_init(&bs->flush_queue);
400
401 for (i = 0; i < bdrv_drain_all_count; i++) {
402 bdrv_drained_begin(bs);
403 }
404
405 QTAILQ_INSERT_TAIL(&all_bdrv_states, bs, bs_list);
406
407 return bs;
408 }
409
410 static BlockDriver *bdrv_do_find_format(const char *format_name)
411 {
412 BlockDriver *drv1;
413
414 QLIST_FOREACH(drv1, &bdrv_drivers, list) {
415 if (!strcmp(drv1->format_name, format_name)) {
416 return drv1;
417 }
418 }
419
420 return NULL;
421 }
422
423 BlockDriver *bdrv_find_format(const char *format_name)
424 {
425 BlockDriver *drv1;
426 int i;
427
428 drv1 = bdrv_do_find_format(format_name);
429 if (drv1) {
430 return drv1;
431 }
432
433 /* The driver isn't registered, maybe we need to load a module */
434 for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
435 if (!strcmp(block_driver_modules[i].format_name, format_name)) {
436 block_module_load_one(block_driver_modules[i].library_name);
437 break;
438 }
439 }
440
441 return bdrv_do_find_format(format_name);
442 }
443
444 static int bdrv_format_is_whitelisted(const char *format_name, bool read_only)
445 {
446 static const char *whitelist_rw[] = {
447 CONFIG_BDRV_RW_WHITELIST
448 NULL
449 };
450 static const char *whitelist_ro[] = {
451 CONFIG_BDRV_RO_WHITELIST
452 NULL
453 };
454 const char **p;
455
456 if (!whitelist_rw[0] && !whitelist_ro[0]) {
457 return 1; /* no whitelist, anything goes */
458 }
459
460 for (p = whitelist_rw; *p; p++) {
461 if (!strcmp(format_name, *p)) {
462 return 1;
463 }
464 }
465 if (read_only) {
466 for (p = whitelist_ro; *p; p++) {
467 if (!strcmp(format_name, *p)) {
468 return 1;
469 }
470 }
471 }
472 return 0;
473 }
474
475 int bdrv_is_whitelisted(BlockDriver *drv, bool read_only)
476 {
477 return bdrv_format_is_whitelisted(drv->format_name, read_only);
478 }
479
480 bool bdrv_uses_whitelist(void)
481 {
482 return use_bdrv_whitelist;
483 }
484
485 typedef struct CreateCo {
486 BlockDriver *drv;
487 char *filename;
488 QemuOpts *opts;
489 int ret;
490 Error *err;
491 } CreateCo;
492
493 static void coroutine_fn bdrv_create_co_entry(void *opaque)
494 {
495 Error *local_err = NULL;
496 int ret;
497
498 CreateCo *cco = opaque;
499 assert(cco->drv);
500
501 ret = cco->drv->bdrv_co_create_opts(cco->drv,
502 cco->filename, cco->opts, &local_err);
503 error_propagate(&cco->err, local_err);
504 cco->ret = ret;
505 }
506
507 int bdrv_create(BlockDriver *drv, const char* filename,
508 QemuOpts *opts, Error **errp)
509 {
510 int ret;
511
512 Coroutine *co;
513 CreateCo cco = {
514 .drv = drv,
515 .filename = g_strdup(filename),
516 .opts = opts,
517 .ret = NOT_DONE,
518 .err = NULL,
519 };
520
521 if (!drv->bdrv_co_create_opts) {
522 error_setg(errp, "Driver '%s' does not support image creation", drv->format_name);
523 ret = -ENOTSUP;
524 goto out;
525 }
526
527 if (qemu_in_coroutine()) {
528 /* Fast-path if already in coroutine context */
529 bdrv_create_co_entry(&cco);
530 } else {
531 co = qemu_coroutine_create(bdrv_create_co_entry, &cco);
532 qemu_coroutine_enter(co);
533 while (cco.ret == NOT_DONE) {
534 aio_poll(qemu_get_aio_context(), true);
535 }
536 }
537
538 ret = cco.ret;
539 if (ret < 0) {
540 if (cco.err) {
541 error_propagate(errp, cco.err);
542 } else {
543 error_setg_errno(errp, -ret, "Could not create image");
544 }
545 }
546
547 out:
548 g_free(cco.filename);
549 return ret;
550 }
551
552 /**
553 * Helper function for bdrv_create_file_fallback(): Resize @blk to at
554 * least the given @minimum_size.
555 *
556 * On success, return @blk's actual length.
557 * Otherwise, return -errno.
558 */
559 static int64_t create_file_fallback_truncate(BlockBackend *blk,
560 int64_t minimum_size, Error **errp)
561 {
562 Error *local_err = NULL;
563 int64_t size;
564 int ret;
565
566 ret = blk_truncate(blk, minimum_size, false, PREALLOC_MODE_OFF, 0,
567 &local_err);
568 if (ret < 0 && ret != -ENOTSUP) {
569 error_propagate(errp, local_err);
570 return ret;
571 }
572
573 size = blk_getlength(blk);
574 if (size < 0) {
575 error_free(local_err);
576 error_setg_errno(errp, -size,
577 "Failed to inquire the new image file's length");
578 return size;
579 }
580
581 if (size < minimum_size) {
582 /* Need to grow the image, but we failed to do that */
583 error_propagate(errp, local_err);
584 return -ENOTSUP;
585 }
586
587 error_free(local_err);
588 local_err = NULL;
589
590 return size;
591 }
592
593 /**
594 * Helper function for bdrv_create_file_fallback(): Zero the first
595 * sector to remove any potentially pre-existing image header.
596 */
597 static int create_file_fallback_zero_first_sector(BlockBackend *blk,
598 int64_t current_size,
599 Error **errp)
600 {
601 int64_t bytes_to_clear;
602 int ret;
603
604 bytes_to_clear = MIN(current_size, BDRV_SECTOR_SIZE);
605 if (bytes_to_clear) {
606 ret = blk_pwrite_zeroes(blk, 0, bytes_to_clear, BDRV_REQ_MAY_UNMAP);
607 if (ret < 0) {
608 error_setg_errno(errp, -ret,
609 "Failed to clear the new image's first sector");
610 return ret;
611 }
612 }
613
614 return 0;
615 }
616
617 /**
618 * Simple implementation of bdrv_co_create_opts for protocol drivers
619 * which only support creation via opening a file
620 * (usually existing raw storage device)
621 */
622 int coroutine_fn bdrv_co_create_opts_simple(BlockDriver *drv,
623 const char *filename,
624 QemuOpts *opts,
625 Error **errp)
626 {
627 BlockBackend *blk;
628 QDict *options;
629 int64_t size = 0;
630 char *buf = NULL;
631 PreallocMode prealloc;
632 Error *local_err = NULL;
633 int ret;
634
635 size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
636 buf = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
637 prealloc = qapi_enum_parse(&PreallocMode_lookup, buf,
638 PREALLOC_MODE_OFF, &local_err);
639 g_free(buf);
640 if (local_err) {
641 error_propagate(errp, local_err);
642 return -EINVAL;
643 }
644
645 if (prealloc != PREALLOC_MODE_OFF) {
646 error_setg(errp, "Unsupported preallocation mode '%s'",
647 PreallocMode_str(prealloc));
648 return -ENOTSUP;
649 }
650
651 options = qdict_new();
652 qdict_put_str(options, "driver", drv->format_name);
653
654 blk = blk_new_open(filename, NULL, options,
655 BDRV_O_RDWR | BDRV_O_RESIZE, errp);
656 if (!blk) {
657 error_prepend(errp, "Protocol driver '%s' does not support image "
658 "creation, and opening the image failed: ",
659 drv->format_name);
660 return -EINVAL;
661 }
662
663 size = create_file_fallback_truncate(blk, size, errp);
664 if (size < 0) {
665 ret = size;
666 goto out;
667 }
668
669 ret = create_file_fallback_zero_first_sector(blk, size, errp);
670 if (ret < 0) {
671 goto out;
672 }
673
674 ret = 0;
675 out:
676 blk_unref(blk);
677 return ret;
678 }
679
680 int bdrv_create_file(const char *filename, QemuOpts *opts, Error **errp)
681 {
682 QemuOpts *protocol_opts;
683 BlockDriver *drv;
684 QDict *qdict;
685 int ret;
686
687 drv = bdrv_find_protocol(filename, true, errp);
688 if (drv == NULL) {
689 return -ENOENT;
690 }
691
692 if (!drv->create_opts) {
693 error_setg(errp, "Driver '%s' does not support image creation",
694 drv->format_name);
695 return -ENOTSUP;
696 }
697
698 /*
699 * 'opts' contains a QemuOptsList with a combination of format and protocol
700 * default values.
701 *
702 * The format properly removes its options, but the default values remain
703 * in 'opts->list'. So if the protocol has options with the same name
704 * (e.g. rbd has 'cluster_size' as qcow2), it will see the default values
705 * of the format, since for overlapping options, the format wins.
706 *
707 * To avoid this issue, lets convert QemuOpts to QDict, in this way we take
708 * only the set options, and then convert it back to QemuOpts, using the
709 * create_opts of the protocol. So the new QemuOpts, will contain only the
710 * protocol defaults.
711 */
712 qdict = qemu_opts_to_qdict(opts, NULL);
713 protocol_opts = qemu_opts_from_qdict(drv->create_opts, qdict, errp);
714 if (protocol_opts == NULL) {
715 ret = -EINVAL;
716 goto out;
717 }
718
719 ret = bdrv_create(drv, filename, protocol_opts, errp);
720 out:
721 qemu_opts_del(protocol_opts);
722 qobject_unref(qdict);
723 return ret;
724 }
725
726 int coroutine_fn bdrv_co_delete_file(BlockDriverState *bs, Error **errp)
727 {
728 Error *local_err = NULL;
729 int ret;
730
731 assert(bs != NULL);
732
733 if (!bs->drv) {
734 error_setg(errp, "Block node '%s' is not opened", bs->filename);
735 return -ENOMEDIUM;
736 }
737
738 if (!bs->drv->bdrv_co_delete_file) {
739 error_setg(errp, "Driver '%s' does not support image deletion",
740 bs->drv->format_name);
741 return -ENOTSUP;
742 }
743
744 ret = bs->drv->bdrv_co_delete_file(bs, &local_err);
745 if (ret < 0) {
746 error_propagate(errp, local_err);
747 }
748
749 return ret;
750 }
751
752 void coroutine_fn bdrv_co_delete_file_noerr(BlockDriverState *bs)
753 {
754 Error *local_err = NULL;
755 int ret;
756
757 if (!bs) {
758 return;
759 }
760
761 ret = bdrv_co_delete_file(bs, &local_err);
762 /*
763 * ENOTSUP will happen if the block driver doesn't support
764 * the 'bdrv_co_delete_file' interface. This is a predictable
765 * scenario and shouldn't be reported back to the user.
766 */
767 if (ret == -ENOTSUP) {
768 error_free(local_err);
769 } else if (ret < 0) {
770 error_report_err(local_err);
771 }
772 }
773
774 /**
775 * Try to get @bs's logical and physical block size.
776 * On success, store them in @bsz struct and return 0.
777 * On failure return -errno.
778 * @bs must not be empty.
779 */
780 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz)
781 {
782 BlockDriver *drv = bs->drv;
783 BlockDriverState *filtered = bdrv_filter_bs(bs);
784
785 if (drv && drv->bdrv_probe_blocksizes) {
786 return drv->bdrv_probe_blocksizes(bs, bsz);
787 } else if (filtered) {
788 return bdrv_probe_blocksizes(filtered, bsz);
789 }
790
791 return -ENOTSUP;
792 }
793
794 /**
795 * Try to get @bs's geometry (cyls, heads, sectors).
796 * On success, store them in @geo struct and return 0.
797 * On failure return -errno.
798 * @bs must not be empty.
799 */
800 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo)
801 {
802 BlockDriver *drv = bs->drv;
803 BlockDriverState *filtered = bdrv_filter_bs(bs);
804
805 if (drv && drv->bdrv_probe_geometry) {
806 return drv->bdrv_probe_geometry(bs, geo);
807 } else if (filtered) {
808 return bdrv_probe_geometry(filtered, geo);
809 }
810
811 return -ENOTSUP;
812 }
813
814 /*
815 * Create a uniquely-named empty temporary file.
816 * Return 0 upon success, otherwise a negative errno value.
817 */
818 int get_tmp_filename(char *filename, int size)
819 {
820 #ifdef _WIN32
821 char temp_dir[MAX_PATH];
822 /* GetTempFileName requires that its output buffer (4th param)
823 have length MAX_PATH or greater. */
824 assert(size >= MAX_PATH);
825 return (GetTempPath(MAX_PATH, temp_dir)
826 && GetTempFileName(temp_dir, "qem", 0, filename)
827 ? 0 : -GetLastError());
828 #else
829 int fd;
830 const char *tmpdir;
831 tmpdir = getenv("TMPDIR");
832 if (!tmpdir) {
833 tmpdir = "/var/tmp";
834 }
835 if (snprintf(filename, size, "%s/vl.XXXXXX", tmpdir) >= size) {
836 return -EOVERFLOW;
837 }
838 fd = mkstemp(filename);
839 if (fd < 0) {
840 return -errno;
841 }
842 if (close(fd) != 0) {
843 unlink(filename);
844 return -errno;
845 }
846 return 0;
847 #endif
848 }
849
850 /*
851 * Detect host devices. By convention, /dev/cdrom[N] is always
852 * recognized as a host CDROM.
853 */
854 static BlockDriver *find_hdev_driver(const char *filename)
855 {
856 int score_max = 0, score;
857 BlockDriver *drv = NULL, *d;
858
859 QLIST_FOREACH(d, &bdrv_drivers, list) {
860 if (d->bdrv_probe_device) {
861 score = d->bdrv_probe_device(filename);
862 if (score > score_max) {
863 score_max = score;
864 drv = d;
865 }
866 }
867 }
868
869 return drv;
870 }
871
872 static BlockDriver *bdrv_do_find_protocol(const char *protocol)
873 {
874 BlockDriver *drv1;
875
876 QLIST_FOREACH(drv1, &bdrv_drivers, list) {
877 if (drv1->protocol_name && !strcmp(drv1->protocol_name, protocol)) {
878 return drv1;
879 }
880 }
881
882 return NULL;
883 }
884
885 BlockDriver *bdrv_find_protocol(const char *filename,
886 bool allow_protocol_prefix,
887 Error **errp)
888 {
889 BlockDriver *drv1;
890 char protocol[128];
891 int len;
892 const char *p;
893 int i;
894
895 /* TODO Drivers without bdrv_file_open must be specified explicitly */
896
897 /*
898 * XXX(hch): we really should not let host device detection
899 * override an explicit protocol specification, but moving this
900 * later breaks access to device names with colons in them.
901 * Thanks to the brain-dead persistent naming schemes on udev-
902 * based Linux systems those actually are quite common.
903 */
904 drv1 = find_hdev_driver(filename);
905 if (drv1) {
906 return drv1;
907 }
908
909 if (!path_has_protocol(filename) || !allow_protocol_prefix) {
910 return &bdrv_file;
911 }
912
913 p = strchr(filename, ':');
914 assert(p != NULL);
915 len = p - filename;
916 if (len > sizeof(protocol) - 1)
917 len = sizeof(protocol) - 1;
918 memcpy(protocol, filename, len);
919 protocol[len] = '\0';
920
921 drv1 = bdrv_do_find_protocol(protocol);
922 if (drv1) {
923 return drv1;
924 }
925
926 for (i = 0; i < (int)ARRAY_SIZE(block_driver_modules); ++i) {
927 if (block_driver_modules[i].protocol_name &&
928 !strcmp(block_driver_modules[i].protocol_name, protocol)) {
929 block_module_load_one(block_driver_modules[i].library_name);
930 break;
931 }
932 }
933
934 drv1 = bdrv_do_find_protocol(protocol);
935 if (!drv1) {
936 error_setg(errp, "Unknown protocol '%s'", protocol);
937 }
938 return drv1;
939 }
940
941 /*
942 * Guess image format by probing its contents.
943 * This is not a good idea when your image is raw (CVE-2008-2004), but
944 * we do it anyway for backward compatibility.
945 *
946 * @buf contains the image's first @buf_size bytes.
947 * @buf_size is the buffer size in bytes (generally BLOCK_PROBE_BUF_SIZE,
948 * but can be smaller if the image file is smaller)
949 * @filename is its filename.
950 *
951 * For all block drivers, call the bdrv_probe() method to get its
952 * probing score.
953 * Return the first block driver with the highest probing score.
954 */
955 BlockDriver *bdrv_probe_all(const uint8_t *buf, int buf_size,
956 const char *filename)
957 {
958 int score_max = 0, score;
959 BlockDriver *drv = NULL, *d;
960
961 QLIST_FOREACH(d, &bdrv_drivers, list) {
962 if (d->bdrv_probe) {
963 score = d->bdrv_probe(buf, buf_size, filename);
964 if (score > score_max) {
965 score_max = score;
966 drv = d;
967 }
968 }
969 }
970
971 return drv;
972 }
973
974 static int find_image_format(BlockBackend *file, const char *filename,
975 BlockDriver **pdrv, Error **errp)
976 {
977 BlockDriver *drv;
978 uint8_t buf[BLOCK_PROBE_BUF_SIZE];
979 int ret = 0;
980
981 /* Return the raw BlockDriver * to scsi-generic devices or empty drives */
982 if (blk_is_sg(file) || !blk_is_inserted(file) || blk_getlength(file) == 0) {
983 *pdrv = &bdrv_raw;
984 return ret;
985 }
986
987 ret = blk_pread(file, 0, buf, sizeof(buf));
988 if (ret < 0) {
989 error_setg_errno(errp, -ret, "Could not read image for determining its "
990 "format");
991 *pdrv = NULL;
992 return ret;
993 }
994
995 drv = bdrv_probe_all(buf, ret, filename);
996 if (!drv) {
997 error_setg(errp, "Could not determine image format: No compatible "
998 "driver found");
999 ret = -ENOENT;
1000 }
1001 *pdrv = drv;
1002 return ret;
1003 }
1004
1005 /**
1006 * Set the current 'total_sectors' value
1007 * Return 0 on success, -errno on error.
1008 */
1009 int refresh_total_sectors(BlockDriverState *bs, int64_t hint)
1010 {
1011 BlockDriver *drv = bs->drv;
1012
1013 if (!drv) {
1014 return -ENOMEDIUM;
1015 }
1016
1017 /* Do not attempt drv->bdrv_getlength() on scsi-generic devices */
1018 if (bdrv_is_sg(bs))
1019 return 0;
1020
1021 /* query actual device if possible, otherwise just trust the hint */
1022 if (drv->bdrv_getlength) {
1023 int64_t length = drv->bdrv_getlength(bs);
1024 if (length < 0) {
1025 return length;
1026 }
1027 hint = DIV_ROUND_UP(length, BDRV_SECTOR_SIZE);
1028 }
1029
1030 bs->total_sectors = hint;
1031
1032 if (bs->total_sectors * BDRV_SECTOR_SIZE > BDRV_MAX_LENGTH) {
1033 return -EFBIG;
1034 }
1035
1036 return 0;
1037 }
1038
1039 /**
1040 * Combines a QDict of new block driver @options with any missing options taken
1041 * from @old_options, so that leaving out an option defaults to its old value.
1042 */
1043 static void bdrv_join_options(BlockDriverState *bs, QDict *options,
1044 QDict *old_options)
1045 {
1046 if (bs->drv && bs->drv->bdrv_join_options) {
1047 bs->drv->bdrv_join_options(options, old_options);
1048 } else {
1049 qdict_join(options, old_options, false);
1050 }
1051 }
1052
1053 static BlockdevDetectZeroesOptions bdrv_parse_detect_zeroes(QemuOpts *opts,
1054 int open_flags,
1055 Error **errp)
1056 {
1057 Error *local_err = NULL;
1058 char *value = qemu_opt_get_del(opts, "detect-zeroes");
1059 BlockdevDetectZeroesOptions detect_zeroes =
1060 qapi_enum_parse(&BlockdevDetectZeroesOptions_lookup, value,
1061 BLOCKDEV_DETECT_ZEROES_OPTIONS_OFF, &local_err);
1062 g_free(value);
1063 if (local_err) {
1064 error_propagate(errp, local_err);
1065 return detect_zeroes;
1066 }
1067
1068 if (detect_zeroes == BLOCKDEV_DETECT_ZEROES_OPTIONS_UNMAP &&
1069 !(open_flags & BDRV_O_UNMAP))
1070 {
1071 error_setg(errp, "setting detect-zeroes to unmap is not allowed "
1072 "without setting discard operation to unmap");
1073 }
1074
1075 return detect_zeroes;
1076 }
1077
1078 /**
1079 * Set open flags for aio engine
1080 *
1081 * Return 0 on success, -1 if the engine specified is invalid
1082 */
1083 int bdrv_parse_aio(const char *mode, int *flags)
1084 {
1085 if (!strcmp(mode, "threads")) {
1086 /* do nothing, default */
1087 } else if (!strcmp(mode, "native")) {
1088 *flags |= BDRV_O_NATIVE_AIO;
1089 #ifdef CONFIG_LINUX_IO_URING
1090 } else if (!strcmp(mode, "io_uring")) {
1091 *flags |= BDRV_O_IO_URING;
1092 #endif
1093 } else {
1094 return -1;
1095 }
1096
1097 return 0;
1098 }
1099
1100 /**
1101 * Set open flags for a given discard mode
1102 *
1103 * Return 0 on success, -1 if the discard mode was invalid.
1104 */
1105 int bdrv_parse_discard_flags(const char *mode, int *flags)
1106 {
1107 *flags &= ~BDRV_O_UNMAP;
1108
1109 if (!strcmp(mode, "off") || !strcmp(mode, "ignore")) {
1110 /* do nothing */
1111 } else if (!strcmp(mode, "on") || !strcmp(mode, "unmap")) {
1112 *flags |= BDRV_O_UNMAP;
1113 } else {
1114 return -1;
1115 }
1116
1117 return 0;
1118 }
1119
1120 /**
1121 * Set open flags for a given cache mode
1122 *
1123 * Return 0 on success, -1 if the cache mode was invalid.
1124 */
1125 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough)
1126 {
1127 *flags &= ~BDRV_O_CACHE_MASK;
1128
1129 if (!strcmp(mode, "off") || !strcmp(mode, "none")) {
1130 *writethrough = false;
1131 *flags |= BDRV_O_NOCACHE;
1132 } else if (!strcmp(mode, "directsync")) {
1133 *writethrough = true;
1134 *flags |= BDRV_O_NOCACHE;
1135 } else if (!strcmp(mode, "writeback")) {
1136 *writethrough = false;
1137 } else if (!strcmp(mode, "unsafe")) {
1138 *writethrough = false;
1139 *flags |= BDRV_O_NO_FLUSH;
1140 } else if (!strcmp(mode, "writethrough")) {
1141 *writethrough = true;
1142 } else {
1143 return -1;
1144 }
1145
1146 return 0;
1147 }
1148
1149 static char *bdrv_child_get_parent_desc(BdrvChild *c)
1150 {
1151 BlockDriverState *parent = c->opaque;
1152 return g_strdup_printf("node '%s'", bdrv_get_node_name(parent));
1153 }
1154
1155 static void bdrv_child_cb_drained_begin(BdrvChild *child)
1156 {
1157 BlockDriverState *bs = child->opaque;
1158 bdrv_do_drained_begin_quiesce(bs, NULL, false);
1159 }
1160
1161 static bool bdrv_child_cb_drained_poll(BdrvChild *child)
1162 {
1163 BlockDriverState *bs = child->opaque;
1164 return bdrv_drain_poll(bs, false, NULL, false);
1165 }
1166
1167 static void bdrv_child_cb_drained_end(BdrvChild *child,
1168 int *drained_end_counter)
1169 {
1170 BlockDriverState *bs = child->opaque;
1171 bdrv_drained_end_no_poll(bs, drained_end_counter);
1172 }
1173
1174 static int bdrv_child_cb_inactivate(BdrvChild *child)
1175 {
1176 BlockDriverState *bs = child->opaque;
1177 assert(bs->open_flags & BDRV_O_INACTIVE);
1178 return 0;
1179 }
1180
1181 static bool bdrv_child_cb_can_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1182 GSList **ignore, Error **errp)
1183 {
1184 BlockDriverState *bs = child->opaque;
1185 return bdrv_can_set_aio_context(bs, ctx, ignore, errp);
1186 }
1187
1188 static void bdrv_child_cb_set_aio_ctx(BdrvChild *child, AioContext *ctx,
1189 GSList **ignore)
1190 {
1191 BlockDriverState *bs = child->opaque;
1192 return bdrv_set_aio_context_ignore(bs, ctx, ignore);
1193 }
1194
1195 /*
1196 * Returns the options and flags that a temporary snapshot should get, based on
1197 * the originally requested flags (the originally requested image will have
1198 * flags like a backing file)
1199 */
1200 static void bdrv_temp_snapshot_options(int *child_flags, QDict *child_options,
1201 int parent_flags, QDict *parent_options)
1202 {
1203 *child_flags = (parent_flags & ~BDRV_O_SNAPSHOT) | BDRV_O_TEMPORARY;
1204
1205 /* For temporary files, unconditional cache=unsafe is fine */
1206 qdict_set_default_str(child_options, BDRV_OPT_CACHE_DIRECT, "off");
1207 qdict_set_default_str(child_options, BDRV_OPT_CACHE_NO_FLUSH, "on");
1208
1209 /* Copy the read-only and discard options from the parent */
1210 qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1211 qdict_copy_default(child_options, parent_options, BDRV_OPT_DISCARD);
1212
1213 /* aio=native doesn't work for cache.direct=off, so disable it for the
1214 * temporary snapshot */
1215 *child_flags &= ~BDRV_O_NATIVE_AIO;
1216 }
1217
1218 static void bdrv_backing_attach(BdrvChild *c)
1219 {
1220 BlockDriverState *parent = c->opaque;
1221 BlockDriverState *backing_hd = c->bs;
1222
1223 assert(!parent->backing_blocker);
1224 error_setg(&parent->backing_blocker,
1225 "node is used as backing hd of '%s'",
1226 bdrv_get_device_or_node_name(parent));
1227
1228 bdrv_refresh_filename(backing_hd);
1229
1230 parent->open_flags &= ~BDRV_O_NO_BACKING;
1231
1232 bdrv_op_block_all(backing_hd, parent->backing_blocker);
1233 /* Otherwise we won't be able to commit or stream */
1234 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_COMMIT_TARGET,
1235 parent->backing_blocker);
1236 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_STREAM,
1237 parent->backing_blocker);
1238 /*
1239 * We do backup in 3 ways:
1240 * 1. drive backup
1241 * The target bs is new opened, and the source is top BDS
1242 * 2. blockdev backup
1243 * Both the source and the target are top BDSes.
1244 * 3. internal backup(used for block replication)
1245 * Both the source and the target are backing file
1246 *
1247 * In case 1 and 2, neither the source nor the target is the backing file.
1248 * In case 3, we will block the top BDS, so there is only one block job
1249 * for the top BDS and its backing chain.
1250 */
1251 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_SOURCE,
1252 parent->backing_blocker);
1253 bdrv_op_unblock(backing_hd, BLOCK_OP_TYPE_BACKUP_TARGET,
1254 parent->backing_blocker);
1255 }
1256
1257 static void bdrv_backing_detach(BdrvChild *c)
1258 {
1259 BlockDriverState *parent = c->opaque;
1260
1261 assert(parent->backing_blocker);
1262 bdrv_op_unblock_all(c->bs, parent->backing_blocker);
1263 error_free(parent->backing_blocker);
1264 parent->backing_blocker = NULL;
1265 }
1266
1267 static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
1268 const char *filename, Error **errp)
1269 {
1270 BlockDriverState *parent = c->opaque;
1271 bool read_only = bdrv_is_read_only(parent);
1272 int ret;
1273
1274 if (read_only) {
1275 ret = bdrv_reopen_set_read_only(parent, false, errp);
1276 if (ret < 0) {
1277 return ret;
1278 }
1279 }
1280
1281 ret = bdrv_change_backing_file(parent, filename,
1282 base->drv ? base->drv->format_name : "",
1283 false);
1284 if (ret < 0) {
1285 error_setg_errno(errp, -ret, "Could not update backing file link");
1286 }
1287
1288 if (read_only) {
1289 bdrv_reopen_set_read_only(parent, true, NULL);
1290 }
1291
1292 return ret;
1293 }
1294
1295 /*
1296 * Returns the options and flags that a generic child of a BDS should
1297 * get, based on the given options and flags for the parent BDS.
1298 */
1299 static void bdrv_inherited_options(BdrvChildRole role, bool parent_is_format,
1300 int *child_flags, QDict *child_options,
1301 int parent_flags, QDict *parent_options)
1302 {
1303 int flags = parent_flags;
1304
1305 /*
1306 * First, decide whether to set, clear, or leave BDRV_O_PROTOCOL.
1307 * Generally, the question to answer is: Should this child be
1308 * format-probed by default?
1309 */
1310
1311 /*
1312 * Pure and non-filtered data children of non-format nodes should
1313 * be probed by default (even when the node itself has BDRV_O_PROTOCOL
1314 * set). This only affects a very limited set of drivers (namely
1315 * quorum and blkverify when this comment was written).
1316 * Force-clear BDRV_O_PROTOCOL then.
1317 */
1318 if (!parent_is_format &&
1319 (role & BDRV_CHILD_DATA) &&
1320 !(role & (BDRV_CHILD_METADATA | BDRV_CHILD_FILTERED)))
1321 {
1322 flags &= ~BDRV_O_PROTOCOL;
1323 }
1324
1325 /*
1326 * All children of format nodes (except for COW children) and all
1327 * metadata children in general should never be format-probed.
1328 * Force-set BDRV_O_PROTOCOL then.
1329 */
1330 if ((parent_is_format && !(role & BDRV_CHILD_COW)) ||
1331 (role & BDRV_CHILD_METADATA))
1332 {
1333 flags |= BDRV_O_PROTOCOL;
1334 }
1335
1336 /*
1337 * If the cache mode isn't explicitly set, inherit direct and no-flush from
1338 * the parent.
1339 */
1340 qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_DIRECT);
1341 qdict_copy_default(child_options, parent_options, BDRV_OPT_CACHE_NO_FLUSH);
1342 qdict_copy_default(child_options, parent_options, BDRV_OPT_FORCE_SHARE);
1343
1344 if (role & BDRV_CHILD_COW) {
1345 /* backing files are opened read-only by default */
1346 qdict_set_default_str(child_options, BDRV_OPT_READ_ONLY, "on");
1347 qdict_set_default_str(child_options, BDRV_OPT_AUTO_READ_ONLY, "off");
1348 } else {
1349 /* Inherit the read-only option from the parent if it's not set */
1350 qdict_copy_default(child_options, parent_options, BDRV_OPT_READ_ONLY);
1351 qdict_copy_default(child_options, parent_options,
1352 BDRV_OPT_AUTO_READ_ONLY);
1353 }
1354
1355 /*
1356 * bdrv_co_pdiscard() respects unmap policy for the parent, so we
1357 * can default to enable it on lower layers regardless of the
1358 * parent option.
1359 */
1360 qdict_set_default_str(child_options, BDRV_OPT_DISCARD, "unmap");
1361
1362 /* Clear flags that only apply to the top layer */
1363 flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_COPY_ON_READ);
1364
1365 if (role & BDRV_CHILD_METADATA) {
1366 flags &= ~BDRV_O_NO_IO;
1367 }
1368 if (role & BDRV_CHILD_COW) {
1369 flags &= ~BDRV_O_TEMPORARY;
1370 }
1371
1372 *child_flags = flags;
1373 }
1374
1375 static void bdrv_child_cb_attach(BdrvChild *child)
1376 {
1377 BlockDriverState *bs = child->opaque;
1378
1379 if (child->role & BDRV_CHILD_COW) {
1380 bdrv_backing_attach(child);
1381 }
1382
1383 bdrv_apply_subtree_drain(child, bs);
1384 }
1385
1386 static void bdrv_child_cb_detach(BdrvChild *child)
1387 {
1388 BlockDriverState *bs = child->opaque;
1389
1390 if (child->role & BDRV_CHILD_COW) {
1391 bdrv_backing_detach(child);
1392 }
1393
1394 bdrv_unapply_subtree_drain(child, bs);
1395 }
1396
1397 static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
1398 const char *filename, Error **errp)
1399 {
1400 if (c->role & BDRV_CHILD_COW) {
1401 return bdrv_backing_update_filename(c, base, filename, errp);
1402 }
1403 return 0;
1404 }
1405
1406 AioContext *child_of_bds_get_parent_aio_context(BdrvChild *c)
1407 {
1408 BlockDriverState *bs = c->opaque;
1409
1410 return bdrv_get_aio_context(bs);
1411 }
1412
1413 const BdrvChildClass child_of_bds = {
1414 .parent_is_bds = true,
1415 .get_parent_desc = bdrv_child_get_parent_desc,
1416 .inherit_options = bdrv_inherited_options,
1417 .drained_begin = bdrv_child_cb_drained_begin,
1418 .drained_poll = bdrv_child_cb_drained_poll,
1419 .drained_end = bdrv_child_cb_drained_end,
1420 .attach = bdrv_child_cb_attach,
1421 .detach = bdrv_child_cb_detach,
1422 .inactivate = bdrv_child_cb_inactivate,
1423 .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
1424 .set_aio_ctx = bdrv_child_cb_set_aio_ctx,
1425 .update_filename = bdrv_child_cb_update_filename,
1426 .get_parent_aio_context = child_of_bds_get_parent_aio_context,
1427 };
1428
1429 AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c)
1430 {
1431 return c->klass->get_parent_aio_context(c);
1432 }
1433
1434 static int bdrv_open_flags(BlockDriverState *bs, int flags)
1435 {
1436 int open_flags = flags;
1437
1438 /*
1439 * Clear flags that are internal to the block layer before opening the
1440 * image.
1441 */
1442 open_flags &= ~(BDRV_O_SNAPSHOT | BDRV_O_NO_BACKING | BDRV_O_PROTOCOL);
1443
1444 return open_flags;
1445 }
1446
1447 static void update_flags_from_options(int *flags, QemuOpts *opts)
1448 {
1449 *flags &= ~(BDRV_O_CACHE_MASK | BDRV_O_RDWR | BDRV_O_AUTO_RDONLY);
1450
1451 if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_NO_FLUSH, false)) {
1452 *flags |= BDRV_O_NO_FLUSH;
1453 }
1454
1455 if (qemu_opt_get_bool_del(opts, BDRV_OPT_CACHE_DIRECT, false)) {
1456 *flags |= BDRV_O_NOCACHE;
1457 }
1458
1459 if (!qemu_opt_get_bool_del(opts, BDRV_OPT_READ_ONLY, false)) {
1460 *flags |= BDRV_O_RDWR;
1461 }
1462
1463 if (qemu_opt_get_bool_del(opts, BDRV_OPT_AUTO_READ_ONLY, false)) {
1464 *flags |= BDRV_O_AUTO_RDONLY;
1465 }
1466 }
1467
1468 static void update_options_from_flags(QDict *options, int flags)
1469 {
1470 if (!qdict_haskey(options, BDRV_OPT_CACHE_DIRECT)) {
1471 qdict_put_bool(options, BDRV_OPT_CACHE_DIRECT, flags & BDRV_O_NOCACHE);
1472 }
1473 if (!qdict_haskey(options, BDRV_OPT_CACHE_NO_FLUSH)) {
1474 qdict_put_bool(options, BDRV_OPT_CACHE_NO_FLUSH,
1475 flags & BDRV_O_NO_FLUSH);
1476 }
1477 if (!qdict_haskey(options, BDRV_OPT_READ_ONLY)) {
1478 qdict_put_bool(options, BDRV_OPT_READ_ONLY, !(flags & BDRV_O_RDWR));
1479 }
1480 if (!qdict_haskey(options, BDRV_OPT_AUTO_READ_ONLY)) {
1481 qdict_put_bool(options, BDRV_OPT_AUTO_READ_ONLY,
1482 flags & BDRV_O_AUTO_RDONLY);
1483 }
1484 }
1485
1486 static void bdrv_assign_node_name(BlockDriverState *bs,
1487 const char *node_name,
1488 Error **errp)
1489 {
1490 char *gen_node_name = NULL;
1491
1492 if (!node_name) {
1493 node_name = gen_node_name = id_generate(ID_BLOCK);
1494 } else if (!id_wellformed(node_name)) {
1495 /*
1496 * Check for empty string or invalid characters, but not if it is
1497 * generated (generated names use characters not available to the user)
1498 */
1499 error_setg(errp, "Invalid node-name: '%s'", node_name);
1500 return;
1501 }
1502
1503 /* takes care of avoiding namespaces collisions */
1504 if (blk_by_name(node_name)) {
1505 error_setg(errp, "node-name=%s is conflicting with a device id",
1506 node_name);
1507 goto out;
1508 }
1509
1510 /* takes care of avoiding duplicates node names */
1511 if (bdrv_find_node(node_name)) {
1512 error_setg(errp, "Duplicate nodes with node-name='%s'", node_name);
1513 goto out;
1514 }
1515
1516 /* Make sure that the node name isn't truncated */
1517 if (strlen(node_name) >= sizeof(bs->node_name)) {
1518 error_setg(errp, "Node name too long");
1519 goto out;
1520 }
1521
1522 /* copy node name into the bs and insert it into the graph list */
1523 pstrcpy(bs->node_name, sizeof(bs->node_name), node_name);
1524 QTAILQ_INSERT_TAIL(&graph_bdrv_states, bs, node_list);
1525 out:
1526 g_free(gen_node_name);
1527 }
1528
1529 static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
1530 const char *node_name, QDict *options,
1531 int open_flags, Error **errp)
1532 {
1533 Error *local_err = NULL;
1534 int i, ret;
1535
1536 bdrv_assign_node_name(bs, node_name, &local_err);
1537 if (local_err) {
1538 error_propagate(errp, local_err);
1539 return -EINVAL;
1540 }
1541
1542 bs->drv = drv;
1543 bs->opaque = g_malloc0(drv->instance_size);
1544
1545 if (drv->bdrv_file_open) {
1546 assert(!drv->bdrv_needs_filename || bs->filename[0]);
1547 ret = drv->bdrv_file_open(bs, options, open_flags, &local_err);
1548 } else if (drv->bdrv_open) {
1549 ret = drv->bdrv_open(bs, options, open_flags, &local_err);
1550 } else {
1551 ret = 0;
1552 }
1553
1554 if (ret < 0) {
1555 if (local_err) {
1556 error_propagate(errp, local_err);
1557 } else if (bs->filename[0]) {
1558 error_setg_errno(errp, -ret, "Could not open '%s'", bs->filename);
1559 } else {
1560 error_setg_errno(errp, -ret, "Could not open image");
1561 }
1562 goto open_failed;
1563 }
1564
1565 ret = refresh_total_sectors(bs, bs->total_sectors);
1566 if (ret < 0) {
1567 error_setg_errno(errp, -ret, "Could not refresh total sector count");
1568 return ret;
1569 }
1570
1571 bdrv_refresh_limits(bs, NULL, &local_err);
1572 if (local_err) {
1573 error_propagate(errp, local_err);
1574 return -EINVAL;
1575 }
1576
1577 assert(bdrv_opt_mem_align(bs) != 0);
1578 assert(bdrv_min_mem_align(bs) != 0);
1579 assert(is_power_of_2(bs->bl.request_alignment));
1580
1581 for (i = 0; i < bs->quiesce_counter; i++) {
1582 if (drv->bdrv_co_drain_begin) {
1583 drv->bdrv_co_drain_begin(bs);
1584 }
1585 }
1586
1587 return 0;
1588 open_failed:
1589 bs->drv = NULL;
1590 if (bs->file != NULL) {
1591 bdrv_unref_child(bs, bs->file);
1592 bs->file = NULL;
1593 }
1594 g_free(bs->opaque);
1595 bs->opaque = NULL;
1596 return ret;
1597 }
1598
1599 BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
1600 int flags, Error **errp)
1601 {
1602 BlockDriverState *bs;
1603 int ret;
1604
1605 bs = bdrv_new();
1606 bs->open_flags = flags;
1607 bs->explicit_options = qdict_new();
1608 bs->options = qdict_new();
1609 bs->opaque = NULL;
1610
1611 update_options_from_flags(bs->options, flags);
1612
1613 ret = bdrv_open_driver(bs, drv, node_name, bs->options, flags, errp);
1614 if (ret < 0) {
1615 qobject_unref(bs->explicit_options);
1616 bs->explicit_options = NULL;
1617 qobject_unref(bs->options);
1618 bs->options = NULL;
1619 bdrv_unref(bs);
1620 return NULL;
1621 }
1622
1623 return bs;
1624 }
1625
1626 QemuOptsList bdrv_runtime_opts = {
1627 .name = "bdrv_common",
1628 .head = QTAILQ_HEAD_INITIALIZER(bdrv_runtime_opts.head),
1629 .desc = {
1630 {
1631 .name = "node-name",
1632 .type = QEMU_OPT_STRING,
1633 .help = "Node name of the block device node",
1634 },
1635 {
1636 .name = "driver",
1637 .type = QEMU_OPT_STRING,
1638 .help = "Block driver to use for the node",
1639 },
1640 {
1641 .name = BDRV_OPT_CACHE_DIRECT,
1642 .type = QEMU_OPT_BOOL,
1643 .help = "Bypass software writeback cache on the host",
1644 },
1645 {
1646 .name = BDRV_OPT_CACHE_NO_FLUSH,
1647 .type = QEMU_OPT_BOOL,
1648 .help = "Ignore flush requests",
1649 },
1650 {
1651 .name = BDRV_OPT_READ_ONLY,
1652 .type = QEMU_OPT_BOOL,
1653 .help = "Node is opened in read-only mode",
1654 },
1655 {
1656 .name = BDRV_OPT_AUTO_READ_ONLY,
1657 .type = QEMU_OPT_BOOL,
1658 .help = "Node can become read-only if opening read-write fails",
1659 },
1660 {
1661 .name = "detect-zeroes",
1662 .type = QEMU_OPT_STRING,
1663 .help = "try to optimize zero writes (off, on, unmap)",
1664 },
1665 {
1666 .name = BDRV_OPT_DISCARD,
1667 .type = QEMU_OPT_STRING,
1668 .help = "discard operation (ignore/off, unmap/on)",
1669 },
1670 {
1671 .name = BDRV_OPT_FORCE_SHARE,
1672 .type = QEMU_OPT_BOOL,
1673 .help = "always accept other writers (default: off)",
1674 },
1675 { /* end of list */ }
1676 },
1677 };
1678
1679 QemuOptsList bdrv_create_opts_simple = {
1680 .name = "simple-create-opts",
1681 .head = QTAILQ_HEAD_INITIALIZER(bdrv_create_opts_simple.head),
1682 .desc = {
1683 {
1684 .name = BLOCK_OPT_SIZE,
1685 .type = QEMU_OPT_SIZE,
1686 .help = "Virtual disk size"
1687 },
1688 {
1689 .name = BLOCK_OPT_PREALLOC,
1690 .type = QEMU_OPT_STRING,
1691 .help = "Preallocation mode (allowed values: off)"
1692 },
1693 { /* end of list */ }
1694 }
1695 };
1696
1697 /*
1698 * Common part for opening disk images and files
1699 *
1700 * Removes all processed options from *options.
1701 */
1702 static int bdrv_open_common(BlockDriverState *bs, BlockBackend *file,
1703 QDict *options, Error **errp)
1704 {
1705 int ret, open_flags;
1706 const char *filename;
1707 const char *driver_name = NULL;
1708 const char *node_name = NULL;
1709 const char *discard;
1710 QemuOpts *opts;
1711 BlockDriver *drv;
1712 Error *local_err = NULL;
1713 bool ro;
1714
1715 assert(bs->file == NULL);
1716 assert(options != NULL && bs->options != options);
1717
1718 opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
1719 if (!qemu_opts_absorb_qdict(opts, options, errp)) {
1720 ret = -EINVAL;
1721 goto fail_opts;
1722 }
1723
1724 update_flags_from_options(&bs->open_flags, opts);
1725
1726 driver_name = qemu_opt_get(opts, "driver");
1727 drv = bdrv_find_format(driver_name);
1728 assert(drv != NULL);
1729
1730 bs->force_share = qemu_opt_get_bool(opts, BDRV_OPT_FORCE_SHARE, false);
1731
1732 if (bs->force_share && (bs->open_flags & BDRV_O_RDWR)) {
1733 error_setg(errp,
1734 BDRV_OPT_FORCE_SHARE
1735 "=on can only be used with read-only images");
1736 ret = -EINVAL;
1737 goto fail_opts;
1738 }
1739
1740 if (file != NULL) {
1741 bdrv_refresh_filename(blk_bs(file));
1742 filename = blk_bs(file)->filename;
1743 } else {
1744 /*
1745 * Caution: while qdict_get_try_str() is fine, getting
1746 * non-string types would require more care. When @options
1747 * come from -blockdev or blockdev_add, its members are typed
1748 * according to the QAPI schema, but when they come from
1749 * -drive, they're all QString.
1750 */
1751 filename = qdict_get_try_str(options, "filename");
1752 }
1753
1754 if (drv->bdrv_needs_filename && (!filename || !filename[0])) {
1755 error_setg(errp, "The '%s' block driver requires a file name",
1756 drv->format_name);
1757 ret = -EINVAL;
1758 goto fail_opts;
1759 }
1760
1761 trace_bdrv_open_common(bs, filename ?: "", bs->open_flags,
1762 drv->format_name);
1763
1764 ro = bdrv_is_read_only(bs);
1765
1766 if (use_bdrv_whitelist && !bdrv_is_whitelisted(drv, ro)) {
1767 if (!ro && bdrv_is_whitelisted(drv, true)) {
1768 ret = bdrv_apply_auto_read_only(bs, NULL, NULL);
1769 } else {
1770 ret = -ENOTSUP;
1771 }
1772 if (ret < 0) {
1773 error_setg(errp,
1774 !ro && bdrv_is_whitelisted(drv, true)
1775 ? "Driver '%s' can only be used for read-only devices"
1776 : "Driver '%s' is not whitelisted",
1777 drv->format_name);
1778 goto fail_opts;
1779 }
1780 }
1781
1782 /* bdrv_new() and bdrv_close() make it so */
1783 assert(qatomic_read(&bs->copy_on_read) == 0);
1784
1785 if (bs->open_flags & BDRV_O_COPY_ON_READ) {
1786 if (!ro) {
1787 bdrv_enable_copy_on_read(bs);
1788 } else {
1789 error_setg(errp, "Can't use copy-on-read on read-only device");
1790 ret = -EINVAL;
1791 goto fail_opts;
1792 }
1793 }
1794
1795 discard = qemu_opt_get(opts, BDRV_OPT_DISCARD);
1796 if (discard != NULL) {
1797 if (bdrv_parse_discard_flags(discard, &bs->open_flags) != 0) {
1798 error_setg(errp, "Invalid discard option");
1799 ret = -EINVAL;
1800 goto fail_opts;
1801 }
1802 }
1803
1804 bs->detect_zeroes =
1805 bdrv_parse_detect_zeroes(opts, bs->open_flags, &local_err);
1806 if (local_err) {
1807 error_propagate(errp, local_err);
1808 ret = -EINVAL;
1809 goto fail_opts;
1810 }
1811
1812 if (filename != NULL) {
1813 pstrcpy(bs->filename, sizeof(bs->filename), filename);
1814 } else {
1815 bs->filename[0] = '\0';
1816 }
1817 pstrcpy(bs->exact_filename, sizeof(bs->exact_filename), bs->filename);
1818
1819 /* Open the image, either directly or using a protocol */
1820 open_flags = bdrv_open_flags(bs, bs->open_flags);
1821 node_name = qemu_opt_get(opts, "node-name");
1822
1823 assert(!drv->bdrv_file_open || file == NULL);
1824 ret = bdrv_open_driver(bs, drv, node_name, options, open_flags, errp);
1825 if (ret < 0) {
1826 goto fail_opts;
1827 }
1828
1829 qemu_opts_del(opts);
1830 return 0;
1831
1832 fail_opts:
1833 qemu_opts_del(opts);
1834 return ret;
1835 }
1836
1837 static QDict *parse_json_filename(const char *filename, Error **errp)
1838 {
1839 QObject *options_obj;
1840 QDict *options;
1841 int ret;
1842
1843 ret = strstart(filename, "json:", &filename);
1844 assert(ret);
1845
1846 options_obj = qobject_from_json(filename, errp);
1847 if (!options_obj) {
1848 error_prepend(errp, "Could not parse the JSON options: ");
1849 return NULL;
1850 }
1851
1852 options = qobject_to(QDict, options_obj);
1853 if (!options) {
1854 qobject_unref(options_obj);
1855 error_setg(errp, "Invalid JSON object given");
1856 return NULL;
1857 }
1858
1859 qdict_flatten(options);
1860
1861 return options;
1862 }
1863
1864 static void parse_json_protocol(QDict *options, const char **pfilename,
1865 Error **errp)
1866 {
1867 QDict *json_options;
1868 Error *local_err = NULL;
1869
1870 /* Parse json: pseudo-protocol */
1871 if (!*pfilename || !g_str_has_prefix(*pfilename, "json:")) {
1872 return;
1873 }
1874
1875 json_options = parse_json_filename(*pfilename, &local_err);
1876 if (local_err) {
1877 error_propagate(errp, local_err);
1878 return;
1879 }
1880
1881 /* Options given in the filename have lower priority than options
1882 * specified directly */
1883 qdict_join(options, json_options, false);
1884 qobject_unref(json_options);
1885 *pfilename = NULL;
1886 }
1887
1888 /*
1889 * Fills in default options for opening images and converts the legacy
1890 * filename/flags pair to option QDict entries.
1891 * The BDRV_O_PROTOCOL flag in *flags will be set or cleared accordingly if a
1892 * block driver has been specified explicitly.
1893 */
1894 static int bdrv_fill_options(QDict **options, const char *filename,
1895 int *flags, Error **errp)
1896 {
1897 const char *drvname;
1898 bool protocol = *flags & BDRV_O_PROTOCOL;
1899 bool parse_filename = false;
1900 BlockDriver *drv = NULL;
1901 Error *local_err = NULL;
1902
1903 /*
1904 * Caution: while qdict_get_try_str() is fine, getting non-string
1905 * types would require more care. When @options come from
1906 * -blockdev or blockdev_add, its members are typed according to
1907 * the QAPI schema, but when they come from -drive, they're all
1908 * QString.
1909 */
1910 drvname = qdict_get_try_str(*options, "driver");
1911 if (drvname) {
1912 drv = bdrv_find_format(drvname);
1913 if (!drv) {
1914 error_setg(errp, "Unknown driver '%s'", drvname);
1915 return -ENOENT;
1916 }
1917 /* If the user has explicitly specified the driver, this choice should
1918 * override the BDRV_O_PROTOCOL flag */
1919 protocol = drv->bdrv_file_open;
1920 }
1921
1922 if (protocol) {
1923 *flags |= BDRV_O_PROTOCOL;
1924 } else {
1925 *flags &= ~BDRV_O_PROTOCOL;
1926 }
1927
1928 /* Translate cache options from flags into options */
1929 update_options_from_flags(*options, *flags);
1930
1931 /* Fetch the file name from the options QDict if necessary */
1932 if (protocol && filename) {
1933 if (!qdict_haskey(*options, "filename")) {
1934 qdict_put_str(*options, "filename", filename);
1935 parse_filename = true;
1936 } else {
1937 error_setg(errp, "Can't specify 'file' and 'filename' options at "
1938 "the same time");
1939 return -EINVAL;
1940 }
1941 }
1942
1943 /* Find the right block driver */
1944 /* See cautionary note on accessing @options above */
1945 filename = qdict_get_try_str(*options, "filename");
1946
1947 if (!drvname && protocol) {
1948 if (filename) {
1949 drv = bdrv_find_protocol(filename, parse_filename, errp);
1950 if (!drv) {
1951 return -EINVAL;
1952 }
1953
1954 drvname = drv->format_name;
1955 qdict_put_str(*options, "driver", drvname);
1956 } else {
1957 error_setg(errp, "Must specify either driver or file");
1958 return -EINVAL;
1959 }
1960 }
1961
1962 assert(drv || !protocol);
1963
1964 /* Driver-specific filename parsing */
1965 if (drv && drv->bdrv_parse_filename && parse_filename) {
1966 drv->bdrv_parse_filename(filename, *options, &local_err);
1967 if (local_err) {
1968 error_propagate(errp, local_err);
1969 return -EINVAL;
1970 }
1971
1972 if (!drv->bdrv_needs_filename) {
1973 qdict_del(*options, "filename");
1974 }
1975 }
1976
1977 return 0;
1978 }
1979
1980 typedef struct BlockReopenQueueEntry {
1981 bool prepared;
1982 bool perms_checked;
1983 BDRVReopenState state;
1984 QTAILQ_ENTRY(BlockReopenQueueEntry) entry;
1985 } BlockReopenQueueEntry;
1986
1987 /*
1988 * Return the flags that @bs will have after the reopens in @q have
1989 * successfully completed. If @q is NULL (or @bs is not contained in @q),
1990 * return the current flags.
1991 */
1992 static int bdrv_reopen_get_flags(BlockReopenQueue *q, BlockDriverState *bs)
1993 {
1994 BlockReopenQueueEntry *entry;
1995
1996 if (q != NULL) {
1997 QTAILQ_FOREACH(entry, q, entry) {
1998 if (entry->state.bs == bs) {
1999 return entry->state.flags;
2000 }
2001 }
2002 }
2003
2004 return bs->open_flags;
2005 }
2006
2007 /* Returns whether the image file can be written to after the reopen queue @q
2008 * has been successfully applied, or right now if @q is NULL. */
2009 static bool bdrv_is_writable_after_reopen(BlockDriverState *bs,
2010 BlockReopenQueue *q)
2011 {
2012 int flags = bdrv_reopen_get_flags(q, bs);
2013
2014 return (flags & (BDRV_O_RDWR | BDRV_O_INACTIVE)) == BDRV_O_RDWR;
2015 }
2016
2017 /*
2018 * Return whether the BDS can be written to. This is not necessarily
2019 * the same as !bdrv_is_read_only(bs), as inactivated images may not
2020 * be written to but do not count as read-only images.
2021 */
2022 bool bdrv_is_writable(BlockDriverState *bs)
2023 {
2024 return bdrv_is_writable_after_reopen(bs, NULL);
2025 }
2026
2027 static char *bdrv_child_user_desc(BdrvChild *c)
2028 {
2029 return c->klass->get_parent_desc(c);
2030 }
2031
2032 /*
2033 * Check that @a allows everything that @b needs. @a and @b must reference same
2034 * child node.
2035 */
2036 static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
2037 {
2038 const char *child_bs_name;
2039 g_autofree char *a_user = NULL;
2040 g_autofree char *b_user = NULL;
2041 g_autofree char *perms = NULL;
2042
2043 assert(a->bs);
2044 assert(a->bs == b->bs);
2045
2046 if ((b->perm & a->shared_perm) == b->perm) {
2047 return true;
2048 }
2049
2050 child_bs_name = bdrv_get_node_name(b->bs);
2051 a_user = bdrv_child_user_desc(a);
2052 b_user = bdrv_child_user_desc(b);
2053 perms = bdrv_perm_names(b->perm & ~a->shared_perm);
2054
2055 error_setg(errp, "Permission conflict on node '%s': permissions '%s' are "
2056 "both required by %s (uses node '%s' as '%s' child) and "
2057 "unshared by %s (uses node '%s' as '%s' child).",
2058 child_bs_name, perms,
2059 b_user, child_bs_name, b->name,
2060 a_user, child_bs_name, a->name);
2061
2062 return false;
2063 }
2064
2065 static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
2066 {
2067 BdrvChild *a, *b;
2068
2069 /*
2070 * During the loop we'll look at each pair twice. That's correct because
2071 * bdrv_a_allow_b() is asymmetric and we should check each pair in both
2072 * directions.
2073 */
2074 QLIST_FOREACH(a, &bs->parents, next_parent) {
2075 QLIST_FOREACH(b, &bs->parents, next_parent) {
2076 if (a == b) {
2077 continue;
2078 }
2079
2080 if (!bdrv_a_allow_b(a, b, errp)) {
2081 return true;
2082 }
2083 }
2084 }
2085
2086 return false;
2087 }
2088
2089 static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
2090 BdrvChild *c, BdrvChildRole role,
2091 BlockReopenQueue *reopen_queue,
2092 uint64_t parent_perm, uint64_t parent_shared,
2093 uint64_t *nperm, uint64_t *nshared)
2094 {
2095 assert(bs->drv && bs->drv->bdrv_child_perm);
2096 bs->drv->bdrv_child_perm(bs, c, role, reopen_queue,
2097 parent_perm, parent_shared,
2098 nperm, nshared);
2099 /* TODO Take force_share from reopen_queue */
2100 if (child_bs && child_bs->force_share) {
2101 *nshared = BLK_PERM_ALL;
2102 }
2103 }
2104
2105 /*
2106 * Adds the whole subtree of @bs (including @bs itself) to the @list (except for
2107 * nodes that are already in the @list, of course) so that final list is
2108 * topologically sorted. Return the result (GSList @list object is updated, so
2109 * don't use old reference after function call).
2110 *
2111 * On function start @list must be already topologically sorted and for any node
2112 * in the @list the whole subtree of the node must be in the @list as well. The
2113 * simplest way to satisfy this criteria: use only result of
2114 * bdrv_topological_dfs() or NULL as @list parameter.
2115 */
2116 static GSList *bdrv_topological_dfs(GSList *list, GHashTable *found,
2117 BlockDriverState *bs)
2118 {
2119 BdrvChild *child;
2120 g_autoptr(GHashTable) local_found = NULL;
2121
2122 if (!found) {
2123 assert(!list);
2124 found = local_found = g_hash_table_new(NULL, NULL);
2125 }
2126
2127 if (g_hash_table_contains(found, bs)) {
2128 return list;
2129 }
2130 g_hash_table_add(found, bs);
2131
2132 QLIST_FOREACH(child, &bs->children, next) {
2133 list = bdrv_topological_dfs(list, found, child->bs);
2134 }
2135
2136 return g_slist_prepend(list, bs);
2137 }
2138
2139 typedef struct BdrvChildSetPermState {
2140 BdrvChild *child;
2141 uint64_t old_perm;
2142 uint64_t old_shared_perm;
2143 } BdrvChildSetPermState;
2144
2145 static void bdrv_child_set_perm_abort(void *opaque)
2146 {
2147 BdrvChildSetPermState *s = opaque;
2148
2149 s->child->perm = s->old_perm;
2150 s->child->shared_perm = s->old_shared_perm;
2151 }
2152
2153 static TransactionActionDrv bdrv_child_set_pem_drv = {
2154 .abort = bdrv_child_set_perm_abort,
2155 .clean = g_free,
2156 };
2157
2158 static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm,
2159 uint64_t shared, Transaction *tran)
2160 {
2161 BdrvChildSetPermState *s = g_new(BdrvChildSetPermState, 1);
2162
2163 *s = (BdrvChildSetPermState) {
2164 .child = c,
2165 .old_perm = c->perm,
2166 .old_shared_perm = c->shared_perm,
2167 };
2168
2169 c->perm = perm;
2170 c->shared_perm = shared;
2171
2172 tran_add(tran, &bdrv_child_set_pem_drv, s);
2173 }
2174
2175 static void bdrv_drv_set_perm_commit(void *opaque)
2176 {
2177 BlockDriverState *bs = opaque;
2178 uint64_t cumulative_perms, cumulative_shared_perms;
2179
2180 if (bs->drv->bdrv_set_perm) {
2181 bdrv_get_cumulative_perm(bs, &cumulative_perms,
2182 &cumulative_shared_perms);
2183 bs->drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
2184 }
2185 }
2186
2187 static void bdrv_drv_set_perm_abort(void *opaque)
2188 {
2189 BlockDriverState *bs = opaque;
2190
2191 if (bs->drv->bdrv_abort_perm_update) {
2192 bs->drv->bdrv_abort_perm_update(bs);
2193 }
2194 }
2195
2196 TransactionActionDrv bdrv_drv_set_perm_drv = {
2197 .abort = bdrv_drv_set_perm_abort,
2198 .commit = bdrv_drv_set_perm_commit,
2199 };
2200
2201 static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
2202 uint64_t shared_perm, Transaction *tran,
2203 Error **errp)
2204 {
2205 if (!bs->drv) {
2206 return 0;
2207 }
2208
2209 if (bs->drv->bdrv_check_perm) {
2210 int ret = bs->drv->bdrv_check_perm(bs, perm, shared_perm, errp);
2211 if (ret < 0) {
2212 return ret;
2213 }
2214 }
2215
2216 if (tran) {
2217 tran_add(tran, &bdrv_drv_set_perm_drv, bs);
2218 }
2219
2220 return 0;
2221 }
2222
2223 typedef struct BdrvReplaceChildState {
2224 BdrvChild *child;
2225 BlockDriverState *old_bs;
2226 } BdrvReplaceChildState;
2227
2228 static void bdrv_replace_child_commit(void *opaque)
2229 {
2230 BdrvReplaceChildState *s = opaque;
2231
2232 bdrv_unref(s->old_bs);
2233 }
2234
2235 static void bdrv_replace_child_abort(void *opaque)
2236 {
2237 BdrvReplaceChildState *s = opaque;
2238 BlockDriverState *new_bs = s->child->bs;
2239
2240 /* old_bs reference is transparently moved from @s to @s->child */
2241 bdrv_replace_child_noperm(s->child, s->old_bs);
2242 bdrv_unref(new_bs);
2243 }
2244
2245 static TransactionActionDrv bdrv_replace_child_drv = {
2246 .commit = bdrv_replace_child_commit,
2247 .abort = bdrv_replace_child_abort,
2248 .clean = g_free,
2249 };
2250
2251 /*
2252 * bdrv_replace_child
2253 *
2254 * Note: real unref of old_bs is done only on commit.
2255 */
2256 static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs,
2257 Transaction *tran)
2258 {
2259 BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
2260 *s = (BdrvReplaceChildState) {
2261 .child = child,
2262 .old_bs = child->bs,
2263 };
2264 tran_add(tran, &bdrv_replace_child_drv, s);
2265
2266 if (new_bs) {
2267 bdrv_ref(new_bs);
2268 }
2269 bdrv_replace_child_noperm(child, new_bs);
2270 /* old_bs reference is transparently moved from @child to @s */
2271 }
2272
2273 /*
2274 * Refresh permissions in @bs subtree. The function is intended to be called
2275 * after some graph modification that was done without permission update.
2276 */
2277 static int bdrv_node_refresh_perm(BlockDriverState *bs, BlockReopenQueue *q,
2278 Transaction *tran, Error **errp)
2279 {
2280 BlockDriver *drv = bs->drv;
2281 BdrvChild *c;
2282 int ret;
2283 uint64_t cumulative_perms, cumulative_shared_perms;
2284
2285 bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
2286
2287 /* Write permissions never work with read-only images */
2288 if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2289 !bdrv_is_writable_after_reopen(bs, q))
2290 {
2291 if (!bdrv_is_writable_after_reopen(bs, NULL)) {
2292 error_setg(errp, "Block node is read-only");
2293 } else {
2294 error_setg(errp, "Read-only block node '%s' cannot support "
2295 "read-write users", bdrv_get_node_name(bs));
2296 }
2297
2298 return -EPERM;
2299 }
2300
2301 /*
2302 * Unaligned requests will automatically be aligned to bl.request_alignment
2303 * and without RESIZE we can't extend requests to write to space beyond the
2304 * end of the image, so it's required that the image size is aligned.
2305 */
2306 if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
2307 !(cumulative_perms & BLK_PERM_RESIZE))
2308 {
2309 if ((bs->total_sectors * BDRV_SECTOR_SIZE) % bs->bl.request_alignment) {
2310 error_setg(errp, "Cannot get 'write' permission without 'resize': "
2311 "Image size is not a multiple of request "
2312 "alignment");
2313 return -EPERM;
2314 }
2315 }
2316
2317 /* Check this node */
2318 if (!drv) {
2319 return 0;
2320 }
2321
2322 ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, tran,
2323 errp);
2324 if (ret < 0) {
2325 return ret;
2326 }
2327
2328 /* Drivers that never have children can omit .bdrv_child_perm() */
2329 if (!drv->bdrv_child_perm) {
2330 assert(QLIST_EMPTY(&bs->children));
2331 return 0;
2332 }
2333
2334 /* Check all children */
2335 QLIST_FOREACH(c, &bs->children, next) {
2336 uint64_t cur_perm, cur_shared;
2337
2338 bdrv_child_perm(bs, c->bs, c, c->role, q,
2339 cumulative_perms, cumulative_shared_perms,
2340 &cur_perm, &cur_shared);
2341 bdrv_child_set_perm(c, cur_perm, cur_shared, tran);
2342 }
2343
2344 return 0;
2345 }
2346
2347 static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
2348 Transaction *tran, Error **errp)
2349 {
2350 int ret;
2351 BlockDriverState *bs;
2352
2353 for ( ; list; list = list->next) {
2354 bs = list->data;
2355
2356 if (bdrv_parent_perms_conflict(bs, errp)) {
2357 return -EINVAL;
2358 }
2359
2360 ret = bdrv_node_refresh_perm(bs, q, tran, errp);
2361 if (ret < 0) {
2362 return ret;
2363 }
2364 }
2365
2366 return 0;
2367 }
2368
2369 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
2370 uint64_t *shared_perm)
2371 {
2372 BdrvChild *c;
2373 uint64_t cumulative_perms = 0;
2374 uint64_t cumulative_shared_perms = BLK_PERM_ALL;
2375
2376 QLIST_FOREACH(c, &bs->parents, next_parent) {
2377 cumulative_perms |= c->perm;
2378 cumulative_shared_perms &= c->shared_perm;
2379 }
2380
2381 *perm = cumulative_perms;
2382 *shared_perm = cumulative_shared_perms;
2383 }
2384
2385 char *bdrv_perm_names(uint64_t perm)
2386 {
2387 struct perm_name {
2388 uint64_t perm;
2389 const char *name;
2390 } permissions[] = {
2391 { BLK_PERM_CONSISTENT_READ, "consistent read" },
2392 { BLK_PERM_WRITE, "write" },
2393 { BLK_PERM_WRITE_UNCHANGED, "write unchanged" },
2394 { BLK_PERM_RESIZE, "resize" },
2395 { BLK_PERM_GRAPH_MOD, "change children" },
2396 { 0, NULL }
2397 };
2398
2399 GString *result = g_string_sized_new(30);
2400 struct perm_name *p;
2401
2402 for (p = permissions; p->name; p++) {
2403 if (perm & p->perm) {
2404 if (result->len > 0) {
2405 g_string_append(result, ", ");
2406 }
2407 g_string_append(result, p->name);
2408 }
2409 }
2410
2411 return g_string_free(result, FALSE);
2412 }
2413
2414
2415 static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
2416 {
2417 int ret;
2418 Transaction *tran = tran_new();
2419 g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
2420
2421 ret = bdrv_list_refresh_perms(list, NULL, tran, errp);
2422 tran_finalize(tran, ret);
2423
2424 return ret;
2425 }
2426
2427 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
2428 Error **errp)
2429 {
2430 Error *local_err = NULL;
2431 Transaction *tran = tran_new();
2432 int ret;
2433
2434 bdrv_child_set_perm(c, perm, shared, tran);
2435
2436 ret = bdrv_refresh_perms(c->bs, &local_err);
2437
2438 tran_finalize(tran, ret);
2439
2440 if (ret < 0) {
2441 if ((perm & ~c->perm) || (c->shared_perm & ~shared)) {
2442 /* tighten permissions */
2443 error_propagate(errp, local_err);
2444 } else {
2445 /*
2446 * Our caller may intend to only loosen restrictions and
2447 * does not expect this function to fail. Errors are not
2448 * fatal in such a case, so we can just hide them from our
2449 * caller.
2450 */
2451 error_free(local_err);
2452 ret = 0;
2453 }
2454 }
2455
2456 return ret;
2457 }
2458
2459 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
2460 {
2461 uint64_t parent_perms, parent_shared;
2462 uint64_t perms, shared;
2463
2464 bdrv_get_cumulative_perm(bs, &parent_perms, &parent_shared);
2465 bdrv_child_perm(bs, c->bs, c, c->role, NULL,
2466 parent_perms, parent_shared, &perms, &shared);
2467
2468 return bdrv_child_try_set_perm(c, perms, shared, errp);
2469 }
2470
2471 /*
2472 * Default implementation for .bdrv_child_perm() for block filters:
2473 * Forward CONSISTENT_READ, WRITE, WRITE_UNCHANGED, and RESIZE to the
2474 * filtered child.
2475 */
2476 static void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
2477 BdrvChildRole role,
2478 BlockReopenQueue *reopen_queue,
2479 uint64_t perm, uint64_t shared,
2480 uint64_t *nperm, uint64_t *nshared)
2481 {
2482 *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
2483 *nshared = (shared & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
2484 }
2485
2486 static void bdrv_default_perms_for_cow(BlockDriverState *bs, BdrvChild *c,
2487 BdrvChildRole role,
2488 BlockReopenQueue *reopen_queue,
2489 uint64_t perm, uint64_t shared,
2490 uint64_t *nperm, uint64_t *nshared)
2491 {
2492 assert(role & BDRV_CHILD_COW);
2493
2494 /*
2495 * We want consistent read from backing files if the parent needs it.
2496 * No other operations are performed on backing files.
2497 */
2498 perm &= BLK_PERM_CONSISTENT_READ;
2499
2500 /*
2501 * If the parent can deal with changing data, we're okay with a
2502 * writable and resizable backing file.
2503 * TODO Require !(perm & BLK_PERM_CONSISTENT_READ), too?
2504 */
2505 if (shared & BLK_PERM_WRITE) {
2506 shared = BLK_PERM_WRITE | BLK_PERM_RESIZE;
2507 } else {
2508 shared = 0;
2509 }
2510
2511 shared |= BLK_PERM_CONSISTENT_READ | BLK_PERM_GRAPH_MOD |
2512 BLK_PERM_WRITE_UNCHANGED;
2513
2514 if (bs->open_flags & BDRV_O_INACTIVE) {
2515 shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2516 }
2517
2518 *nperm = perm;
2519 *nshared = shared;
2520 }
2521
2522 static void bdrv_default_perms_for_storage(BlockDriverState *bs, BdrvChild *c,
2523 BdrvChildRole role,
2524 BlockReopenQueue *reopen_queue,
2525 uint64_t perm, uint64_t shared,
2526 uint64_t *nperm, uint64_t *nshared)
2527 {
2528 int flags;
2529
2530 assert(role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA));
2531
2532 flags = bdrv_reopen_get_flags(reopen_queue, bs);
2533
2534 /*
2535 * Apart from the modifications below, the same permissions are
2536 * forwarded and left alone as for filters
2537 */
2538 bdrv_filter_default_perms(bs, c, role, reopen_queue,
2539 perm, shared, &perm, &shared);
2540
2541 if (role & BDRV_CHILD_METADATA) {
2542 /* Format drivers may touch metadata even if the guest doesn't write */
2543 if (bdrv_is_writable_after_reopen(bs, reopen_queue)) {
2544 perm |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2545 }
2546
2547 /*
2548 * bs->file always needs to be consistent because of the
2549 * metadata. We can never allow other users to resize or write
2550 * to it.
2551 */
2552 if (!(flags & BDRV_O_NO_IO)) {
2553 perm |= BLK_PERM_CONSISTENT_READ;
2554 }
2555 shared &= ~(BLK_PERM_WRITE | BLK_PERM_RESIZE);
2556 }
2557
2558 if (role & BDRV_CHILD_DATA) {
2559 /*
2560 * Technically, everything in this block is a subset of the
2561 * BDRV_CHILD_METADATA path taken above, and so this could
2562 * be an "else if" branch. However, that is not obvious, and
2563 * this function is not performance critical, therefore we let
2564 * this be an independent "if".
2565 */
2566
2567 /*
2568 * We cannot allow other users to resize the file because the
2569 * format driver might have some assumptions about the size
2570 * (e.g. because it is stored in metadata, or because the file
2571 * is split into fixed-size data files).
2572 */
2573 shared &= ~BLK_PERM_RESIZE;
2574
2575 /*
2576 * WRITE_UNCHANGED often cannot be performed as such on the
2577 * data file. For example, the qcow2 driver may still need to
2578 * write copied clusters on copy-on-read.
2579 */
2580 if (perm & BLK_PERM_WRITE_UNCHANGED) {
2581 perm |= BLK_PERM_WRITE;
2582 }
2583
2584 /*
2585 * If the data file is written to, the format driver may
2586 * expect to be able to resize it by writing beyond the EOF.
2587 */
2588 if (perm & BLK_PERM_WRITE) {
2589 perm |= BLK_PERM_RESIZE;
2590 }
2591 }
2592
2593 if (bs->open_flags & BDRV_O_INACTIVE) {
2594 shared |= BLK_PERM_WRITE | BLK_PERM_RESIZE;
2595 }
2596
2597 *nperm = perm;
2598 *nshared = shared;
2599 }
2600
2601 void bdrv_default_perms(BlockDriverState *bs, BdrvChild *c,
2602 BdrvChildRole role, BlockReopenQueue *reopen_queue,
2603 uint64_t perm, uint64_t shared,
2604 uint64_t *nperm, uint64_t *nshared)
2605 {
2606 if (role & BDRV_CHILD_FILTERED) {
2607 assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA |
2608 BDRV_CHILD_COW)));
2609 bdrv_filter_default_perms(bs, c, role, reopen_queue,
2610 perm, shared, nperm, nshared);
2611 } else if (role & BDRV_CHILD_COW) {
2612 assert(!(role & (BDRV_CHILD_DATA | BDRV_CHILD_METADATA)));
2613 bdrv_default_perms_for_cow(bs, c, role, reopen_queue,
2614 perm, shared, nperm, nshared);
2615 } else if (role & (BDRV_CHILD_METADATA | BDRV_CHILD_DATA)) {
2616 bdrv_default_perms_for_storage(bs, c, role, reopen_queue,
2617 perm, shared, nperm, nshared);
2618 } else {
2619 g_assert_not_reached();
2620 }
2621 }
2622
2623 uint64_t bdrv_qapi_perm_to_blk_perm(BlockPermission qapi_perm)
2624 {
2625 static const uint64_t permissions[] = {
2626 [BLOCK_PERMISSION_CONSISTENT_READ] = BLK_PERM_CONSISTENT_READ,
2627 [BLOCK_PERMISSION_WRITE] = BLK_PERM_WRITE,
2628 [BLOCK_PERMISSION_WRITE_UNCHANGED] = BLK_PERM_WRITE_UNCHANGED,
2629 [BLOCK_PERMISSION_RESIZE] = BLK_PERM_RESIZE,
2630 [BLOCK_PERMISSION_GRAPH_MOD] = BLK_PERM_GRAPH_MOD,
2631 };
2632
2633 QEMU_BUILD_BUG_ON(ARRAY_SIZE(permissions) != BLOCK_PERMISSION__MAX);
2634 QEMU_BUILD_BUG_ON(1UL << ARRAY_SIZE(permissions) != BLK_PERM_ALL + 1);
2635
2636 assert(qapi_perm < BLOCK_PERMISSION__MAX);
2637
2638 return permissions[qapi_perm];
2639 }
2640
2641 static void bdrv_replace_child_noperm(BdrvChild *child,
2642 BlockDriverState *new_bs)
2643 {
2644 BlockDriverState *old_bs = child->bs;
2645 int new_bs_quiesce_counter;
2646 int drain_saldo;
2647
2648 assert(!child->frozen);
2649
2650 if (old_bs && new_bs) {
2651 assert(bdrv_get_aio_context(old_bs) == bdrv_get_aio_context(new_bs));
2652 }
2653
2654 new_bs_quiesce_counter = (new_bs ? new_bs->quiesce_counter : 0);
2655 drain_saldo = new_bs_quiesce_counter - child->parent_quiesce_counter;
2656
2657 /*
2658 * If the new child node is drained but the old one was not, flush
2659 * all outstanding requests to the old child node.
2660 */
2661 while (drain_saldo > 0 && child->klass->drained_begin) {
2662 bdrv_parent_drained_begin_single(child, true);
2663 drain_saldo--;
2664 }
2665
2666 if (old_bs) {
2667 /* Detach first so that the recursive drain sections coming from @child
2668 * are already gone and we only end the drain sections that came from
2669 * elsewhere. */
2670 if (child->klass->detach) {
2671 child->klass->detach(child);
2672 }
2673 QLIST_REMOVE(child, next_parent);
2674 }
2675
2676 child->bs = new_bs;
2677
2678 if (new_bs) {
2679 QLIST_INSERT_HEAD(&new_bs->parents, child, next_parent);
2680
2681 /*
2682 * Detaching the old node may have led to the new node's
2683 * quiesce_counter having been decreased. Not a problem, we
2684 * just need to recognize this here and then invoke
2685 * drained_end appropriately more often.
2686 */
2687 assert(new_bs->quiesce_counter <= new_bs_quiesce_counter);
2688 drain_saldo += new_bs->quiesce_counter - new_bs_quiesce_counter;
2689
2690 /* Attach only after starting new drained sections, so that recursive
2691 * drain sections coming from @child don't get an extra .drained_begin
2692 * callback. */
2693 if (child->klass->attach) {
2694 child->klass->attach(child);
2695 }
2696 }
2697
2698 /*
2699 * If the old child node was drained but the new one is not, allow
2700 * requests to come in only after the new node has been attached.
2701 */
2702 while (drain_saldo < 0 && child->klass->drained_end) {
2703 bdrv_parent_drained_end_single(child);
2704 drain_saldo++;
2705 }
2706 }
2707
2708 static void bdrv_child_free(void *opaque)
2709 {
2710 BdrvChild *c = opaque;
2711
2712 g_free(c->name);
2713 g_free(c);
2714 }
2715
2716 static void bdrv_remove_empty_child(BdrvChild *child)
2717 {
2718 assert(!child->bs);
2719 QLIST_SAFE_REMOVE(child, next);
2720 bdrv_child_free(child);
2721 }
2722
2723 typedef struct BdrvAttachChildCommonState {
2724 BdrvChild **child;
2725 AioContext *old_parent_ctx;
2726 AioContext *old_child_ctx;
2727 } BdrvAttachChildCommonState;
2728
2729 static void bdrv_attach_child_common_abort(void *opaque)
2730 {
2731 BdrvAttachChildCommonState *s = opaque;
2732 BdrvChild *child = *s->child;
2733 BlockDriverState *bs = child->bs;
2734
2735 bdrv_replace_child_noperm(child, NULL);
2736
2737 if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
2738 bdrv_try_set_aio_context(bs, s->old_child_ctx, &error_abort);
2739 }
2740
2741 if (bdrv_child_get_parent_aio_context(child) != s->old_parent_ctx) {
2742 GSList *ignore = g_slist_prepend(NULL, child);
2743
2744 child->klass->can_set_aio_ctx(child, s->old_parent_ctx, &ignore,
2745 &error_abort);
2746 g_slist_free(ignore);
2747 ignore = g_slist_prepend(NULL, child);
2748 child->klass->set_aio_ctx(child, s->old_parent_ctx, &ignore);
2749
2750 g_slist_free(ignore);
2751 }
2752
2753 bdrv_unref(bs);
2754 bdrv_remove_empty_child(child);
2755 *s->child = NULL;
2756 }
2757
2758 static TransactionActionDrv bdrv_attach_child_common_drv = {
2759 .abort = bdrv_attach_child_common_abort,
2760 .clean = g_free,
2761 };
2762
2763 /*
2764 * Common part of attaching bdrv child to bs or to blk or to job
2765 *
2766 * Resulting new child is returned through @child.
2767 * At start *@child must be NULL.
2768 * @child is saved to a new entry of @tran, so that *@child could be reverted to
2769 * NULL on abort(). So referenced variable must live at least until transaction
2770 * end.
2771 */
2772 static int bdrv_attach_child_common(BlockDriverState *child_bs,
2773 const char *child_name,
2774 const BdrvChildClass *child_class,
2775 BdrvChildRole child_role,
2776 uint64_t perm, uint64_t shared_perm,
2777 void *opaque, BdrvChild **child,
2778 Transaction *tran, Error **errp)
2779 {
2780 BdrvChild *new_child;
2781 AioContext *parent_ctx;
2782 AioContext *child_ctx = bdrv_get_aio_context(child_bs);
2783
2784 assert(child);
2785 assert(*child == NULL);
2786 assert(child_class->get_parent_desc);
2787
2788 new_child = g_new(BdrvChild, 1);
2789 *new_child = (BdrvChild) {
2790 .bs = NULL,
2791 .name = g_strdup(child_name),
2792 .klass = child_class,
2793 .role = child_role,
2794 .perm = perm,
2795 .shared_perm = shared_perm,
2796 .opaque = opaque,
2797 };
2798
2799 /*
2800 * If the AioContexts don't match, first try to move the subtree of
2801 * child_bs into the AioContext of the new parent. If this doesn't work,
2802 * try moving the parent into the AioContext of child_bs instead.
2803 */
2804 parent_ctx = bdrv_child_get_parent_aio_context(new_child);
2805 if (child_ctx != parent_ctx) {
2806 Error *local_err = NULL;
2807 int ret = bdrv_try_set_aio_context(child_bs, parent_ctx, &local_err);
2808
2809 if (ret < 0 && child_class->can_set_aio_ctx) {
2810 GSList *ignore = g_slist_prepend(NULL, new_child);
2811 if (child_class->can_set_aio_ctx(new_child, child_ctx, &ignore,
2812 NULL))
2813 {
2814 error_free(local_err);
2815 ret = 0;
2816 g_slist_free(ignore);
2817 ignore = g_slist_prepend(NULL, new_child);
2818 child_class->set_aio_ctx(new_child, child_ctx, &ignore);
2819 }
2820 g_slist_free(ignore);
2821 }
2822
2823 if (ret < 0) {
2824 error_propagate(errp, local_err);
2825 bdrv_remove_empty_child(new_child);
2826 return ret;
2827 }
2828 }
2829
2830 bdrv_ref(child_bs);
2831 bdrv_replace_child_noperm(new_child, child_bs);
2832
2833 *child = new_child;
2834
2835 BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
2836 *s = (BdrvAttachChildCommonState) {
2837 .child = child,
2838 .old_parent_ctx = parent_ctx,
2839 .old_child_ctx = child_ctx,
2840 };
2841 tran_add(tran, &bdrv_attach_child_common_drv, s);
2842
2843 return 0;
2844 }
2845
2846 /*
2847 * Variable referenced by @child must live at least until transaction end.
2848 * (see bdrv_attach_child_common() doc for details)
2849 */
2850 static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
2851 BlockDriverState *child_bs,
2852 const char *child_name,
2853 const BdrvChildClass *child_class,
2854 BdrvChildRole child_role,
2855 BdrvChild **child,
2856 Transaction *tran,
2857 Error **errp)
2858 {
2859 int ret;
2860 uint64_t perm, shared_perm;
2861
2862 assert(parent_bs->drv);
2863
2864 bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
2865 bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
2866 perm, shared_perm, &perm, &shared_perm);
2867
2868 ret = bdrv_attach_child_common(child_bs, child_name, child_class,
2869 child_role, perm, shared_perm, parent_bs,
2870 child, tran, errp);
2871 if (ret < 0) {
2872 return ret;
2873 }
2874
2875 QLIST_INSERT_HEAD(&parent_bs->children, *child, next);
2876 /*
2877 * child is removed in bdrv_attach_child_common_abort(), so don't care to
2878 * abort this change separately.
2879 */
2880
2881 return 0;
2882 }
2883
2884 static void bdrv_detach_child(BdrvChild *child)
2885 {
2886 BlockDriverState *old_bs = child->bs;
2887
2888 bdrv_replace_child_noperm(child, NULL);
2889 bdrv_remove_empty_child(child);
2890
2891 if (old_bs) {
2892 /*
2893 * Update permissions for old node. We're just taking a parent away, so
2894 * we're loosening restrictions. Errors of permission update are not
2895 * fatal in this case, ignore them.
2896 */
2897 bdrv_refresh_perms(old_bs, NULL);
2898
2899 /*
2900 * When the parent requiring a non-default AioContext is removed, the
2901 * node moves back to the main AioContext
2902 */
2903 bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
2904 }
2905 }
2906
2907 /*
2908 * This function steals the reference to child_bs from the caller.
2909 * That reference is later dropped by bdrv_root_unref_child().
2910 *
2911 * On failure NULL is returned, errp is set and the reference to
2912 * child_bs is also dropped.
2913 *
2914 * The caller must hold the AioContext lock @child_bs, but not that of @ctx
2915 * (unless @child_bs is already in @ctx).
2916 */
2917 BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
2918 const char *child_name,
2919 const BdrvChildClass *child_class,
2920 BdrvChildRole child_role,
2921 uint64_t perm, uint64_t shared_perm,
2922 void *opaque, Error **errp)
2923 {
2924 int ret;
2925 BdrvChild *child = NULL;
2926 Transaction *tran = tran_new();
2927
2928 ret = bdrv_attach_child_common(child_bs, child_name, child_class,
2929 child_role, perm, shared_perm, opaque,
2930 &child, tran, errp);
2931 if (ret < 0) {
2932 goto out;
2933 }
2934
2935 ret = bdrv_refresh_perms(child_bs, errp);
2936
2937 out:
2938 tran_finalize(tran, ret);
2939 /* child is unset on failure by bdrv_attach_child_common_abort() */
2940 assert((ret < 0) == !child);
2941
2942 bdrv_unref(child_bs);
2943 return child;
2944 }
2945
2946 /*
2947 * This function transfers the reference to child_bs from the caller
2948 * to parent_bs. That reference is later dropped by parent_bs on
2949 * bdrv_close() or if someone calls bdrv_unref_child().
2950 *
2951 * On failure NULL is returned, errp is set and the reference to
2952 * child_bs is also dropped.
2953 *
2954 * If @parent_bs and @child_bs are in different AioContexts, the caller must
2955 * hold the AioContext lock for @child_bs, but not for @parent_bs.
2956 */
2957 BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
2958 BlockDriverState *child_bs,
2959 const char *child_name,
2960 const BdrvChildClass *child_class,
2961 BdrvChildRole child_role,
2962 Error **errp)
2963 {
2964 int ret;
2965 BdrvChild *child = NULL;
2966 Transaction *tran = tran_new();
2967
2968 ret = bdrv_attach_child_noperm(parent_bs, child_bs, child_name, child_class,
2969 child_role, &child, tran, errp);
2970 if (ret < 0) {
2971 goto out;
2972 }
2973
2974 ret = bdrv_refresh_perms(parent_bs, errp);
2975 if (ret < 0) {
2976 goto out;
2977 }
2978
2979 out:
2980 tran_finalize(tran, ret);
2981 /* child is unset on failure by bdrv_attach_child_common_abort() */
2982 assert((ret < 0) == !child);
2983
2984 bdrv_unref(child_bs);
2985
2986 return child;
2987 }
2988
2989 /* Callers must ensure that child->frozen is false. */
2990 void bdrv_root_unref_child(BdrvChild *child)
2991 {
2992 BlockDriverState *child_bs;
2993
2994 child_bs = child->bs;
2995 bdrv_detach_child(child);
2996 bdrv_unref(child_bs);
2997 }
2998
2999 typedef struct BdrvSetInheritsFrom {
3000 BlockDriverState *bs;
3001 BlockDriverState *old_inherits_from;
3002 } BdrvSetInheritsFrom;
3003
3004 static void bdrv_set_inherits_from_abort(void *opaque)
3005 {
3006 BdrvSetInheritsFrom *s = opaque;
3007
3008 s->bs->inherits_from = s->old_inherits_from;
3009 }
3010
3011 static TransactionActionDrv bdrv_set_inherits_from_drv = {
3012 .abort = bdrv_set_inherits_from_abort,
3013 .clean = g_free,
3014 };
3015
3016 /* @tran is allowed to be NULL. In this case no rollback is possible */
3017 static void bdrv_set_inherits_from(BlockDriverState *bs,
3018 BlockDriverState *new_inherits_from,
3019 Transaction *tran)
3020 {
3021 if (tran) {
3022 BdrvSetInheritsFrom *s = g_new(BdrvSetInheritsFrom, 1);
3023
3024 *s = (BdrvSetInheritsFrom) {
3025 .bs = bs,
3026 .old_inherits_from = bs->inherits_from,
3027 };
3028
3029 tran_add(tran, &bdrv_set_inherits_from_drv, s);
3030 }
3031
3032 bs->inherits_from = new_inherits_from;
3033 }
3034
3035 /**
3036 * Clear all inherits_from pointers from children and grandchildren of
3037 * @root that point to @root, where necessary.
3038 * @tran is allowed to be NULL. In this case no rollback is possible
3039 */
3040 static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child,
3041 Transaction *tran)
3042 {
3043 BdrvChild *c;
3044
3045 if (child->bs->inherits_from == root) {
3046 /*
3047 * Remove inherits_from only when the last reference between root and
3048 * child->bs goes away.
3049 */
3050 QLIST_FOREACH(c, &root->children, next) {
3051 if (c != child && c->bs == child->bs) {
3052 break;
3053 }
3054 }
3055 if (c == NULL) {
3056 bdrv_set_inherits_from(child->bs, NULL, tran);
3057 }
3058 }
3059
3060 QLIST_FOREACH(c, &child->bs->children, next) {
3061 bdrv_unset_inherits_from(root, c, tran);
3062 }
3063 }
3064
3065 /* Callers must ensure that child->frozen is false. */
3066 void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
3067 {
3068 if (child == NULL) {
3069 return;
3070 }
3071
3072 bdrv_unset_inherits_from(parent, child, NULL);
3073 bdrv_root_unref_child(child);
3074 }
3075
3076
3077 static void bdrv_parent_cb_change_media(BlockDriverState *bs, bool load)
3078 {
3079 BdrvChild *c;
3080 QLIST_FOREACH(c, &bs->parents, next_parent) {
3081 if (c->klass->change_media) {
3082 c->klass->change_media(c, load);
3083 }
3084 }
3085 }
3086
3087 /* Return true if you can reach parent going through child->inherits_from
3088 * recursively. If parent or child are NULL, return false */
3089 static bool bdrv_inherits_from_recursive(BlockDriverState *child,
3090 BlockDriverState *parent)
3091 {
3092 while (child && child != parent) {
3093 child = child->inherits_from;
3094 }
3095
3096 return child != NULL;
3097 }
3098
3099 /*
3100 * Return the BdrvChildRole for @bs's backing child. bs->backing is
3101 * mostly used for COW backing children (role = COW), but also for
3102 * filtered children (role = FILTERED | PRIMARY).
3103 */
3104 static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
3105 {
3106 if (bs->drv && bs->drv->is_filter) {
3107 return BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY;
3108 } else {
3109 return BDRV_CHILD_COW;
3110 }
3111 }
3112
3113 /*
3114 * Sets the bs->backing link of a BDS. A new reference is created; callers
3115 * which don't need their own reference any more must call bdrv_unref().
3116 */
3117 static int bdrv_set_backing_noperm(BlockDriverState *bs,
3118 BlockDriverState *backing_hd,
3119 Transaction *tran, Error **errp)
3120 {
3121 int ret = 0;
3122 bool update_inherits_from = bdrv_chain_contains(bs, backing_hd) &&
3123 bdrv_inherits_from_recursive(backing_hd, bs);
3124
3125 if (bdrv_is_backing_chain_frozen(bs, child_bs(bs->backing), errp)) {
3126 return -EPERM;
3127 }
3128
3129 if (bs->backing) {
3130 /* Cannot be frozen, we checked that above */
3131 bdrv_unset_inherits_from(bs, bs->backing, tran);
3132 bdrv_remove_filter_or_cow_child(bs, tran);
3133 }
3134
3135 if (!backing_hd) {
3136 goto out;
3137 }
3138
3139 ret = bdrv_attach_child_noperm(bs, backing_hd, "backing",
3140 &child_of_bds, bdrv_backing_role(bs),
3141 &bs->backing, tran, errp);
3142 if (ret < 0) {
3143 return ret;
3144 }
3145
3146
3147 /*
3148 * If backing_hd was already part of bs's backing chain, and
3149 * inherits_from pointed recursively to bs then let's update it to
3150 * point directly to bs (else it will become NULL).
3151 */
3152 if (update_inherits_from) {
3153 bdrv_set_inherits_from(backing_hd, bs, tran);
3154 }
3155
3156 out:
3157 bdrv_refresh_limits(bs, tran, NULL);
3158
3159 return 0;
3160 }
3161
3162 int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
3163 Error **errp)
3164 {
3165 int ret;
3166 Transaction *tran = tran_new();
3167
3168 ret = bdrv_set_backing_noperm(bs, backing_hd, tran, errp);
3169 if (ret < 0) {
3170 goto out;
3171 }
3172
3173 ret = bdrv_refresh_perms(bs, errp);
3174 out:
3175 tran_finalize(tran, ret);
3176
3177 return ret;
3178 }
3179
3180 /*
3181 * Opens the backing file for a BlockDriverState if not yet open
3182 *
3183 * bdref_key specifies the key for the image's BlockdevRef in the options QDict.
3184 * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3185 * itself, all options starting with "${bdref_key}." are considered part of the
3186 * BlockdevRef.
3187 *
3188 * TODO Can this be unified with bdrv_open_image()?
3189 */
3190 int bdrv_open_backing_file(BlockDriverState *bs, QDict *parent_options,
3191 const char *bdref_key, Error **errp)
3192 {
3193 char *backing_filename = NULL;
3194 char *bdref_key_dot;
3195 const char *reference = NULL;
3196 int ret = 0;
3197 bool implicit_backing = false;
3198 BlockDriverState *backing_hd;
3199 QDict *options;
3200 QDict *tmp_parent_options = NULL;
3201 Error *local_err = NULL;
3202
3203 if (bs->backing != NULL) {
3204 goto free_exit;
3205 }
3206
3207 /* NULL means an empty set of options */
3208 if (parent_options == NULL) {
3209 tmp_parent_options = qdict_new();
3210 parent_options = tmp_parent_options;
3211 }
3212
3213 bs->open_flags &= ~BDRV_O_NO_BACKING;
3214
3215 bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3216 qdict_extract_subqdict(parent_options, &options, bdref_key_dot);
3217 g_free(bdref_key_dot);
3218
3219 /*
3220 * Caution: while qdict_get_try_str() is fine, getting non-string
3221 * types would require more care. When @parent_options come from
3222 * -blockdev or blockdev_add, its members are typed according to
3223 * the QAPI schema, but when they come from -drive, they're all
3224 * QString.
3225 */
3226 reference = qdict_get_try_str(parent_options, bdref_key);
3227 if (reference || qdict_haskey(options, "file.filename")) {
3228 /* keep backing_filename NULL */
3229 } else if (bs->backing_file[0] == '\0' && qdict_size(options) == 0) {
3230 qobject_unref(options);
3231 goto free_exit;
3232 } else {
3233 if (qdict_size(options) == 0) {
3234 /* If the user specifies options that do not modify the
3235 * backing file's behavior, we might still consider it the
3236 * implicit backing file. But it's easier this way, and
3237 * just specifying some of the backing BDS's options is
3238 * only possible with -drive anyway (otherwise the QAPI
3239 * schema forces the user to specify everything). */
3240 implicit_backing = !strcmp(bs->auto_backing_file, bs->backing_file);
3241 }
3242
3243 backing_filename = bdrv_get_full_backing_filename(bs, &local_err);
3244 if (local_err) {
3245 ret = -EINVAL;
3246 error_propagate(errp, local_err);
3247 qobject_unref(options);
3248 goto free_exit;
3249 }
3250 }
3251
3252 if (!bs->drv || !bs->drv->supports_backing) {
3253 ret = -EINVAL;
3254 error_setg(errp, "Driver doesn't support backing files");
3255 qobject_unref(options);
3256 goto free_exit;
3257 }
3258
3259 if (!reference &&
3260 bs->backing_format[0] != '\0' && !qdict_haskey(options, "driver")) {
3261 qdict_put_str(options, "driver", bs->backing_format);
3262 }
3263
3264 backing_hd = bdrv_open_inherit(backing_filename, reference, options, 0, bs,
3265 &child_of_bds, bdrv_backing_role(bs), errp);
3266 if (!backing_hd) {
3267 bs->open_flags |= BDRV_O_NO_BACKING;
3268 error_prepend(errp, "Could not open backing file: ");
3269 ret = -EINVAL;
3270 goto free_exit;
3271 }
3272
3273 if (implicit_backing) {
3274 bdrv_refresh_filename(backing_hd);
3275 pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
3276 backing_hd->filename);
3277 }
3278
3279 /* Hook up the backing file link; drop our reference, bs owns the
3280 * backing_hd reference now */
3281 ret = bdrv_set_backing_hd(bs, backing_hd, errp);
3282 bdrv_unref(backing_hd);
3283 if (ret < 0) {
3284 goto free_exit;
3285 }
3286
3287 qdict_del(parent_options, bdref_key);
3288
3289 free_exit:
3290 g_free(backing_filename);
3291 qobject_unref(tmp_parent_options);
3292 return ret;
3293 }
3294
3295 static BlockDriverState *
3296 bdrv_open_child_bs(const char *filename, QDict *options, const char *bdref_key,
3297 BlockDriverState *parent, const BdrvChildClass *child_class,
3298 BdrvChildRole child_role, bool allow_none, Error **errp)
3299 {
3300 BlockDriverState *bs = NULL;
3301 QDict *image_options;
3302 char *bdref_key_dot;
3303 const char *reference;
3304
3305 assert(child_class != NULL);
3306
3307 bdref_key_dot = g_strdup_printf("%s.", bdref_key);
3308 qdict_extract_subqdict(options, &image_options, bdref_key_dot);
3309 g_free(bdref_key_dot);
3310
3311 /*
3312 * Caution: while qdict_get_try_str() is fine, getting non-string
3313 * types would require more care. When @options come from
3314 * -blockdev or blockdev_add, its members are typed according to
3315 * the QAPI schema, but when they come from -drive, they're all
3316 * QString.
3317 */
3318 reference = qdict_get_try_str(options, bdref_key);
3319 if (!filename && !reference && !qdict_size(image_options)) {
3320 if (!allow_none) {
3321 error_setg(errp, "A block device must be specified for \"%s\"",
3322 bdref_key);
3323 }
3324 qobject_unref(image_options);
3325 goto done;
3326 }
3327
3328 bs = bdrv_open_inherit(filename, reference, image_options, 0,
3329 parent, child_class, child_role, errp);
3330 if (!bs) {
3331 goto done;
3332 }
3333
3334 done:
3335 qdict_del(options, bdref_key);
3336 return bs;
3337 }
3338
3339 /*
3340 * Opens a disk image whose options are given as BlockdevRef in another block
3341 * device's options.
3342 *
3343 * If allow_none is true, no image will be opened if filename is false and no
3344 * BlockdevRef is given. NULL will be returned, but errp remains unset.
3345 *
3346 * bdrev_key specifies the key for the image's BlockdevRef in the options QDict.
3347 * That QDict has to be flattened; therefore, if the BlockdevRef is a QDict
3348 * itself, all options starting with "${bdref_key}." are considered part of the
3349 * BlockdevRef.
3350 *
3351 * The BlockdevRef will be removed from the options QDict.
3352 */
3353 BdrvChild *bdrv_open_child(const char *filename,
3354 QDict *options, const char *bdref_key,
3355 BlockDriverState *parent,
3356 const BdrvChildClass *child_class,
3357 BdrvChildRole child_role,
3358 bool allow_none, Error **errp)
3359 {
3360 BlockDriverState *bs;
3361
3362 bs = bdrv_open_child_bs(filename, options, bdref_key, parent, child_class,
3363 child_role, allow_none, errp);
3364 if (bs == NULL) {
3365 return NULL;
3366 }
3367
3368 return bdrv_attach_child(parent, bs, bdref_key, child_class, child_role,
3369 errp);
3370 }
3371
3372 /*
3373 * TODO Future callers may need to specify parent/child_class in order for
3374 * option inheritance to work. Existing callers use it for the root node.
3375 */
3376 BlockDriverState *bdrv_open_blockdev_ref(BlockdevRef *ref, Error **errp)
3377 {
3378 BlockDriverState *bs = NULL;
3379 QObject *obj = NULL;
3380 QDict *qdict = NULL;
3381 const char *reference = NULL;
3382 Visitor *v = NULL;
3383
3384 if (ref->type == QTYPE_QSTRING) {
3385 reference = ref->u.reference;
3386 } else {
3387 BlockdevOptions *options = &ref->u.definition;
3388 assert(ref->type == QTYPE_QDICT);
3389
3390 v = qobject_output_visitor_new(&obj);
3391 visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
3392 visit_complete(v, &obj);
3393
3394 qdict = qobject_to(QDict, obj);
3395 qdict_flatten(qdict);
3396
3397 /* bdrv_open_inherit() defaults to the values in bdrv_flags (for
3398 * compatibility with other callers) rather than what we want as the
3399 * real defaults. Apply the defaults here instead. */
3400 qdict_set_default_str(qdict, BDRV_OPT_CACHE_DIRECT, "off");
3401 qdict_set_default_str(qdict, BDRV_OPT_CACHE_NO_FLUSH, "off");
3402 qdict_set_default_str(qdict, BDRV_OPT_READ_ONLY, "off");
3403 qdict_set_default_str(qdict, BDRV_OPT_AUTO_READ_ONLY, "off");
3404
3405 }
3406
3407 bs = bdrv_open_inherit(NULL, reference, qdict, 0, NULL, NULL, 0, errp);
3408 obj = NULL;
3409 qobject_unref(obj);
3410 visit_free(v);
3411 return bs;
3412 }
3413
3414 static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
3415 int flags,
3416 QDict *snapshot_options,
3417 Error **errp)
3418 {
3419 /* TODO: extra byte is a hack to ensure MAX_PATH space on Windows. */
3420 char *tmp_filename = g_malloc0(PATH_MAX + 1);
3421 int64_t total_size;
3422 QemuOpts *opts = NULL;
3423 BlockDriverState *bs_snapshot = NULL;
3424 int ret;
3425
3426 /* if snapshot, we create a temporary backing file and open it
3427 instead of opening 'filename' directly */
3428
3429 /* Get the required size from the image */
3430 total_size = bdrv_getlength(bs);
3431 if (total_size < 0) {
3432 error_setg_errno(errp, -total_size, "Could not get image size");
3433 goto out;
3434 }
3435
3436 /* Create the temporary image */
3437 ret = get_tmp_filename(tmp_filename, PATH_MAX + 1);
3438 if (ret < 0) {
3439 error_setg_errno(errp, -ret, "Could not get temporary filename");
3440 goto out;
3441 }
3442
3443 opts = qemu_opts_create(bdrv_qcow2.create_opts, NULL, 0,
3444 &error_abort);
3445 qemu_opt_set_number(opts, BLOCK_OPT_SIZE, total_size, &error_abort);
3446 ret = bdrv_create(&bdrv_qcow2, tmp_filename, opts, errp);
3447 qemu_opts_del(opts);
3448 if (ret < 0) {
3449 error_prepend(errp, "Could not create temporary overlay '%s': ",
3450 tmp_filename);
3451 goto out;
3452 }
3453
3454 /* Prepare options QDict for the temporary file */
3455 qdict_put_str(snapshot_options, "file.driver", "file");
3456 qdict_put_str(snapshot_options, "file.filename", tmp_filename);
3457 qdict_put_str(snapshot_options, "driver", "qcow2");
3458
3459 bs_snapshot = bdrv_open(NULL, NULL, snapshot_options, flags, errp);
3460 snapshot_options = NULL;
3461 if (!bs_snapshot) {
3462 goto out;
3463 }
3464
3465 ret = bdrv_append(bs_snapshot, bs, errp);
3466 if (ret < 0) {
3467 bs_snapshot = NULL;
3468 goto out;
3469 }
3470
3471 out:
3472 qobject_unref(snapshot_options);
3473 g_free(tmp_filename);
3474 return bs_snapshot;
3475 }
3476
3477 /*
3478 * Opens a disk image (raw, qcow2, vmdk, ...)
3479 *
3480 * options is a QDict of options to pass to the block drivers, or NULL for an
3481 * empty set of options. The reference to the QDict belongs to the block layer
3482 * after the call (even on failure), so if the caller intends to reuse the
3483 * dictionary, it needs to use qobject_ref() before calling bdrv_open.
3484 *
3485 * If *pbs is NULL, a new BDS will be created with a pointer to it stored there.
3486 * If it is not NULL, the referenced BDS will be reused.
3487 *
3488 * The reference parameter may be used to specify an existing block device which
3489 * should be opened. If specified, neither options nor a filename may be given,
3490 * nor can an existing BDS be reused (that is, *pbs has to be NULL).
3491 */
3492 static BlockDriverState *bdrv_open_inherit(const char *filename,
3493 const char *reference,
3494 QDict *options, int flags,
3495 BlockDriverState *parent,
3496 const BdrvChildClass *child_class,
3497 BdrvChildRole child_role,
3498 Error **errp)
3499 {
3500 int ret;
3501 BlockBackend *file = NULL;
3502 BlockDriverState *bs;
3503 BlockDriver *drv = NULL;
3504 BdrvChild *child;
3505 const char *drvname;
3506 const char *backing;
3507 Error *local_err = NULL;
3508 QDict *snapshot_options = NULL;
3509 int snapshot_flags = 0;
3510
3511 assert(!child_class || !flags);
3512 assert(!child_class == !parent);
3513
3514 if (reference) {
3515 bool options_non_empty = options ? qdict_size(options) : false;
3516 qobject_unref(options);
3517
3518 if (filename || options_non_empty) {
3519 error_setg(errp, "Cannot reference an existing block device with "
3520 "additional options or a new filename");
3521 return NULL;
3522 }
3523
3524 bs = bdrv_lookup_bs(reference, reference, errp);
3525 if (!bs) {
3526 return NULL;
3527 }
3528
3529 bdrv_ref(bs);
3530 return bs;
3531 }
3532
3533 bs = bdrv_new();
3534
3535 /* NULL means an empty set of options */
3536 if (options == NULL) {
3537 options = qdict_new();
3538 }
3539
3540 /* json: syntax counts as explicit options, as if in the QDict */
3541 parse_json_protocol(options, &filename, &local_err);
3542 if (local_err) {
3543 goto fail;
3544 }
3545
3546 bs->explicit_options = qdict_clone_shallow(options);
3547
3548 if (child_class) {
3549 bool parent_is_format;
3550
3551 if (parent->drv) {
3552 parent_is_format = parent->drv->is_format;
3553 } else {
3554 /*
3555 * parent->drv is not set yet because this node is opened for
3556 * (potential) format probing. That means that @parent is going
3557 * to be a format node.
3558 */
3559 parent_is_format = true;
3560 }
3561
3562 bs->inherits_from = parent;
3563 child_class->inherit_options(child_role, parent_is_format,
3564 &flags, options,
3565 parent->open_flags, parent->options);
3566 }
3567
3568 ret = bdrv_fill_options(&options, filename, &flags, &local_err);
3569 if (ret < 0) {
3570 goto fail;
3571 }
3572
3573 /*
3574 * Set the BDRV_O_RDWR and BDRV_O_ALLOW_RDWR flags.
3575 * Caution: getting a boolean member of @options requires care.
3576 * When @options come from -blockdev or blockdev_add, members are
3577 * typed according to the QAPI schema, but when they come from
3578 * -drive, they're all QString.
3579 */
3580 if (g_strcmp0(qdict_get_try_str(options, BDRV_OPT_READ_ONLY), "on") &&
3581 !qdict_get_try_bool(options, BDRV_OPT_READ_ONLY, false)) {
3582 flags |= (BDRV_O_RDWR | BDRV_O_ALLOW_RDWR);
3583 } else {
3584 flags &= ~BDRV_O_RDWR;
3585 }
3586
3587 if (flags & BDRV_O_SNAPSHOT) {
3588 snapshot_options = qdict_new();
3589 bdrv_temp_snapshot_options(&snapshot_flags, snapshot_options,
3590 flags, options);
3591 /* Let bdrv_backing_options() override "read-only" */
3592 qdict_del(options, BDRV_OPT_READ_ONLY);
3593 bdrv_inherited_options(BDRV_CHILD_COW, true,
3594 &flags, options, flags, options);
3595 }
3596
3597 bs->open_flags = flags;
3598 bs->options = options;
3599 options = qdict_clone_shallow(options);
3600
3601 /* Find the right image format driver */
3602 /* See cautionary note on accessing @options above */
3603 drvname = qdict_get_try_str(options, "driver");
3604 if (drvname) {
3605 drv = bdrv_find_format(drvname);
3606 if (!drv) {
3607 error_setg(errp, "Unknown driver: '%s'", drvname);
3608 goto fail;
3609 }
3610 }
3611
3612 assert(drvname || !(flags & BDRV_O_PROTOCOL));
3613
3614 /* See cautionary note on accessing @options above */
3615 backing = qdict_get_try_str(options, "backing");
3616 if (qobject_to(QNull, qdict_get(options, "backing")) != NULL ||
3617 (backing && *backing == '\0'))
3618 {
3619 if (backing) {
3620 warn_report("Use of \"backing\": \"\" is deprecated; "
3621 "use \"backing\": null instead");
3622 }
3623 flags |= BDRV_O_NO_BACKING;
3624 qdict_del(bs->explicit_options, "backing");
3625 qdict_del(bs->options, "backing");
3626 qdict_del(options, "backing");
3627 }
3628
3629 /* Open image file without format layer. This BlockBackend is only used for
3630 * probing, the block drivers will do their own bdrv_open_child() for the
3631 * same BDS, which is why we put the node name back into options. */
3632 if ((flags & BDRV_O_PROTOCOL) == 0) {
3633 BlockDriverState *file_bs;
3634
3635 file_bs = bdrv_open_child_bs(filename, options, "file", bs,
3636 &child_of_bds, BDRV_CHILD_IMAGE,
3637 true, &local_err);
3638 if (local_err) {
3639 goto fail;
3640 }
3641 if (file_bs != NULL) {
3642 /* Not requesting BLK_PERM_CONSISTENT_READ because we're only
3643 * looking at the header to guess the image format. This works even
3644 * in cases where a guest would not see a consistent state. */
3645 file = blk_new(bdrv_get_aio_context(file_bs), 0, BLK_PERM_ALL);
3646 blk_insert_bs(file, file_bs, &local_err);
3647 bdrv_unref(file_bs);
3648 if (local_err) {
3649 goto fail;
3650 }
3651
3652 qdict_put_str(options, "file", bdrv_get_node_name(file_bs));
3653 }
3654 }
3655
3656 /* Image format probing */
3657 bs->probed = !drv;
3658 if (!drv && file) {
3659 ret = find_image_format(file, filename, &drv, &local_err);
3660 if (ret < 0) {
3661 goto fail;
3662 }
3663 /*
3664 * This option update would logically belong in bdrv_fill_options(),
3665 * but we first need to open bs->file for the probing to work, while
3666 * opening bs->file already requires the (mostly) final set of options
3667 * so that cache mode etc. can be inherited.
3668 *
3669 * Adding the driver later is somewhat ugly, but it's not an option
3670 * that would ever be inherited, so it's correct. We just need to make
3671 * sure to update both bs->options (which has the full effective
3672 * options for bs) and options (which has file.* already removed).
3673 */
3674 qdict_put_str(bs->options, "driver", drv->format_name);
3675 qdict_put_str(options, "driver", drv->format_name);
3676 } else if (!drv) {
3677 error_setg(errp, "Must specify either driver or file");
3678 goto fail;
3679 }
3680
3681 /* BDRV_O_PROTOCOL must be set iff a protocol BDS is about to be created */
3682 assert(!!(flags & BDRV_O_PROTOCOL) == !!drv->bdrv_file_open);
3683 /* file must be NULL if a protocol BDS is about to be created
3684 * (the inverse results in an error message from bdrv_open_common()) */
3685 assert(!(flags & BDRV_O_PROTOCOL) || !file);
3686
3687 /* Open the image */
3688 ret = bdrv_open_common(bs, file, options, &local_err);
3689 if (ret < 0) {
3690 goto fail;
3691 }
3692
3693 if (file) {
3694 blk_unref(file);
3695 file = NULL;
3696 }
3697
3698 /* If there is a backing file, use it */
3699 if ((flags & BDRV_O_NO_BACKING) == 0) {
3700 ret = bdrv_open_backing_file(bs, options, "backing", &local_err);
3701 if (ret < 0) {
3702 goto close_and_fail;
3703 }
3704 }
3705
3706 /* Remove all children options and references
3707 * from bs->options and bs->explicit_options */
3708 QLIST_FOREACH(child, &bs->children, next) {
3709 char *child_key_dot;
3710 child_key_dot = g_strdup_printf("%s.", child->name);
3711 qdict_extract_subqdict(bs->explicit_options, NULL, child_key_dot);
3712 qdict_extract_subqdict(bs->options, NULL, child_key_dot);
3713 qdict_del(bs->explicit_options, child->name);
3714 qdict_del(bs->options, child->name);
3715 g_free(child_key_dot);
3716 }
3717
3718 /* Check if any unknown options were used */
3719 if (qdict_size(options) != 0) {
3720 const QDictEntry *entry = qdict_first(options);
3721 if (flags & BDRV_O_PROTOCOL) {
3722 error_setg(errp, "Block protocol '%s' doesn't support the option "
3723 "'%s'", drv->format_name, entry->key);
3724 } else {
3725 error_setg(errp,
3726 "Block format '%s' does not support the option '%s'",
3727 drv->format_name, entry->key);
3728 }
3729
3730 goto close_and_fail;
3731 }
3732
3733 bdrv_parent_cb_change_media(bs, true);
3734
3735 qobject_unref(options);
3736 options = NULL;
3737
3738 /* For snapshot=on, create a temporary qcow2 overlay. bs points to the
3739 * temporary snapshot afterwards. */
3740 if (snapshot_flags) {
3741 BlockDriverState *snapshot_bs;
3742 snapshot_bs = bdrv_append_temp_snapshot(bs, snapshot_flags,
3743 snapshot_options, &local_err);
3744 snapshot_options = NULL;
3745 if (local_err) {
3746 goto close_and_fail;
3747 }
3748 /* We are not going to return bs but the overlay on top of it
3749 * (snapshot_bs); thus, we have to drop the strong reference to bs
3750 * (which we obtained by calling bdrv_new()). bs will not be deleted,
3751 * though, because the overlay still has a reference to it. */
3752 bdrv_unref(bs);
3753 bs = snapshot_bs;
3754 }
3755
3756 return bs;
3757
3758 fail:
3759 blk_unref(file);
3760 qobject_unref(snapshot_options);
3761 qobject_unref(bs->explicit_options);
3762 qobject_unref(bs->options);
3763 qobject_unref(options);
3764 bs->options = NULL;
3765 bs->explicit_options = NULL;
3766 bdrv_unref(bs);
3767 error_propagate(errp, local_err);
3768 return NULL;
3769
3770 close_and_fail:
3771 bdrv_unref(bs);
3772 qobject_unref(snapshot_options);
3773 qobject_unref(options);
3774 error_propagate(errp, local_err);
3775 return NULL;
3776 }
3777
3778 BlockDriverState *bdrv_open(const char *filename, const char *reference,
3779 QDict *options, int flags, Error **errp)
3780 {
3781 return bdrv_open_inherit(filename, reference, options, flags, NULL,
3782 NULL, 0, errp);
3783 }
3784
3785 /* Return true if the NULL-terminated @list contains @str */
3786 static bool is_str_in_list(const char *str, const char *const *list)
3787 {
3788 if (str && list) {
3789 int i;
3790 for (i = 0; list[i] != NULL; i++) {
3791 if (!strcmp(str, list[i])) {
3792 return true;
3793 }
3794 }
3795 }
3796 return false;
3797 }
3798
3799 /*
3800 * Check that every option set in @bs->options is also set in
3801 * @new_opts.
3802 *
3803 * Options listed in the common_options list and in
3804 * @bs->drv->mutable_opts are skipped.
3805 *
3806 * Return 0 on success, otherwise return -EINVAL and set @errp.
3807 */
3808 static int bdrv_reset_options_allowed(BlockDriverState *bs,
3809 const QDict *new_opts, Error **errp)
3810 {
3811 const QDictEntry *e;
3812 /* These options are common to all block drivers and are handled
3813 * in bdrv_reopen_prepare() so they can be left out of @new_opts */
3814 const char *const common_options[] = {
3815 "node-name", "discard", "cache.direct", "cache.no-flush",
3816 "read-only", "auto-read-only", "detect-zeroes", NULL
3817 };
3818
3819 for (e = qdict_first(bs->options); e; e = qdict_next(bs->options, e)) {
3820 if (!qdict_haskey(new_opts, e->key) &&
3821 !is_str_in_list(e->key, common_options) &&
3822 !is_str_in_list(e->key, bs->drv->mutable_opts)) {
3823 error_setg(errp, "Option '%s' cannot be reset "
3824 "to its default value", e->key);
3825 return -EINVAL;
3826 }
3827 }
3828
3829 return 0;
3830 }
3831
3832 /*
3833 * Returns true if @child can be reached recursively from @bs
3834 */
3835 static bool bdrv_recurse_has_child(BlockDriverState *bs,
3836 BlockDriverState *child)
3837 {
3838 BdrvChild *c;
3839
3840 if (bs == child) {
3841 return true;
3842 }
3843
3844 QLIST_FOREACH(c, &bs->children, next) {
3845 if (bdrv_recurse_has_child(c->bs, child)) {
3846 return true;
3847 }
3848 }
3849
3850 return false;
3851 }
3852
3853 /*
3854 * Adds a BlockDriverState to a simple queue for an atomic, transactional
3855 * reopen of multiple devices.
3856 *
3857 * bs_queue can either be an existing BlockReopenQueue that has had QTAILQ_INIT
3858 * already performed, or alternatively may be NULL a new BlockReopenQueue will
3859 * be created and initialized. This newly created BlockReopenQueue should be
3860 * passed back in for subsequent calls that are intended to be of the same
3861 * atomic 'set'.
3862 *
3863 * bs is the BlockDriverState to add to the reopen queue.
3864 *
3865 * options contains the changed options for the associated bs
3866 * (the BlockReopenQueue takes ownership)
3867 *
3868 * flags contains the open flags for the associated bs
3869 *
3870 * returns a pointer to bs_queue, which is either the newly allocated
3871 * bs_queue, or the existing bs_queue being used.
3872 *
3873 * bs must be drained between bdrv_reopen_queue() and bdrv_reopen_multiple().
3874 */
3875 static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
3876 BlockDriverState *bs,
3877 QDict *options,
3878 const BdrvChildClass *klass,
3879 BdrvChildRole role,
3880 bool parent_is_format,
3881 QDict *parent_options,
3882 int parent_flags,
3883 bool keep_old_opts)
3884 {
3885 assert(bs != NULL);
3886
3887 BlockReopenQueueEntry *bs_entry;
3888 BdrvChild *child;
3889 QDict *old_options, *explicit_options, *options_copy;
3890 int flags;
3891 QemuOpts *opts;
3892
3893 /* Make sure that the caller remembered to use a drained section. This is
3894 * important to avoid graph changes between the recursive queuing here and
3895 * bdrv_reopen_multiple(). */
3896 assert(bs->quiesce_counter > 0);
3897
3898 if (bs_queue == NULL) {
3899 bs_queue = g_new0(BlockReopenQueue, 1);
3900 QTAILQ_INIT(bs_queue);
3901 }
3902
3903 if (!options) {
3904 options = qdict_new();
3905 }
3906
3907 /* Check if this BlockDriverState is already in the queue */
3908 QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
3909 if (bs == bs_entry->state.bs) {
3910 break;
3911 }
3912 }
3913
3914 /*
3915 * Precedence of options:
3916 * 1. Explicitly passed in options (highest)
3917 * 2. Retained from explicitly set options of bs
3918 * 3. Inherited from parent node
3919 * 4. Retained from effective options of bs
3920 */
3921
3922 /* Old explicitly set values (don't overwrite by inherited value) */
3923 if (bs_entry || keep_old_opts) {
3924 old_options = qdict_clone_shallow(bs_entry ?
3925 bs_entry->state.explicit_options :
3926 bs->explicit_options);
3927 bdrv_join_options(bs, options, old_options);
3928 qobject_unref(old_options);
3929 }
3930
3931 explicit_options = qdict_clone_shallow(options);
3932
3933 /* Inherit from parent node */
3934 if (parent_options) {
3935 flags = 0;
3936 klass->inherit_options(role, parent_is_format, &flags, options,
3937 parent_flags, parent_options);
3938 } else {
3939 flags = bdrv_get_flags(bs);
3940 }
3941
3942 if (keep_old_opts) {
3943 /* Old values are used for options that aren't set yet */
3944 old_options = qdict_clone_shallow(bs->options);
3945 bdrv_join_options(bs, options, old_options);
3946 qobject_unref(old_options);
3947 }
3948
3949 /* We have the final set of options so let's update the flags */
3950 options_copy = qdict_clone_shallow(options);
3951 opts = qemu_opts_create(&bdrv_runtime_opts, NULL, 0, &error_abort);
3952 qemu_opts_absorb_qdict(opts, options_copy, NULL);
3953 update_flags_from_options(&flags, opts);
3954 qemu_opts_del(opts);
3955 qobject_unref(options_copy);
3956
3957 /* bdrv_open_inherit() sets and clears some additional flags internally */
3958 flags &= ~BDRV_O_PROTOCOL;
3959 if (flags & BDRV_O_RDWR) {
3960 flags |= BDRV_O_ALLOW_RDWR;
3961 }
3962
3963 if (!bs_entry) {
3964 bs_entry = g_new0(BlockReopenQueueEntry, 1);
3965 QTAILQ_INSERT_TAIL(bs_queue, bs_entry, entry);
3966 } else {
3967 qobject_unref(bs_entry->state.options);
3968 qobject_unref(bs_entry->state.explicit_options);
3969 }
3970
3971 bs_entry->state.bs = bs;
3972 bs_entry->state.options = options;
3973 bs_entry->state.explicit_options = explicit_options;
3974 bs_entry->state.flags = flags;
3975
3976 /*
3977 * If keep_old_opts is false then it means that unspecified
3978 * options must be reset to their original value. We don't allow
3979 * resetting 'backing' but we need to know if the option is
3980 * missing in order to decide if we have to return an error.
3981 */
3982 if (!keep_old_opts) {
3983 bs_entry->state.backing_missing =
3984 !qdict_haskey(options, "backing") &&
3985 !qdict_haskey(options, "backing.driver");
3986 }
3987
3988 QLIST_FOREACH(child, &bs->children, next) {
3989 QDict *new_child_options = NULL;
3990 bool child_keep_old = keep_old_opts;
3991
3992 /* reopen can only change the options of block devices that were
3993 * implicitly created and inherited options. For other (referenced)
3994 * block devices, a syntax like "backing.foo" results in an error. */
3995 if (child->bs->inherits_from != bs) {
3996 continue;
3997 }
3998
3999 /* Check if the options contain a child reference */
4000 if (qdict_haskey(options, child->name)) {
4001 const char *childref = qdict_get_try_str(options, child->name);
4002 /*
4003 * The current child must not be reopened if the child
4004 * reference is null or points to a different node.
4005 */
4006 if (g_strcmp0(childref, child->bs->node_name)) {
4007 continue;
4008 }
4009 /*
4010 * If the child reference points to the current child then
4011 * reopen it with its existing set of options (note that
4012 * it can still inherit new options from the parent).
4013 */
4014 child_keep_old = true;
4015 } else {
4016 /* Extract child options ("child-name.*") */
4017 char *child_key_dot = g_strdup_printf("%s.", child->name);
4018 qdict_extract_subqdict(explicit_options, NULL, child_key_dot);
4019 qdict_extract_subqdict(options, &new_child_options, child_key_dot);
4020 g_free(child_key_dot);
4021 }
4022
4023 bdrv_reopen_queue_child(bs_queue, child->bs, new_child_options,
4024 child->klass, child->role, bs->drv->is_format,
4025 options, flags, child_keep_old);
4026 }
4027
4028 return bs_queue;
4029 }
4030
4031 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
4032 BlockDriverState *bs,
4033 QDict *options, bool keep_old_opts)
4034 {
4035 return bdrv_reopen_queue_child(bs_queue, bs, options, NULL, 0, false,
4036 NULL, 0, keep_old_opts);
4037 }
4038
4039 /*
4040 * Reopen multiple BlockDriverStates atomically & transactionally.
4041 *
4042 * The queue passed in (bs_queue) must have been built up previous
4043 * via bdrv_reopen_queue().
4044 *
4045 * Reopens all BDS specified in the queue, with the appropriate
4046 * flags. All devices are prepared for reopen, and failure of any
4047 * device will cause all device changes to be abandoned, and intermediate
4048 * data cleaned up.
4049 *
4050 * If all devices prepare successfully, then the changes are committed
4051 * to all devices.
4052 *
4053 * All affected nodes must be drained between bdrv_reopen_queue() and
4054 * bdrv_reopen_multiple().
4055 */
4056 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
4057 {
4058 int ret = -1;
4059 BlockReopenQueueEntry *bs_entry, *next;
4060 Transaction *tran = tran_new();
4061 g_autoptr(GHashTable) found = NULL;
4062 g_autoptr(GSList) refresh_list = NULL;
4063
4064 assert(bs_queue != NULL);
4065
4066 QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4067 ret = bdrv_flush(bs_entry->state.bs);
4068 if (ret < 0) {
4069 error_setg_errno(errp, -ret, "Error flushing drive");
4070 goto abort;
4071 }
4072 }
4073
4074 QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
4075 assert(bs_entry->state.bs->quiesce_counter > 0);
4076 ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
4077 if (ret < 0) {
4078 goto abort;
4079 }
4080 bs_entry->prepared = true;
4081 }
4082