Series comparison

-[Qemu-devel] [PULL 0/5] Block layer patches
+[PULL 00/28] Block layer patches
-The following changes since commit a395717cbd26e7593d3c3fe81faca121ec6d13e8:
+The following changes since commit 9db3065c62a983286d06c207f4981408cf42184d:
-  Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2018-07-03 11:49:51 +0100)
+  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-6.1-pull-request' into staging (2021-07-08 16:30:18 +0100)
-are available in the git repository at:
+are available in the Git repository at:
   git://repo.or.cz/qemu/kevin.git tags/for-upstream
-for you to fetch changes up to 59738025a1674bb7e07713c3c93ff4fb9c5079f5:
+for you to fetch changes up to e60edf69e2f64e818466019313517a2e6d6b63f4:
-  block: Add blklogwrites (2018-07-03 16:09:48 +0200)
+  block: Make blockdev-reopen stable API (2021-07-09 13:19:11 +0200)
 ----------------------------------------------------------------
-Block layer patches:
+Block layer patches
-- qcow2: Use worker threads for compression to improve performance of
+- Make blockdev-reopen stable
-  'qemu-img convert -W' and compressed backup jobs
+- Remove deprecated qemu-img backing file without format
-- blklogwrites: New filter driver to log write requests to an image in
+- rbd: Convert to coroutines and add write zeroes support
-  the dm-log-writes format
+- rbd: Updated MAINTAINERS
 - export/fuse: Allow other users access to the export
 - vhost-user: Fix backends without multiqueue support
 - Fix drive-backup transaction endless drained section
 ----------------------------------------------------------------
-Aapo Vienamo (1):
+Alberto Garcia (4):
-      block: Add blklogwrites
+      block: Add bdrv_reopen_queue_free()
       block: Support multiple reopening with x-blockdev-reopen
       iotests: Test reopening multiple devices at the same time
       block: Make blockdev-reopen stable API
-Ari Sundholm (1):
+Eric Blake (3):
-      block: Move two block permission constants to the relevant enum
+      qcow2: Prohibit backing file changes in 'qemu-img amend'
       qemu-img: Require -F with -b backing image
       qemu-img: Improve error for rebase without backing format
-Vladimir Sementsov-Ogievskiy (3):
+Heinrich Schuchardt (1):
-      qemu-img: allow compressed not-in-order writes
+      util/uri: do not check argument of uri_free()
       qcow2: refactor data compression
       qcow2: add compress threads
- qapi/block-core.json  |  33 ++++-
+Ilya Dryomov (1):
- block/qcow2.h         |   3 +
+      MAINTAINERS: update block/rbd.c maintainer
  include/block/block.h |   7 +
  block.c               |   6 -
  block/blklogwrites.c  | 392 ++++++++++++++++++++++++++++++++++++++++++++++++++
  block/qcow2.c         | 136 ++++++++++++++----
  qemu-img.c            |   5 -
  MAINTAINERS           |   6 +
  block/Makefile.objs   |   1 +
 files changed, 545 insertions(+), 44 deletions(-)
  create mode 100644 block/blklogwrites.c
+Kevin Wolf (3):
+      vhost-user: Fix backends without multiqueue support
+      qcow2: Fix dangling pointer after reopen for 'file'
+      block: Acquire AioContexts during bdrv_reopen_multiple()
+Max Reitz (6):
+      export/fuse: Pass default_permissions for mount
+      export/fuse: Add allow-other option
+      export/fuse: Give SET_ATTR_SIZE its own branch
+      export/fuse: Let permissions be adjustable
+      iotests/308: Test +w on read-only FUSE exports
+      iotests/fuse-allow-other: Test allow-other
+Or Ozeri (1):
+      block/rbd: Add support for rbd image encryption
+Peter Lieven (8):
+      block/rbd: bump librbd requirement to luminous release
+      block/rbd: store object_size in BDRVRBDState
+      block/rbd: update s->image_size in qemu_rbd_getlength
+      block/rbd: migrate from aio to coroutines
+      block/rbd: add write zeroes support
+      block/rbd: drop qemu_rbd_refresh_limits
+      block/rbd: fix type of task->complete
+      MAINTAINERS: add block/rbd.c reviewer
+Vladimir Sementsov-Ogievskiy (1):
+      blockdev: fix drive-backup transaction endless drained section
+ qapi/block-core.json                               | 134 +++-
+ qapi/block-export.json                             |  33 +-
+ docs/system/deprecated.rst                         |  32 -
+ docs/system/removed-features.rst                   |  31 +
+ include/block/block.h                              |   3 +
+ block.c                                            | 108 +--
+ block/export/fuse.c                                | 121 +++-
+ block/nfs.c                                        |   4 +-
+ block/qcow2.c                                      |  42 +-
+ block/rbd.c                                        | 749 +++++++++++++--------
+ block/replication.c                                |   7 +
+ block/ssh.c                                        |   4 +-
+ blockdev.c                                         |  77 ++-
+ hw/virtio/vhost-user.c                             |   3 +
+ qemu-img.c                                         |   9 +-
+ qemu-io-cmds.c                                     |   7 +-
+ util/uri.c                                         |  22 +-
+ MAINTAINERS                                        |   3 +-
+ meson.build                                        |   7 +-
+ tests/qemu-iotests/040                             |   4 +-
+ tests/qemu-iotests/041                             |   6 +-
+ tests/qemu-iotests/061                             |   3 +
+ tests/qemu-iotests/061.out                         |   3 +-
+ tests/qemu-iotests/082.out                         |   6 +-
+ tests/qemu-iotests/114                             |  18 +-
+ tests/qemu-iotests/114.out                         |  11 +-
+ tests/qemu-iotests/155                             |   9 +-
+ tests/qemu-iotests/165                             |   4 +-
+ tests/qemu-iotests/245                             |  78 ++-
+ tests/qemu-iotests/245.out                         |   4 +-
+ tests/qemu-iotests/248                             |   4 +-
+ tests/qemu-iotests/248.out                         |   2 +-
+ tests/qemu-iotests/296                             |  11 +-
+ tests/qemu-iotests/298                             |   4 +-
+ tests/qemu-iotests/301                             |   4 +-
+ tests/qemu-iotests/301.out                         |  16 +-
+ tests/qemu-iotests/308                             |  20 +-
+ tests/qemu-iotests/308.out                         |   6 +-
+ tests/qemu-iotests/common.rc                       |   6 +-
+ tests/qemu-iotests/tests/fuse-allow-other          | 168 +++++
+ tests/qemu-iotests/tests/fuse-allow-other.out      |  88 +++
+ .../qemu-iotests/tests/remove-bitmap-from-backing  |  22 +-
+files changed, 1350 insertions(+), 543 deletions(-)
+ create mode 100755 tests/qemu-iotests/tests/fuse-allow-other
+ create mode 100644 tests/qemu-iotests/tests/fuse-allow-other.out

-New patch
+[PULL 01/28] MAINTAINERS: update block/rbd.c maintainer
+From: Ilya Dryomov <idryomov@gmail.com>
+Jason has moved on from working on RBD and Ceph.  I'm taking over
+his role upstream.
+Signed-off-by: Ilya Dryomov <idryomov@gmail.com>
+Message-Id: <20210519112513.19694-1-idryomov@gmail.com>
+Acked-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ MAINTAINERS | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ S: Supported
+ F: block/vmdk.c
+ RBD
+-M: Jason Dillaman <dillaman@redhat.com>
++M: Ilya Dryomov <idryomov@gmail.com>
+ L: qemu-block@nongnu.org
+ S: Supported
+ F: block/rbd.c
+--
+.31.1

-[Qemu-devel] [PULL 5/5] block: Add blklogwrites
+[PULL 02/28] block/rbd: Add support for rbd image encryption
-From: Aapo Vienamo <aapo@tuxera.com>
+From: Or Ozeri <oro@il.ibm.com>
-Implements a block device write logging system, similar to Linux kernel
+Starting from ceph Pacific, RBD has built-in support for image-level encryption.
-device mapper dm-log-writes. The write operations that are performed
+Currently supported formats are LUKS version 1 and 2.
-on a block device are logged to a file or another block device. The
-write log format is identical to the dm-log-writes format. Currently,
+There are 2 new relevant librbd APIs for controlling encryption, both expect an
-log markers are not supported.
+open image context:
-This functionality can be used for crash consistency and fs consistency
+rbd_encryption_format: formats an image (i.e. writes the LUKS header)
-testing. By implementing it in qemu, tests utilizing write logs can be
+rbd_encryption_load: loads encryptor/decryptor to the image IO stack
-be used to test non-Linux drivers and older kernels.
+This commit extends the qemu rbd driver API to support the above.
-The driver accepts an optional parameter to set the sector size used
-for logging. This makes the driver require all requests to be aligned
+Signed-off-by: Or Ozeri <oro@il.ibm.com>
-to this sector size and also makes offsets and sizes of writes in the
+Message-Id: <20210627114635.39326-1-oro@il.ibm.com>
-log metadata to be expressed in terms of this value (the log format has
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
 a granularity of one sector for offsets and sizes). This allows
 accurate logging of writes to guest block devices that have unusual
 sector sizes.
 The implementation is based on the blkverify and blkdebug block
 drivers.
 Signed-off-by: Aapo Vienamo <aapo@tuxera.com>
 Signed-off-by: Ari Sundholm <ari@tuxera.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- qapi/block-core.json |  33 ++++-
+ qapi/block-core.json | 110 ++++++++++++-
- block/blklogwrites.c | 392 +++++++++++++++++++++++++++++++++++++++++++++++++++
+ block/rbd.c          | 361 ++++++++++++++++++++++++++++++++++++++++++-
- MAINTAINERS          |   6 +
+files changed, 465 insertions(+), 6 deletions(-)
  block/Makefile.objs  |   1 +
 files changed, 426 insertions(+), 6 deletions(-)
  create mode 100644 block/blklogwrites.c
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
 @@ -XXX,XX +XXX,XX @@
- # @throttle: Since 2.11
+       'extents': ['ImageInfo']
- # @nvme: Since 2.12
+   } }
- # @copy-on-read: Since 3.0
-+# @blklogwrites: Since 3.0
++##
 +# @ImageInfoSpecificRbd:
 +#
 +# @encryption-format: Image encryption format
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'ImageInfoSpecificRbd',
 +  'data': {
 +      '*encryption-format': 'RbdImageEncryptionFormat'
 +  } }
 +
  ##
  # @ImageInfoSpecific:
  #
- # Since: 2.9
+@@ -XXX,XX +XXX,XX @@
        # If we need to add block driver specific parameters for
        # LUKS in future, then we'll subclass QCryptoBlockInfoLUKS
        # to define a ImageInfoSpecificLUKS
 -      'luks': 'QCryptoBlockInfoLUKS'
 +      'luks': 'QCryptoBlockInfoLUKS',
 +      'rbd': 'ImageInfoSpecificRbd'
    } }
  ##
- { 'enum': 'BlockdevDriver',
+@@ -XXX,XX +XXX,XX @@
--  'data': [ 'blkdebug', 'blkverify', 'bochs', 'cloop', 'copy-on-read',
+ { 'enum': 'RbdAuthMode',
--            'dmg', 'file', 'ftp', 'ftps', 'gluster', 'host_cdrom',
+   'data': [ 'cephx', 'none' ] }
--            'host_device', 'http', 'https', 'iscsi', 'luks', 'nbd', 'nfs',
--            'null-aio', 'null-co', 'nvme', 'parallels', 'qcow', 'qcow2', 'qed',
++##
--            'quorum', 'raw', 'rbd', 'replication', 'sheepdog', 'ssh',
++# @RbdImageEncryptionFormat:
--            'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat', 'vxhs' ] }
++#
-+  'data': [ 'blkdebug', 'blklogwrites', 'blkverify', 'bochs', 'cloop',
++# Since: 6.1
-+            'copy-on-read', 'dmg', 'file', 'ftp', 'ftps', 'gluster',
++##
-+            'host_cdrom', 'host_device', 'http', 'https', 'iscsi', 'luks',
++{ 'enum': 'RbdImageEncryptionFormat',
-+            'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels', 'qcow',
++  'data': [ 'luks', 'luks2' ] }
-+            'qcow2', 'qed', 'quorum', 'raw', 'rbd', 'replication', 'sheepdog',
++
-+            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat', 'vxhs' ] }
++##
++# @RbdEncryptionOptionsLUKSBase:
 +#
 +# @key-secret: ID of a QCryptoSecret object providing a passphrase
 +#              for unlocking the encryption
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'RbdEncryptionOptionsLUKSBase',
 +  'data': { 'key-secret': 'str' } }
 +
 +##
 +# @RbdEncryptionCreateOptionsLUKSBase:
 +#
 +# @cipher-alg: The encryption algorithm
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'RbdEncryptionCreateOptionsLUKSBase',
 +  'base': 'RbdEncryptionOptionsLUKSBase',
 +  'data': { '*cipher-alg': 'QCryptoCipherAlgorithm' } }
 +
 +##
 +# @RbdEncryptionOptionsLUKS:
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'RbdEncryptionOptionsLUKS',
 +  'base': 'RbdEncryptionOptionsLUKSBase',
 +  'data': { } }
 +
 +##
 +# @RbdEncryptionOptionsLUKS2:
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'RbdEncryptionOptionsLUKS2',
 +  'base': 'RbdEncryptionOptionsLUKSBase',
 +  'data': { } }
 +
 +##
 +# @RbdEncryptionCreateOptionsLUKS:
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'RbdEncryptionCreateOptionsLUKS',
 +  'base': 'RbdEncryptionCreateOptionsLUKSBase',
 +  'data': { } }
 +
 +##
 +# @RbdEncryptionCreateOptionsLUKS2:
 +#
 +# Since: 6.1
 +##
 +{ 'struct': 'RbdEncryptionCreateOptionsLUKS2',
 +  'base': 'RbdEncryptionCreateOptionsLUKSBase',
 +  'data': { } }
 +
 +##
 +# @RbdEncryptionOptions:
 +#
 +# Since: 6.1
 +##
 +{ 'union': 'RbdEncryptionOptions',
 +  'base': { 'format': 'RbdImageEncryptionFormat' },
 +  'discriminator': 'format',
 +  'data': { 'luks': 'RbdEncryptionOptionsLUKS',
 +            'luks2': 'RbdEncryptionOptionsLUKS2' } }
 +
 +##
 +# @RbdEncryptionCreateOptions:
 +#
 +# Since: 6.1
 +##
 +{ 'union': 'RbdEncryptionCreateOptions',
 +  'base': { 'format': 'RbdImageEncryptionFormat' },
 +  'discriminator': 'format',
 +  'data': { 'luks': 'RbdEncryptionCreateOptionsLUKS',
 +            'luks2': 'RbdEncryptionCreateOptionsLUKS2' } }
 +
  ##
- # @BlockdevOptionsFile:
+ # @BlockdevOptionsRbd:
  #
 @@ -XXX,XX +XXX,XX @@
-             '*set-state': ['BlkdebugSetStateOptions'] } }
+ #
+ # @snapshot: Ceph snapshot name.
  #
 +# @encrypt: Image encryption options. (Since 6.1)
 +#
  # @user: Ceph id name.
  #
  # @auth-client-required: Acceptable authentication modes.
@@ -XXX,XX +XXX,XX @@
              'image': 'str',
              '*conf': 'str',
              '*snapshot': 'str',
 +            '*encrypt': 'RbdEncryptionOptions',
              '*user': 'str',
              '*auth-client-required': ['RbdAuthMode'],
              '*key-secret': 'str',
@@ -XXX,XX +XXX,XX @@
  #            point to a snapshot.
  # @size: Size of the virtual disk in bytes
  # @cluster-size: RBD object size
 +# @encrypt: Image encryption options. (Since 6.1)
  #
  # Since: 2.12
  ##
-+# @BlockdevOptionsBlklogwrites:
+ { 'struct': 'BlockdevCreateOptionsRbd',
-+#
+   'data': { 'location':         'BlockdevOptionsRbd',
-+# Driver specific block device options for blklogwrites.
+             'size':             'size',
-+#
+-            '*cluster-size' :   'size' } }
-+# @file:            block device
++            '*cluster-size' :   'size',
-+#
++            '*encrypt' :        'RbdEncryptionCreateOptions' } }
-+# @log:             block device used to log writes to @file
-+#
+ ##
-+# @log-sector-size: sector size used in logging writes to @file, determines
+ # @BlockdevVmdkSubformat:
-+#                   granularity of offsets and sizes of writes (default: 512)
+diff --git a/block/rbd.c b/block/rbd.c
-+#
+index XXXXXXX..XXXXXXX 100644
-+# Since: 3.0
+--- a/block/rbd.c
-+##
++++ b/block/rbd.c
 +{ 'struct': 'BlockdevOptionsBlklogwrites',
 +  'data': { 'file': 'BlockdevRef',
 +            'log': 'BlockdevRef',
 +            '*log-sector-size': 'uint32' } }
 +
 +##
  # @BlockdevOptionsBlkverify:
  #
  # Driver specific block device options for blkverify.
 @@ -XXX,XX +XXX,XX @@
-   'discriminator': 'driver',
+ #define LIBRBD_USE_IOVEC 0
-   'data': {
+ #endif
-       'blkdebug':   'BlockdevOptionsBlkdebug',
-+      'blklogwrites':'BlockdevOptionsBlklogwrites',
++#define RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN 8
-       'blkverify':  'BlockdevOptionsBlkverify',
++
-       'bochs':      'BlockdevOptionsGenericFormat',
++static const char rbd_luks_header_verification[
-       'cloop':      'BlockdevOptionsGenericFormat',
++        RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {
-diff --git a/block/blklogwrites.c b/block/blklogwrites.c
++    'L', 'U', 'K', 'S', 0xBA, 0xBE, 0, 1
-new file mode 100644
++};
-index XXXXXXX..XXXXXXX
++
---- /dev/null
++static const char rbd_luks2_header_verification[
-+++ b/block/blklogwrites.c
++        RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {
-@@ -XXX,XX +XXX,XX @@
++    'L', 'U', 'K', 'S', 0xBA, 0xBE, 0, 2
-+/*
++};
-+ * Write logging blk driver based on blkverify and blkdebug.
++
-+ *
+ typedef enum {
-+ * Copyright (c) 2017 Tuomas Tynkkynen <tuomas@tuxera.com>
+     RBD_AIO_READ,
-+ * Copyright (c) 2018 Aapo Vienamo <aapo@tuxera.com>
+     RBD_AIO_WRITE,
-+ * Copyright (c) 2018 Ari Sundholm <ari@tuxera.com>
+@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
-+ *
+     }
-+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ }
-+ * See the COPYING file in the top-level directory.
-+ */
++#ifdef LIBRBD_SUPPORTS_ENCRYPTION
-+
++static int qemu_rbd_convert_luks_options(
-+#include "qemu/osdep.h"
++        RbdEncryptionOptionsLUKSBase *luks_opts,
-+#include "qapi/error.h"
++        char **passphrase,
-+#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
++        size_t *passphrase_len,
-+#include "block/block_int.h"
++        Error **errp)
 +#include "qapi/qmp/qdict.h"
 +#include "qapi/qmp/qstring.h"
 +#include "qemu/cutils.h"
 +#include "qemu/option.h"
 +
 +/* Disk format stuff - taken from Linux drivers/md/dm-log-writes.c */
 +
 +#define LOG_FLUSH_FLAG   (1 << 0)
 +#define LOG_FUA_FLAG     (1 << 1)
 +#define LOG_DISCARD_FLAG (1 << 2)
 +#define LOG_MARK_FLAG    (1 << 3)
 +
 +#define WRITE_LOG_VERSION 1ULL
 +#define WRITE_LOG_MAGIC 0x6a736677736872ULL
 +
 +/* All fields are little-endian. */
 +struct log_write_super {
 +    uint64_t magic;
 +    uint64_t version;
 +    uint64_t nr_entries;
 +    uint32_t sectorsize;
 +} QEMU_PACKED;
 +
 +struct log_write_entry {
 +    uint64_t sector;
 +    uint64_t nr_sectors;
 +    uint64_t flags;
 +    uint64_t data_len;
 +} QEMU_PACKED;
 +
 +/* End of disk format structures. */
 +
 +typedef struct {
 +    BdrvChild *log_file;
 +    uint32_t sectorsize;
 +    uint32_t sectorbits;
 +    uint64_t cur_log_sector;
 +    uint64_t nr_entries;
 +} BDRVBlkLogWritesState;
 +
 +static inline uint32_t blk_log_writes_log2(uint32_t value)
 +{
-+    assert(value > 0);
++    return qcrypto_secret_lookup(luks_opts->key_secret, (uint8_t **)passphrase,
-+    return 31 - clz32(value);
++                                 passphrase_len, errp);
 +}
 +
-+static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
++static int qemu_rbd_convert_luks_create_options(
-+                               Error **errp)
++        RbdEncryptionCreateOptionsLUKSBase *luks_opts,
 +        rbd_encryption_algorithm_t *alg,
 +        char **passphrase,
 +        size_t *passphrase_len,
 +        Error **errp)
 +{
-+    BDRVBlkLogWritesState *s = bs->opaque;
++    int r = 0;
-+    Error *local_err = NULL;
++
-+    int ret;
++    r = qemu_rbd_convert_luks_options(
-+    int64_t log_sector_size = BDRV_SECTOR_SIZE;
++            qapi_RbdEncryptionCreateOptionsLUKSBase_base(luks_opts),
-+
++            passphrase, passphrase_len, errp);
-+    /* Open the file */
++    if (r < 0) {
-+    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, false,
++        return r;
-+                               &local_err);
++    }
-+    if (local_err) {
++
 +    if (luks_opts->has_cipher_alg) {
 +        switch (luks_opts->cipher_alg) {
 +            case QCRYPTO_CIPHER_ALG_AES_128: {
 +                *alg = RBD_ENCRYPTION_ALGORITHM_AES128;
 +                break;
 +            }
 +            case QCRYPTO_CIPHER_ALG_AES_256: {
 +                *alg = RBD_ENCRYPTION_ALGORITHM_AES256;
 +                break;
 +            }
 +            default: {
 +                r = -ENOTSUP;
 +                error_setg_errno(errp, -r, "unknown encryption algorithm: %u",
 +                                 luks_opts->cipher_alg);
 +                return r;
 +            }
 +        }
 +    } else {
 +        /* default alg */
 +        *alg = RBD_ENCRYPTION_ALGORITHM_AES256;
 +    }
 +
 +    return 0;
 +}
 +
 +static int qemu_rbd_encryption_format(rbd_image_t image,
 +                                      RbdEncryptionCreateOptions *encrypt,
 +                                      Error **errp)
 +{
 +    int r = 0;
 +    g_autofree char *passphrase = NULL;
 +    size_t passphrase_len;
 +    rbd_encryption_format_t format;
 +    rbd_encryption_options_t opts;
 +    rbd_encryption_luks1_format_options_t luks_opts;
 +    rbd_encryption_luks2_format_options_t luks2_opts;
 +    size_t opts_size;
 +    uint64_t raw_size, effective_size;
 +
 +    r = rbd_get_size(image, &raw_size);
 +    if (r < 0) {
 +        error_setg_errno(errp, -r, "cannot get raw image size");
 +        return r;
 +    }
 +
 +    switch (encrypt->format) {
 +        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS: {
 +            memset(&luks_opts, 0, sizeof(luks_opts));
 +            format = RBD_ENCRYPTION_FORMAT_LUKS1;
 +            opts = &luks_opts;
 +            opts_size = sizeof(luks_opts);
 +            r = qemu_rbd_convert_luks_create_options(
 +                    qapi_RbdEncryptionCreateOptionsLUKS_base(&encrypt->u.luks),
 +                    &luks_opts.alg, &passphrase, &passphrase_len, errp);
 +            if (r < 0) {
 +                return r;
 +            }
 +            luks_opts.passphrase = passphrase;
 +            luks_opts.passphrase_size = passphrase_len;
 +            break;
 +        }
 +        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2: {
 +            memset(&luks2_opts, 0, sizeof(luks2_opts));
 +            format = RBD_ENCRYPTION_FORMAT_LUKS2;
 +            opts = &luks2_opts;
 +            opts_size = sizeof(luks2_opts);
 +            r = qemu_rbd_convert_luks_create_options(
 +                    qapi_RbdEncryptionCreateOptionsLUKS2_base(
 +                            &encrypt->u.luks2),
 +                    &luks2_opts.alg, &passphrase, &passphrase_len, errp);
 +            if (r < 0) {
 +                return r;
 +            }
 +            luks2_opts.passphrase = passphrase;
 +            luks2_opts.passphrase_size = passphrase_len;
 +            break;
 +        }
 +        default: {
 +            r = -ENOTSUP;
 +            error_setg_errno(
 +                    errp, -r, "unknown image encryption format: %u",
 +                    encrypt->format);
 +            return r;
 +        }
 +    }
 +
 +    r = rbd_encryption_format(image, format, opts, opts_size);
 +    if (r < 0) {
 +        error_setg_errno(errp, -r, "encryption format fail");
 +        return r;
 +    }
 +
 +    r = rbd_get_size(image, &effective_size);
 +    if (r < 0) {
 +        error_setg_errno(errp, -r, "cannot get effective image size");
 +        return r;
 +    }
 +
 +    r = rbd_resize(image, raw_size + (raw_size - effective_size));
 +    if (r < 0) {
 +        error_setg_errno(errp, -r, "cannot resize image after format");
 +        return r;
 +    }
 +
 +    return 0;
 +}
 +
 +static int qemu_rbd_encryption_load(rbd_image_t image,
 +                                    RbdEncryptionOptions *encrypt,
 +                                    Error **errp)
 +{
 +    int r = 0;
 +    g_autofree char *passphrase = NULL;
 +    size_t passphrase_len;
 +    rbd_encryption_luks1_format_options_t luks_opts;
 +    rbd_encryption_luks2_format_options_t luks2_opts;
 +    rbd_encryption_format_t format;
 +    rbd_encryption_options_t opts;
 +    size_t opts_size;
 +
 +    switch (encrypt->format) {
 +        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS: {
 +            memset(&luks_opts, 0, sizeof(luks_opts));
 +            format = RBD_ENCRYPTION_FORMAT_LUKS1;
 +            opts = &luks_opts;
 +            opts_size = sizeof(luks_opts);
 +            r = qemu_rbd_convert_luks_options(
 +                    qapi_RbdEncryptionOptionsLUKS_base(&encrypt->u.luks),
 +                    &passphrase, &passphrase_len, errp);
 +            if (r < 0) {
 +                return r;
 +            }
 +            luks_opts.passphrase = passphrase;
 +            luks_opts.passphrase_size = passphrase_len;
 +            break;
 +        }
 +        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2: {
 +            memset(&luks2_opts, 0, sizeof(luks2_opts));
 +            format = RBD_ENCRYPTION_FORMAT_LUKS2;
 +            opts = &luks2_opts;
 +            opts_size = sizeof(luks2_opts);
 +            r = qemu_rbd_convert_luks_options(
 +                    qapi_RbdEncryptionOptionsLUKS2_base(&encrypt->u.luks2),
 +                    &passphrase, &passphrase_len, errp);
 +            if (r < 0) {
 +                return r;
 +            }
 +            luks2_opts.passphrase = passphrase;
 +            luks2_opts.passphrase_size = passphrase_len;
 +            break;
 +        }
 +        default: {
 +            r = -ENOTSUP;
 +            error_setg_errno(
 +                    errp, -r, "unknown image encryption format: %u",
 +                    encrypt->format);
 +            return r;
 +        }
 +    }
 +
 +    r = rbd_encryption_load(image, format, opts, opts_size);
 +    if (r < 0) {
 +        error_setg_errno(errp, -r, "encryption load fail");
 +        return r;
 +    }
 +
 +    return 0;
 +}
 +#endif
 +
  /* FIXME Deprecate and remove keypairs or make it available in QMP. */
  static int qemu_rbd_do_create(BlockdevCreateOptions *options,
                                const char *keypairs, const char *password_secret,
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_do_create(BlockdevCreateOptions *options,
          return -EINVAL;
      }
 +#ifndef LIBRBD_SUPPORTS_ENCRYPTION
 +    if (opts->has_encrypt) {
 +        error_setg(errp, "RBD library does not support image encryption");
 +        return -ENOTSUP;
 +    }
 +#endif
 +
      if (opts->has_cluster_size) {
          int64_t objsize = opts->cluster_size;
          if ((objsize - 1) & objsize) {    /* not a power of 2? */
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_do_create(BlockdevCreateOptions *options,
          goto out;
      }
 +#ifdef LIBRBD_SUPPORTS_ENCRYPTION
 +    if (opts->has_encrypt) {
 +        rbd_image_t image;
 +
 +        ret = rbd_open(io_ctx, opts->location->image, &image, NULL);
 +        if (ret < 0) {
 +            error_setg_errno(errp, -ret,
 +                             "error opening image '%s' for encryption format",
 +                             opts->location->image);
 +            goto out;
 +        }
 +
 +        ret = qemu_rbd_encryption_format(image, opts->encrypt, errp);
 +        rbd_close(image);
 +        if (ret < 0) {
 +            /* encryption format fail, try removing the image */
 +            rbd_remove(io_ctx, opts->location->image);
 +            goto out;
 +        }
 +    }
 +#endif
 +
      ret = 0;
  out:
      rados_ioctx_destroy(io_ctx);
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_co_create(BlockdevCreateOptions *options, Error **errp)
      return qemu_rbd_do_create(options, NULL, NULL, errp);
  }
 +static int qemu_rbd_extract_encryption_create_options(
 +        QemuOpts *opts,
 +        RbdEncryptionCreateOptions **spec,
 +        Error **errp)
 +{
 +    QDict *opts_qdict;
 +    QDict *encrypt_qdict;
 +    Visitor *v;
 +    int ret = 0;
 +
 +    opts_qdict = qemu_opts_to_qdict(opts, NULL);
 +    qdict_extract_subqdict(opts_qdict, &encrypt_qdict, "encrypt.");
 +    qobject_unref(opts_qdict);
 +    if (!qdict_size(encrypt_qdict)) {
 +        *spec = NULL;
 +        goto exit;
 +    }
 +
 +    /* Convert options into a QAPI object */
 +    v = qobject_input_visitor_new_flat_confused(encrypt_qdict, errp);
 +    if (!v) {
 +        ret = -EINVAL;
-+        error_propagate(errp, local_err);
++        goto exit;
-+        goto fail;
++    }
-+    }
++
-+
++    visit_type_RbdEncryptionCreateOptions(v, NULL, spec, errp);
-+    if (qdict_haskey(options, "log-sector-size")) {
++    visit_free(v);
-+        log_sector_size = qdict_get_int(options, "log-sector-size");
++    if (!*spec) {
 +        qdict_del(options, "log-sector-size");
 +    }
 +
 +    if (log_sector_size < 0 || log_sector_size >= (1ull << 32) ||
 +        !is_power_of_2(log_sector_size))
 +    {
 +        ret = -EINVAL;
-+        error_setg(errp, "Invalid log sector size %"PRId64, log_sector_size);
++        goto exit;
-+        goto fail;
++    }
-+    }
++
-+
++exit:
-+    s->sectorsize = log_sector_size;
++    qobject_unref(encrypt_qdict);
 +    s->sectorbits = blk_log_writes_log2(log_sector_size);
 +    s->cur_log_sector = 1;
 +    s->nr_entries = 0;
 +
 +    /* Open the log file */
 +    s->log_file = bdrv_open_child(NULL, options, "log", bs, &child_file, false,
 +                                  &local_err);
 +    if (local_err) {
 +        ret = -EINVAL;
 +        error_propagate(errp, local_err);
 +        goto fail;
 +    }
 +
 +    ret = 0;
 +fail:
 +    if (ret < 0) {
 +        bdrv_unref_child(bs, bs->file);
 +        bs->file = NULL;
 +    }
 +    return ret;
 +}
 +
-+static void blk_log_writes_close(BlockDriverState *bs)
+ static int coroutine_fn qemu_rbd_co_create_opts(BlockDriver *drv,
                                                  const char *filename,
                                                  QemuOpts *opts,
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_create_opts(BlockDriver *drv,
      BlockdevCreateOptions *create_options;
      BlockdevCreateOptionsRbd *rbd_opts;
      BlockdevOptionsRbd *loc;
 +    RbdEncryptionCreateOptions *encrypt = NULL;
      Error *local_err = NULL;
      const char *keypairs, *password_secret;
      QDict *options = NULL;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_create_opts(BlockDriver *drv,
          goto exit;
      }
 +    ret = qemu_rbd_extract_encryption_create_options(opts, &encrypt, errp);
 +    if (ret < 0) {
 +        goto exit;
 +    }
 +    rbd_opts->encrypt     = encrypt;
 +    rbd_opts->has_encrypt = !!encrypt;
 +
      /*
       * Caution: while qdict_get_try_str() is fine, getting non-string
       * types would require more care.  When @options come from -blockdev
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
          goto failed_open;
      }
 +    if (opts->has_encrypt) {
 +#ifdef LIBRBD_SUPPORTS_ENCRYPTION
 +        r = qemu_rbd_encryption_load(s->image, opts->encrypt, errp);
 +        if (r < 0) {
 +            goto failed_post_open;
 +        }
 +#else
 +        r = -ENOTSUP;
 +        error_setg(errp, "RBD library does not support image encryption");
 +        goto failed_post_open;
 +#endif
 +    }
 +
      r = rbd_get_size(s->image, &s->image_size);
      if (r < 0) {
          error_setg_errno(errp, -r, "error getting image size from %s",
                           s->image_name);
 -        rbd_close(s->image);
 -        goto failed_open;
 +        goto failed_post_open;
      }
      /* If we are using an rbd snapshot, we must be r/o, otherwise
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
      if (s->snap != NULL) {
          r = bdrv_apply_auto_read_only(bs, "rbd snapshots are read-only", errp);
          if (r < 0) {
 -            rbd_close(s->image);
 -            goto failed_open;
 +            goto failed_post_open;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
      r = 0;
      goto out;
 +failed_post_open:
 +    rbd_close(s->image);
  failed_open:
      rados_ioctx_destroy(s->io_ctx);
      g_free(s->snap);
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
      return 0;
  }
 +static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
 +                                                     Error **errp)
 +{
-+    BDRVBlkLogWritesState *s = bs->opaque;
++    BDRVRBDState *s = bs->opaque;
-+
++    ImageInfoSpecific *spec_info;
-+    bdrv_unref_child(bs, s->log_file);
++    char buf[RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {0};
-+    s->log_file = NULL;
++    int r;
 +
 +    if (s->image_size >= RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) {
 +        r = rbd_read(s->image, 0,
 +                     RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN, buf);
 +        if (r < 0) {
 +            error_setg_errno(errp, -r, "cannot read image start for probe");
 +            return NULL;
 +        }
 +    }
 +
 +    spec_info = g_new(ImageInfoSpecific, 1);
 +    *spec_info = (ImageInfoSpecific){
 +        .type  = IMAGE_INFO_SPECIFIC_KIND_RBD,
 +        .u.rbd.data = g_new0(ImageInfoSpecificRbd, 1),
 +    };
 +
 +    if (memcmp(buf, rbd_luks_header_verification,
 +               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
 +        spec_info->u.rbd.data->encryption_format =
 +                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
 +        spec_info->u.rbd.data->has_encryption_format = true;
 +    } else if (memcmp(buf, rbd_luks2_header_verification,
 +               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
 +        spec_info->u.rbd.data->encryption_format =
 +                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
 +        spec_info->u.rbd.data->has_encryption_format = true;
 +    } else {
 +        spec_info->u.rbd.data->has_encryption_format = false;
 +    }
 +
 +    return spec_info;
 +}
 +
-+static int64_t blk_log_writes_getlength(BlockDriverState *bs)
+ static int64_t qemu_rbd_getlength(BlockDriverState *bs)
-+{
+ {
-+    return bdrv_getlength(bs->file->bs);
+     BDRVRBDState *s = bs->opaque;
-+}
+@@ -XXX,XX +XXX,XX @@ static QemuOptsList qemu_rbd_create_opts = {
-+
+             .type = QEMU_OPT_STRING,
-+static void blk_log_writes_refresh_filename(BlockDriverState *bs,
+             .help = "ID of secret providing the password",
-+                                            QDict *options)
+         },
-+{
++        {
-+    BDRVBlkLogWritesState *s = bs->opaque;
++            .name = "encrypt.format",
-+
++            .type = QEMU_OPT_STRING,
-+    /* bs->file->bs has already been refreshed */
++            .help = "Encrypt the image, format choices: 'luks', 'luks2'",
 +    bdrv_refresh_filename(s->log_file->bs);
 +
 +    if (bs->file->bs->full_open_options
 +        && s->log_file->bs->full_open_options)
 +    {
 +        QDict *opts = qdict_new();
 +        qdict_put_str(opts, "driver", "blklogwrites");
 +
 +        qobject_ref(bs->file->bs->full_open_options);
 +        qdict_put_obj(opts, "file", QOBJECT(bs->file->bs->full_open_options));
 +        qobject_ref(s->log_file->bs->full_open_options);
 +        qdict_put_obj(opts, "log",
 +                      QOBJECT(s->log_file->bs->full_open_options));
 +
 +        bs->full_open_options = opts;
 +    }
 +}
 +
 +static void blk_log_writes_child_perm(BlockDriverState *bs, BdrvChild *c,
 +                                      const BdrvChildRole *role,
 +                                      BlockReopenQueue *ro_q,
 +                                      uint64_t perm, uint64_t shrd,
 +                                      uint64_t *nperm, uint64_t *nshrd)
 +{
 +    if (!c) {
 +        *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
 +        *nshrd = (shrd & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
 +        return;
 +    }
 +
 +    if (!strcmp(c->name, "log")) {
 +        bdrv_format_default_perms(bs, c, role, ro_q, perm, shrd, nperm, nshrd);
 +    } else {
 +        bdrv_filter_default_perms(bs, c, role, ro_q, perm, shrd, nperm, nshrd);
 +    }
 +}
 +
 +static void blk_log_writes_refresh_limits(BlockDriverState *bs, Error **errp)
 +{
 +    BDRVBlkLogWritesState *s = bs->opaque;
 +    bs->bl.request_alignment = s->sectorsize;
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
 +                         QEMUIOVector *qiov, int flags)
 +{
 +    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
 +}
 +
 +typedef struct BlkLogWritesFileReq {
 +    BlockDriverState *bs;
 +    uint64_t offset;
 +    uint64_t bytes;
 +    int file_flags;
 +    QEMUIOVector *qiov;
 +    int (*func)(struct BlkLogWritesFileReq *r);
 +    int file_ret;
 +} BlkLogWritesFileReq;
 +
 +typedef struct {
 +    BlockDriverState *bs;
 +    QEMUIOVector *qiov;
 +    struct log_write_entry entry;
 +    uint64_t zero_size;
 +    int log_ret;
 +} BlkLogWritesLogReq;
 +
 +static void coroutine_fn blk_log_writes_co_do_log(BlkLogWritesLogReq *lr)
 +{
 +    BDRVBlkLogWritesState *s = lr->bs->opaque;
 +    uint64_t cur_log_offset = s->cur_log_sector << s->sectorbits;
 +
 +    s->nr_entries++;
 +    s->cur_log_sector +=
 +            ROUND_UP(lr->qiov->size, s->sectorsize) >> s->sectorbits;
 +
 +    lr->log_ret = bdrv_co_pwritev(s->log_file, cur_log_offset, lr->qiov->size,
 +                                  lr->qiov, 0);
 +
 +    /* Logging for the "write zeroes" operation */
 +    if (lr->log_ret == 0 && lr->zero_size) {
 +        cur_log_offset = s->cur_log_sector << s->sectorbits;
 +        s->cur_log_sector +=
 +                ROUND_UP(lr->zero_size, s->sectorsize) >> s->sectorbits;
 +
 +        lr->log_ret = bdrv_co_pwrite_zeroes(s->log_file, cur_log_offset,
 +                                            lr->zero_size, 0);
 +    }
 +
 +    /* Update super block on flush */
 +    if (lr->log_ret == 0 && lr->entry.flags & LOG_FLUSH_FLAG) {
 +        struct log_write_super super = {
 +            .magic      = cpu_to_le64(WRITE_LOG_MAGIC),
 +            .version    = cpu_to_le64(WRITE_LOG_VERSION),
 +            .nr_entries = cpu_to_le64(s->nr_entries),
 +            .sectorsize = cpu_to_le32(s->sectorsize),
 +        };
 +        void *zeroes = g_malloc0(s->sectorsize - sizeof(super));
 +        QEMUIOVector qiov;
 +
 +        qemu_iovec_init(&qiov, 2);
 +        qemu_iovec_add(&qiov, &super, sizeof(super));
 +        qemu_iovec_add(&qiov, zeroes, s->sectorsize - sizeof(super));
 +
 +        lr->log_ret =
 +            bdrv_co_pwritev(s->log_file, 0, s->sectorsize, &qiov, 0);
 +        if (lr->log_ret == 0) {
 +            lr->log_ret = bdrv_co_flush(s->log_file->bs);
 +        }
 +        qemu_iovec_destroy(&qiov);
 +        g_free(zeroes);
 +    }
 +}
 +
 +static void coroutine_fn blk_log_writes_co_do_file(BlkLogWritesFileReq *fr)
 +{
 +    fr->file_ret = fr->func(fr);
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_log(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
 +                      QEMUIOVector *qiov, int flags,
 +                      int (*file_func)(BlkLogWritesFileReq *r),
 +                      uint64_t entry_flags, bool is_zero_write)
 +{
 +    QEMUIOVector log_qiov;
 +    size_t niov = qiov ? qiov->niov : 0;
 +    BDRVBlkLogWritesState *s = bs->opaque;
 +    BlkLogWritesFileReq fr = {
 +        .bs         = bs,
 +        .offset     = offset,
 +        .bytes      = bytes,
 +        .file_flags = flags,
 +        .qiov       = qiov,
 +        .func       = file_func,
 +    };
 +    BlkLogWritesLogReq lr = {
 +        .bs             = bs,
 +        .qiov           = &log_qiov,
 +        .entry = {
 +            .sector     = cpu_to_le64(offset >> s->sectorbits),
 +            .nr_sectors = cpu_to_le64(bytes >> s->sectorbits),
 +            .flags      = cpu_to_le64(entry_flags),
 +            .data_len   = 0,
 +        },
-+        .zero_size = is_zero_write ? bytes : 0,
++        {
-+    };
++            .name = "encrypt.cipher-alg",
-+    void *zeroes = g_malloc0(s->sectorsize - sizeof(lr.entry));
++            .type = QEMU_OPT_STRING,
-+
++            .help = "Name of encryption cipher algorithm"
-+    assert((1 << s->sectorbits) == s->sectorsize);
++                    " (allowed values: aes-128, aes-256)",
-+    assert(bs->bl.request_alignment == s->sectorsize);
++        },
-+    assert(QEMU_IS_ALIGNED(offset, bs->bl.request_alignment));
++        {
-+    assert(QEMU_IS_ALIGNED(bytes, bs->bl.request_alignment));
++            .name = "encrypt.key-secret",
-+
++            .type = QEMU_OPT_STRING,
-+    qemu_iovec_init(&log_qiov, niov + 2);
++            .help = "ID of secret providing LUKS passphrase",
-+    qemu_iovec_add(&log_qiov, &lr.entry, sizeof(lr.entry));
++        },
-+    qemu_iovec_add(&log_qiov, zeroes, s->sectorsize - sizeof(lr.entry));
+         { /* end of list */ }
-+    if (qiov) {
+     }
-+        qemu_iovec_concat(&log_qiov, qiov, 0, qiov->size);
+ };
-+    }
+@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
-+
+     .bdrv_co_create_opts    = qemu_rbd_co_create_opts,
-+    blk_log_writes_co_do_file(&fr);
+     .bdrv_has_zero_init     = bdrv_has_zero_init_1,
-+    blk_log_writes_co_do_log(&lr);
+     .bdrv_get_info          = qemu_rbd_getinfo,
-+
++    .bdrv_get_specific_info = qemu_rbd_get_specific_info,
-+    qemu_iovec_destroy(&log_qiov);
+     .create_opts            = &qemu_rbd_create_opts,
-+    g_free(zeroes);
+     .bdrv_getlength         = qemu_rbd_getlength,
-+
+     .bdrv_co_truncate       = qemu_rbd_co_truncate,
 +    if (lr.log_ret < 0) {
 +        return lr.log_ret;
 +    }
 +
 +    return fr.file_ret;
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_do_file_pwritev(BlkLogWritesFileReq *fr)
 +{
 +    return bdrv_co_pwritev(fr->bs->file, fr->offset, fr->bytes,
 +                           fr->qiov, fr->file_flags);
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_do_file_pwrite_zeroes(BlkLogWritesFileReq *fr)
 +{
 +    return bdrv_co_pwrite_zeroes(fr->bs->file, fr->offset, fr->bytes,
 +                                 fr->file_flags);
 +}
 +
 +static int coroutine_fn blk_log_writes_co_do_file_flush(BlkLogWritesFileReq *fr)
 +{
 +    return bdrv_co_flush(fr->bs->file->bs);
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_do_file_pdiscard(BlkLogWritesFileReq *fr)
 +{
 +    return bdrv_co_pdiscard(fr->bs->file->bs, fr->offset, fr->bytes);
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
 +                          QEMUIOVector *qiov, int flags)
 +{
 +    return blk_log_writes_co_log(bs, offset, bytes, qiov, flags,
 +                                 blk_log_writes_co_do_file_pwritev, 0, false);
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int bytes,
 +                                BdrvRequestFlags flags)
 +{
 +    return blk_log_writes_co_log(bs, offset, bytes, NULL, flags,
 +                                 blk_log_writes_co_do_file_pwrite_zeroes, 0,
 +                                 true);
 +}
 +
 +static int coroutine_fn blk_log_writes_co_flush_to_disk(BlockDriverState *bs)
 +{
 +    return blk_log_writes_co_log(bs, 0, 0, NULL, 0,
 +                                 blk_log_writes_co_do_file_flush,
 +                                 LOG_FLUSH_FLAG, false);
 +}
 +
 +static int coroutine_fn
 +blk_log_writes_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
 +{
 +    return blk_log_writes_co_log(bs, offset, count, NULL, 0,
 +                                 blk_log_writes_co_do_file_pdiscard,
 +                                 LOG_DISCARD_FLAG, false);
 +}
 +
 +static BlockDriver bdrv_blk_log_writes = {
 +    .format_name            = "blklogwrites",
 +    .instance_size          = sizeof(BDRVBlkLogWritesState),
 +
 +    .bdrv_open              = blk_log_writes_open,
 +    .bdrv_close             = blk_log_writes_close,
 +    .bdrv_getlength         = blk_log_writes_getlength,
 +    .bdrv_refresh_filename  = blk_log_writes_refresh_filename,
 +    .bdrv_child_perm        = blk_log_writes_child_perm,
 +    .bdrv_refresh_limits    = blk_log_writes_refresh_limits,
 +
 +    .bdrv_co_preadv         = blk_log_writes_co_preadv,
 +    .bdrv_co_pwritev        = blk_log_writes_co_pwritev,
 +    .bdrv_co_pwrite_zeroes  = blk_log_writes_co_pwrite_zeroes,
 +    .bdrv_co_flush_to_disk  = blk_log_writes_co_flush_to_disk,
 +    .bdrv_co_pdiscard       = blk_log_writes_co_pdiscard,
 +    .bdrv_co_block_status   = bdrv_co_block_status_from_file,
 +
 +    .is_filter              = true,
 +};
 +
 +static void bdrv_blk_log_writes_init(void)
 +{
 +    bdrv_register(&bdrv_blk_log_writes);
 +}
 +
 +block_init(bdrv_blk_log_writes_init);
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Supported
  F: block/quorum.c
  L: qemu-block@nongnu.org
 +blklogwrites
 +M: Ari Sundholm <ari@tuxera.com>
 +L: qemu-block@nongnu.org
 +S: Supported
 +F: block/blklogwrites.c
 +
  blkverify
  M: Stefan Hajnoczi <stefanha@redhat.com>
  L: qemu-block@nongnu.org
 diff --git a/block/Makefile.objs b/block/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/block/Makefile.objs
 +++ b/block/Makefile.objs
@@ -XXX,XX +XXX,XX @@ block-obj-y += qed-check.o
  block-obj-y += vhdx.o vhdx-endian.o vhdx-log.o
  block-obj-y += quorum.o
  block-obj-y += parallels.o blkdebug.o blkverify.o blkreplay.o
 +block-obj-y += blklogwrites.o
  block-obj-y += block-backend.o snapshot.o qapi.o
  block-obj-$(CONFIG_WIN32) += file-win32.o win32-aio.o
  block-obj-$(CONFIG_POSIX) += file-posix.o
 --
-.13.6
+.31.1

-New patch
+[PULL 03/28] block/rbd: bump librbd requirement to luminous release
+From: Peter Lieven <pl@kamp.de>
 Ceph Luminous (version 12.2.z) is almost 4 years old at this point.
 Bump the requirement to get rid of the ifdef'ry in the code.
 Qemu 6.1 dropped the support for RHEL-7 which was the last supported
 OS that required an older librbd.
 Signed-off-by: Peter Lieven <pl@kamp.de>
 Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
 Message-Id: <20210702172356.11574-2-idryomov@gmail.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  block/rbd.c | 120 ++++------------------------------------------------
  meson.build |   7 ++-
 files changed, 13 insertions(+), 114 deletions(-)
 diff --git a/block/rbd.c b/block/rbd.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/rbd.c
 +++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@
   * leading "\".
   */
 -/* rbd_aio_discard added in 0.1.2 */
 -#if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 2)
 -#define LIBRBD_SUPPORTS_DISCARD
 -#else
 -#undef LIBRBD_SUPPORTS_DISCARD
 -#endif
 -
  #define OBJ_MAX_SIZE (1UL << OBJ_DEFAULT_OBJ_ORDER)
  #define RBD_MAX_SNAPS 100
 -/* The LIBRBD_SUPPORTS_IOVEC is defined in librbd.h */
 -#ifdef LIBRBD_SUPPORTS_IOVEC
 -#define LIBRBD_USE_IOVEC 1
 -#else
 -#define LIBRBD_USE_IOVEC 0
 -#endif
 -
  #define RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN 8
  static const char rbd_luks_header_verification[
@@ -XXX,XX +XXX,XX @@ typedef struct RBDAIOCB {
      BlockAIOCB common;
      int64_t ret;
      QEMUIOVector *qiov;
 -    char *bounce;
      RBDAIOCmd cmd;
      int error;
      struct BDRVRBDState *s;
@@ -XXX,XX +XXX,XX @@ typedef struct RADOSCB {
      RBDAIOCB *acb;
      struct BDRVRBDState *s;
      int64_t size;
 -    char *buf;
      int64_t ret;
  } RADOSCB;
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json,
  static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
  {
 -    if (LIBRBD_USE_IOVEC) {
 -        RBDAIOCB *acb = rcb->acb;
 -        iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
 -                   acb->qiov->size - offs);
 -    } else {
 -        memset(rcb->buf + offs, 0, rcb->size - offs);
 -    }
 +    RBDAIOCB *acb = rcb->acb;
 +    iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
 +               acb->qiov->size - offs);
  }
  #ifdef LIBRBD_SUPPORTS_ENCRYPTION
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
      g_free(rcb);
 -    if (!LIBRBD_USE_IOVEC) {
 -        if (acb->cmd == RBD_AIO_READ) {
 -            qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
 -        }
 -        qemu_vfree(acb->bounce);
 -    }
 -
      acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
      qemu_aio_unref(acb);
@@ -XXX,XX +XXX,XX @@ static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
                                       rbd_finish_bh, rcb);
  }
 -static int rbd_aio_discard_wrapper(rbd_image_t image,
 -                                   uint64_t off,
 -                                   uint64_t len,
 -                                   rbd_completion_t comp)
 -{
 -#ifdef LIBRBD_SUPPORTS_DISCARD
 -    return rbd_aio_discard(image, off, len, comp);
 -#else
 -    return -ENOTSUP;
 -#endif
 -}
 -
 -static int rbd_aio_flush_wrapper(rbd_image_t image,
 -                                 rbd_completion_t comp)
 -{
 -#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
 -    return rbd_aio_flush(image, comp);
 -#else
 -    return -ENOTSUP;
 -#endif
 -}
 -
  static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
                                   int64_t off,
                                   QEMUIOVector *qiov,
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
      rcb = g_new(RADOSCB, 1);
 -    if (!LIBRBD_USE_IOVEC) {
 -        if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
 -            acb->bounce = NULL;
 -        } else {
 -            acb->bounce = qemu_try_blockalign(bs, qiov->size);
 -            if (acb->bounce == NULL) {
 -                goto failed;
 -            }
 -        }
 -        if (cmd == RBD_AIO_WRITE) {
 -            qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
 -        }
 -        rcb->buf = acb->bounce;
 -    }
 -
      acb->ret = 0;
      acb->error = 0;
      acb->s = s;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
      }
      switch (cmd) {
 -    case RBD_AIO_WRITE: {
 +    case RBD_AIO_WRITE:
          /*
           * RBD APIs don't allow us to write more than actual size, so in order
           * to support growing images, we resize the image before write
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
                  goto failed_completion;
              }
          }
 -#ifdef LIBRBD_SUPPORTS_IOVEC
 -            r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
 -#else
 -            r = rbd_aio_write(s->image, off, size, rcb->buf, c);
 -#endif
 +        r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
          break;
 -    }
      case RBD_AIO_READ:
 -#ifdef LIBRBD_SUPPORTS_IOVEC
 -            r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
 -#else
 -            r = rbd_aio_read(s->image, off, size, rcb->buf, c);
 -#endif
 +        r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
          break;
      case RBD_AIO_DISCARD:
 -        r = rbd_aio_discard_wrapper(s->image, off, size, c);
 +        r = rbd_aio_discard(s->image, off, size, c);
          break;
      case RBD_AIO_FLUSH:
 -        r = rbd_aio_flush_wrapper(s->image, c);
 +        r = rbd_aio_flush(s->image, c);
          break;
      default:
          r = -EINVAL;
@@ -XXX,XX +XXX,XX @@ failed_completion:
      rbd_aio_release(c);
  failed:
      g_free(rcb);
 -    if (!LIBRBD_USE_IOVEC) {
 -        qemu_vfree(acb->bounce);
 -    }
      qemu_aio_unref(acb);
      return NULL;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_pwritev(BlockDriverState *bs,
                           RBD_AIO_WRITE);
  }
 -#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
  static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
                                        BlockCompletionFunc *cb,
                                        void *opaque)
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
      return rbd_start_aio(bs, 0, NULL, 0, cb, opaque, RBD_AIO_FLUSH);
  }
 -#else
 -
 -static int qemu_rbd_co_flush(BlockDriverState *bs)
 -{
 -#if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 1)
 -    /* rbd_flush added in 0.1.1 */
 -    BDRVRBDState *s = bs->opaque;
 -    return rbd_flush(s->image);
 -#else
 -    return 0;
 -#endif
 -}
 -#endif
 -
  static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
  {
      BDRVRBDState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
      return snap_count;
  }
 -#ifdef LIBRBD_SUPPORTS_DISCARD
  static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
                                           int64_t offset,
                                           int bytes,
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
      return rbd_start_aio(bs, offset, NULL, bytes, cb, opaque,
                           RBD_AIO_DISCARD);
  }
 -#endif
 -#ifdef LIBRBD_SUPPORTS_INVALIDATE
  static void coroutine_fn qemu_rbd_co_invalidate_cache(BlockDriverState *bs,
                                                        Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qemu_rbd_co_invalidate_cache(BlockDriverState *bs,
          error_setg_errno(errp, -r, "Failed to invalidate the cache");
      }
  }
 -#endif
  static QemuOptsList qemu_rbd_create_opts = {
      .name = "rbd-create-opts",
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
      .bdrv_aio_preadv        = qemu_rbd_aio_preadv,
      .bdrv_aio_pwritev       = qemu_rbd_aio_pwritev,
 -#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
      .bdrv_aio_flush         = qemu_rbd_aio_flush,
 -#else
 -    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
 -#endif
 -
 -#ifdef LIBRBD_SUPPORTS_DISCARD
      .bdrv_aio_pdiscard      = qemu_rbd_aio_pdiscard,
 -#endif
      .bdrv_snapshot_create   = qemu_rbd_snap_create,
      .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
      .bdrv_snapshot_list     = qemu_rbd_snap_list,
      .bdrv_snapshot_goto     = qemu_rbd_snap_rollback,
 -#ifdef LIBRBD_SUPPORTS_INVALIDATE
      .bdrv_co_invalidate_cache = qemu_rbd_co_invalidate_cache,
 -#endif
      .strong_runtime_opts    = qemu_rbd_strong_runtime_opts,
  };
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('rbd').auto() or have_block
        int main(void) {
          rados_t cluster;
          rados_create(&cluster, NULL);
 +        #if LIBRBD_VERSION_CODE < LIBRBD_VERSION(1, 12, 0)
 +        #error
 +        #endif
          return 0;
        }''', dependencies: [librbd, librados])
        rbd = declare_dependency(dependencies: [librbd, librados])
      elif get_option('rbd').enabled()
 -      error('could not link librados')
 +      error('librbd >= 1.12.0 required')
      else
 -      warning('could not link librados, disabling')
 +      warning('librbd >= 1.12.0 not found, disabling')
      endif
    endif
  endif
 --
 .31.1

-New patch
+[PULL 04/28] block/rbd: store object_size in BDRVRBDState
+From: Peter Lieven <pl@kamp.de>
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Message-Id: <20210702172356.11574-3-idryomov@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/rbd.c | 18 +++++++-----------
+file changed, 7 insertions(+), 11 deletions(-)
+diff --git a/block/rbd.c b/block/rbd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -XXX,XX +XXX,XX @@ typedef struct BDRVRBDState {
+     char *snap;
+     char *namespace;
+     uint64_t image_size;
++    uint64_t object_size;
+ } BDRVRBDState;
+ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
+@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
+     const QDictEntry *e;
+     Error *local_err = NULL;
+     char *keypairs, *secretid;
++    rbd_image_info_t info;
+     int r;
+     keypairs = g_strdup(qdict_get_try_str(options, "=keyvalue-pairs"));
+@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
+ #endif
+     }
+-    r = rbd_get_size(s->image, &s->image_size);
++    r = rbd_stat(s->image, &info, sizeof(info));
+     if (r < 0) {
+-        error_setg_errno(errp, -r, "error getting image size from %s",
++        error_setg_errno(errp, -r, "error getting image info from %s",
+                          s->image_name);
+         goto failed_post_open;
+     }
++    s->image_size = info.size;
++    s->object_size = info.obj_size;
+     /* If we are using an rbd snapshot, we must be r/o, otherwise
+      * leave as-is */
+@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
+ static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
+ {
+     BDRVRBDState *s = bs->opaque;
+-    rbd_image_info_t info;
+-    int r;
+-
+-    r = rbd_stat(s->image, &info, sizeof(info));
+-    if (r < 0) {
+-        return r;
+-    }
+-
+-    bdi->cluster_size = info.obj_size;
++    bdi->cluster_size = s->object_size;
+     return 0;
+ }
+--
+.31.1

-New patch
+[PULL 05/28] block/rbd: update s->image_size in qemu_rbd_getlength
+From: Peter Lieven <pl@kamp.de>
+While at it just call rbd_get_size and avoid rbd_image_info_t.
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Message-Id: <20210702172356.11574-4-idryomov@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/rbd.c | 5 ++---
+file changed, 2 insertions(+), 3 deletions(-)
+diff --git a/block/rbd.c b/block/rbd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -XXX,XX +XXX,XX @@ static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
+ static int64_t qemu_rbd_getlength(BlockDriverState *bs)
+ {
+     BDRVRBDState *s = bs->opaque;
+-    rbd_image_info_t info;
+     int r;
+-    r = rbd_stat(s->image, &info, sizeof(info));
++    r = rbd_get_size(s->image, &s->image_size);
+     if (r < 0) {
+         return r;
+     }
+-    return info.size;
++    return s->image_size;
+ }
+ static int coroutine_fn qemu_rbd_co_truncate(BlockDriverState *bs,
+--
+.31.1

-[Qemu-devel] [PULL 3/5] qcow2: add compress threads
+[PULL 06/28] block/rbd: migrate from aio to coroutines
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+From: Peter Lieven <pl@kamp.de>
-Do data compression in separate threads. This significantly improve
+Signed-off-by: Peter Lieven <pl@kamp.de>
-performance for qemu-img convert with -W (allow async writes) and -c
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
-(compressed) options.
+Message-Id: <20210702172356.11574-5-idryomov@gmail.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/qcow2.h |  3 +++
+ block/rbd.c | 252 +++++++++++++++++++---------------------------------
- block/qcow2.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
+file changed, 90 insertions(+), 162 deletions(-)
 files changed, 64 insertions(+), 1 deletion(-)
-diff --git a/block/qcow2.h b/block/qcow2.h
+diff --git a/block/rbd.c b/block/rbd.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/qcow2.h
+--- a/block/rbd.c
-+++ b/block/qcow2.h
++++ b/block/rbd.c
-@@ -XXX,XX +XXX,XX @@ typedef struct BDRVQcow2State {
+@@ -XXX,XX +XXX,XX @@ typedef enum {
-      * override) */
+     RBD_AIO_FLUSH
-     char *image_backing_file;
+ } RBDAIOCmd;
-     char *image_backing_format;
 -typedef struct RBDAIOCB {
 -    BlockAIOCB common;
 -    int64_t ret;
 -    QEMUIOVector *qiov;
 -    RBDAIOCmd cmd;
 -    int error;
 -    struct BDRVRBDState *s;
 -} RBDAIOCB;
 -
 -typedef struct RADOSCB {
 -    RBDAIOCB *acb;
 -    struct BDRVRBDState *s;
 -    int64_t size;
 -    int64_t ret;
 -} RADOSCB;
 -
  typedef struct BDRVRBDState {
      rados_t cluster;
      rados_ioctx_t io_ctx;
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVRBDState {
      uint64_t object_size;
  } BDRVRBDState;
 +typedef struct RBDTask {
 +    BlockDriverState *bs;
 +    Coroutine *co;
 +    bool complete;
 +    int64_t ret;
 +} RBDTask;
 +
-+    CoQueue compress_wait_queue;
+ static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
-+    int nb_compress_threads;
+                             BlockdevOptionsRbd *opts, bool cache,
- } BDRVQcow2State;
+                             const char *keypairs, const char *secretid,
+@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json,
- typedef struct Qcow2COWRegion {
+     return ret;
-diff --git a/block/qcow2.c b/block/qcow2.c
+ }
-index XXXXXXX..XXXXXXX 100644
---- a/block/qcow2.c
+-static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
-+++ b/block/qcow2.c
+-{
-@@ -XXX,XX +XXX,XX @@
+-    RBDAIOCB *acb = rcb->acb;
- #include "qapi/qobject-input-visitor.h"
+-    iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
- #include "qapi/qapi-visit-block-core.h"
+-               acb->qiov->size - offs);
- #include "crypto.h"
+-}
-+#include "block/thread-pool.h"
+-
  #ifdef LIBRBD_SUPPORTS_ENCRYPTION
  static int qemu_rbd_convert_luks_options(
          RbdEncryptionOptionsLUKSBase *luks_opts,
@@ -XXX,XX +XXX,XX @@ exit:
      return ret;
  }
 -/*
 - * This aio completion is being called from rbd_finish_bh() and runs in qemu
 - * BH context.
 - */
 -static void qemu_rbd_complete_aio(RADOSCB *rcb)
 -{
 -    RBDAIOCB *acb = rcb->acb;
 -    int64_t r;
 -
 -    r = rcb->ret;
 -
 -    if (acb->cmd != RBD_AIO_READ) {
 -        if (r < 0) {
 -            acb->ret = r;
 -            acb->error = 1;
 -        } else if (!acb->error) {
 -            acb->ret = rcb->size;
 -        }
 -    } else {
 -        if (r < 0) {
 -            qemu_rbd_memset(rcb, 0);
 -            acb->ret = r;
 -            acb->error = 1;
 -        } else if (r < rcb->size) {
 -            qemu_rbd_memset(rcb, r);
 -            if (!acb->error) {
 -                acb->ret = rcb->size;
 -            }
 -        } else if (!acb->error) {
 -            acb->ret = r;
 -        }
 -    }
 -
 -    g_free(rcb);
 -
 -    acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
 -
 -    qemu_aio_unref(acb);
 -}
 -
  static char *qemu_rbd_mon_host(BlockdevOptionsRbd *opts, Error **errp)
  {
      const char **vals;
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_resize(BlockDriverState *bs, uint64_t size)
      return 0;
  }
 -static const AIOCBInfo rbd_aiocb_info = {
 -    .aiocb_size = sizeof(RBDAIOCB),
 -};
 -
 -static void rbd_finish_bh(void *opaque)
 +static void qemu_rbd_finish_bh(void *opaque)
  {
 -    RADOSCB *rcb = opaque;
 -    qemu_rbd_complete_aio(rcb);
 +    RBDTask *task = opaque;
 +    task->complete = 1;
 +    aio_co_wake(task->co);
  }
  /*
-   Differences with QCOW:
+- * This is the callback function for rbd_aio_read and _write
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
++ * This is the completion callback function for all rbd aio calls
-         qcow2_check_refcounts(bs, &result, 0);
++ * started from qemu_rbd_start_co().
   *
   * Note: this function is being called from a non qemu thread so
   * we need to be careful about what we do here. Generally we only
   * schedule a BH, and do the rest of the io completion handling
 - * from rbd_finish_bh() which runs in a qemu context.
 + * from qemu_rbd_finish_bh() which runs in a qemu context.
   */
 -static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
 +static void qemu_rbd_completion_cb(rbd_completion_t c, RBDTask *task)
  {
 -    RBDAIOCB *acb = rcb->acb;
 -
 -    rcb->ret = rbd_aio_get_return_value(c);
 +    task->ret = rbd_aio_get_return_value(c);
      rbd_aio_release(c);
 -
 -    replay_bh_schedule_oneshot_event(bdrv_get_aio_context(acb->common.bs),
 -                                     rbd_finish_bh, rcb);
 +    aio_bh_schedule_oneshot(bdrv_get_aio_context(task->bs),
 +                            qemu_rbd_finish_bh, task);
  }
 -static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
 -                                 int64_t off,
 -                                 QEMUIOVector *qiov,
 -                                 int64_t size,
 -                                 BlockCompletionFunc *cb,
 -                                 void *opaque,
 -                                 RBDAIOCmd cmd)
 +static int coroutine_fn qemu_rbd_start_co(BlockDriverState *bs,
 +                                          uint64_t offset,
 +                                          uint64_t bytes,
 +                                          QEMUIOVector *qiov,
 +                                          int flags,
 +                                          RBDAIOCmd cmd)
  {
 -    RBDAIOCB *acb;
 -    RADOSCB *rcb = NULL;
 +    BDRVRBDState *s = bs->opaque;
 +    RBDTask task = { .bs = bs, .co = qemu_coroutine_self() };
      rbd_completion_t c;
      int r;
 -    BDRVRBDState *s = bs->opaque;
 -
 -    acb = qemu_aio_get(&rbd_aiocb_info, bs, cb, opaque);
 -    acb->cmd = cmd;
 -    acb->qiov = qiov;
 -    assert(!qiov || qiov->size == size);
 -
 -    rcb = g_new(RADOSCB, 1);
 +    assert(!qiov || qiov->size == bytes);
 -    acb->ret = 0;
 -    acb->error = 0;
 -    acb->s = s;
 -
 -    rcb->acb = acb;
 -    rcb->s = acb->s;
 -    rcb->size = size;
 -    r = rbd_aio_create_completion(rcb, (rbd_callback_t) rbd_finish_aiocb, &c);
 +    r = rbd_aio_create_completion(&task,
 +                                  (rbd_callback_t) qemu_rbd_completion_cb, &c);
      if (r < 0) {
 -        goto failed;
 +        return r;
      }
- #endif
      switch (cmd) {
 -    case RBD_AIO_WRITE:
 -        /*
 -         * RBD APIs don't allow us to write more than actual size, so in order
 -         * to support growing images, we resize the image before write
 -         * operations that exceed the current size.
 -         */
 -        if (off + size > s->image_size) {
 -            r = qemu_rbd_resize(bs, off + size);
 -            if (r < 0) {
 -                goto failed_completion;
 -            }
 -        }
 -        r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
 -        break;
      case RBD_AIO_READ:
 -        r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
 +        r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, offset, c);
 +        break;
 +    case RBD_AIO_WRITE:
 +        r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, offset, c);
          break;
      case RBD_AIO_DISCARD:
 -        r = rbd_aio_discard(s->image, off, size, c);
 +        r = rbd_aio_discard(s->image, offset, bytes, c);
          break;
      case RBD_AIO_FLUSH:
          r = rbd_aio_flush(s->image, c);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
      }
      if (r < 0) {
 -        goto failed_completion;
 +        error_report("rbd request failed early: cmd %d offset %" PRIu64
 +                     " bytes %" PRIu64 " flags %d r %d (%s)", cmd, offset,
 +                     bytes, flags, r, strerror(-r));
 +        rbd_aio_release(c);
 +        return r;
      }
 -    return &acb->common;
 -failed_completion:
 -    rbd_aio_release(c);
 -failed:
 -    g_free(rcb);
 +    while (!task.complete) {
 +        qemu_coroutine_yield();
 +    }
 -    qemu_aio_unref(acb);
 -    return NULL;
 +    if (task.ret < 0) {
 +        error_report("rbd request failed: cmd %d offset %" PRIu64 " bytes %"
 +                     PRIu64 " flags %d task.ret %" PRIi64 " (%s)", cmd, offset,
 +                     bytes, flags, task.ret, strerror(-task.ret));
 +        return task.ret;
 +    }
 +
-+    qemu_co_queue_init(&s->compress_wait_queue);
++    /* zero pad short reads */
-+
++    if (cmd == RBD_AIO_READ && task.ret < qiov->size) {
-     return ret;
++        qemu_iovec_memset(qiov, task.ret, 0, qiov->size - task.ret);
++    }
   fail:
@@ -XXX,XX +XXX,XX @@ static ssize_t qcow2_compress(void *dest, const void *src, size_t size)
      return ret;
  }
 +#define MAX_COMPRESS_THREADS 4
 +
 +typedef struct Qcow2CompressData {
 +    void *dest;
 +    const void *src;
 +    size_t size;
 +    ssize_t ret;
 +} Qcow2CompressData;
 +
 +static int qcow2_compress_pool_func(void *opaque)
 +{
 +    Qcow2CompressData *data = opaque;
 +
 +    data->ret = qcow2_compress(data->dest, data->src, data->size);
 +
 +    return 0;
 +}
 +
-+static void qcow2_compress_complete(void *opaque, int ret)
++static int
 +coroutine_fn qemu_rbd_co_preadv(BlockDriverState *bs, uint64_t offset,
 +                               uint64_t bytes, QEMUIOVector *qiov,
 +                               int flags)
 +{
-+    qemu_coroutine_enter(opaque);
++    return qemu_rbd_start_co(bs, offset, bytes, qiov, flags, RBD_AIO_READ);
-+}
+ }
-+
-+/* See qcow2_compress definition for parameters description */
+-static BlockAIOCB *qemu_rbd_aio_preadv(BlockDriverState *bs,
-+static ssize_t qcow2_co_compress(BlockDriverState *bs,
+-                                       uint64_t offset, uint64_t bytes,
-+                                 void *dest, const void *src, size_t size)
+-                                       QEMUIOVector *qiov, int flags,
-+{
+-                                       BlockCompletionFunc *cb,
-+    BDRVQcow2State *s = bs->opaque;
+-                                       void *opaque)
-+    BlockAIOCB *acb;
++static int
-+    ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
++coroutine_fn qemu_rbd_co_pwritev(BlockDriverState *bs, uint64_t offset,
-+    Qcow2CompressData arg = {
++                                 uint64_t bytes, QEMUIOVector *qiov,
-+        .dest = dest,
++                                 int flags)
-+        .src = src,
+ {
-+        .size = size,
+-    return rbd_start_aio(bs, offset, qiov, bytes, cb, opaque,
-+    };
+-                         RBD_AIO_READ);
-+
++    BDRVRBDState *s = bs->opaque;
-+    while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
++    /*
-+        qemu_co_queue_wait(&s->compress_wait_queue, NULL);
++     * RBD APIs don't allow us to write more than actual size, so in order
 +     * to support growing images, we resize the image before write
 +     * operations that exceed the current size.
 +     */
 +    if (offset + bytes > s->image_size) {
 +        int r = qemu_rbd_resize(bs, offset + bytes);
 +        if (r < 0) {
 +            return r;
 +        }
 +    }
-+
++    return qemu_rbd_start_co(bs, offset, bytes, qiov, flags, RBD_AIO_WRITE);
-+    s->nb_compress_threads++;
+ }
-+    acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
-+                                 qcow2_compress_complete,
+-static BlockAIOCB *qemu_rbd_aio_pwritev(BlockDriverState *bs,
-+                                 qemu_coroutine_self());
+-                                        uint64_t offset, uint64_t bytes,
-+
+-                                        QEMUIOVector *qiov, int flags,
-+    if (!acb) {
+-                                        BlockCompletionFunc *cb,
-+        s->nb_compress_threads--;
+-                                        void *opaque)
-+        return -EINVAL;
++static int coroutine_fn qemu_rbd_co_flush(BlockDriverState *bs)
-+    }
+ {
-+    qemu_coroutine_yield();
+-    return rbd_start_aio(bs, offset, qiov, bytes, cb, opaque,
-+    s->nb_compress_threads--;
+-                         RBD_AIO_WRITE);
-+    qemu_co_queue_next(&s->compress_wait_queue);
++    return qemu_rbd_start_co(bs, 0, 0, NULL, 0, RBD_AIO_FLUSH);
-+
+ }
-+    return arg.ret;
-+}
+-static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
-+
+-                                      BlockCompletionFunc *cb,
- /* XXX: put compressed sectors first, then all the cluster aligned
+-                                      void *opaque)
-    tables to avoid losing bytes in alignment */
++static int coroutine_fn qemu_rbd_co_pdiscard(BlockDriverState *bs,
- static coroutine_fn int
++                                             int64_t offset, int count)
-@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
+ {
+-    return rbd_start_aio(bs, 0, NULL, 0, cb, opaque, RBD_AIO_FLUSH);
-     out_buf = g_malloc(s->cluster_size);
++    return qemu_rbd_start_co(bs, offset, count, NULL, 0, RBD_AIO_DISCARD);
+ }
--    out_len = qcow2_compress(out_buf, buf, s->cluster_size);
-+    out_len = qcow2_co_compress(bs, out_buf, buf, s->cluster_size);
+ static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
-     if (out_len == -2) {
+@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
-         ret = -EINVAL;
+     return snap_count;
-         goto fail;
+ }
 -static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
 -                                         int64_t offset,
 -                                         int bytes,
 -                                         BlockCompletionFunc *cb,
 -                                         void *opaque)
 -{
 -    return rbd_start_aio(bs, offset, NULL, bytes, cb, opaque,
 -                         RBD_AIO_DISCARD);
 -}
 -
  static void coroutine_fn qemu_rbd_co_invalidate_cache(BlockDriverState *bs,
                                                        Error **errp)
  {
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
      .bdrv_co_truncate       = qemu_rbd_co_truncate,
      .protocol_name          = "rbd",
 -    .bdrv_aio_preadv        = qemu_rbd_aio_preadv,
 -    .bdrv_aio_pwritev       = qemu_rbd_aio_pwritev,
 -
 -    .bdrv_aio_flush         = qemu_rbd_aio_flush,
 -    .bdrv_aio_pdiscard      = qemu_rbd_aio_pdiscard,
 +    .bdrv_co_preadv         = qemu_rbd_co_preadv,
 +    .bdrv_co_pwritev        = qemu_rbd_co_pwritev,
 +    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
 +    .bdrv_co_pdiscard       = qemu_rbd_co_pdiscard,
      .bdrv_snapshot_create   = qemu_rbd_snap_create,
      .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
 --
-.13.6
+.31.1

-New patch
+[PULL 07/28] block/rbd: add write zeroes support
+From: Peter Lieven <pl@kamp.de>
+This patch wittingly sets BDRV_REQ_NO_FALLBACK and silently ignores
+BDRV_REQ_MAY_UNMAP for older librbd versions.
+The rationale for this is as follows (citing Ilya Dryomov current RBD
+maintainer):
+---8<---
+a) remove the BDRV_REQ_MAY_UNMAP check in qemu_rbd_co_pwrite_zeroes()
+   and as a consequence always unmap if librbd is too old
+   It's not clear what qemu's expectation is but in general Write
+   Zeroes is allowed to unmap.  The only guarantee is that subsequent
+   reads return zeroes, everything else is a hint.  This is how it is
+   specified in the kernel and in the NVMe spec.
+   In particular, block/nvme.c implements it as follows:
+   if (flags & BDRV_REQ_MAY_UNMAP) {
+       cdw12 |= (1 << 25);
+   }
+   This sets the Deallocate bit.  But if it's not set, the device may
+   still deallocate:
+   """
+   If the Deallocate bit (CDW12.DEAC) is set to '1' in a Write Zeroes
+   command, and the namespace supports clearing all bytes to 0h in the
+   values read (e.g., bits 2:0 in the DLFEAT field are set to 001b)
+   from a deallocated logical block and its metadata (excluding
+   protection information), then for each specified logical block, the
+   controller:
+   - should deallocate that logical block;
+   ...
+   If the Deallocate bit is cleared to '0' in a Write Zeroes command,
+   and the namespace supports clearing all bytes to 0h in the values
+   read (e.g., bits 2:0 in the DLFEAT field are set to 001b) from
+   a deallocated logical block and its metadata (excluding protection
+   information), then, for each specified logical block, the
+   controller:
+   - may deallocate that logical block;
+   """
+   https://nvmexpress.org/wp-content/uploads/NVM-Express-NVM-Command-Set-Specification-2021.06.02-Ratified-1.pdf
+b) set BDRV_REQ_NO_FALLBACK in supported_zero_flags
+   Again, it's not clear what qemu expects here, but without it we end
+   up in a ridiculous situation where specifying the "don't allow slow
+   fallback" switch immediately fails all efficient zeroing requests on
+   a device where Write Zeroes is always efficient:
+   $ qemu-io -c 'help write' | grep -- '-[zun]'
+    -n, -- with -z, don't allow slow fallback
+    -u, -- with -z, allow unmapping
+    -z, -- write zeroes using blk_co_pwrite_zeroes
+   $ qemu-io -f rbd -c 'write -z -u -n 0 1M' rbd:foo/bar
+   write failed: Operation not supported
+--->8---
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Message-Id: <20210702172356.11574-6-idryomov@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/rbd.c | 32 +++++++++++++++++++++++++++++++-
+file changed, 31 insertions(+), 1 deletion(-)
+diff --git a/block/rbd.c b/block/rbd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -XXX,XX +XXX,XX @@ typedef enum {
+     RBD_AIO_READ,
+     RBD_AIO_WRITE,
+     RBD_AIO_DISCARD,
+-    RBD_AIO_FLUSH
++    RBD_AIO_FLUSH,
++    RBD_AIO_WRITE_ZEROES
+ } RBDAIOCmd;
+ typedef struct BDRVRBDState {
+@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
+         }
+     }
++#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
++    bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK;
++#endif
++
+     /* When extending regular files, we get zeros from the OS */
+     bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_start_co(BlockDriverState *bs,
+     case RBD_AIO_FLUSH:
+         r = rbd_aio_flush(s->image, c);
+         break;
++#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
++    case RBD_AIO_WRITE_ZEROES: {
++        int zero_flags = 0;
++#ifdef RBD_WRITE_ZEROES_FLAG_THICK_PROVISION
++        if (!(flags & BDRV_REQ_MAY_UNMAP)) {
++            zero_flags = RBD_WRITE_ZEROES_FLAG_THICK_PROVISION;
++        }
++#endif
++        r = rbd_aio_write_zeroes(s->image, offset, bytes, c, zero_flags, 0);
++        break;
++    }
++#endif
+     default:
+         r = -EINVAL;
+     }
+@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_pdiscard(BlockDriverState *bs,
+     return qemu_rbd_start_co(bs, offset, count, NULL, 0, RBD_AIO_DISCARD);
+ }
++#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
++static int
++coroutine_fn qemu_rbd_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
++                                      int count, BdrvRequestFlags flags)
++{
++    return qemu_rbd_start_co(bs, offset, count, NULL, flags,
++                             RBD_AIO_WRITE_ZEROES);
++}
++#endif
++
+ static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
+ {
+     BDRVRBDState *s = bs->opaque;
+@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
+     .bdrv_co_pwritev        = qemu_rbd_co_pwritev,
+     .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
+     .bdrv_co_pdiscard       = qemu_rbd_co_pdiscard,
++#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
++    .bdrv_co_pwrite_zeroes  = qemu_rbd_co_pwrite_zeroes,
++#endif
+     .bdrv_snapshot_create   = qemu_rbd_snap_create,
+     .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
+--
+.31.1

-New patch
+[PULL 08/28] block/rbd: drop qemu_rbd_refresh_limits
+From: Peter Lieven <pl@kamp.de>
+librbd supports 1 byte alignment for all aio operations.
+Currently, there is no API call to query limits from the Ceph
+ObjectStore backend.  So drop the bdrv_refresh_limits completely
+until there is such an API call.
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Message-Id: <20210702172356.11574-7-idryomov@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/rbd.c | 9 ---------
+file changed, 9 deletions(-)
+diff --git a/block/rbd.c b/block/rbd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -XXX,XX +XXX,XX @@ done:
+     return;
+ }
+-
+-static void qemu_rbd_refresh_limits(BlockDriverState *bs, Error **errp)
+-{
+-    /* XXX Does RBD support AIO on less than 512-byte alignment? */
+-    bs->bl.request_alignment = 512;
+-}
+-
+-
+ static int qemu_rbd_set_auth(rados_t cluster, BlockdevOptionsRbd *opts,
+                              Error **errp)
+ {
+@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
+     .format_name            = "rbd",
+     .instance_size          = sizeof(BDRVRBDState),
+     .bdrv_parse_filename    = qemu_rbd_parse_filename,
+-    .bdrv_refresh_limits    = qemu_rbd_refresh_limits,
+     .bdrv_file_open         = qemu_rbd_open,
+     .bdrv_close             = qemu_rbd_close,
+     .bdrv_reopen_prepare    = qemu_rbd_reopen_prepare,
+--
+.31.1

-New patch
+[PULL 09/28] util/uri: do not check argument of uri_free()
+From: Heinrich Schuchardt <xypron.glpk@gmx.de>
+uri_free() checks if its argument is NULL in uri_clean() and g_free().
+There is no need to check the argument before the call.
+Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
+Message-Id: <20210629063602.4239-1-xypron.glpk@gmx.de>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/nfs.c |  4 +---
+ block/ssh.c |  4 +---
+ util/uri.c  | 22 ++++++----------------
+files changed, 8 insertions(+), 22 deletions(-)
+diff --git a/block/nfs.c b/block/nfs.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/nfs.c
++++ b/block/nfs.c
+@@ -XXX,XX +XXX,XX @@ out:
+     if (qp) {
+         query_params_free(qp);
+     }
+-    if (uri) {
+-        uri_free(uri);
+-    }
++    uri_free(uri);
+     return ret;
+ }
+diff --git a/block/ssh.c b/block/ssh.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/ssh.c
++++ b/block/ssh.c
+@@ -XXX,XX +XXX,XX @@ static int parse_uri(const char *filename, QDict *options, Error **errp)
+     return 0;
+  err:
+-    if (uri) {
+-      uri_free(uri);
+-    }
++    uri_free(uri);
+     return -EINVAL;
+ }
+diff --git a/util/uri.c b/util/uri.c
+index XXXXXXX..XXXXXXX 100644
+--- a/util/uri.c
++++ b/util/uri.c
+@@ -XXX,XX +XXX,XX @@ static void uri_clean(URI *uri)
+ /**
+  * uri_free:
+- * @uri:  pointer to an URI
++ * @uri:  pointer to an URI, NULL is ignored
+  *
+  * Free up the URI struct
+  */
+@@ -XXX,XX +XXX,XX @@ step_7:
+     val = uri_to_string(res);
+ done:
+-    if (ref != NULL) {
+-        uri_free(ref);
+-    }
+-    if (bas != NULL) {
+-        uri_free(bas);
+-    }
+-    if (res != NULL) {
+-        uri_free(res);
+-    }
++    uri_free(ref);
++    uri_free(bas);
++    uri_free(res);
+     return val;
+ }
+@@ -XXX,XX +XXX,XX @@ done:
+     if (remove_path != 0) {
+         ref->path = NULL;
+     }
+-    if (ref != NULL) {
+-        uri_free(ref);
+-    }
+-    if (bas != NULL) {
+-        uri_free(bas);
+-    }
++    uri_free(ref);
++    uri_free(bas);
+     return val;
+ }
+--
+.31.1

-New patch
+[PULL 10/28] export/fuse: Pass default_permissions for mount
+From: Max Reitz <mreitz@redhat.com>
+We do not do any permission checks in fuse_open(), so let the kernel do
+them.  We already let fuse_getattr() report the proper UNIX permissions,
+so this should work the way we want.
+This causes a change in 308's reference output, because now opening a
+non-writable export with O_RDWR fails already, instead of only actually
+attempting to write to it.  (That is an improvement.)
+Signed-off-by: Max Reitz <mreitz@redhat.com>
+Message-Id: <20210625142317.271673-2-mreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/export/fuse.c        | 8 ++++++--
+ tests/qemu-iotests/308     | 3 ++-
+ tests/qemu-iotests/308.out | 2 +-
+files changed, 9 insertions(+), 4 deletions(-)
+diff --git a/block/export/fuse.c b/block/export/fuse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/fuse.c
++++ b/block/export/fuse.c
+@@ -XXX,XX +XXX,XX @@ static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
+     struct fuse_args fuse_args;
+     int ret;
+-    /* Needs to match what fuse_init() sets.  Only max_read must be supplied. */
+-    mount_opts = g_strdup_printf("max_read=%zu", FUSE_MAX_BOUNCE_BYTES);
++    /*
++     * max_read needs to match what fuse_init() sets.
++     * max_write need not be supplied.
++     */
++    mount_opts = g_strdup_printf("max_read=%zu,default_permissions",
++                                 FUSE_MAX_BOUNCE_BYTES);
+     fuse_argv[0] = ""; /* Dummy program name */
+     fuse_argv[1] = "-o";
+diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/308
++++ b/tests/qemu-iotests/308
+@@ -XXX,XX +XXX,XX @@ echo '=== Writable export ==='
+ fuse_export_add 'export-mp' "'mountpoint': '$EXT_MP', 'writable': true"
+ # Check that writing to the read-only export fails
+-$QEMU_IO -f raw -c 'write -P 42 1M 64k' "$TEST_IMG" | _filter_qemu_io
++$QEMU_IO -f raw -c 'write -P 42 1M 64k' "$TEST_IMG" 2>&1 \
++    | _filter_qemu_io | _filter_testdir | _filter_imgfmt
+ # But here it should work
+ $QEMU_IO -f raw -c 'write -P 42 1M 64k' "$EXT_MP" | _filter_qemu_io
+diff --git a/tests/qemu-iotests/308.out b/tests/qemu-iotests/308.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/308.out
++++ b/tests/qemu-iotests/308.out
+@@ -XXX,XX +XXX,XX @@ virtual size: 0 B (0 bytes)
+               'mountpoint': 'TEST_DIR/t.IMGFMT.fuse', 'writable': true
+           } }
+ {"return": {}}
+-write failed: Permission denied
++qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open 'TEST_DIR/t.IMGFMT': Permission denied
+ wrote 65536/65536 bytes at offset 1048576
+KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ wrote 65536/65536 bytes at offset 1048576
+--
+.31.1

-New patch
+[PULL 11/28] export/fuse: Add allow-other option
+From: Max Reitz <mreitz@redhat.com>
 Without the allow_other mount option, no user (not even root) but the
 one who started qemu/the storage daemon can access the export.  Allow
 users to configure the export such that such accesses are possible.
 While allow_other is probably what users want, we cannot make it an
 unconditional default, because passing it is only possible (for non-root
 users) if the global fuse.conf configuration file allows it.  Thus, the
 default is an 'auto' mode, in which we first try with allow_other, and
 then fall back to without.
 FuseExport.allow_other reports whether allow_other was actually used as
 a mount option or not.  Currently, this information is not used, but a
 future patch will let this field decide whether e.g. an export's UID and
 GID can be changed through chmod.
 One notable thing about 'auto' mode is that libfuse may print error
 messages directly to stderr, and so may fusermount (which it executes).
 Our export code cannot really filter or hide them.  Therefore, if 'auto'
 fails its first attempt and has to fall back, fusermount will print an
 error message that mounting with allow_other failed.
 This behavior necessitates a change to iotest 308, namely we need to
 filter out this error message (because if the first attempt at mounting
 with allow_other succeeds, there will be no such message).
 Furthermore, common.rc's _make_test_img should use allow-other=off for
 FUSE exports, because iotests generally do not need to access images
 from other users, so allow-other=on or allow-other=auto have no
 advantage.  OTOH, allow-other=on will not work on systems where
 user_allow_other is disabled, and with allow-other=auto, we get said
 error message that we would need to filter out again.  Just disabling
 allow-other is simplest.
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Message-Id: <20210625142317.271673-3-mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  qapi/block-export.json       | 33 ++++++++++++++++++++++++++++++++-
  block/export/fuse.c          | 28 +++++++++++++++++++++++-----
  tests/qemu-iotests/308       |  6 +++++-
  tests/qemu-iotests/common.rc |  6 +++++-
 files changed, 65 insertions(+), 8 deletions(-)
 diff --git a/qapi/block-export.json b/qapi/block-export.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-export.json
 +++ b/qapi/block-export.json
@@ -XXX,XX +XXX,XX @@
          '*logical-block-size': 'size',
              '*num-queues': 'uint16'} }
 +##
 +# @FuseExportAllowOther:
 +#
 +# Possible allow_other modes for FUSE exports.
 +#
 +# @off: Do not pass allow_other as a mount option.
 +#
 +# @on: Pass allow_other as a mount option.
 +#
 +# @auto: Try mounting with allow_other first, and if that fails, retry
 +#        without allow_other.
 +#
 +# Since: 6.1
 +##
 +{ 'enum': 'FuseExportAllowOther',
 +  'data': ['off', 'on', 'auto'] }
 +
  ##
  # @BlockExportOptionsFuse:
  #
@@ -XXX,XX +XXX,XX @@
  # @growable: Whether writes beyond the EOF should grow the block node
  #            accordingly. (default: false)
  #
 +# @allow-other: If this is off, only qemu's user is allowed access to
 +#               this export.  That cannot be changed even with chmod or
 +#               chown.
 +#               Enabling this option will allow other users access to
 +#               the export with the FUSE mount option "allow_other".
 +#               Note that using allow_other as a non-root user requires
 +#               user_allow_other to be enabled in the global fuse.conf
 +#               configuration file.
 +#               In auto mode (the default), the FUSE export driver will
 +#               first attempt to mount the export with allow_other, and
 +#               if that fails, try again without.
 +#               (since 6.1; default: auto)
 +#
  # Since: 6.0
  ##
  { 'struct': 'BlockExportOptionsFuse',
    'data': { 'mountpoint': 'str',
 -            '*growable': 'bool' },
 +            '*growable': 'bool',
 +            '*allow-other': 'FuseExportAllowOther' },
    'if': 'defined(CONFIG_FUSE)' }
  ##
 diff --git a/block/export/fuse.c b/block/export/fuse.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/export/fuse.c
 +++ b/block/export/fuse.c
@@ -XXX,XX +XXX,XX @@ typedef struct FuseExport {
      char *mountpoint;
      bool writable;
      bool growable;
 +    /* Whether allow_other was used as a mount option or not */
 +    bool allow_other;
  } FuseExport;
  static GHashTable *exports;
@@ -XXX,XX +XXX,XX @@ static void fuse_export_delete(BlockExport *exp);
  static void init_exports_table(void);
  static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
 -                             Error **errp);
 +                             bool allow_other, Error **errp);
  static void read_from_fuse_export(void *opaque);
  static bool is_regular_file(const char *path, Error **errp);
@@ -XXX,XX +XXX,XX @@ static int fuse_export_create(BlockExport *blk_exp,
      exp->writable = blk_exp_args->writable;
      exp->growable = args->growable;
 -    ret = setup_fuse_export(exp, args->mountpoint, errp);
 +    /* set default */
 +    if (!args->has_allow_other) {
 +        args->allow_other = FUSE_EXPORT_ALLOW_OTHER_AUTO;
 +    }
 +
 +    if (args->allow_other == FUSE_EXPORT_ALLOW_OTHER_AUTO) {
 +        /* Ignore errors on our first attempt */
 +        ret = setup_fuse_export(exp, args->mountpoint, true, NULL);
 +        exp->allow_other = ret == 0;
 +        if (ret < 0) {
 +            ret = setup_fuse_export(exp, args->mountpoint, false, errp);
 +        }
 +    } else {
 +        exp->allow_other = args->allow_other == FUSE_EXPORT_ALLOW_OTHER_ON;
 +        ret = setup_fuse_export(exp, args->mountpoint, exp->allow_other, errp);
 +    }
      if (ret < 0) {
          goto fail;
      }
@@ -XXX,XX +XXX,XX @@ static void init_exports_table(void)
   * Create exp->fuse_session and mount it.
   */
  static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
 -                             Error **errp)
 +                             bool allow_other, Error **errp)
  {
      const char *fuse_argv[4];
      char *mount_opts;
@@ -XXX,XX +XXX,XX @@ static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
       * max_read needs to match what fuse_init() sets.
       * max_write need not be supplied.
       */
 -    mount_opts = g_strdup_printf("max_read=%zu,default_permissions",
 -                                 FUSE_MAX_BOUNCE_BYTES);
 +    mount_opts = g_strdup_printf("max_read=%zu,default_permissions%s",
 +                                 FUSE_MAX_BOUNCE_BYTES,
 +                                 allow_other ? ",allow_other" : "");
      fuse_argv[0] = ""; /* Dummy program name */
      fuse_argv[1] = "-o";
 diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/308
 +++ b/tests/qemu-iotests/308
@@ -XXX,XX +XXX,XX @@ _supported_os Linux # We need /dev/urandom
  # $4: Node to export (defaults to 'node-format')
  fuse_export_add()
  {
 +    # The grep -v is a filter for errors when /etc/fuse.conf does not contain
 +    # user_allow_other.  (The error is benign, but it is printed by fusermount
 +    # on the first mount attempt, so our export code cannot hide it.)
      _send_qemu_cmd $QEMU_HANDLE \
          "{'execute': 'block-export-add',
            'arguments': {
@@ -XXX,XX +XXX,XX @@ fuse_export_add()
                $2
            } }" \
          "${3:-return}" \
 -        | _filter_imgfmt
 +        | _filter_imgfmt \
 +        | grep -v 'option allow_other only allowed if'
  }
  # $1: Export ID
 diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/common.rc
 +++ b/tests/qemu-iotests/common.rc
@@ -XXX,XX +XXX,XX @@ _make_test_img()
          # Usually, users would export formatted nodes.  But we present fuse as a
          # protocol-level driver here, so we have to leave the format to the
          # client.
 +        # Switch off allow-other, because in general we do not need it for
 +        # iotests.  The default allow-other=auto has the downside of printing a
 +        # fusermount error on its first attempt if allow_other is not
 +        # permissible, which we would need to filter.
          QSD_NEED_PID=y $QSD \
                --blockdev file,node-name=export-node,filename=$img_name,discard=unmap \
 -              --export fuse,id=fuse-export,node-name=export-node,mountpoint="$export_mp",writable=on,growable=on \
 +              --export fuse,id=fuse-export,node-name=export-node,mountpoint="$export_mp",writable=on,growable=on,allow-other=off \
                &
          pidfile="$QEMU_TEST_DIR/qemu-storage-daemon.pid"
 --
 .31.1

-New patch
+[PULL 12/28] export/fuse: Give SET_ATTR_SIZE its own branch
+From: Max Reitz <mreitz@redhat.com>
+In order to support changing other attributes than the file size in
+fuse_setattr(), we have to give each its own independent branch.  This
+also applies to the only attribute we do support right now.
+Signed-off-by: Max Reitz <mreitz@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210625142317.271673-4-mreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/export/fuse.c | 20 +++++++++++---------
+file changed, 11 insertions(+), 9 deletions(-)
+diff --git a/block/export/fuse.c b/block/export/fuse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/fuse.c
++++ b/block/export/fuse.c
+@@ -XXX,XX +XXX,XX @@ static void fuse_setattr(fuse_req_t req, fuse_ino_t inode, struct stat *statbuf,
+     FuseExport *exp = fuse_req_userdata(req);
+     int ret;
+-    if (!exp->writable) {
+-        fuse_reply_err(req, EACCES);
+-        return;
+-    }
+-
+     if (to_set & ~FUSE_SET_ATTR_SIZE) {
+         fuse_reply_err(req, ENOTSUP);
+         return;
+     }
+-    ret = fuse_do_truncate(exp, statbuf->st_size, true, PREALLOC_MODE_OFF);
+-    if (ret < 0) {
+-        fuse_reply_err(req, -ret);
+-        return;
++    if (to_set & FUSE_SET_ATTR_SIZE) {
++        if (!exp->writable) {
++            fuse_reply_err(req, EACCES);
++            return;
++        }
++
++        ret = fuse_do_truncate(exp, statbuf->st_size, true, PREALLOC_MODE_OFF);
++        if (ret < 0) {
++            fuse_reply_err(req, -ret);
++            return;
++        }
+     }
+     fuse_getattr(req, inode, fi);
+--
+.31.1

-New patch
+[PULL 13/28] export/fuse: Let permissions be adjustable
+From: Max Reitz <mreitz@redhat.com>
+Allow changing the file mode, UID, and GID through SETATTR.
+Without allow_other, UID and GID are not allowed to be changed, because
+it would not make sense.  Also, changing group or others' permissions
+is not allowed either.
+For read-only exports, +w cannot be set.
+Signed-off-by: Max Reitz <mreitz@redhat.com>
+Message-Id: <20210625142317.271673-5-mreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/export/fuse.c | 73 ++++++++++++++++++++++++++++++++++++++-------
+file changed, 62 insertions(+), 11 deletions(-)
+diff --git a/block/export/fuse.c b/block/export/fuse.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/export/fuse.c
++++ b/block/export/fuse.c
+@@ -XXX,XX +XXX,XX @@ typedef struct FuseExport {
+     bool growable;
+     /* Whether allow_other was used as a mount option or not */
+     bool allow_other;
++
++    mode_t st_mode;
++    uid_t st_uid;
++    gid_t st_gid;
+ } FuseExport;
+ static GHashTable *exports;
+@@ -XXX,XX +XXX,XX @@ static int fuse_export_create(BlockExport *blk_exp,
+         args->allow_other = FUSE_EXPORT_ALLOW_OTHER_AUTO;
+     }
++    exp->st_mode = S_IFREG | S_IRUSR;
++    if (exp->writable) {
++        exp->st_mode |= S_IWUSR;
++    }
++    exp->st_uid = getuid();
++    exp->st_gid = getgid();
++
+     if (args->allow_other == FUSE_EXPORT_ALLOW_OTHER_AUTO) {
+         /* Ignore errors on our first attempt */
+         ret = setup_fuse_export(exp, args->mountpoint, true, NULL);
+@@ -XXX,XX +XXX,XX @@ static void fuse_getattr(fuse_req_t req, fuse_ino_t inode,
+     int64_t length, allocated_blocks;
+     time_t now = time(NULL);
+     FuseExport *exp = fuse_req_userdata(req);
+-    mode_t mode;
+     length = blk_getlength(exp->common.blk);
+     if (length < 0) {
+@@ -XXX,XX +XXX,XX @@ static void fuse_getattr(fuse_req_t req, fuse_ino_t inode,
+         allocated_blocks = DIV_ROUND_UP(allocated_blocks, 512);
+     }
+-    mode = S_IFREG | S_IRUSR;
+-    if (exp->writable) {
+-        mode |= S_IWUSR;
+-    }
+-
+     statbuf = (struct stat) {
+         .st_ino     = inode,
+-        .st_mode    = mode,
++        .st_mode    = exp->st_mode,
+         .st_nlink   = 1,
+-        .st_uid     = getuid(),
+-        .st_gid     = getgid(),
++        .st_uid     = exp->st_uid,
++        .st_gid     = exp->st_gid,
+         .st_size    = length,
+         .st_blksize = blk_bs(exp->common.blk)->bl.request_alignment,
+         .st_blocks  = allocated_blocks,
+@@ -XXX,XX +XXX,XX @@ static int fuse_do_truncate(const FuseExport *exp, int64_t size,
+ }
+ /**
+- * Let clients set file attributes.  Only resizing is supported.
++ * Let clients set file attributes.  Only resizing and changing
++ * permissions (st_mode, st_uid, st_gid) is allowed.
++ * Changing permissions is only allowed as far as it will actually
++ * permit access: Read-only exports cannot be given +w, and exports
++ * without allow_other cannot be given a different UID or GID, and
++ * they cannot be given non-owner access.
+  */
+ static void fuse_setattr(fuse_req_t req, fuse_ino_t inode, struct stat *statbuf,
+                          int to_set, struct fuse_file_info *fi)
+ {
+     FuseExport *exp = fuse_req_userdata(req);
++    int supported_attrs;
+     int ret;
+-    if (to_set & ~FUSE_SET_ATTR_SIZE) {
++    supported_attrs = FUSE_SET_ATTR_SIZE | FUSE_SET_ATTR_MODE;
++    if (exp->allow_other) {
++        supported_attrs |= FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID;
++    }
++
++    if (to_set & ~supported_attrs) {
+         fuse_reply_err(req, ENOTSUP);
+         return;
+     }
++    /* Do some argument checks first before committing to anything */
++    if (to_set & FUSE_SET_ATTR_MODE) {
++        /*
++         * Without allow_other, non-owners can never access the export, so do
++         * not allow setting permissions for them
++         */
++        if (!exp->allow_other &&
++            (statbuf->st_mode & (S_IRWXG | S_IRWXO)) != 0)
++        {
++            fuse_reply_err(req, EPERM);
++            return;
++        }
++
++        /* +w for read-only exports makes no sense, disallow it */
++        if (!exp->writable &&
++            (statbuf->st_mode & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0)
++        {
++            fuse_reply_err(req, EROFS);
++            return;
++        }
++    }
++
+     if (to_set & FUSE_SET_ATTR_SIZE) {
+         if (!exp->writable) {
+             fuse_reply_err(req, EACCES);
+@@ -XXX,XX +XXX,XX @@ static void fuse_setattr(fuse_req_t req, fuse_ino_t inode, struct stat *statbuf,
+         }
+     }
++    if (to_set & FUSE_SET_ATTR_MODE) {
++        /* Ignore FUSE-supplied file type, only change the mode */
++        exp->st_mode = (statbuf->st_mode & 07777) | S_IFREG;
++    }
++
++    if (to_set & FUSE_SET_ATTR_UID) {
++        exp->st_uid = statbuf->st_uid;
++    }
++
++    if (to_set & FUSE_SET_ATTR_GID) {
++        exp->st_gid = statbuf->st_gid;
++    }
++
+     fuse_getattr(req, inode, fi);
+ }
+--
+.31.1

-New patch
+[PULL 14/28] iotests/308: Test +w on read-only FUSE exports
+From: Max Reitz <mreitz@redhat.com>
+Test that +w on read-only FUSE exports returns an EROFS error.  u+x on
+the other hand should work.  (There is no special reason to choose u+x
+here, it simply is like +w another flag that is not set by default.)
+Signed-off-by: Max Reitz <mreitz@redhat.com>
+Message-Id: <20210625142317.271673-6-mreitz@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/qemu-iotests/308     | 11 +++++++++++
+ tests/qemu-iotests/308.out |  4 ++++
+files changed, 15 insertions(+)
+diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/308
++++ b/tests/qemu-iotests/308
+@@ -XXX,XX +XXX,XX @@ fuse_export_add 'export-mp' "'mountpoint': '$EXT_MP'"
+ # Check that the export presents the same data as the original image
+ $QEMU_IMG compare -f raw -F $IMGFMT -U "$EXT_MP" "$TEST_IMG"
++# Some quick chmod tests
++stat -c 'Permissions pre-chmod: %a' "$EXT_MP"
++
++# Verify that we cannot set +w
++chmod u+w "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
++stat -c 'Permissions post-+w: %a' "$EXT_MP"
++
++# But that we can set, say, +x (if we are so inclined)
++chmod u+x "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
++stat -c 'Permissions post-+x: %a' "$EXT_MP"
++
+ echo
+ echo '=== Mount over existing file ==='
+diff --git a/tests/qemu-iotests/308.out b/tests/qemu-iotests/308.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/308.out
++++ b/tests/qemu-iotests/308.out
+@@ -XXX,XX +XXX,XX @@ wrote 67108864/67108864 bytes at offset 0
+           } }
+ {"return": {}}
+ Images are identical.
++Permissions pre-chmod: 400
++chmod: changing permissions of 'TEST_DIR/t.IMGFMT.fuse': Read-only file system
++Permissions post-+w: 400
++Permissions post-+x: 500
+ === Mount over existing file ===
+ {'execute': 'block-export-add',
+--
+.31.1

-New patch
+[PULL 15/28] iotests/fuse-allow-other: Test allow-other
+From: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Max Reitz <mreitz@redhat.com>
 Message-Id: <20210625142317.271673-7-mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  tests/qemu-iotests/tests/fuse-allow-other     | 168 ++++++++++++++++++
  tests/qemu-iotests/tests/fuse-allow-other.out |  88 +++++++++
 files changed, 256 insertions(+)
  create mode 100755 tests/qemu-iotests/tests/fuse-allow-other
  create mode 100644 tests/qemu-iotests/tests/fuse-allow-other.out
 diff --git a/tests/qemu-iotests/tests/fuse-allow-other b/tests/qemu-iotests/tests/fuse-allow-other
 new file mode 100755
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qemu-iotests/tests/fuse-allow-other
@@ -XXX,XX +XXX,XX @@
 +#!/usr/bin/env bash
 +# group: rw
 +#
 +# Test FUSE exports' allow-other option
 +#
 +# Copyright (C) 2021 Red Hat, Inc.
 +#
 +# This program is free software; you can redistribute it and/or modify
 +# it under the terms of the GNU General Public License as published by
 +# the Free Software Foundation; either version 2 of the License, or
 +# (at your option) any later version.
 +#
 +# This program is distributed in the hope that it will be useful,
 +# but WITHOUT ANY WARRANTY; without even the implied warranty of
 +# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 +# GNU General Public License for more details.
 +#
 +# You should have received a copy of the GNU General Public License
 +# along with this program.  If not, see <http://www.gnu.org/licenses/>.
 +#
 +
 +seq=$(basename "$0")
 +echo "QA output created by $seq"
 +
 +status=1    # failure is the default!
 +
 +_cleanup()
 +{
 +    _cleanup_qemu
 +    _cleanup_test_img
 +    rm -f "$EXT_MP"
 +}
 +trap "_cleanup; exit \$status" 0 1 2 3 15
 +
 +# get standard environment, filters and checks
 +. ../common.rc
 +. ../common.filter
 +. ../common.qemu
 +
 +_supported_fmt generic
 +
 +_supported_proto file # We create the FUSE export manually
 +
 +sudo -n -u nobody true || \
 +    _notrun 'Password-less sudo as nobody required to test allow_other'
 +
 +# $1: Export ID
 +# $2: Options (beyond the node-name and ID)
 +# $3: Expected return value (defaults to 'return')
 +# $4: Node to export (defaults to 'node-format')
 +fuse_export_add()
 +{
 +    allow_other_not_supported='option allow_other only allowed if'
 +
 +    output=$(
 +        success_or_failure=yes _send_qemu_cmd $QEMU_HANDLE \
 +            "{'execute': 'block-export-add',
 +              'arguments': {
 +                  'type': 'fuse',
 +                  'id': '$1',
 +                  'node-name': '${4:-node-format}',
 +                  $2
 +              } }" \
 +            "${3:-return}" \
 +            "$allow_other_not_supported" \
 +            | _filter_imgfmt
 +    )
 +
 +    if echo "$output" | grep -q "$allow_other_not_supported"; then
 +        # Shut down qemu gracefully so it can unmount the export
 +        _send_qemu_cmd $QEMU_HANDLE \
 +            "{'execute': 'quit'}" \
 +            'return'
 +
 +        wait=yes _cleanup_qemu
 +
 +        _notrun "allow_other not supported"
 +    fi
 +
 +    echo "$output"
 +}
 +
 +EXT_MP="$TEST_DIR/fuse-export"
 +
 +_make_test_img 64k
 +touch "$EXT_MP"
 +
 +echo
 +echo '=== Test permissions ==='
 +
 +# $1: allow-other value ('on'/'off'/'auto')
 +run_permission_test()
 +{
 +    _launch_qemu \
 +        -blockdev \
 +        "$IMGFMT,node-name=node-format,file.driver=file,file.filename=$TEST_IMG"
 +
 +    _send_qemu_cmd $QEMU_HANDLE \
 +        "{'execute': 'qmp_capabilities'}" \
 +        'return'
 +
 +    fuse_export_add 'export' \
 +        "'mountpoint': '$EXT_MP',
 +         'allow-other': '$1'"
 +
 +    # Should always work
 +    echo '(Removing all permissions)'
 +    chmod 000 "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
 +    stat -c 'Permissions post-chmod: %a' "$EXT_MP"
 +
 +    # Should always work
 +    echo '(Granting u+r)'
 +    chmod u+r "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
 +    stat -c 'Permissions post-chmod: %a' "$EXT_MP"
 +
 +    # Should only work with allow-other: Otherwise, no permissions can be
 +    # granted to the group or others
 +    echo '(Granting read permissions for everyone)'
 +    chmod 444 "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
 +    stat -c 'Permissions post-chmod: %a' "$EXT_MP"
 +
 +    echo 'Doing operations as nobody:'
 +    # Change to TEST_DIR, so nobody will not have to attempt a lookup
 +    pushd "$TEST_DIR" >/dev/null
 +
 +    # This is already prevented by the permissions (without allow-other, FUSE
 +    # exports always have o-r), but test it anyway
 +    sudo -n -u nobody cat fuse-export >/dev/null
 +
 +    # If the only problem were the lack of permissions, we should still be able
 +    # to stat the export as nobody; it should not work without allow-other,
 +    # though
 +    sudo -n -u nobody \
 +        stat -c 'Permissions seen by nobody: %a' fuse-export 2>&1 \
 +        | _filter_imgfmt
 +
 +    # To prove the point, revoke read permissions for others and try again
 +    chmod o-r fuse-export 2>&1 | _filter_testdir | _filter_imgfmt
 +
 +    # Should fail
 +    sudo -n -u nobody cat fuse-export >/dev/null
 +    # Should work with allow_other
 +    sudo -n -u nobody \
 +        stat -c 'Permissions seen by nobody: %a' fuse-export 2>&1 \
 +        | _filter_imgfmt
 +
 +    popd >/dev/null
 +
 +    _send_qemu_cmd $QEMU_HANDLE \
 +        "{'execute': 'quit'}" \
 +        'return'
 +
 +    wait=yes _cleanup_qemu
 +}
 +
 +# 'auto' should behave exactly like 'on', because 'on' tests that
 +# allow_other works (otherwise, this test is skipped)
 +for ao in off on auto; do
 +    echo
 +    echo "--- allow-other=$ao ---"
 +
 +    run_permission_test "$ao"
 +done
 +
 +# success, all done
 +echo "*** done"
 +rm -f $seq.full
 +status=0
 diff --git a/tests/qemu-iotests/tests/fuse-allow-other.out b/tests/qemu-iotests/tests/fuse-allow-other.out
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qemu-iotests/tests/fuse-allow-other.out
@@ -XXX,XX +XXX,XX @@
 +QA output created by fuse-allow-other
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=65536
 +
 +=== Test permissions ===
 +
 +--- allow-other=off ---
 +{'execute': 'qmp_capabilities'}
 +{"return": {}}
 +{'execute': 'block-export-add',
 +              'arguments': {
 +                  'type': 'fuse',
 +                  'id': 'export',
 +                  'node-name': 'node-format',
 +                  'mountpoint': 'TEST_DIR/fuse-export',
 +         'allow-other': 'off'
 +              } }
 +{"return": {}}
 +(Removing all permissions)
 +Permissions post-chmod: 0
 +(Granting u+r)
 +Permissions post-chmod: 400
 +(Granting read permissions for everyone)
 +chmod: changing permissions of 'TEST_DIR/fuse-export': Operation not permitted
 +Permissions post-chmod: 400
 +Doing operations as nobody:
 +cat: fuse-export: Permission denied
 +stat: cannot statx 'fuse-export': Permission denied
 +cat: fuse-export: Permission denied
 +stat: cannot statx 'fuse-export': Permission denied
 +{'execute': 'quit'}
 +{"return": {}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
 +
 +--- allow-other=on ---
 +{'execute': 'qmp_capabilities'}
 +{"return": {}}
 +{'execute': 'block-export-add',
 +              'arguments': {
 +                  'type': 'fuse',
 +                  'id': 'export',
 +                  'node-name': 'node-format',
 +                  'mountpoint': 'TEST_DIR/fuse-export',
 +         'allow-other': 'on'
 +              } }
 +{"return": {}}
 +(Removing all permissions)
 +Permissions post-chmod: 0
 +(Granting u+r)
 +Permissions post-chmod: 400
 +(Granting read permissions for everyone)
 +Permissions post-chmod: 444
 +Doing operations as nobody:
 +Permissions seen by nobody: 444
 +cat: fuse-export: Permission denied
 +Permissions seen by nobody: 440
 +{'execute': 'quit'}
 +{"return": {}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
 +
 +--- allow-other=auto ---
 +{'execute': 'qmp_capabilities'}
 +{"return": {}}
 +{'execute': 'block-export-add',
 +              'arguments': {
 +                  'type': 'fuse',
 +                  'id': 'export',
 +                  'node-name': 'node-format',
 +                  'mountpoint': 'TEST_DIR/fuse-export',
 +         'allow-other': 'auto'
 +              } }
 +{"return": {}}
 +(Removing all permissions)
 +Permissions post-chmod: 0
 +(Granting u+r)
 +Permissions post-chmod: 400
 +(Granting read permissions for everyone)
 +Permissions post-chmod: 444
 +Doing operations as nobody:
 +Permissions seen by nobody: 444
 +cat: fuse-export: Permission denied
 +Permissions seen by nobody: 440
 +{'execute': 'quit'}
 +{"return": {}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
 +{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
 +*** done
 --
 .31.1

-New patch
+[PULL 16/28] block/rbd: fix type of task->complete
+From: Peter Lieven <pl@kamp.de>
+task->complete is a bool not an integer.
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Message-Id: <20210707180449.32665-1-pl@kamp.de>
+Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/rbd.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/block/rbd.c b/block/rbd.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/rbd.c
++++ b/block/rbd.c
+@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_resize(BlockDriverState *bs, uint64_t size)
+ static void qemu_rbd_finish_bh(void *opaque)
+ {
+     RBDTask *task = opaque;
+-    task->complete = 1;
++    task->complete = true;
+     aio_co_wake(task->co);
+ }
+--
+.31.1

-New patch
+[PULL 17/28] MAINTAINERS: add block/rbd.c reviewer
+From: Peter Lieven <pl@kamp.de>
+adding myself as a designated reviewer.
+Signed-off-by: Peter Lieven <pl@kamp.de>
+Message-Id: <20210707180449.32665-2-pl@kamp.de>
+Acked-by: Ilya Dryomov <idryomov@gmail.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ MAINTAINERS | 1 +
+file changed, 1 insertion(+)
+diff --git a/MAINTAINERS b/MAINTAINERS
+index XXXXXXX..XXXXXXX 100644
+--- a/MAINTAINERS
++++ b/MAINTAINERS
+@@ -XXX,XX +XXX,XX @@ F: block/vmdk.c
+ RBD
+ M: Ilya Dryomov <idryomov@gmail.com>
++R: Peter Lieven <pl@kamp.de>
+ L: qemu-block@nongnu.org
+ S: Supported
+ F: block/rbd.c
+--
+.31.1

-New patch
+[PULL 18/28] vhost-user: Fix backends without multiqueue support
+dev->max_queues was never initialised for backends that don't support
+VHOST_USER_PROTOCOL_F_MQ, so it would use 0 as the maximum number of
+queues to check against and consequently fail for any such backend.
+Set it to 1 if the backend doesn't have multiqueue support.
+Fixes: c90bd505a3e8210c23d69fecab9ee6f56ec4a161
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210705171429.29286-1-kwolf@redhat.com>
+Reviewed-by: Cornelia Huck <cohuck@redhat.com>
+Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ hw/virtio/vhost-user.c | 3 +++
+file changed, 3 insertions(+)
+diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/virtio/vhost-user.c
++++ b/hw/virtio/vhost-user.c
+@@ -XXX,XX +XXX,XX @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque,
+             if (err < 0) {
+                 return -EPROTO;
+             }
++        } else {
++            dev->max_queues = 1;
+         }
++
+         if (dev->num_queues && dev->max_queues < dev->num_queues) {
+             error_setg(errp, "The maximum number of queues supported by the "
+                        "backend is %" PRIu64, dev->max_queues);
+--
+.31.1

-New patch
+[PULL 19/28] blockdev: fix drive-backup transaction endless drained section
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+drive_backup_prepare() does bdrv_drained_begin() in hope that
+bdrv_drained_end() will be called in drive_backup_clean(). Still we
+need to set state->bs for this to work. That's done too late: a lot of
+failure paths in drive_backup_prepare() miss setting state->bs. Fix
+that.
+Fixes: 2288ccfac96281c316db942d10e3f921c1373064
+Fixes: https://gitlab.com/qemu-project/qemu/-/issues/399
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20210608171852.250775-1-vsementsov@virtuozzo.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ blockdev.c | 3 +--
+file changed, 1 insertion(+), 2 deletions(-)
+diff --git a/blockdev.c b/blockdev.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
+     aio_context = bdrv_get_aio_context(bs);
+     aio_context_acquire(aio_context);
++    state->bs = bs;
+     /* Paired with .clean() */
+     bdrv_drained_begin(bs);
+@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
+         }
+     }
+-    state->bs = bs;
+-
+     state->job = do_backup_common(qapi_DriveBackup_base(backup),
+                                   bs, target_bs, aio_context,
+                                   common->block_job_txn, errp);
+--
+.31.1

-New patch
+[PULL 20/28] qcow2: Prohibit backing file changes in 'qemu-img amend'
+From: Eric Blake <eblake@redhat.com>
+This was deprecated back in bc5ee6da7 (qcow2: Deprecate use of
+qemu-img amend to change backing file), and no one in the meantime has
+given any reasons why it should be supported.  Time to make change
+attempts a hard error (but for convenience, specifying the _same_
+backing chain is not forbidden).  Update a couple of iotests to match.
+Signed-off-by: Eric Blake <eblake@redhat.com>
+Message-Id: <20210503213600.569128-2-eblake@redhat.com>
+Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ docs/system/deprecated.rst       | 12 ------------
+ docs/system/removed-features.rst | 12 ++++++++++++
+ block/qcow2.c                    | 13 ++++---------
+ tests/qemu-iotests/061           |  3 +++
+ tests/qemu-iotests/061.out       |  3 ++-
+ tests/qemu-iotests/082.out       |  6 ++++--
+files changed, 25 insertions(+), 24 deletions(-)
+diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/deprecated.rst
++++ b/docs/system/deprecated.rst
+@@ -XXX,XX +XXX,XX @@ this CPU is also deprecated.
+ Related binaries
+ ----------------
+-qemu-img amend to adjust backing file (since 5.1)
+-'''''''''''''''''''''''''''''''''''''''''''''''''
+-
+-The use of ``qemu-img amend`` to modify the name or format of a qcow2
+-backing image is deprecated; this functionality was never fully
+-documented or tested, and interferes with other amend operations that
+-need access to the original backing image (such as deciding whether a
+-v3 zero cluster may be left unallocated when converting to a v2
+-image).  Rather, any changes to the backing chain should be performed
+-with ``qemu-img rebase -u`` either before or after the remaining
+-changes being performed by amend, as appropriate.
+-
+ qemu-img backing file without format (since 5.1)
+ ''''''''''''''''''''''''''''''''''''''''''''''''
+diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
+index XXXXXXX..XXXXXXX 100644
+--- a/docs/system/removed-features.rst
++++ b/docs/system/removed-features.rst
+@@ -XXX,XX +XXX,XX @@ topologies described with -smp include all possible cpus, i.e.
+ The ``enforce-config-section`` property was replaced by the
+ ``-global migration.send-configuration={on|off}`` option.
++qemu-img amend to adjust backing file (removed in 6.1)
++''''''''''''''''''''''''''''''''''''''''''''''''''''''
++
++The use of ``qemu-img amend`` to modify the name or format of a qcow2
++backing image was never fully documented or tested, and interferes
++with other amend operations that need access to the original backing
++image (such as deciding whether a v3 zero cluster may be left
++unallocated when converting to a v2 image).  Any changes to the
++backing chain should be performed with ``qemu-img rebase -u`` either
++before or after the remaining changes being performed by amend, as
++appropriate.
++
+ Block devices
+ -------------
+diff --git a/block/qcow2.c b/block/qcow2.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/qcow2.c
++++ b/block/qcow2.c
+@@ -XXX,XX +XXX,XX @@ static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
+     if (backing_file || backing_format) {
+         if (g_strcmp0(backing_file, s->image_backing_file) ||
+             g_strcmp0(backing_format, s->image_backing_format)) {
+-            warn_report("Deprecated use of amend to alter the backing file; "
+-                        "use qemu-img rebase instead");
+-        }
+-        ret = qcow2_change_backing_file(bs,
+-                    backing_file ?: s->image_backing_file,
+-                    backing_format ?: s->image_backing_format);
+-        if (ret < 0) {
+-            error_setg_errno(errp, -ret, "Failed to change the backing file");
+-            return ret;
++            error_setg(errp, "Cannot amend the backing file");
++            error_append_hint(errp,
++                              "You can use 'qemu-img rebase' instead.\n");
++            return -EINVAL;
+         }
+     }
+diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/061
++++ b/tests/qemu-iotests/061
+@@ -XXX,XX +XXX,XX @@ _make_test_img -o "compat=1.1" 64M
+ TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
+ $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
+ $QEMU_IO -c "read -P 0 0 128k" "$TEST_IMG" | _filter_qemu_io
++$QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" \
++      "$TEST_IMG" && echo "unexpected pass"
++$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F qcow2 "$TEST_IMG"
+ $QEMU_IMG amend -o "backing_file=$TEST_IMG.base,backing_fmt=qcow2" "$TEST_IMG"
+ $QEMU_IO -c "read -P 0x2a 0 128k" "$TEST_IMG" | _filter_qemu_io
+ _check_test_img
+diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/061.out
++++ b/tests/qemu-iotests/061.out
+@@ -XXX,XX +XXX,XX @@ wrote 131072/131072 bytes at offset 0
+KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ read 131072/131072 bytes at offset 0
+KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+-qemu-img: warning: Deprecated use of amend to alter the backing file; use qemu-img rebase instead
++qemu-img: Cannot amend the backing file
++You can use 'qemu-img rebase' instead.
+ read 131072/131072 bytes at offset 0
+KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+ No errors were found on the image.
+diff --git a/tests/qemu-iotests/082.out b/tests/qemu-iotests/082.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/082.out
++++ b/tests/qemu-iotests/082.out
+@@ -XXX,XX +XXX,XX @@ Amend options for 'qcow2':
+   size=<size>            - Virtual disk size
+ Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2
+-qemu-img: warning: Deprecated use of amend to alter the backing file; use qemu-img rebase instead
++qemu-img: Cannot amend the backing file
++You can use 'qemu-img rebase' instead.
+ Testing: rebase -u -b  -f qcow2 TEST_DIR/t.qcow2
+ Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2
+-qemu-img: warning: Deprecated use of amend to alter the backing file; use qemu-img rebase instead
++qemu-img: Cannot amend the backing file
++You can use 'qemu-img rebase' instead.
+ Testing: rebase -u -b  -f qcow2 TEST_DIR/t.qcow2
+--
+.31.1

-New patch
+[PULL 21/28] qemu-img: Require -F with -b backing image
+From: Eric Blake <eblake@redhat.com>
 Back in commit d9f059aa6c (qemu-img: Deprecate use of -b without -F),
 we deprecated the ability to create a file with a backing image that
 requires qemu to perform format probing.  Qemu can still probe older
 files for backwards compatibility, but it is time to finish off the
 ability to create such images, due to the potential security risk they
 present.  Update a couple of iotests affected by the change.
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20210503213600.569128-3-eblake@redhat.com>
 Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  docs/system/deprecated.rst       | 20 -----------------
  docs/system/removed-features.rst | 19 ++++++++++++++++
  block.c                          | 37 ++++++++++----------------------
  qemu-img.c                       |  6 ++++--
  tests/qemu-iotests/040           |  4 ++--
  tests/qemu-iotests/041           |  6 ++++--
  tests/qemu-iotests/114           | 18 ++++++++--------
  tests/qemu-iotests/114.out       | 11 ++++------
  tests/qemu-iotests/301           |  4 +---
  tests/qemu-iotests/301.out       | 16 ++------------
 files changed, 56 insertions(+), 85 deletions(-)
 diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/deprecated.rst
 +++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ this CPU is also deprecated.
  Related binaries
  ----------------
 -qemu-img backing file without format (since 5.1)
 -''''''''''''''''''''''''''''''''''''''''''''''''
 -
 -The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
 -convert`` to create or modify an image that depends on a backing file
 -now recommends that an explicit backing format be provided.  This is
 -for safety: if QEMU probes a different format than what you thought,
 -the data presented to the guest will be corrupt; similarly, presenting
 -a raw image to a guest allows a potential security exploit if a future
 -probe sees a non-raw image based on guest writes.
 -
 -To avoid the warning message, or even future refusal to create an
 -unsafe image, you must pass ``-o backing_fmt=`` (or the shorthand
 -``-F`` during create) to specify the intended backing format.  You may
 -use ``qemu-img rebase -u`` to retroactively add a backing format to an
 -existing image.  However, be aware that there are already potential
 -security risks to blindly using ``qemu-img info`` to probe the format
 -of an untrusted backing image, when deciding what format to add into
 -an existing image.
 -
  Backwards compatibility
  -----------------------
 diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/system/removed-features.rst
 +++ b/docs/system/removed-features.rst
@@ -XXX,XX +XXX,XX @@ backing chain should be performed with ``qemu-img rebase -u`` either
  before or after the remaining changes being performed by amend, as
  appropriate.
 +qemu-img backing file without format (removed in 6.1)
 +'''''''''''''''''''''''''''''''''''''''''''''''''''''
 +
 +The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
 +convert`` to create or modify an image that depends on a backing file
 +now requires that an explicit backing format be provided.  This is
 +for safety: if QEMU probes a different format than what you thought,
 +the data presented to the guest will be corrupt; similarly, presenting
 +a raw image to a guest allows a potential security exploit if a future
 +probe sees a non-raw image based on guest writes.
 +
 +To avoid creating unsafe backing chains, you must pass ``-o
 +backing_fmt=`` (or the shorthand ``-F`` during create) to specify the
 +intended backing format.  You may use ``qemu-img rebase -u`` to
 +retroactively add a backing format to an existing image.  However, be
 +aware that there are already potential security risks to blindly using
 +``qemu-img info`` to probe the format of an untrusted backing image,
 +when deciding what format to add into an existing image.
 +
  Block devices
  -------------
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_check(BlockDriverState *bs,
   * -ENOTSUP - format driver doesn't support changing the backing file
   */
  int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
 -                             const char *backing_fmt, bool warn)
 +                             const char *backing_fmt, bool require)
  {
      BlockDriver *drv = bs->drv;
      int ret;
@@ -XXX,XX +XXX,XX @@ int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
          return -EINVAL;
      }
 -    if (warn && backing_file && !backing_fmt) {
 -        warn_report("Deprecated use of backing file without explicit "
 -                    "backing format, use of this image requires "
 -                    "potentially unsafe format probing");
 +    if (require && backing_file && !backing_fmt) {
 +        return -EINVAL;
      }
      if (drv->bdrv_change_backing_file != NULL) {
@@ -XXX,XX +XXX,XX @@ void bdrv_img_create(const char *filename, const char *fmt,
              goto out;
          } else {
              if (!backing_fmt) {
 -                warn_report("Deprecated use of backing file without explicit "
 -                            "backing format (detected format of %s)",
 -                            bs->drv->format_name);
 -                if (bs->drv != &bdrv_raw) {
 -                    /*
 -                     * A probe of raw deserves the most attention:
 -                     * leaving the backing format out of the image
 -                     * will ensure bs->probed is set (ensuring we
 -                     * don't accidentally commit into the backing
 -                     * file), and allow more spots to warn the users
 -                     * to fix their toolchain when opening this image
 -                     * later.  For other images, we can safely record
 -                     * the format that we probed.
 -                     */
 -                    backing_fmt = bs->drv->format_name;
 -                    qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, backing_fmt,
 -                                 NULL);
 -                }
 +                error_setg(&local_err,
 +                           "Backing file specified without backing format");
 +                error_append_hint(&local_err, "Detected format of %s.",
 +                                  bs->drv->format_name);
 +                goto out;
              }
              if (size == -1) {
                  /* Opened BS, have no size */
@@ -XXX,XX +XXX,XX @@ void bdrv_img_create(const char *filename, const char *fmt,
          }
          /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
      } else if (backing_file && !backing_fmt) {
 -        warn_report("Deprecated use of unopened backing file without "
 -                    "explicit backing format, use of this image requires "
 -                    "potentially unsafe format probing");
 +        error_setg(&local_err,
 +                   "Backing file specified without backing format");
 +        goto out;
      }
      if (size == -1) {
 diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
      if (out_baseimg_param) {
          if (!qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT)) {
 -            warn_report("Deprecated use of backing file without explicit "
 -                        "backing format");
 +            error_report("Use of backing file requires explicit "
 +                         "backing format");
 +            ret = -1;
 +            goto out;
          }
      }
 diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/040
 +++ b/tests/qemu-iotests/040
@@ -XXX,XX +XXX,XX @@ class TestCommitWithOverriddenBacking(iotests.QMPTestCase):
      def setUp(self):
          qemu_img('create', '-f', iotests.imgfmt, self.img_base_a, '1M')
          qemu_img('create', '-f', iotests.imgfmt, self.img_base_b, '1M')
 -        qemu_img('create', '-f', iotests.imgfmt, '-b', self.img_base_a, \
 -                 self.img_top)
 +        qemu_img('create', '-f', iotests.imgfmt, '-b', self.img_base_a,
 +                 '-F', iotests.imgfmt, self.img_top)
          self.vm = iotests.VM()
          self.vm.launch()
 diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/041
 +++ b/tests/qemu-iotests/041
@@ -XXX,XX +XXX,XX @@ class TestReplaces(iotests.QMPTestCase):
  class TestFilters(iotests.QMPTestCase):
      def setUp(self):
          qemu_img('create', '-f', iotests.imgfmt, backing_img, '1M')
 -        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img, test_img)
 -        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img, target_img)
 +        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img,
 +                 '-F', iotests.imgfmt, test_img)
 +        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img,
 +                 '-F', iotests.imgfmt, target_img)
          qemu_io('-c', 'write -P 1 0 512k', backing_img)
          qemu_io('-c', 'write -P 2 512k 512k', test_img)
 diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/114
 +++ b/tests/qemu-iotests/114
@@ -XXX,XX +XXX,XX @@ _supported_os Linux
  # qcow2.py does not work too well with external data files
  _unsupported_imgopts data_file
 -# Intentionally specify backing file without backing format; demonstrate
 -# the difference in warning messages when backing file could be probed.
 -# Note that only a non-raw probe result will affect the resulting image.
 +# Older qemu-img could set up backing file without backing format; modern
 +# qemu can't but we can use qcow2.py to simulate older files.
  truncate -s $((64 * 1024 * 1024)) "$TEST_IMG.orig"
 -_make_test_img -b "$TEST_IMG.orig" 64M
 +_make_test_img -b "$TEST_IMG.orig" -F raw 64M
 +$PYTHON qcow2.py "$TEST_IMG" del-header-ext 0xE2792ACA
  TEST_IMG="$TEST_IMG.base" _make_test_img 64M
  $QEMU_IMG convert -O qcow2 -B "$TEST_IMG.orig" "$TEST_IMG.orig" "$TEST_IMG"
 -_make_test_img -b "$TEST_IMG.base" 64M
 -_make_test_img -u -b "$TEST_IMG.base" 64M
 +_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 64M
 +_make_test_img -u -b "$TEST_IMG.base" -F $IMGFMT 64M
  # Set an invalid backing file format
  $PYTHON qcow2.py "$TEST_IMG" add-header-ext 0xE2792ACA "foo"
@@ -XXX,XX +XXX,XX @@ _img_info
  $QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
  $QEMU_IO -c "open -o backing.driver=$IMGFMT $TEST_IMG" -c "read 0 4k" | _filter_qemu_io
 -# Rebase the image, to show that omitting backing format triggers a warning,
 -# but probing now lets us use the backing file.
 -$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG"
 +# Rebase the image, to show that backing format is required.
 +($QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG" 2>&1 && echo "unexpected pass") | _filter_testdir
 +$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F $IMGFMT "$TEST_IMG"
  $QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
  # success, all done
 diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/114.out
 +++ b/tests/qemu-iotests/114.out
@@ -XXX,XX +XXX,XX @@
  QA output created by 114
 -qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
 -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig backing_fmt=raw
  Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
 -qemu-img: warning: Deprecated use of backing file without explicit backing format
 -qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
 +qemu-img: Use of backing file requires explicit backing format
 +Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
  Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 -qemu-img: warning: Deprecated use of unopened backing file without explicit backing format, use of this image requires potentially unsafe format probing
 -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
  image: TEST_DIR/t.IMGFMT
  file format: IMGFMT
  virtual size: 64 MiB (67108864 bytes)
@@ -XXX,XX +XXX,XX @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
  no file open, try 'help open'
  read 4096/4096 bytes at offset 0
 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 -qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing
 +qemu-img: Could not change the backing file to 'TEST_DIR/t.qcow2.base': Invalid argument
  read 4096/4096 bytes at offset 0
 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
  *** done
 diff --git a/tests/qemu-iotests/301 b/tests/qemu-iotests/301
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/301
 +++ b/tests/qemu-iotests/301
@@ -XXX,XX +XXX,XX @@
  #
  # Test qcow backing file warnings
  #
 -# Copyright (C) 2020 Red Hat, Inc.
 +# Copyright (C) 2020-2021 Red Hat, Inc.
  #
  # This program is free software; you can redistribute it and/or modify
  # it under the terms of the GNU General Public License as published by
@@ -XXX,XX +XXX,XX @@ echo "== qcow backed by qcow =="
  TEST_IMG="$TEST_IMG.base" _make_test_img $size
  _make_test_img -b "$TEST_IMG.base" $size
 -_img_info
  _make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
  _img_info
@@ -XXX,XX +XXX,XX @@ echo "== qcow backed by raw =="
  rm "$TEST_IMG.base"
  truncate --size=$size "$TEST_IMG.base"
  _make_test_img -b "$TEST_IMG.base" $size
 -_img_info
  _make_test_img -b "$TEST_IMG.base" -F raw $size
  _img_info
 diff --git a/tests/qemu-iotests/301.out b/tests/qemu-iotests/301.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/301.out
 +++ b/tests/qemu-iotests/301.out
@@ -XXX,XX +XXX,XX @@ QA output created by 301
  == qcow backed by qcow ==
  Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432
 -qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
 -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 -image: TEST_DIR/t.IMGFMT
 -file format: IMGFMT
 -virtual size: 32 MiB (33554432 bytes)
 -cluster_size: 512
 -backing file: TEST_DIR/t.IMGFMT.base
 +qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
  Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
  image: TEST_DIR/t.IMGFMT
  file format: IMGFMT
@@ -XXX,XX +XXX,XX @@ cluster_size: 512
  backing file: TEST_DIR/t.IMGFMT.base
  == qcow backed by raw ==
 -qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
 -Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
 -image: TEST_DIR/t.IMGFMT
 -file format: IMGFMT
 -virtual size: 32 MiB (33554432 bytes)
 -cluster_size: 512
 -backing file: TEST_DIR/t.IMGFMT.base
 +qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
  Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=raw
  image: TEST_DIR/t.IMGFMT
  file format: IMGFMT
 --
 .31.1

-[Qemu-devel] [PULL 1/5] qemu-img: allow compressed not-in-order writes
+[PULL 22/28] qemu-img: Improve error for rebase without backing format
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+From: Eric Blake <eblake@redhat.com>
-No reason to forbid them, and they are needed to improve performance
+When removeing support for qemu-img being able to create backing
-with compress-threads in further patches.
+chains without embedded backing formats, we caused a poor error
 message as caught by iotest 114.  Improve the situation to inform the
 user what went wrong.
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Suggested-by: Kevin Wolf <kwolf@redhat.com>
 Signed-off-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20210708155228.2666172-1-eblake@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- qemu-img.c | 5 -----
+ qemu-img.c                 | 3 +++
-file changed, 5 deletions(-)
+ tests/qemu-iotests/114.out | 2 +-
 files changed, 4 insertions(+), 1 deletion(-)
 diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-img.c
 +++ b/qemu-img.c
-@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
+@@ -XXX,XX +XXX,XX @@ static int img_rebase(int argc, char **argv)
-         goto fail_getopt;
+     if (ret == -ENOSPC) {
-     }
+         error_report("Could not change the backing file to '%s': No "
+                      "space left in the file header", out_baseimg);
--    if (!s.wr_in_order && s.compressed) {
++    } else if (ret == -EINVAL && out_baseimg && !out_basefmt) {
--        error_report("Out of order write and compress are mutually exclusive");
++        error_report("Could not change the backing file to '%s': backing "
--        goto fail_getopt;
++                     "format must be specified", out_baseimg);
--    }
+     } else if (ret < 0) {
--
+         error_report("Could not change the backing file to '%s': %s",
-     if (tgt_image_opts && !skip_create) {
+             out_baseimg, strerror(-ret));
-         error_report("--target-image-opts requires use of -n flag");
+diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
-         goto fail_getopt;
+index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/114.out
 +++ b/tests/qemu-iotests/114.out
@@ -XXX,XX +XXX,XX @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
  no file open, try 'help open'
  read 4096/4096 bytes at offset 0
 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 -qemu-img: Could not change the backing file to 'TEST_DIR/t.qcow2.base': Invalid argument
 +qemu-img: Could not change the backing file to 'TEST_DIR/t.qcow2.base': backing format must be specified
  read 4096/4096 bytes at offset 0
 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
  *** done
 --
-.13.6
+.31.1

-[Qemu-devel] [PULL 2/5] qcow2: refactor data compression
+[PULL 23/28] qcow2: Fix dangling pointer after reopen for 'file'
-From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Without an external data file, s->data_file is a second pointer with the
 same value as bs->file. When changing bs->file to a different BdrvChild
 and freeing the old BdrvChild, s->data_file must also be updated,
 otherwise it points to freed memory and causes crashes.
-Make a separate function for compression to be parallelized later.
+This problem was caught by iotests case 245.
  - use .avail_out field instead of .next_out to calculate size of
    compressed data. It looks more natural and it allows to keep dest to
    be void pointer
  - set avail_out to be at least one byte less than input, to be sure
    avoid inefficient compression earlier
-Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Fixes: df2b7086f169239ebad5d150efa29c9bb6d4f820
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210708114709.206487-2-kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/qcow2.c | 76 ++++++++++++++++++++++++++++++++++++++---------------------
+ block/qcow2.c | 29 +++++++++++++++++++++++++++++
-file changed, 49 insertions(+), 27 deletions(-)
+file changed, 29 insertions(+)
 diff --git a/block/qcow2.c b/block/qcow2.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/qcow2.c
 +++ b/block/qcow2.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
-  */
+ static int qcow2_reopen_prepare(BDRVReopenState *state,
+                                 BlockReopenQueue *queue, Error **errp)
- #include "qemu/osdep.h"
+ {
-+
++    BDRVQcow2State *s = state->bs->opaque;
-+#define ZLIB_CONST
+     Qcow2ReopenState *r;
-+#include <zlib.h>
+     int ret;
-+
- #include "block/block_int.h"
+@@ -XXX,XX +XXX,XX @@ static int qcow2_reopen_prepare(BDRVReopenState *state,
- #include "block/qdict.h"
+         }
- #include "sysemu/block-backend.h"
+     }
- #include "qemu/module.h"
--#include <zlib.h>
++    /*
- #include "qcow2.h"
++     * Without an external data file, s->data_file points to the same BdrvChild
- #include "qemu/error-report.h"
++     * as bs->file. It needs to be resynced after reopen because bs->file may
- #include "qapi/error.h"
++     * be changed. We can't use it in the meantime.
-@@ -XXX,XX +XXX,XX @@ fail:
++     */
-     return ret;
++    if (!has_data_file(state->bs)) {
- }
++        assert(s->data_file == state->bs->file);
++        s->data_file = NULL;
 +/*
 + * qcow2_compress()
 + *
 + * @dest - destination buffer, at least of @size-1 bytes
 + * @src - source buffer, @size bytes
 + *
 + * Returns: compressed size on success
 + *          -1 if compression is inefficient
 + *          -2 on any other error
 + */
 +static ssize_t qcow2_compress(void *dest, const void *src, size_t size)
 +{
 +    ssize_t ret;
 +    z_stream strm;
 +
 +    /* best compression, small window, no zlib header */
 +    memset(&strm, 0, sizeof(strm));
 +    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
 +                       -12, 9, Z_DEFAULT_STRATEGY);
 +    if (ret != 0) {
 +        return -2;
 +    }
 +
-+    strm.avail_in = size;
+     return 0;
-+    strm.next_in = src;
-+    strm.avail_out = size - 1;
+ fail:
-+    strm.next_out = dest;
+@@ -XXX,XX +XXX,XX @@ fail:
  static void qcow2_reopen_commit(BDRVReopenState *state)
  {
 +    BDRVQcow2State *s = state->bs->opaque;
 +
-+    ret = deflate(&strm, Z_FINISH);
+     qcow2_update_options_commit(state->bs, state->opaque);
-+    if (ret == Z_STREAM_END) {
++    if (!s->data_file) {
-+        ret = size - 1 - strm.avail_out;
++        /*
-+    } else {
++         * If we don't have an external data file, s->data_file was cleared by
-+        ret = (ret == Z_OK ? -1 : -2);
++         * qcow2_reopen_prepare() and needs to be updated.
 +         */
 +        s->data_file = state->bs->file;
 +    }
+     g_free(state->opaque);
+ }
+@@ -XXX,XX +XXX,XX @@ static void qcow2_reopen_commit_post(BDRVReopenState *state)
+ static void qcow2_reopen_abort(BDRVReopenState *state)
+ {
++    BDRVQcow2State *s = state->bs->opaque;
 +
-+    deflateEnd(&strm);
++    if (!s->data_file) {
-+
++        /*
-+    return ret;
++         * If we don't have an external data file, s->data_file was cleared by
-+}
++         * qcow2_reopen_prepare() and needs to be restored.
-+
++         */
- /* XXX: put compressed sectors first, then all the cluster aligned
++        s->data_file = state->bs->file;
-    tables to avoid losing bytes in alignment */
++    }
- static coroutine_fn int
+     qcow2_update_options_abort(state->bs, state->opaque);
-@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
+     g_free(state->opaque);
-     BDRVQcow2State *s = bs->opaque;
+ }
      QEMUIOVector hd_qiov;
      struct iovec iov;
 -    z_stream strm;
 -    int ret, out_len;
 +    int ret;
 +    size_t out_len;
      uint8_t *buf, *out_buf;
      int64_t cluster_offset;
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
      out_buf = g_malloc(s->cluster_size);
 -    /* best compression, small window, no zlib header */
 -    memset(&strm, 0, sizeof(strm));
 -    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
 -                       Z_DEFLATED, -12,
 -                       9, Z_DEFAULT_STRATEGY);
 -    if (ret != 0) {
 +    out_len = qcow2_compress(out_buf, buf, s->cluster_size);
 +    if (out_len == -2) {
          ret = -EINVAL;
          goto fail;
 -    }
 -
 -    strm.avail_in = s->cluster_size;
 -    strm.next_in = (uint8_t *)buf;
 -    strm.avail_out = s->cluster_size;
 -    strm.next_out = out_buf;
 -
 -    ret = deflate(&strm, Z_FINISH);
 -    if (ret != Z_STREAM_END && ret != Z_OK) {
 -        deflateEnd(&strm);
 -        ret = -EINVAL;
 -        goto fail;
 -    }
 -    out_len = strm.next_out - out_buf;
 -
 -    deflateEnd(&strm);
 -
 -    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
 +    } else if (out_len == -1) {
          /* could not compress: write normal cluster */
          ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
          if (ret < 0) {
 --
-.13.6
+.31.1

-[Qemu-devel] [PULL 4/5] block: Move two block permission constants to the relevant enum
+[PULL 24/28] block: Add bdrv_reopen_queue_free()
-From: Ari Sundholm <ari@tuxera.com>
+From: Alberto Garcia <berto@igalia.com>
-This allows using the two constants outside of block.c, which will
+Move the code to free a BlockReopenQueue to a separate function.
-happen in a subsequent patch.
+It will be used in a subsequent patch.
-Signed-off-by: Ari Sundholm <ari@tuxera.com>
+[ kwolf: Also free explicit_options and options, and explicitly
   qobject_ref() the value when it continues to be used. This makes
   future memory leaks less likely. ]
 Signed-off-by: Alberto Garcia <berto@igalia.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210708114709.206487-3-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- include/block/block.h | 7 +++++++
+ include/block/block.h |  1 +
- block.c               | 6 ------
+ block.c               | 22 ++++++++++++++++------
-files changed, 7 insertions(+), 6 deletions(-)
+files changed, 17 insertions(+), 6 deletions(-)
 diff --git a/include/block/block.h b/include/block/block.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
-@@ -XXX,XX +XXX,XX @@ enum {
+@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
-     BLK_PERM_GRAPH_MOD          = 0x10,
+ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
+                                     BlockDriverState *bs, QDict *options,
-     BLK_PERM_ALL                = 0x1f,
+                                     bool keep_old_opts);
-+
++void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue);
-+    DEFAULT_PERM_PASSTHROUGH    = BLK_PERM_CONSISTENT_READ
+ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
-+                                 | BLK_PERM_WRITE
+ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
-+                                 | BLK_PERM_WRITE_UNCHANGED
+                               Error **errp);
 +                                 | BLK_PERM_RESIZE,
 +
 +    DEFAULT_PERM_UNCHANGED      = BLK_PERM_ALL & ~DEFAULT_PERM_PASSTHROUGH,
  };
  char *bdrv_perm_names(uint64_t perm);
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
-@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
+@@ -XXX,XX +XXX,XX @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
-     return 0;
+                                    NULL, 0, keep_old_opts);
  }
--#define DEFAULT_PERM_PASSTHROUGH (BLK_PERM_CONSISTENT_READ \
++void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
--                                 | BLK_PERM_WRITE \
++{
--                                 | BLK_PERM_WRITE_UNCHANGED \
++    if (bs_queue) {
--                                 | BLK_PERM_RESIZE)
++        BlockReopenQueueEntry *bs_entry, *next;
--#define DEFAULT_PERM_UNCHANGED (BLK_PERM_ALL & ~DEFAULT_PERM_PASSTHROUGH)
++        QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
--
++            qobject_unref(bs_entry->state.explicit_options);
- void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
++            qobject_unref(bs_entry->state.options);
-                                const BdrvChildRole *role,
++            g_free(bs_entry);
-                                BlockReopenQueue *reopen_queue,
++        }
 +        g_free(bs_queue);
 +    }
 +}
 +
  /*
   * Reopen multiple BlockDriverStates atomically & transactionally.
   *
@@ -XXX,XX +XXX,XX @@ abort:
          if (bs_entry->prepared) {
              bdrv_reopen_abort(&bs_entry->state);
          }
 -        qobject_unref(bs_entry->state.explicit_options);
 -        qobject_unref(bs_entry->state.options);
      }
  cleanup:
 -    QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
 -        g_free(bs_entry);
 -    }
 -    g_free(bs_queue);
 +    bdrv_reopen_queue_free(bs_queue);
      return ret;
  }
@@ -XXX,XX +XXX,XX @@ static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
      /* set BDS specific flags now */
      qobject_unref(bs->explicit_options);
      qobject_unref(bs->options);
 +    qobject_ref(reopen_state->explicit_options);
 +    qobject_ref(reopen_state->options);
      bs->explicit_options   = reopen_state->explicit_options;
      bs->options            = reopen_state->options;
 --
-.13.6
+.31.1

-New patch
+[PULL 25/28] block: Acquire AioContexts during bdrv_reopen_multiple()
+As the BlockReopenQueue can contain nodes in multiple AioContexts, only
 one of which may be locked when AIO_WAIT_WHILE() can be called, we can't
 let the caller lock the right contexts. Instead, individually lock the
 AioContext of a single node when iterating the queue.
 Reintroduce bdrv_reopen() as a wrapper for reopening a single node that
 drains the node and temporarily drops the AioContext lock for
 bdrv_reopen_multiple().
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210708114709.206487-4-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  include/block/block.h |  2 ++
  block.c               | 49 ++++++++++++++++++++++++++++++++++++-------
  block/replication.c   |  7 +++++++
  blockdev.c            |  5 +++++
  qemu-io-cmds.c        |  7 +------
 files changed, 57 insertions(+), 13 deletions(-)
 diff --git a/include/block/block.h b/include/block/block.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/block/block.h
 +++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
                                      bool keep_old_opts);
  void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue);
  int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
 +int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
 +                Error **errp);
  int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
                                Error **errp);
  int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
   *
   * All affected nodes must be drained between bdrv_reopen_queue() and
   * bdrv_reopen_multiple().
 + *
 + * To be called from the main thread, with all other AioContexts unlocked.
   */
  int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
  {
      int ret = -1;
      BlockReopenQueueEntry *bs_entry, *next;
 +    AioContext *ctx;
      Transaction *tran = tran_new();
      g_autoptr(GHashTable) found = NULL;
      g_autoptr(GSList) refresh_list = NULL;
 +    assert(qemu_get_current_aio_context() == qemu_get_aio_context());
      assert(bs_queue != NULL);
      QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
 +        ctx = bdrv_get_aio_context(bs_entry->state.bs);
 +        aio_context_acquire(ctx);
          ret = bdrv_flush(bs_entry->state.bs);
 +        aio_context_release(ctx);
          if (ret < 0) {
              error_setg_errno(errp, -ret, "Error flushing drive");
              goto abort;
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
      QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
          assert(bs_entry->state.bs->quiesce_counter > 0);
 +        ctx = bdrv_get_aio_context(bs_entry->state.bs);
 +        aio_context_acquire(ctx);
          ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
 +        aio_context_release(ctx);
          if (ret < 0) {
              goto abort;
          }
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
       * to first element.
       */
      QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
 +        ctx = bdrv_get_aio_context(bs_entry->state.bs);
 +        aio_context_acquire(ctx);
          bdrv_reopen_commit(&bs_entry->state);
 +        aio_context_release(ctx);
      }
      tran_commit(tran);
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
          BlockDriverState *bs = bs_entry->state.bs;
          if (bs->drv->bdrv_reopen_commit_post) {
 +            ctx = bdrv_get_aio_context(bs);
 +            aio_context_acquire(ctx);
              bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
 +            aio_context_release(ctx);
          }
      }
@@ -XXX,XX +XXX,XX @@ abort:
      tran_abort(tran);
      QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
          if (bs_entry->prepared) {
 +            ctx = bdrv_get_aio_context(bs_entry->state.bs);
 +            aio_context_acquire(ctx);
              bdrv_reopen_abort(&bs_entry->state);
 +            aio_context_release(ctx);
          }
      }
@@ -XXX,XX +XXX,XX @@ cleanup:
      return ret;
  }
 -int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
 -                              Error **errp)
 +int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
 +                Error **errp)
  {
 -    int ret;
 +    AioContext *ctx = bdrv_get_aio_context(bs);
      BlockReopenQueue *queue;
 -    QDict *opts = qdict_new();
 -
 -    qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
 +    int ret;
      bdrv_subtree_drained_begin(bs);
 -    queue = bdrv_reopen_queue(NULL, bs, opts, true);
 +    if (ctx != qemu_get_aio_context()) {
 +        aio_context_release(ctx);
 +    }
 +
 +    queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
      ret = bdrv_reopen_multiple(queue, errp);
 +
 +    if (ctx != qemu_get_aio_context()) {
 +        aio_context_acquire(ctx);
 +    }
      bdrv_subtree_drained_end(bs);
      return ret;
  }
 +int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
 +                              Error **errp)
 +{
 +    QDict *opts = qdict_new();
 +
 +    qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
 +
 +    return bdrv_reopen(bs, opts, true, errp);
 +}
 +
  /*
   * Take a BDRVReopenState and check if the value of 'backing' in the
   * reopen_state->options QDict is valid or not.
 diff --git a/block/replication.c b/block/replication.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/replication.c
 +++ b/block/replication.c
@@ -XXX,XX +XXX,XX @@ static void reopen_backing_file(BlockDriverState *bs, bool writable,
      }
      if (reopen_queue) {
 +        AioContext *ctx = bdrv_get_aio_context(bs);
 +        if (ctx != qemu_get_aio_context()) {
 +            aio_context_release(ctx);
 +        }
          bdrv_reopen_multiple(reopen_queue, errp);
 +        if (ctx != qemu_get_aio_context()) {
 +            aio_context_acquire(ctx);
 +        }
      }
      bdrv_subtree_drained_end(s->hidden_disk->bs);
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ void qmp_x_blockdev_reopen(BlockdevOptions *options, Error **errp)
      ctx = bdrv_get_aio_context(bs);
      aio_context_acquire(ctx);
      bdrv_subtree_drained_begin(bs);
 +    aio_context_release(ctx);
 +
      queue = bdrv_reopen_queue(NULL, bs, qdict, false);
      bdrv_reopen_multiple(queue, errp);
 +
 +    ctx = bdrv_get_aio_context(bs);
 +    aio_context_acquire(ctx);
      bdrv_subtree_drained_end(bs);
      aio_context_release(ctx);
 diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-io-cmds.c
 +++ b/qemu-io-cmds.c
@@ -XXX,XX +XXX,XX @@ static int reopen_f(BlockBackend *blk, int argc, char **argv)
      bool writethrough = !blk_enable_write_cache(blk);
      bool has_rw_option = false;
      bool has_cache_option = false;
 -
 -    BlockReopenQueue *brq;
      Error *local_err = NULL;
      while ((c = getopt(argc, argv, "c:o:rw")) != -1) {
@@ -XXX,XX +XXX,XX @@ static int reopen_f(BlockBackend *blk, int argc, char **argv)
          qdict_put_bool(opts, BDRV_OPT_CACHE_NO_FLUSH, flags & BDRV_O_NO_FLUSH);
      }
 -    bdrv_subtree_drained_begin(bs);
 -    brq = bdrv_reopen_queue(NULL, bs, opts, true);
 -    bdrv_reopen_multiple(brq, &local_err);
 -    bdrv_subtree_drained_end(bs);
 +    bdrv_reopen(bs, opts, true, &local_err);
      if (local_err) {
          error_report_err(local_err);
 --
 .31.1

-New patch
+[PULL 26/28] block: Support multiple reopening with x-blockdev-reopen
+From: Alberto Garcia <berto@igalia.com>
 [ kwolf: Fixed AioContext locking ]
 Signed-off-by: Alberto Garcia <berto@igalia.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210708114709.206487-5-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  qapi/block-core.json                          | 18 +++--
  blockdev.c                                    | 81 ++++++++++---------
  tests/qemu-iotests/155                        |  9 ++-
  tests/qemu-iotests/165                        |  4 +-
  tests/qemu-iotests/245                        | 27 ++++---
  tests/qemu-iotests/248                        |  2 +-
  tests/qemu-iotests/248.out                    |  2 +-
  tests/qemu-iotests/296                        |  9 ++-
  tests/qemu-iotests/298                        |  4 +-
  .../tests/remove-bitmap-from-backing          | 18 +++--
 files changed, 99 insertions(+), 75 deletions(-)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
  ##
  # @x-blockdev-reopen:
  #
 -# Reopens a block device using the given set of options. Any option
 -# not specified will be reset to its default value regardless of its
 -# previous status. If an option cannot be changed or a particular
 +# Reopens one or more block devices using the given set of options.
 +# Any option not specified will be reset to its default value regardless
 +# of its previous status. If an option cannot be changed or a particular
  # driver does not support reopening then the command will return an
 -# error.
 +# error. All devices in the list are reopened in one transaction, so
 +# if one of them fails then the whole transaction is cancelled.
  #
 -# The top-level @node-name option (from BlockdevOptions) must be
 +# The command receives a list of block devices to reopen. For each one
 +# of them, the top-level @node-name option (from BlockdevOptions) must be
  # specified and is used to select the block device to be reopened.
  # Other @node-name options must be either omitted or set to the
  # current name of the appropriate node. This command won't change any
@@ -XXX,XX +XXX,XX @@
  #
  #  4) NULL: the current child (if any) is detached.
  #
 -# Options (1) and (2) are supported in all cases, but at the moment
 -# only @backing allows replacing or detaching an existing child.
 +# Options (1) and (2) are supported in all cases. Option (3) is
 +# supported for @file and @backing, and option (4) for @backing only.
  #
  # Unlike with blockdev-add, the @backing option must always be present
  # unless the node being reopened does not have a backing file and its
@@ -XXX,XX +XXX,XX @@
  # Since: 4.0
  ##
  { 'command': 'x-blockdev-reopen',
 -  'data': 'BlockdevOptions', 'boxed': true }
 +  'data': { 'options': ['BlockdevOptions'] } }
  ##
  # @blockdev-del:
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ fail:
      visit_free(v);
  }
 -void qmp_x_blockdev_reopen(BlockdevOptions *options, Error **errp)
 -{
 -    BlockDriverState *bs;
 -    AioContext *ctx;
 -    QObject *obj;
 -    Visitor *v = qobject_output_visitor_new(&obj);
 -    BlockReopenQueue *queue;
 -    QDict *qdict;
 +void qmp_x_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 +{
 +    BlockReopenQueue *queue = NULL;
 +    GSList *drained = NULL;
 +
 +    /* Add each one of the BDS that we want to reopen to the queue */
 +    for (; reopen_list != NULL; reopen_list = reopen_list->next) {
 +        BlockdevOptions *options = reopen_list->value;
 +        BlockDriverState *bs;
 +        AioContext *ctx;
 +        QObject *obj;
 +        Visitor *v;
 +        QDict *qdict;
 +
 +        /* Check for the selected node name */
 +        if (!options->has_node_name) {
 +            error_setg(errp, "node-name not specified");
 +            goto fail;
 +        }
 -    /* Check for the selected node name */
 -    if (!options->has_node_name) {
 -        error_setg(errp, "node-name not specified");
 -        goto fail;
 -    }
 +        bs = bdrv_find_node(options->node_name);
 +        if (!bs) {
 +            error_setg(errp, "Failed to find node with node-name='%s'",
 +                       options->node_name);
 +            goto fail;
 +        }
 -    bs = bdrv_find_node(options->node_name);
 -    if (!bs) {
 -        error_setg(errp, "Failed to find node with node-name='%s'",
 -                   options->node_name);
 -        goto fail;
 -    }
 +        /* Put all options in a QDict and flatten it */
 +        v = qobject_output_visitor_new(&obj);
 +        visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
 +        visit_complete(v, &obj);
 +        visit_free(v);
 -    /* Put all options in a QDict and flatten it */
 -    visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
 -    visit_complete(v, &obj);
 -    qdict = qobject_to(QDict, obj);
 +        qdict = qobject_to(QDict, obj);
 -    qdict_flatten(qdict);
 +        qdict_flatten(qdict);
 -    /* Perform the reopen operation */
 -    ctx = bdrv_get_aio_context(bs);
 -    aio_context_acquire(ctx);
 -    bdrv_subtree_drained_begin(bs);
 -    aio_context_release(ctx);
 +        ctx = bdrv_get_aio_context(bs);
 +        aio_context_acquire(ctx);
 -    queue = bdrv_reopen_queue(NULL, bs, qdict, false);
 -    bdrv_reopen_multiple(queue, errp);
 +        bdrv_subtree_drained_begin(bs);
 +        queue = bdrv_reopen_queue(queue, bs, qdict, false);
 +        drained = g_slist_prepend(drained, bs);
 -    ctx = bdrv_get_aio_context(bs);
 -    aio_context_acquire(ctx);
 -    bdrv_subtree_drained_end(bs);
 -    aio_context_release(ctx);
 +        aio_context_release(ctx);
 +    }
 +
 +    /* Perform the reopen operation */
 +    bdrv_reopen_multiple(queue, errp);
 +    queue = NULL;
  fail:
 -    visit_free(v);
 +    bdrv_reopen_queue_free(queue);
 +    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
  }
  void qmp_blockdev_del(const char *node_name, Error **errp)
 diff --git a/tests/qemu-iotests/155 b/tests/qemu-iotests/155
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/155
 +++ b/tests/qemu-iotests/155
@@ -XXX,XX +XXX,XX @@ class TestBlockdevMirrorReopen(MirrorBaseClass):
              result = self.vm.qmp('blockdev-add', node_name="backing",
                                   driver="null-co")
              self.assert_qmp(result, 'return', {})
 -            result = self.vm.qmp('x-blockdev-reopen', node_name="target",
 -                                 driver=iotests.imgfmt, file="target-file",
 -                                 backing="backing")
 +            result = self.vm.qmp('x-blockdev-reopen', options=[{
 +                                     'node-name': "target",
 +                                     'driver': iotests.imgfmt,
 +                                     'file': "target-file",
 +                                     'backing': "backing"
 +                                 }])
              self.assert_qmp(result, 'return', {})
  class TestBlockdevMirrorReopenIothread(TestBlockdevMirrorReopen):
 diff --git a/tests/qemu-iotests/165 b/tests/qemu-iotests/165
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/165
 +++ b/tests/qemu-iotests/165
@@ -XXX,XX +XXX,XX @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
          assert sha256_1 == self.getSha256()
          # Reopen to RW
 -        result = self.vm.qmp('x-blockdev-reopen', **{
 +        result = self.vm.qmp('x-blockdev-reopen', options=[{
              'node-name': 'node0',
              'driver': iotests.imgfmt,
              'file': {
@@ -XXX,XX +XXX,XX @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
                  'filename': disk
              },
              'read-only': False
 -        })
 +        }])
          self.assert_qmp(result, 'return', {})
          # Check that bitmap is reopened to RW and we can write to it.
 diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/245
 +++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                           "Expected output of %d qemu-io commands, found %d" %
                           (found, self.total_io_cmds))
 -    # Run x-blockdev-reopen with 'opts' but applying 'newopts'
 -    # on top of it. The original 'opts' dict is unmodified
 +    # Run x-blockdev-reopen on a list of block devices
 +    def reopenMultiple(self, opts, errmsg = None):
 +        result = self.vm.qmp('x-blockdev-reopen', conv_keys=False, options=opts)
 +        if errmsg:
 +            self.assert_qmp(result, 'error/class', 'GenericError')
 +            self.assert_qmp(result, 'error/desc', errmsg)
 +        else:
 +            self.assert_qmp(result, 'return', {})
 +
 +    # Run x-blockdev-reopen on a single block device (specified by
 +    # 'opts') but applying 'newopts' on top of it. The original 'opts'
 +    # dict is unmodified
      def reopen(self, opts, newopts = {}, errmsg = None):
          opts = copy.deepcopy(opts)
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                  subdict = opts[prefix]
              subdict[key] = value
 -        result = self.vm.qmp('x-blockdev-reopen', conv_keys = False, **opts)
 -        if errmsg:
 -            self.assert_qmp(result, 'error/class', 'GenericError')
 -            self.assert_qmp(result, 'error/desc', errmsg)
 -        else:
 -            self.assert_qmp(result, 'return', {})
 +        self.reopenMultiple([ opts ], errmsg)
      # Run query-named-block-nodes and return the specified entry
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
          # We cannot change any of these
          self.reopen(opts, {'node-name': 'not-found'}, "Failed to find node with node-name='not-found'")
          self.reopen(opts, {'node-name': ''}, "Failed to find node with node-name=''")
 -        self.reopen(opts, {'node-name': None}, "Invalid parameter type for 'node-name', expected: string")
 +        self.reopen(opts, {'node-name': None}, "Invalid parameter type for 'options[0].node-name', expected: string")
          self.reopen(opts, {'driver': 'raw'}, "Cannot change the option 'driver'")
          self.reopen(opts, {'driver': ''}, "Invalid parameter ''")
 -        self.reopen(opts, {'driver': None}, "Invalid parameter type for 'driver', expected: string")
 +        self.reopen(opts, {'driver': None}, "Invalid parameter type for 'options[0].driver', expected: string")
          self.reopen(opts, {'file': 'not-found'}, "Cannot find device='' nor node-name='not-found'")
          self.reopen(opts, {'file': ''}, "Cannot find device='' nor node-name=''")
          self.reopen(opts, {'file': None}, "Invalid parameter type for 'file', expected: BlockdevRef")
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
          self.reopen(opts, {'file.filename': hd_path[1]}, "Cannot change the option 'filename'")
          self.reopen(opts, {'file.aio': 'native'}, "Cannot change the option 'aio'")
          self.reopen(opts, {'file.locking': 'off'}, "Cannot change the option 'locking'")
 -        self.reopen(opts, {'file.filename': None}, "Invalid parameter type for 'file.filename', expected: string")
 +        self.reopen(opts, {'file.filename': None}, "Invalid parameter type for 'options[0].file.filename', expected: string")
          # node-name is optional in BlockdevOptions, but x-blockdev-reopen needs it
          del opts['node-name']
 diff --git a/tests/qemu-iotests/248 b/tests/qemu-iotests/248
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/248
 +++ b/tests/qemu-iotests/248
@@ -XXX,XX +XXX,XX @@ vm.get_qmp_events()
  del blockdev_opts['file']['size']
  vm.qmp_log('x-blockdev-reopen', filters=[filter_qmp_testfiles],
 -           **blockdev_opts)
 +           options = [ blockdev_opts ])
  vm.qmp_log('block-job-resume', device='drive0')
  vm.event_wait('JOB_STATUS_CHANGE', timeout=1.0,
 diff --git a/tests/qemu-iotests/248.out b/tests/qemu-iotests/248.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/248.out
 +++ b/tests/qemu-iotests/248.out
@@ -XXX,XX +XXX,XX @@
  {"return": {}}
  {"execute": "blockdev-mirror", "arguments": {"device": "drive0", "on-target-error": "enospc", "sync": "full", "target": "target"}}
  {"return": {}}
 -{"execute": "x-blockdev-reopen", "arguments": {"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}}
 +{"execute": "x-blockdev-reopen", "arguments": {"options": [{"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}]}}
  {"return": {}}
  {"execute": "block-job-resume", "arguments": {"device": "drive0"}}
  {"return": {}}
 diff --git a/tests/qemu-iotests/296 b/tests/qemu-iotests/296
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/296
 +++ b/tests/qemu-iotests/296
@@ -XXX,XX +XXX,XX @@ class EncryptionSetupTestCase(iotests.QMPTestCase):
          command = 'x-blockdev-reopen' if reOpen else 'blockdev-add'
 -        result = vm.qmp(command, **
 -            {
 +        opts = {
                  'driver': iotests.imgfmt,
                  'node-name': id,
                  'read-only': readOnly,
@@ -XXX,XX +XXX,XX @@ class EncryptionSetupTestCase(iotests.QMPTestCase):
                      'filename': test_img,
                  }
              }
 -        )
 +
 +        if reOpen:
 +            result = vm.qmp(command, options=[opts])
 +        else:
 +            result = vm.qmp(command, **opts)
          self.assert_qmp(result, 'return', {})
 diff --git a/tests/qemu-iotests/298 b/tests/qemu-iotests/298
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/298
 +++ b/tests/qemu-iotests/298
@@ -XXX,XX +XXX,XX @@ class TestPreallocateFilter(TestPreallocateBase):
          self.check_big()
      def test_reopen_opts(self):
 -        result = self.vm.qmp('x-blockdev-reopen', **{
 +        result = self.vm.qmp('x-blockdev-reopen', options=[{
              'node-name': 'disk',
              'driver': iotests.imgfmt,
              'file': {
@@ -XXX,XX +XXX,XX @@ class TestPreallocateFilter(TestPreallocateBase):
                      'filename': disk
                  }
              }
 -        })
 +        }])
          self.assert_qmp(result, 'return', {})
          self.vm.hmp_qemu_io('drive0', 'write 0 1M')
 diff --git a/tests/qemu-iotests/tests/remove-bitmap-from-backing b/tests/qemu-iotests/tests/remove-bitmap-from-backing
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/tests/remove-bitmap-from-backing
 +++ b/tests/qemu-iotests/tests/remove-bitmap-from-backing
@@ -XXX,XX +XXX,XX @@ log('Trying to remove persistent bitmap from r-o base node, should fail:')
  vm.qmp_log('block-dirty-bitmap-remove', node='base', name='bitmap0')
  new_base_opts = {
 -    'node-name': 'base',
 -    'driver': 'qcow2',
 -    'file': {
 -        'driver': 'file',
 -        'filename':  base
 -    },
 -    'read-only': False
 +    'options': [{
 +        'node-name': 'base',
 +        'driver': 'qcow2',
 +        'file': {
 +            'driver': 'file',
 +            'filename':  base
 +        },
 +        'read-only': False
 +    }]
  }
  # Don't want to bother with filtering qmp_log for reopen command
@@ -XXX,XX +XXX,XX @@ if result != {'return': {}}:
  log('Remove persistent bitmap from base node reopened to RW:')
  vm.qmp_log('block-dirty-bitmap-remove', node='base', name='bitmap0')
 -new_base_opts['read-only'] = True
 +new_base_opts['options'][0]['read-only'] = True
  result = vm.qmp('x-blockdev-reopen', **new_base_opts)
  if result != {'return': {}}:
      log('Failed to reopen: ' + str(result))
 --
 .31.1

-New patch
+[PULL 27/28] iotests: Test reopening multiple devices at the same time
+From: Alberto Garcia <berto@igalia.com>
+This test swaps the images used by two active block devices.
+This is now possible thanks to the new ability to run
+x-blockdev-reopen on multiple devices at the same time.
+Signed-off-by: Alberto Garcia <berto@igalia.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Message-Id: <20210708114709.206487-6-kwolf@redhat.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/qemu-iotests/245     | 47 ++++++++++++++++++++++++++++++++++++++
+ tests/qemu-iotests/245.out |  4 ++--
+files changed, 49 insertions(+), 2 deletions(-)
+diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
+index XXXXXXX..XXXXXXX 100755
+--- a/tests/qemu-iotests/245
++++ b/tests/qemu-iotests/245
+@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
+                                          '-c', 'read -P 0x40 0x40008 1',
+                                          '-c', 'read -P 0x80 0x40010 1', hd_path[0])
++    # Swap the disk images of two active block devices
++    def test_swap_files(self):
++        # Add hd0 and hd2 (none of them with backing files)
++        opts0 = hd_opts(0)
++        result = self.vm.qmp('blockdev-add', conv_keys = False, **opts0)
++        self.assert_qmp(result, 'return', {})
++
++        opts2 = hd_opts(2)
++        result = self.vm.qmp('blockdev-add', conv_keys = False, **opts2)
++        self.assert_qmp(result, 'return', {})
++
++        # Write different data to both block devices
++        self.run_qemu_io("hd0", "write -P 0xa0 0 1k")
++        self.run_qemu_io("hd2", "write -P 0xa2 0 1k")
++
++        # Check that the data reads correctly
++        self.run_qemu_io("hd0", "read  -P 0xa0 0 1k")
++        self.run_qemu_io("hd2", "read  -P 0xa2 0 1k")
++
++        # It's not possible to make a block device use an image that
++        # is already being used by the other device.
++        self.reopen(opts0, {'file': 'hd2-file'},
++                    "Permission conflict on node 'hd2-file': permissions "
++                    "'write, resize' are both required by node 'hd2' (uses "
++                    "node 'hd2-file' as 'file' child) and unshared by node "
++                    "'hd0' (uses node 'hd2-file' as 'file' child).")
++        self.reopen(opts2, {'file': 'hd0-file'},
++                    "Permission conflict on node 'hd0-file': permissions "
++                    "'write, resize' are both required by node 'hd0' (uses "
++                    "node 'hd0-file' as 'file' child) and unshared by node "
++                    "'hd2' (uses node 'hd0-file' as 'file' child).")
++
++        # But we can swap the images if we reopen both devices at the
++        # same time
++        opts0['file'] = 'hd2-file'
++        opts2['file'] = 'hd0-file'
++        self.reopenMultiple([opts0, opts2])
++        self.run_qemu_io("hd0", "read  -P 0xa2 0 1k")
++        self.run_qemu_io("hd2", "read  -P 0xa0 0 1k")
++
++        # And we can of course come back to the original state
++        opts0['file'] = 'hd0-file'
++        opts2['file'] = 'hd2-file'
++        self.reopenMultiple([opts0, opts2])
++        self.run_qemu_io("hd0", "read  -P 0xa0 0 1k")
++        self.run_qemu_io("hd2", "read  -P 0xa2 0 1k")
++
+     # Misc reopen tests with different block drivers
+     @iotests.skip_if_unsupported(['quorum', 'throttle'])
+     def test_misc_drivers(self):
+diff --git a/tests/qemu-iotests/245.out b/tests/qemu-iotests/245.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/245.out
++++ b/tests/qemu-iotests/245.out
+@@ -XXX,XX +XXX,XX @@ read 1/1 bytes at offset 262152
+ read 1/1 bytes at offset 262160
+bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+-..............
++...............
+ ----------------------------------------------------------------------
+-Ran 24 tests
++Ran 25 tests
+ OK
+--
+.31.1

-New patch
+[PULL 28/28] block: Make blockdev-reopen stable API
+From: Alberto Garcia <berto@igalia.com>
 This patch drops the 'x-' prefix from x-blockdev-reopen.
 Signed-off-by: Alberto Garcia <berto@igalia.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210708114709.206487-7-kwolf@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  qapi/block-core.json                                |  6 +++---
  blockdev.c                                          |  2 +-
  tests/qemu-iotests/155                              |  2 +-
  tests/qemu-iotests/165                              |  2 +-
  tests/qemu-iotests/245                              | 10 +++++-----
  tests/qemu-iotests/248                              |  2 +-
  tests/qemu-iotests/248.out                          |  2 +-
  tests/qemu-iotests/296                              |  2 +-
  tests/qemu-iotests/298                              |  2 +-
  tests/qemu-iotests/tests/remove-bitmap-from-backing |  4 ++--
 files changed, 17 insertions(+), 17 deletions(-)
 diff --git a/qapi/block-core.json b/qapi/block-core.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/block-core.json
 +++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
  { 'command': 'blockdev-add', 'data': 'BlockdevOptions', 'boxed': true }
  ##
 -# @x-blockdev-reopen:
 +# @blockdev-reopen:
  #
  # Reopens one or more block devices using the given set of options.
  # Any option not specified will be reset to its default value regardless
@@ -XXX,XX +XXX,XX @@
  # image does not have a default backing file name as part of its
  # metadata.
  #
 -# Since: 4.0
 +# Since: 6.1
  ##
 -{ 'command': 'x-blockdev-reopen',
 +{ 'command': 'blockdev-reopen',
    'data': { 'options': ['BlockdevOptions'] } }
  ##
 diff --git a/blockdev.c b/blockdev.c
 index XXXXXXX..XXXXXXX 100644
 --- a/blockdev.c
 +++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ fail:
      visit_free(v);
  }
 -void qmp_x_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 +void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
  {
      BlockReopenQueue *queue = NULL;
      GSList *drained = NULL;
 diff --git a/tests/qemu-iotests/155 b/tests/qemu-iotests/155
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/155
 +++ b/tests/qemu-iotests/155
@@ -XXX,XX +XXX,XX @@ class TestBlockdevMirrorReopen(MirrorBaseClass):
              result = self.vm.qmp('blockdev-add', node_name="backing",
                                   driver="null-co")
              self.assert_qmp(result, 'return', {})
 -            result = self.vm.qmp('x-blockdev-reopen', options=[{
 +            result = self.vm.qmp('blockdev-reopen', options=[{
                                       'node-name': "target",
                                       'driver': iotests.imgfmt,
                                       'file': "target-file",
 diff --git a/tests/qemu-iotests/165 b/tests/qemu-iotests/165
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/165
 +++ b/tests/qemu-iotests/165
@@ -XXX,XX +XXX,XX @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
          assert sha256_1 == self.getSha256()
          # Reopen to RW
 -        result = self.vm.qmp('x-blockdev-reopen', options=[{
 +        result = self.vm.qmp('blockdev-reopen', options=[{
              'node-name': 'node0',
              'driver': iotests.imgfmt,
              'file': {
 diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/245
 +++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@
  #!/usr/bin/env python3
  # group: rw
  #
 -# Test cases for the QMP 'x-blockdev-reopen' command
 +# Test cases for the QMP 'blockdev-reopen' command
  #
  # Copyright (C) 2018-2019 Igalia, S.L.
  # Author: Alberto Garcia <berto@igalia.com>
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                           "Expected output of %d qemu-io commands, found %d" %
                           (found, self.total_io_cmds))
 -    # Run x-blockdev-reopen on a list of block devices
 +    # Run blockdev-reopen on a list of block devices
      def reopenMultiple(self, opts, errmsg = None):
 -        result = self.vm.qmp('x-blockdev-reopen', conv_keys=False, options=opts)
 +        result = self.vm.qmp('blockdev-reopen', conv_keys=False, options=opts)
          if errmsg:
              self.assert_qmp(result, 'error/class', 'GenericError')
              self.assert_qmp(result, 'error/desc', errmsg)
          else:
              self.assert_qmp(result, 'return', {})
 -    # Run x-blockdev-reopen on a single block device (specified by
 +    # Run blockdev-reopen on a single block device (specified by
      # 'opts') but applying 'newopts' on top of it. The original 'opts'
      # dict is unmodified
      def reopen(self, opts, newopts = {}, errmsg = None):
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
          self.reopen(opts, {'file.locking': 'off'}, "Cannot change the option 'locking'")
          self.reopen(opts, {'file.filename': None}, "Invalid parameter type for 'options[0].file.filename', expected: string")
 -        # node-name is optional in BlockdevOptions, but x-blockdev-reopen needs it
 +        # node-name is optional in BlockdevOptions, but blockdev-reopen needs it
          del opts['node-name']
          self.reopen(opts, {}, "node-name not specified")
 diff --git a/tests/qemu-iotests/248 b/tests/qemu-iotests/248
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/248
 +++ b/tests/qemu-iotests/248
@@ -XXX,XX +XXX,XX @@ vm.event_wait('JOB_STATUS_CHANGE', timeout=3.0,
  vm.get_qmp_events()
  del blockdev_opts['file']['size']
 -vm.qmp_log('x-blockdev-reopen', filters=[filter_qmp_testfiles],
 +vm.qmp_log('blockdev-reopen', filters=[filter_qmp_testfiles],
             options = [ blockdev_opts ])
  vm.qmp_log('block-job-resume', device='drive0')
 diff --git a/tests/qemu-iotests/248.out b/tests/qemu-iotests/248.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/248.out
 +++ b/tests/qemu-iotests/248.out
@@ -XXX,XX +XXX,XX @@
  {"return": {}}
  {"execute": "blockdev-mirror", "arguments": {"device": "drive0", "on-target-error": "enospc", "sync": "full", "target": "target"}}
  {"return": {}}
 -{"execute": "x-blockdev-reopen", "arguments": {"options": [{"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}]}}
 +{"execute": "blockdev-reopen", "arguments": {"options": [{"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}]}}
  {"return": {}}
  {"execute": "block-job-resume", "arguments": {"device": "drive0"}}
  {"return": {}}
 diff --git a/tests/qemu-iotests/296 b/tests/qemu-iotests/296
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/296
 +++ b/tests/qemu-iotests/296
@@ -XXX,XX +XXX,XX @@ class EncryptionSetupTestCase(iotests.QMPTestCase):
      def openImageQmp(self, vm, id, file, secret,
                       readOnly = False, reOpen = False):
 -        command = 'x-blockdev-reopen' if reOpen else 'blockdev-add'
 +        command = 'blockdev-reopen' if reOpen else 'blockdev-add'
          opts = {
                  'driver': iotests.imgfmt,
 diff --git a/tests/qemu-iotests/298 b/tests/qemu-iotests/298
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/298
 +++ b/tests/qemu-iotests/298
@@ -XXX,XX +XXX,XX @@ class TestPreallocateFilter(TestPreallocateBase):
          self.check_big()
      def test_reopen_opts(self):
 -        result = self.vm.qmp('x-blockdev-reopen', options=[{
 +        result = self.vm.qmp('blockdev-reopen', options=[{
              'node-name': 'disk',
              'driver': iotests.imgfmt,
              'file': {
 diff --git a/tests/qemu-iotests/tests/remove-bitmap-from-backing b/tests/qemu-iotests/tests/remove-bitmap-from-backing
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/tests/remove-bitmap-from-backing
 +++ b/tests/qemu-iotests/tests/remove-bitmap-from-backing
@@ -XXX,XX +XXX,XX @@ new_base_opts = {
  }
  # Don't want to bother with filtering qmp_log for reopen command
 -result = vm.qmp('x-blockdev-reopen', **new_base_opts)
 +result = vm.qmp('blockdev-reopen', **new_base_opts)
  if result != {'return': {}}:
      log('Failed to reopen: ' + str(result))
@@ -XXX,XX +XXX,XX @@ log('Remove persistent bitmap from base node reopened to RW:')
  vm.qmp_log('block-dirty-bitmap-remove', node='base', name='bitmap0')
  new_base_opts['options'][0]['read-only'] = True
 -result = vm.qmp('x-blockdev-reopen', **new_base_opts)
 +result = vm.qmp('blockdev-reopen', **new_base_opts)
  if result != {'return': {}}:
      log('Failed to reopen: ' + str(result))
 --
 .31.1

The following changes since commit a395717cbd26e7593d3c3fe81faca121ec6d13e8:

Merge remote-tracking branch 'remotes/cody/tags/block-pull-request' into staging (2018-07-03 11:49:51 +0100)

are available in the git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to 59738025a1674bb7e07713c3c93ff4fb9c5079f5:

block: Add blklogwrites (2018-07-03 16:09:48 +0200)

----------------------------------------------------------------
Block layer patches:

- qcow2: Use worker threads for compression to improve performance of
  'qemu-img convert -W' and compressed backup jobs
- blklogwrites: New filter driver to log write requests to an image in
  the dm-log-writes format

----------------------------------------------------------------
Aapo Vienamo (1):
      block: Add blklogwrites

Ari Sundholm (1):
      block: Move two block permission constants to the relevant enum

Vladimir Sementsov-Ogievskiy (3):
      qemu-img: allow compressed not-in-order writes
      qcow2: refactor data compression
      qcow2: add compress threads

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Make a separate function for compression to be parallelized later.
 - use .avail_out field instead of .next_out to calculate size of
   compressed data. It looks more natural and it allows to keep dest to
   be void pointer
 - set avail_out to be at least one byte less than input, to be sure
   avoid inefficient compression earlier

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c | 76 ++++++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 49 insertions(+), 27 deletions(-)

diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+
+#define ZLIB_CONST
+#include <zlib.h>
+
 #include "block/block_int.h"
 #include "block/qdict.h"
 #include "sysemu/block-backend.h"
 #include "qemu/module.h"
-#include <zlib.h>
 #include "qcow2.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@ fail:
     return ret;
 }
 
+/*
+ * qcow2_compress()
+ *
+ * @dest - destination buffer, at least of @size-1 bytes
+ * @src - source buffer, @size bytes
+ *
+ * Returns: compressed size on success
+ *          -1 if compression is inefficient
+ *          -2 on any other error
+ */
+static ssize_t qcow2_compress(void *dest, const void *src, size_t size)
+{
+    ssize_t ret;
+    z_stream strm;
+
+    /* best compression, small window, no zlib header */
+    memset(&strm, 0, sizeof(strm));
+    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION, Z_DEFLATED,
+                       -12, 9, Z_DEFAULT_STRATEGY);
+    if (ret != 0) {
+        return -2;
+    }
+
+    strm.avail_in = size;
+    strm.next_in = src;
+    strm.avail_out = size - 1;
+    strm.next_out = dest;
+
+    ret = deflate(&strm, Z_FINISH);
+    if (ret == Z_STREAM_END) {
+        ret = size - 1 - strm.avail_out;
+    } else {
+        ret = (ret == Z_OK ? -1 : -2);
+    }
+
+    deflateEnd(&strm);
+
+    return ret;
+}
+
 /* XXX: put compressed sectors first, then all the cluster aligned
    tables to avoid losing bytes in alignment */
 static coroutine_fn int
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
     BDRVQcow2State *s = bs->opaque;
     QEMUIOVector hd_qiov;
     struct iovec iov;
-    z_stream strm;
-    int ret, out_len;
+    int ret;
+    size_t out_len;
     uint8_t *buf, *out_buf;
     int64_t cluster_offset;
 
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 
     out_buf = g_malloc(s->cluster_size);
 
-    /* best compression, small window, no zlib header */
-    memset(&strm, 0, sizeof(strm));
-    ret = deflateInit2(&strm, Z_DEFAULT_COMPRESSION,
-                       Z_DEFLATED, -12,
-                       9, Z_DEFAULT_STRATEGY);
-    if (ret != 0) {
+    out_len = qcow2_compress(out_buf, buf, s->cluster_size);
+    if (out_len == -2) {
         ret = -EINVAL;
         goto fail;
-    }
-
-    strm.avail_in = s->cluster_size;
-    strm.next_in = (uint8_t *)buf;
-    strm.avail_out = s->cluster_size;
-    strm.next_out = out_buf;
-
-    ret = deflate(&strm, Z_FINISH);
-    if (ret != Z_STREAM_END && ret != Z_OK) {
-        deflateEnd(&strm);
-        ret = -EINVAL;
-        goto fail;
-    }
-    out_len = strm.next_out - out_buf;
-
-    deflateEnd(&strm);
-
-    if (ret != Z_STREAM_END || out_len >= s->cluster_size) {
+    } else if (out_len == -1) {
         /* could not compress: write normal cluster */
         ret = qcow2_co_pwritev(bs, offset, bytes, qiov, 0);
         if (ret < 0) {
-- 
2.13.6

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Do data compression in separate threads. This significantly improve
performance for qemu-img convert with -W (allow async writes) and -c
(compressed) options.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.h |  3 +++
 block/qcow2.c | 62 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 64 insertions(+), 1 deletion(-)

diff --git a/block/qcow2.h b/block/qcow2.h
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.h
+++ b/block/qcow2.h
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVQcow2State {
      * override) */
     char *image_backing_file;
     char *image_backing_format;
+
+    CoQueue compress_wait_queue;
+    int nb_compress_threads;
 } BDRVQcow2State;
 
 typedef struct Qcow2COWRegion {
diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi/qobject-input-visitor.h"
 #include "qapi/qapi-visit-block-core.h"
 #include "crypto.h"
+#include "block/thread-pool.h"
 
 /*
   Differences with QCOW:
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
         qcow2_check_refcounts(bs, &result, 0);
     }
 #endif
+
+    qemu_co_queue_init(&s->compress_wait_queue);
+
     return ret;
 
  fail:
@@ -XXX,XX +XXX,XX @@ static ssize_t qcow2_compress(void *dest, const void *src, size_t size)
     return ret;
 }
 
+#define MAX_COMPRESS_THREADS 4
+
+typedef struct Qcow2CompressData {
+    void *dest;
+    const void *src;
+    size_t size;
+    ssize_t ret;
+} Qcow2CompressData;
+
+static int qcow2_compress_pool_func(void *opaque)
+{
+    Qcow2CompressData *data = opaque;
+
+    data->ret = qcow2_compress(data->dest, data->src, data->size);
+
+    return 0;
+}
+
+static void qcow2_compress_complete(void *opaque, int ret)
+{
+    qemu_coroutine_enter(opaque);
+}
+
+/* See qcow2_compress definition for parameters description */
+static ssize_t qcow2_co_compress(BlockDriverState *bs,
+                                 void *dest, const void *src, size_t size)
+{
+    BDRVQcow2State *s = bs->opaque;
+    BlockAIOCB *acb;
+    ThreadPool *pool = aio_get_thread_pool(bdrv_get_aio_context(bs));
+    Qcow2CompressData arg = {
+        .dest = dest,
+        .src = src,
+        .size = size,
+    };
+
+    while (s->nb_compress_threads >= MAX_COMPRESS_THREADS) {
+        qemu_co_queue_wait(&s->compress_wait_queue, NULL);
+    }
+
+    s->nb_compress_threads++;
+    acb = thread_pool_submit_aio(pool, qcow2_compress_pool_func, &arg,
+                                 qcow2_compress_complete,
+                                 qemu_coroutine_self());
+
+    if (!acb) {
+        s->nb_compress_threads--;
+        return -EINVAL;
+    }
+    qemu_coroutine_yield();
+    s->nb_compress_threads--;
+    qemu_co_queue_next(&s->compress_wait_queue);
+
+    return arg.ret;
+}
+
 /* XXX: put compressed sectors first, then all the cluster aligned
    tables to avoid losing bytes in alignment */
 static coroutine_fn int
@@ -XXX,XX +XXX,XX @@ qcow2_co_pwritev_compressed(BlockDriverState *bs, uint64_t offset,
 
     out_buf = g_malloc(s->cluster_size);
 
-    out_len = qcow2_compress(out_buf, buf, s->cluster_size);
+    out_len = qcow2_co_compress(bs, out_buf, buf, s->cluster_size);
     if (out_len == -2) {
         ret = -EINVAL;
         goto fail;
-- 
2.13.6

From: Ari Sundholm <ari@tuxera.com>

This allows using the two constants outside of block.c, which will
happen in a subsequent patch.

Signed-off-by: Ari Sundholm <ari@tuxera.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h | 7 +++++++
 block.c               | 6 ------
 2 files changed, 7 insertions(+), 6 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ enum {
     BLK_PERM_GRAPH_MOD          = 0x10,
 
     BLK_PERM_ALL                = 0x1f,
+
+    DEFAULT_PERM_PASSTHROUGH    = BLK_PERM_CONSISTENT_READ
+                                 | BLK_PERM_WRITE
+                                 | BLK_PERM_WRITE_UNCHANGED
+                                 | BLK_PERM_RESIZE,
+
+    DEFAULT_PERM_UNCHANGED      = BLK_PERM_ALL & ~DEFAULT_PERM_PASSTHROUGH,
 };
 
 char *bdrv_perm_names(uint64_t perm);
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
     return 0;
 }
 
-#define DEFAULT_PERM_PASSTHROUGH (BLK_PERM_CONSISTENT_READ \
-                                 | BLK_PERM_WRITE \
-                                 | BLK_PERM_WRITE_UNCHANGED \
-                                 | BLK_PERM_RESIZE)
-#define DEFAULT_PERM_UNCHANGED (BLK_PERM_ALL & ~DEFAULT_PERM_PASSTHROUGH)
-
 void bdrv_filter_default_perms(BlockDriverState *bs, BdrvChild *c,
                                const BdrvChildRole *role,
                                BlockReopenQueue *reopen_queue,
-- 
2.13.6

From: Aapo Vienamo <aapo@tuxera.com>

Implements a block device write logging system, similar to Linux kernel
device mapper dm-log-writes. The write operations that are performed
on a block device are logged to a file or another block device. The
write log format is identical to the dm-log-writes format. Currently,
log markers are not supported.

This functionality can be used for crash consistency and fs consistency
testing. By implementing it in qemu, tests utilizing write logs can be
be used to test non-Linux drivers and older kernels.

The driver accepts an optional parameter to set the sector size used
for logging. This makes the driver require all requests to be aligned
to this sector size and also makes offsets and sizes of writes in the
log metadata to be expressed in terms of this value (the log format has
a granularity of one sector for offsets and sizes). This allows
accurate logging of writes to guest block devices that have unusual
sector sizes.

The implementation is based on the blkverify and blkdebug block
drivers.

Signed-off-by: Aapo Vienamo <aapo@tuxera.com>
Signed-off-by: Ari Sundholm <ari@tuxera.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qapi/block-core.json |  33 ++++-
 block/blklogwrites.c | 392 +++++++++++++++++++++++++++++++++++++++++++++++++++
 MAINTAINERS          |   6 +
 block/Makefile.objs  |   1 +
 4 files changed, 426 insertions(+), 6 deletions(-)
 create mode 100644 block/blklogwrites.c

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 # @throttle: Since 2.11
 # @nvme: Since 2.12
 # @copy-on-read: Since 3.0
+# @blklogwrites: Since 3.0
 #
 # Since: 2.9
 ##
 { 'enum': 'BlockdevDriver',
-  'data': [ 'blkdebug', 'blkverify', 'bochs', 'cloop', 'copy-on-read',
-            'dmg', 'file', 'ftp', 'ftps', 'gluster', 'host_cdrom',
-            'host_device', 'http', 'https', 'iscsi', 'luks', 'nbd', 'nfs',
-            'null-aio', 'null-co', 'nvme', 'parallels', 'qcow', 'qcow2', 'qed',
-            'quorum', 'raw', 'rbd', 'replication', 'sheepdog', 'ssh',
-            'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat', 'vxhs' ] }
+  'data': [ 'blkdebug', 'blklogwrites', 'blkverify', 'bochs', 'cloop',
+            'copy-on-read', 'dmg', 'file', 'ftp', 'ftps', 'gluster',
+            'host_cdrom', 'host_device', 'http', 'https', 'iscsi', 'luks',
+            'nbd', 'nfs', 'null-aio', 'null-co', 'nvme', 'parallels', 'qcow',
+            'qcow2', 'qed', 'quorum', 'raw', 'rbd', 'replication', 'sheepdog',
+            'ssh', 'throttle', 'vdi', 'vhdx', 'vmdk', 'vpc', 'vvfat', 'vxhs' ] }
 
 ##
 # @BlockdevOptionsFile:
@@ -XXX,XX +XXX,XX @@
             '*set-state': ['BlkdebugSetStateOptions'] } }
 
 ##
+# @BlockdevOptionsBlklogwrites:
+#
+# Driver specific block device options for blklogwrites.
+#
+# @file:            block device
+#
+# @log:             block device used to log writes to @file
+#
+# @log-sector-size: sector size used in logging writes to @file, determines
+#                   granularity of offsets and sizes of writes (default: 512)
+#
+# Since: 3.0
+##
+{ 'struct': 'BlockdevOptionsBlklogwrites',
+  'data': { 'file': 'BlockdevRef',
+            'log': 'BlockdevRef',
+            '*log-sector-size': 'uint32' } }
+
+##
 # @BlockdevOptionsBlkverify:
 #
 # Driver specific block device options for blkverify.
@@ -XXX,XX +XXX,XX @@
   'discriminator': 'driver',
   'data': {
       'blkdebug':   'BlockdevOptionsBlkdebug',
+      'blklogwrites':'BlockdevOptionsBlklogwrites',
       'blkverify':  'BlockdevOptionsBlkverify',
       'bochs':      'BlockdevOptionsGenericFormat',
       'cloop':      'BlockdevOptionsGenericFormat',
diff --git a/block/blklogwrites.c b/block/blklogwrites.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/block/blklogwrites.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Write logging blk driver based on blkverify and blkdebug.
+ *
+ * Copyright (c) 2017 Tuomas Tynkkynen <tuomas@tuxera.com>
+ * Copyright (c) 2018 Aapo Vienamo <aapo@tuxera.com>
+ * Copyright (c) 2018 Ari Sundholm <ari@tuxera.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "qemu/sockets.h" /* for EINPROGRESS on Windows */
+#include "block/block_int.h"
+#include "qapi/qmp/qdict.h"
+#include "qapi/qmp/qstring.h"
+#include "qemu/cutils.h"
+#include "qemu/option.h"
+
+/* Disk format stuff - taken from Linux drivers/md/dm-log-writes.c */
+
+#define LOG_FLUSH_FLAG   (1 << 0)
+#define LOG_FUA_FLAG     (1 << 1)
+#define LOG_DISCARD_FLAG (1 << 2)
+#define LOG_MARK_FLAG    (1 << 3)
+
+#define WRITE_LOG_VERSION 1ULL
+#define WRITE_LOG_MAGIC 0x6a736677736872ULL
+
+/* All fields are little-endian. */
+struct log_write_super {
+    uint64_t magic;
+    uint64_t version;
+    uint64_t nr_entries;
+    uint32_t sectorsize;
+} QEMU_PACKED;
+
+struct log_write_entry {
+    uint64_t sector;
+    uint64_t nr_sectors;
+    uint64_t flags;
+    uint64_t data_len;
+} QEMU_PACKED;
+
+/* End of disk format structures. */
+
+typedef struct {
+    BdrvChild *log_file;
+    uint32_t sectorsize;
+    uint32_t sectorbits;
+    uint64_t cur_log_sector;
+    uint64_t nr_entries;
+} BDRVBlkLogWritesState;
+
+static inline uint32_t blk_log_writes_log2(uint32_t value)
+{
+    assert(value > 0);
+    return 31 - clz32(value);
+}
+
+static int blk_log_writes_open(BlockDriverState *bs, QDict *options, int flags,
+                               Error **errp)
+{
+    BDRVBlkLogWritesState *s = bs->opaque;
+    Error *local_err = NULL;
+    int ret;
+    int64_t log_sector_size = BDRV_SECTOR_SIZE;
+
+    /* Open the file */
+    bs->file = bdrv_open_child(NULL, options, "file", bs, &child_file, false,
+                               &local_err);
+    if (local_err) {
+        ret = -EINVAL;
+        error_propagate(errp, local_err);
+        goto fail;
+    }
+
+    if (qdict_haskey(options, "log-sector-size")) {
+        log_sector_size = qdict_get_int(options, "log-sector-size");
+        qdict_del(options, "log-sector-size");
+    }
+
+    if (log_sector_size < 0 || log_sector_size >= (1ull << 32) ||
+        !is_power_of_2(log_sector_size))
+    {
+        ret = -EINVAL;
+        error_setg(errp, "Invalid log sector size %"PRId64, log_sector_size);
+        goto fail;
+    }
+
+    s->sectorsize = log_sector_size;
+    s->sectorbits = blk_log_writes_log2(log_sector_size);
+    s->cur_log_sector = 1;
+    s->nr_entries = 0;
+
+    /* Open the log file */
+    s->log_file = bdrv_open_child(NULL, options, "log", bs, &child_file, false,
+                                  &local_err);
+    if (local_err) {
+        ret = -EINVAL;
+        error_propagate(errp, local_err);
+        goto fail;
+    }
+
+    ret = 0;
+fail:
+    if (ret < 0) {
+        bdrv_unref_child(bs, bs->file);
+        bs->file = NULL;
+    }
+    return ret;
+}
+
+static void blk_log_writes_close(BlockDriverState *bs)
+{
+    BDRVBlkLogWritesState *s = bs->opaque;
+
+    bdrv_unref_child(bs, s->log_file);
+    s->log_file = NULL;
+}
+
+static int64_t blk_log_writes_getlength(BlockDriverState *bs)
+{
+    return bdrv_getlength(bs->file->bs);
+}
+
+static void blk_log_writes_refresh_filename(BlockDriverState *bs,
+                                            QDict *options)
+{
+    BDRVBlkLogWritesState *s = bs->opaque;
+
+    /* bs->file->bs has already been refreshed */
+    bdrv_refresh_filename(s->log_file->bs);
+
+    if (bs->file->bs->full_open_options
+        && s->log_file->bs->full_open_options)
+    {
+        QDict *opts = qdict_new();
+        qdict_put_str(opts, "driver", "blklogwrites");
+
+        qobject_ref(bs->file->bs->full_open_options);
+        qdict_put_obj(opts, "file", QOBJECT(bs->file->bs->full_open_options));
+        qobject_ref(s->log_file->bs->full_open_options);
+        qdict_put_obj(opts, "log",
+                      QOBJECT(s->log_file->bs->full_open_options));
+
+        bs->full_open_options = opts;
+    }
+}
+
+static void blk_log_writes_child_perm(BlockDriverState *bs, BdrvChild *c,
+                                      const BdrvChildRole *role,
+                                      BlockReopenQueue *ro_q,
+                                      uint64_t perm, uint64_t shrd,
+                                      uint64_t *nperm, uint64_t *nshrd)
+{
+    if (!c) {
+        *nperm = perm & DEFAULT_PERM_PASSTHROUGH;
+        *nshrd = (shrd & DEFAULT_PERM_PASSTHROUGH) | DEFAULT_PERM_UNCHANGED;
+        return;
+    }
+
+    if (!strcmp(c->name, "log")) {
+        bdrv_format_default_perms(bs, c, role, ro_q, perm, shrd, nperm, nshrd);
+    } else {
+        bdrv_filter_default_perms(bs, c, role, ro_q, perm, shrd, nperm, nshrd);
+    }
+}
+
+static void blk_log_writes_refresh_limits(BlockDriverState *bs, Error **errp)
+{
+    BDRVBlkLogWritesState *s = bs->opaque;
+    bs->bl.request_alignment = s->sectorsize;
+}
+
+static int coroutine_fn
+blk_log_writes_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+                         QEMUIOVector *qiov, int flags)
+{
+    return bdrv_co_preadv(bs->file, offset, bytes, qiov, flags);
+}
+
+typedef struct BlkLogWritesFileReq {
+    BlockDriverState *bs;
+    uint64_t offset;
+    uint64_t bytes;
+    int file_flags;
+    QEMUIOVector *qiov;
+    int (*func)(struct BlkLogWritesFileReq *r);
+    int file_ret;
+} BlkLogWritesFileReq;
+
+typedef struct {
+    BlockDriverState *bs;
+    QEMUIOVector *qiov;
+    struct log_write_entry entry;
+    uint64_t zero_size;
+    int log_ret;
+} BlkLogWritesLogReq;
+
+static void coroutine_fn blk_log_writes_co_do_log(BlkLogWritesLogReq *lr)
+{
+    BDRVBlkLogWritesState *s = lr->bs->opaque;
+    uint64_t cur_log_offset = s->cur_log_sector << s->sectorbits;
+
+    s->nr_entries++;
+    s->cur_log_sector +=
+            ROUND_UP(lr->qiov->size, s->sectorsize) >> s->sectorbits;
+
+    lr->log_ret = bdrv_co_pwritev(s->log_file, cur_log_offset, lr->qiov->size,
+                                  lr->qiov, 0);
+
+    /* Logging for the "write zeroes" operation */
+    if (lr->log_ret == 0 && lr->zero_size) {
+        cur_log_offset = s->cur_log_sector << s->sectorbits;
+        s->cur_log_sector +=
+                ROUND_UP(lr->zero_size, s->sectorsize) >> s->sectorbits;
+
+        lr->log_ret = bdrv_co_pwrite_zeroes(s->log_file, cur_log_offset,
+                                            lr->zero_size, 0);
+    }
+
+    /* Update super block on flush */
+    if (lr->log_ret == 0 && lr->entry.flags & LOG_FLUSH_FLAG) {
+        struct log_write_super super = {
+            .magic      = cpu_to_le64(WRITE_LOG_MAGIC),
+            .version    = cpu_to_le64(WRITE_LOG_VERSION),
+            .nr_entries = cpu_to_le64(s->nr_entries),
+            .sectorsize = cpu_to_le32(s->sectorsize),
+        };
+        void *zeroes = g_malloc0(s->sectorsize - sizeof(super));
+        QEMUIOVector qiov;
+
+        qemu_iovec_init(&qiov, 2);
+        qemu_iovec_add(&qiov, &super, sizeof(super));
+        qemu_iovec_add(&qiov, zeroes, s->sectorsize - sizeof(super));
+
+        lr->log_ret =
+            bdrv_co_pwritev(s->log_file, 0, s->sectorsize, &qiov, 0);
+        if (lr->log_ret == 0) {
+            lr->log_ret = bdrv_co_flush(s->log_file->bs);
+        }
+        qemu_iovec_destroy(&qiov);
+        g_free(zeroes);
+    }
+}
+
+static void coroutine_fn blk_log_writes_co_do_file(BlkLogWritesFileReq *fr)
+{
+    fr->file_ret = fr->func(fr);
+}
+
+static int coroutine_fn
+blk_log_writes_co_log(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+                      QEMUIOVector *qiov, int flags,
+                      int (*file_func)(BlkLogWritesFileReq *r),
+                      uint64_t entry_flags, bool is_zero_write)
+{
+    QEMUIOVector log_qiov;
+    size_t niov = qiov ? qiov->niov : 0;
+    BDRVBlkLogWritesState *s = bs->opaque;
+    BlkLogWritesFileReq fr = {
+        .bs         = bs,
+        .offset     = offset,
+        .bytes      = bytes,
+        .file_flags = flags,
+        .qiov       = qiov,
+        .func       = file_func,
+    };
+    BlkLogWritesLogReq lr = {
+        .bs             = bs,
+        .qiov           = &log_qiov,
+        .entry = {
+            .sector     = cpu_to_le64(offset >> s->sectorbits),
+            .nr_sectors = cpu_to_le64(bytes >> s->sectorbits),
+            .flags      = cpu_to_le64(entry_flags),
+            .data_len   = 0,
+        },
+        .zero_size = is_zero_write ? bytes : 0,
+    };
+    void *zeroes = g_malloc0(s->sectorsize - sizeof(lr.entry));
+
+    assert((1 << s->sectorbits) == s->sectorsize);
+    assert(bs->bl.request_alignment == s->sectorsize);
+    assert(QEMU_IS_ALIGNED(offset, bs->bl.request_alignment));
+    assert(QEMU_IS_ALIGNED(bytes, bs->bl.request_alignment));
+
+    qemu_iovec_init(&log_qiov, niov + 2);
+    qemu_iovec_add(&log_qiov, &lr.entry, sizeof(lr.entry));
+    qemu_iovec_add(&log_qiov, zeroes, s->sectorsize - sizeof(lr.entry));
+    if (qiov) {
+        qemu_iovec_concat(&log_qiov, qiov, 0, qiov->size);
+    }
+
+    blk_log_writes_co_do_file(&fr);
+    blk_log_writes_co_do_log(&lr);
+
+    qemu_iovec_destroy(&log_qiov);
+    g_free(zeroes);
+
+    if (lr.log_ret < 0) {
+        return lr.log_ret;
+    }
+
+    return fr.file_ret;
+}
+
+static int coroutine_fn
+blk_log_writes_co_do_file_pwritev(BlkLogWritesFileReq *fr)
+{
+    return bdrv_co_pwritev(fr->bs->file, fr->offset, fr->bytes,
+                           fr->qiov, fr->file_flags);
+}
+
+static int coroutine_fn
+blk_log_writes_co_do_file_pwrite_zeroes(BlkLogWritesFileReq *fr)
+{
+    return bdrv_co_pwrite_zeroes(fr->bs->file, fr->offset, fr->bytes,
+                                 fr->file_flags);
+}
+
+static int coroutine_fn blk_log_writes_co_do_file_flush(BlkLogWritesFileReq *fr)
+{
+    return bdrv_co_flush(fr->bs->file->bs);
+}
+
+static int coroutine_fn
+blk_log_writes_co_do_file_pdiscard(BlkLogWritesFileReq *fr)
+{
+    return bdrv_co_pdiscard(fr->bs->file->bs, fr->offset, fr->bytes);
+}
+
+static int coroutine_fn
+blk_log_writes_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+                          QEMUIOVector *qiov, int flags)
+{
+    return blk_log_writes_co_log(bs, offset, bytes, qiov, flags,
+                                 blk_log_writes_co_do_file_pwritev, 0, false);
+}
+
+static int coroutine_fn
+blk_log_writes_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset, int bytes,
+                                BdrvRequestFlags flags)
+{
+    return blk_log_writes_co_log(bs, offset, bytes, NULL, flags,
+                                 blk_log_writes_co_do_file_pwrite_zeroes, 0,
+                                 true);
+}
+
+static int coroutine_fn blk_log_writes_co_flush_to_disk(BlockDriverState *bs)
+{
+    return blk_log_writes_co_log(bs, 0, 0, NULL, 0,
+                                 blk_log_writes_co_do_file_flush,
+                                 LOG_FLUSH_FLAG, false);
+}
+
+static int coroutine_fn
+blk_log_writes_co_pdiscard(BlockDriverState *bs, int64_t offset, int count)
+{
+    return blk_log_writes_co_log(bs, offset, count, NULL, 0,
+                                 blk_log_writes_co_do_file_pdiscard,
+                                 LOG_DISCARD_FLAG, false);
+}
+
+static BlockDriver bdrv_blk_log_writes = {
+    .format_name            = "blklogwrites",
+    .instance_size          = sizeof(BDRVBlkLogWritesState),
+
+    .bdrv_open              = blk_log_writes_open,
+    .bdrv_close             = blk_log_writes_close,
+    .bdrv_getlength         = blk_log_writes_getlength,
+    .bdrv_refresh_filename  = blk_log_writes_refresh_filename,
+    .bdrv_child_perm        = blk_log_writes_child_perm,
+    .bdrv_refresh_limits    = blk_log_writes_refresh_limits,
+
+    .bdrv_co_preadv         = blk_log_writes_co_preadv,
+    .bdrv_co_pwritev        = blk_log_writes_co_pwritev,
+    .bdrv_co_pwrite_zeroes  = blk_log_writes_co_pwrite_zeroes,
+    .bdrv_co_flush_to_disk  = blk_log_writes_co_flush_to_disk,
+    .bdrv_co_pdiscard       = blk_log_writes_co_pdiscard,
+    .bdrv_co_block_status   = bdrv_co_block_status_from_file,
+
+    .is_filter              = true,
+};
+
+static void bdrv_blk_log_writes_init(void)
+{
+    bdrv_register(&bdrv_blk_log_writes);
+}
+
+block_init(bdrv_blk_log_writes_init);
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ S: Supported
 F: block/quorum.c
 L: qemu-block@nongnu.org
 
+blklogwrites
+M: Ari Sundholm <ari@tuxera.com>
+L: qemu-block@nongnu.org
+S: Supported
+F: block/blklogwrites.c
+
 blkverify
 M: Stefan Hajnoczi <stefanha@redhat.com>
 L: qemu-block@nongnu.org
diff --git a/block/Makefile.objs b/block/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/block/Makefile.objs
+++ b/block/Makefile.objs
@@ -XXX,XX +XXX,XX @@ block-obj-y += qed-check.o
 block-obj-y += vhdx.o vhdx-endian.o vhdx-log.o
 block-obj-y += quorum.o
 block-obj-y += parallels.o blkdebug.o blkverify.o blkreplay.o
+block-obj-y += blklogwrites.o
 block-obj-y += block-backend.o snapshot.o qapi.o
 block-obj-$(CONFIG_WIN32) += file-win32.o win32-aio.o
 block-obj-$(CONFIG_POSIX) += file-posix.o
-- 
2.13.6

The following changes since commit 9db3065c62a983286d06c207f4981408cf42184d:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-6.1-pull-request' into staging (2021-07-08 16:30:18 +0100)

are available in the Git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to e60edf69e2f64e818466019313517a2e6d6b63f4:

block: Make blockdev-reopen stable API (2021-07-09 13:19:11 +0200)

----------------------------------------------------------------
Block layer patches

- Make blockdev-reopen stable
- Remove deprecated qemu-img backing file without format
- rbd: Convert to coroutines and add write zeroes support
- rbd: Updated MAINTAINERS
- export/fuse: Allow other users access to the export
- vhost-user: Fix backends without multiqueue support
- Fix drive-backup transaction endless drained section

----------------------------------------------------------------
Alberto Garcia (4):
      block: Add bdrv_reopen_queue_free()
      block: Support multiple reopening with x-blockdev-reopen
      iotests: Test reopening multiple devices at the same time
      block: Make blockdev-reopen stable API

Eric Blake (3):
      qcow2: Prohibit backing file changes in 'qemu-img amend'
      qemu-img: Require -F with -b backing image
      qemu-img: Improve error for rebase without backing format

Heinrich Schuchardt (1):
      util/uri: do not check argument of uri_free()

Ilya Dryomov (1):
      MAINTAINERS: update block/rbd.c maintainer

Kevin Wolf (3):
      vhost-user: Fix backends without multiqueue support
      qcow2: Fix dangling pointer after reopen for 'file'
      block: Acquire AioContexts during bdrv_reopen_multiple()

Max Reitz (6):
      export/fuse: Pass default_permissions for mount
      export/fuse: Add allow-other option
      export/fuse: Give SET_ATTR_SIZE its own branch
      export/fuse: Let permissions be adjustable
      iotests/308: Test +w on read-only FUSE exports
      iotests/fuse-allow-other: Test allow-other

Or Ozeri (1):
      block/rbd: Add support for rbd image encryption

Peter Lieven (8):
      block/rbd: bump librbd requirement to luminous release
      block/rbd: store object_size in BDRVRBDState
      block/rbd: update s->image_size in qemu_rbd_getlength
      block/rbd: migrate from aio to coroutines
      block/rbd: add write zeroes support
      block/rbd: drop qemu_rbd_refresh_limits
      block/rbd: fix type of task->complete
      MAINTAINERS: add block/rbd.c reviewer

Vladimir Sementsov-Ogievskiy (1):
      blockdev: fix drive-backup transaction endless drained section

From: Or Ozeri <oro@il.ibm.com>

Starting from ceph Pacific, RBD has built-in support for image-level encryption.
Currently supported formats are LUKS version 1 and 2.

There are 2 new relevant librbd APIs for controlling encryption, both expect an
open image context:

rbd_encryption_format: formats an image (i.e. writes the LUKS header)
rbd_encryption_load: loads encryptor/decryptor to the image IO stack

This commit extends the qemu rbd driver API to support the above.

Signed-off-by: Or Ozeri <oro@il.ibm.com>
Message-Id: <20210627114635.39326-1-oro@il.ibm.com>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qapi/block-core.json | 110 ++++++++++++-
 block/rbd.c          | 361 ++++++++++++++++++++++++++++++++++++++++++-
 2 files changed, 465 insertions(+), 6 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
       'extents': ['ImageInfo']
   } }
 
+##
+# @ImageInfoSpecificRbd:
+#
+# @encryption-format: Image encryption format
+#
+# Since: 6.1
+##
+{ 'struct': 'ImageInfoSpecificRbd',
+  'data': {
+      '*encryption-format': 'RbdImageEncryptionFormat'
+  } }
+
 ##
 # @ImageInfoSpecific:
 #
@@ -XXX,XX +XXX,XX @@
       # If we need to add block driver specific parameters for
       # LUKS in future, then we'll subclass QCryptoBlockInfoLUKS
       # to define a ImageInfoSpecificLUKS
-      'luks': 'QCryptoBlockInfoLUKS'
+      'luks': 'QCryptoBlockInfoLUKS',
+      'rbd': 'ImageInfoSpecificRbd'
   } }
 
 ##
@@ -XXX,XX +XXX,XX @@
 { 'enum': 'RbdAuthMode',
   'data': [ 'cephx', 'none' ] }
 
+##
+# @RbdImageEncryptionFormat:
+#
+# Since: 6.1
+##
+{ 'enum': 'RbdImageEncryptionFormat',
+  'data': [ 'luks', 'luks2' ] }
+
+##
+# @RbdEncryptionOptionsLUKSBase:
+#
+# @key-secret: ID of a QCryptoSecret object providing a passphrase
+#              for unlocking the encryption
+#
+# Since: 6.1
+##
+{ 'struct': 'RbdEncryptionOptionsLUKSBase',
+  'data': { 'key-secret': 'str' } }
+
+##
+# @RbdEncryptionCreateOptionsLUKSBase:
+#
+# @cipher-alg: The encryption algorithm
+#
+# Since: 6.1
+##
+{ 'struct': 'RbdEncryptionCreateOptionsLUKSBase',
+  'base': 'RbdEncryptionOptionsLUKSBase',
+  'data': { '*cipher-alg': 'QCryptoCipherAlgorithm' } }
+
+##
+# @RbdEncryptionOptionsLUKS:
+#
+# Since: 6.1
+##
+{ 'struct': 'RbdEncryptionOptionsLUKS',
+  'base': 'RbdEncryptionOptionsLUKSBase',
+  'data': { } }
+
+##
+# @RbdEncryptionOptionsLUKS2:
+#
+# Since: 6.1
+##
+{ 'struct': 'RbdEncryptionOptionsLUKS2',
+  'base': 'RbdEncryptionOptionsLUKSBase',
+  'data': { } }
+
+##
+# @RbdEncryptionCreateOptionsLUKS:
+#
+# Since: 6.1
+##
+{ 'struct': 'RbdEncryptionCreateOptionsLUKS',
+  'base': 'RbdEncryptionCreateOptionsLUKSBase',
+  'data': { } }
+
+##
+# @RbdEncryptionCreateOptionsLUKS2:
+#
+# Since: 6.1
+##
+{ 'struct': 'RbdEncryptionCreateOptionsLUKS2',
+  'base': 'RbdEncryptionCreateOptionsLUKSBase',
+  'data': { } }
+
+##
+# @RbdEncryptionOptions:
+#
+# Since: 6.1
+##
+{ 'union': 'RbdEncryptionOptions',
+  'base': { 'format': 'RbdImageEncryptionFormat' },
+  'discriminator': 'format',
+  'data': { 'luks': 'RbdEncryptionOptionsLUKS',
+            'luks2': 'RbdEncryptionOptionsLUKS2' } }
+
+##
+# @RbdEncryptionCreateOptions:
+#
+# Since: 6.1
+##
+{ 'union': 'RbdEncryptionCreateOptions',
+  'base': { 'format': 'RbdImageEncryptionFormat' },
+  'discriminator': 'format',
+  'data': { 'luks': 'RbdEncryptionCreateOptionsLUKS',
+            'luks2': 'RbdEncryptionCreateOptionsLUKS2' } }
+
 ##
 # @BlockdevOptionsRbd:
 #
@@ -XXX,XX +XXX,XX @@
 #
 # @snapshot: Ceph snapshot name.
 #
+# @encrypt: Image encryption options. (Since 6.1)
+#
 # @user: Ceph id name.
 #
 # @auth-client-required: Acceptable authentication modes.
@@ -XXX,XX +XXX,XX @@
             'image': 'str',
             '*conf': 'str',
             '*snapshot': 'str',
+            '*encrypt': 'RbdEncryptionOptions',
             '*user': 'str',
             '*auth-client-required': ['RbdAuthMode'],
             '*key-secret': 'str',
@@ -XXX,XX +XXX,XX @@
 #            point to a snapshot.
 # @size: Size of the virtual disk in bytes
 # @cluster-size: RBD object size
+# @encrypt: Image encryption options. (Since 6.1)
 #
 # Since: 2.12
 ##
 { 'struct': 'BlockdevCreateOptionsRbd',
   'data': { 'location':         'BlockdevOptionsRbd',
             'size':             'size',
-            '*cluster-size' :   'size' } }
+            '*cluster-size' :   'size',
+            '*encrypt' :        'RbdEncryptionCreateOptions' } }
 
 ##
 # @BlockdevVmdkSubformat:
diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@
 #define LIBRBD_USE_IOVEC 0
 #endif
 
+#define RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN 8
+
+static const char rbd_luks_header_verification[
+        RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {
+    'L', 'U', 'K', 'S', 0xBA, 0xBE, 0, 1
+};
+
+static const char rbd_luks2_header_verification[
+        RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {
+    'L', 'U', 'K', 'S', 0xBA, 0xBE, 0, 2
+};
+
 typedef enum {
     RBD_AIO_READ,
     RBD_AIO_WRITE,
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
     }
 }
 
+#ifdef LIBRBD_SUPPORTS_ENCRYPTION
+static int qemu_rbd_convert_luks_options(
+        RbdEncryptionOptionsLUKSBase *luks_opts,
+        char **passphrase,
+        size_t *passphrase_len,
+        Error **errp)
+{
+    return qcrypto_secret_lookup(luks_opts->key_secret, (uint8_t **)passphrase,
+                                 passphrase_len, errp);
+}
+
+static int qemu_rbd_convert_luks_create_options(
+        RbdEncryptionCreateOptionsLUKSBase *luks_opts,
+        rbd_encryption_algorithm_t *alg,
+        char **passphrase,
+        size_t *passphrase_len,
+        Error **errp)
+{
+    int r = 0;
+
+    r = qemu_rbd_convert_luks_options(
+            qapi_RbdEncryptionCreateOptionsLUKSBase_base(luks_opts),
+            passphrase, passphrase_len, errp);
+    if (r < 0) {
+        return r;
+    }
+
+    if (luks_opts->has_cipher_alg) {
+        switch (luks_opts->cipher_alg) {
+            case QCRYPTO_CIPHER_ALG_AES_128: {
+                *alg = RBD_ENCRYPTION_ALGORITHM_AES128;
+                break;
+            }
+            case QCRYPTO_CIPHER_ALG_AES_256: {
+                *alg = RBD_ENCRYPTION_ALGORITHM_AES256;
+                break;
+            }
+            default: {
+                r = -ENOTSUP;
+                error_setg_errno(errp, -r, "unknown encryption algorithm: %u",
+                                 luks_opts->cipher_alg);
+                return r;
+            }
+        }
+    } else {
+        /* default alg */
+        *alg = RBD_ENCRYPTION_ALGORITHM_AES256;
+    }
+
+    return 0;
+}
+
+static int qemu_rbd_encryption_format(rbd_image_t image,
+                                      RbdEncryptionCreateOptions *encrypt,
+                                      Error **errp)
+{
+    int r = 0;
+    g_autofree char *passphrase = NULL;
+    size_t passphrase_len;
+    rbd_encryption_format_t format;
+    rbd_encryption_options_t opts;
+    rbd_encryption_luks1_format_options_t luks_opts;
+    rbd_encryption_luks2_format_options_t luks2_opts;
+    size_t opts_size;
+    uint64_t raw_size, effective_size;
+
+    r = rbd_get_size(image, &raw_size);
+    if (r < 0) {
+        error_setg_errno(errp, -r, "cannot get raw image size");
+        return r;
+    }
+
+    switch (encrypt->format) {
+        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS: {
+            memset(&luks_opts, 0, sizeof(luks_opts));
+            format = RBD_ENCRYPTION_FORMAT_LUKS1;
+            opts = &luks_opts;
+            opts_size = sizeof(luks_opts);
+            r = qemu_rbd_convert_luks_create_options(
+                    qapi_RbdEncryptionCreateOptionsLUKS_base(&encrypt->u.luks),
+                    &luks_opts.alg, &passphrase, &passphrase_len, errp);
+            if (r < 0) {
+                return r;
+            }
+            luks_opts.passphrase = passphrase;
+            luks_opts.passphrase_size = passphrase_len;
+            break;
+        }
+        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2: {
+            memset(&luks2_opts, 0, sizeof(luks2_opts));
+            format = RBD_ENCRYPTION_FORMAT_LUKS2;
+            opts = &luks2_opts;
+            opts_size = sizeof(luks2_opts);
+            r = qemu_rbd_convert_luks_create_options(
+                    qapi_RbdEncryptionCreateOptionsLUKS2_base(
+                            &encrypt->u.luks2),
+                    &luks2_opts.alg, &passphrase, &passphrase_len, errp);
+            if (r < 0) {
+                return r;
+            }
+            luks2_opts.passphrase = passphrase;
+            luks2_opts.passphrase_size = passphrase_len;
+            break;
+        }
+        default: {
+            r = -ENOTSUP;
+            error_setg_errno(
+                    errp, -r, "unknown image encryption format: %u",
+                    encrypt->format);
+            return r;
+        }
+    }
+
+    r = rbd_encryption_format(image, format, opts, opts_size);
+    if (r < 0) {
+        error_setg_errno(errp, -r, "encryption format fail");
+        return r;
+    }
+
+    r = rbd_get_size(image, &effective_size);
+    if (r < 0) {
+        error_setg_errno(errp, -r, "cannot get effective image size");
+        return r;
+    }
+
+    r = rbd_resize(image, raw_size + (raw_size - effective_size));
+    if (r < 0) {
+        error_setg_errno(errp, -r, "cannot resize image after format");
+        return r;
+    }
+
+    return 0;
+}
+
+static int qemu_rbd_encryption_load(rbd_image_t image,
+                                    RbdEncryptionOptions *encrypt,
+                                    Error **errp)
+{
+    int r = 0;
+    g_autofree char *passphrase = NULL;
+    size_t passphrase_len;
+    rbd_encryption_luks1_format_options_t luks_opts;
+    rbd_encryption_luks2_format_options_t luks2_opts;
+    rbd_encryption_format_t format;
+    rbd_encryption_options_t opts;
+    size_t opts_size;
+
+    switch (encrypt->format) {
+        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS: {
+            memset(&luks_opts, 0, sizeof(luks_opts));
+            format = RBD_ENCRYPTION_FORMAT_LUKS1;
+            opts = &luks_opts;
+            opts_size = sizeof(luks_opts);
+            r = qemu_rbd_convert_luks_options(
+                    qapi_RbdEncryptionOptionsLUKS_base(&encrypt->u.luks),
+                    &passphrase, &passphrase_len, errp);
+            if (r < 0) {
+                return r;
+            }
+            luks_opts.passphrase = passphrase;
+            luks_opts.passphrase_size = passphrase_len;
+            break;
+        }
+        case RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2: {
+            memset(&luks2_opts, 0, sizeof(luks2_opts));
+            format = RBD_ENCRYPTION_FORMAT_LUKS2;
+            opts = &luks2_opts;
+            opts_size = sizeof(luks2_opts);
+            r = qemu_rbd_convert_luks_options(
+                    qapi_RbdEncryptionOptionsLUKS2_base(&encrypt->u.luks2),
+                    &passphrase, &passphrase_len, errp);
+            if (r < 0) {
+                return r;
+            }
+            luks2_opts.passphrase = passphrase;
+            luks2_opts.passphrase_size = passphrase_len;
+            break;
+        }
+        default: {
+            r = -ENOTSUP;
+            error_setg_errno(
+                    errp, -r, "unknown image encryption format: %u",
+                    encrypt->format);
+            return r;
+        }
+    }
+
+    r = rbd_encryption_load(image, format, opts, opts_size);
+    if (r < 0) {
+        error_setg_errno(errp, -r, "encryption load fail");
+        return r;
+    }
+
+    return 0;
+}
+#endif
+
 /* FIXME Deprecate and remove keypairs or make it available in QMP. */
 static int qemu_rbd_do_create(BlockdevCreateOptions *options,
                               const char *keypairs, const char *password_secret,
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_do_create(BlockdevCreateOptions *options,
         return -EINVAL;
     }
 
+#ifndef LIBRBD_SUPPORTS_ENCRYPTION
+    if (opts->has_encrypt) {
+        error_setg(errp, "RBD library does not support image encryption");
+        return -ENOTSUP;
+    }
+#endif
+
     if (opts->has_cluster_size) {
         int64_t objsize = opts->cluster_size;
         if ((objsize - 1) & objsize) {    /* not a power of 2? */
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_do_create(BlockdevCreateOptions *options,
         goto out;
     }
 
+#ifdef LIBRBD_SUPPORTS_ENCRYPTION
+    if (opts->has_encrypt) {
+        rbd_image_t image;
+
+        ret = rbd_open(io_ctx, opts->location->image, &image, NULL);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret,
+                             "error opening image '%s' for encryption format",
+                             opts->location->image);
+            goto out;
+        }
+
+        ret = qemu_rbd_encryption_format(image, opts->encrypt, errp);
+        rbd_close(image);
+        if (ret < 0) {
+            /* encryption format fail, try removing the image */
+            rbd_remove(io_ctx, opts->location->image);
+            goto out;
+        }
+    }
+#endif
+
     ret = 0;
 out:
     rados_ioctx_destroy(io_ctx);
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_co_create(BlockdevCreateOptions *options, Error **errp)
     return qemu_rbd_do_create(options, NULL, NULL, errp);
 }
 
+static int qemu_rbd_extract_encryption_create_options(
+        QemuOpts *opts,
+        RbdEncryptionCreateOptions **spec,
+        Error **errp)
+{
+    QDict *opts_qdict;
+    QDict *encrypt_qdict;
+    Visitor *v;
+    int ret = 0;
+
+    opts_qdict = qemu_opts_to_qdict(opts, NULL);
+    qdict_extract_subqdict(opts_qdict, &encrypt_qdict, "encrypt.");
+    qobject_unref(opts_qdict);
+    if (!qdict_size(encrypt_qdict)) {
+        *spec = NULL;
+        goto exit;
+    }
+
+    /* Convert options into a QAPI object */
+    v = qobject_input_visitor_new_flat_confused(encrypt_qdict, errp);
+    if (!v) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+    visit_type_RbdEncryptionCreateOptions(v, NULL, spec, errp);
+    visit_free(v);
+    if (!*spec) {
+        ret = -EINVAL;
+        goto exit;
+    }
+
+exit:
+    qobject_unref(encrypt_qdict);
+    return ret;
+}
+
 static int coroutine_fn qemu_rbd_co_create_opts(BlockDriver *drv,
                                                 const char *filename,
                                                 QemuOpts *opts,
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_create_opts(BlockDriver *drv,
     BlockdevCreateOptions *create_options;
     BlockdevCreateOptionsRbd *rbd_opts;
     BlockdevOptionsRbd *loc;
+    RbdEncryptionCreateOptions *encrypt = NULL;
     Error *local_err = NULL;
     const char *keypairs, *password_secret;
     QDict *options = NULL;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_create_opts(BlockDriver *drv,
         goto exit;
     }
 
+    ret = qemu_rbd_extract_encryption_create_options(opts, &encrypt, errp);
+    if (ret < 0) {
+        goto exit;
+    }
+    rbd_opts->encrypt     = encrypt;
+    rbd_opts->has_encrypt = !!encrypt;
+
     /*
      * Caution: while qdict_get_try_str() is fine, getting non-string
      * types would require more care.  When @options come from -blockdev
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
         goto failed_open;
     }
 
+    if (opts->has_encrypt) {
+#ifdef LIBRBD_SUPPORTS_ENCRYPTION
+        r = qemu_rbd_encryption_load(s->image, opts->encrypt, errp);
+        if (r < 0) {
+            goto failed_post_open;
+        }
+#else
+        r = -ENOTSUP;
+        error_setg(errp, "RBD library does not support image encryption");
+        goto failed_post_open;
+#endif
+    }
+
     r = rbd_get_size(s->image, &s->image_size);
     if (r < 0) {
         error_setg_errno(errp, -r, "error getting image size from %s",
                          s->image_name);
-        rbd_close(s->image);
-        goto failed_open;
+        goto failed_post_open;
     }
 
     /* If we are using an rbd snapshot, we must be r/o, otherwise
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
     if (s->snap != NULL) {
         r = bdrv_apply_auto_read_only(bs, "rbd snapshots are read-only", errp);
         if (r < 0) {
-            rbd_close(s->image);
-            goto failed_open;
+            goto failed_post_open;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
     r = 0;
     goto out;
 
+failed_post_open:
+    rbd_close(s->image);
 failed_open:
     rados_ioctx_destroy(s->io_ctx);
     g_free(s->snap);
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
     return 0;
 }
 
+static ImageInfoSpecific *qemu_rbd_get_specific_info(BlockDriverState *bs,
+                                                     Error **errp)
+{
+    BDRVRBDState *s = bs->opaque;
+    ImageInfoSpecific *spec_info;
+    char buf[RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN] = {0};
+    int r;
+
+    if (s->image_size >= RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) {
+        r = rbd_read(s->image, 0,
+                     RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN, buf);
+        if (r < 0) {
+            error_setg_errno(errp, -r, "cannot read image start for probe");
+            return NULL;
+        }
+    }
+
+    spec_info = g_new(ImageInfoSpecific, 1);
+    *spec_info = (ImageInfoSpecific){
+        .type  = IMAGE_INFO_SPECIFIC_KIND_RBD,
+        .u.rbd.data = g_new0(ImageInfoSpecificRbd, 1),
+    };
+
+    if (memcmp(buf, rbd_luks_header_verification,
+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
+        spec_info->u.rbd.data->encryption_format =
+                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS;
+        spec_info->u.rbd.data->has_encryption_format = true;
+    } else if (memcmp(buf, rbd_luks2_header_verification,
+               RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN) == 0) {
+        spec_info->u.rbd.data->encryption_format =
+                RBD_IMAGE_ENCRYPTION_FORMAT_LUKS2;
+        spec_info->u.rbd.data->has_encryption_format = true;
+    } else {
+        spec_info->u.rbd.data->has_encryption_format = false;
+    }
+
+    return spec_info;
+}
+
 static int64_t qemu_rbd_getlength(BlockDriverState *bs)
 {
     BDRVRBDState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static QemuOptsList qemu_rbd_create_opts = {
             .type = QEMU_OPT_STRING,
             .help = "ID of secret providing the password",
         },
+        {
+            .name = "encrypt.format",
+            .type = QEMU_OPT_STRING,
+            .help = "Encrypt the image, format choices: 'luks', 'luks2'",
+        },
+        {
+            .name = "encrypt.cipher-alg",
+            .type = QEMU_OPT_STRING,
+            .help = "Name of encryption cipher algorithm"
+                    " (allowed values: aes-128, aes-256)",
+        },
+        {
+            .name = "encrypt.key-secret",
+            .type = QEMU_OPT_STRING,
+            .help = "ID of secret providing LUKS passphrase",
+        },
         { /* end of list */ }
     }
 };
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
     .bdrv_co_create_opts    = qemu_rbd_co_create_opts,
     .bdrv_has_zero_init     = bdrv_has_zero_init_1,
     .bdrv_get_info          = qemu_rbd_getinfo,
+    .bdrv_get_specific_info = qemu_rbd_get_specific_info,
     .create_opts            = &qemu_rbd_create_opts,
     .bdrv_getlength         = qemu_rbd_getlength,
     .bdrv_co_truncate       = qemu_rbd_co_truncate,
-- 
2.31.1

From: Peter Lieven <pl@kamp.de>

Ceph Luminous (version 12.2.z) is almost 4 years old at this point.
Bump the requirement to get rid of the ifdef'ry in the code.
Qemu 6.1 dropped the support for RHEL-7 which was the last supported
OS that required an older librbd.

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Message-Id: <20210702172356.11574-2-idryomov@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c | 120 ++++------------------------------------------------
 meson.build |   7 ++-
 2 files changed, 13 insertions(+), 114 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@
  * leading "\".
  */
 
-/* rbd_aio_discard added in 0.1.2 */
-#if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 2)
-#define LIBRBD_SUPPORTS_DISCARD
-#else
-#undef LIBRBD_SUPPORTS_DISCARD
-#endif
-
 #define OBJ_MAX_SIZE (1UL << OBJ_DEFAULT_OBJ_ORDER)
 
 #define RBD_MAX_SNAPS 100
 
-/* The LIBRBD_SUPPORTS_IOVEC is defined in librbd.h */
-#ifdef LIBRBD_SUPPORTS_IOVEC
-#define LIBRBD_USE_IOVEC 1
-#else
-#define LIBRBD_USE_IOVEC 0
-#endif
-
 #define RBD_ENCRYPTION_LUKS_HEADER_VERIFICATION_LEN 8
 
 static const char rbd_luks_header_verification[
@@ -XXX,XX +XXX,XX @@ typedef struct RBDAIOCB {
     BlockAIOCB common;
     int64_t ret;
     QEMUIOVector *qiov;
-    char *bounce;
     RBDAIOCmd cmd;
     int error;
     struct BDRVRBDState *s;
@@ -XXX,XX +XXX,XX @@ typedef struct RADOSCB {
     RBDAIOCB *acb;
     struct BDRVRBDState *s;
     int64_t size;
-    char *buf;
     int64_t ret;
 } RADOSCB;
 
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json,
 
 static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
 {
-    if (LIBRBD_USE_IOVEC) {
-        RBDAIOCB *acb = rcb->acb;
-        iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
-                   acb->qiov->size - offs);
-    } else {
-        memset(rcb->buf + offs, 0, rcb->size - offs);
-    }
+    RBDAIOCB *acb = rcb->acb;
+    iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
+               acb->qiov->size - offs);
 }
 
 #ifdef LIBRBD_SUPPORTS_ENCRYPTION
@@ -XXX,XX +XXX,XX @@ static void qemu_rbd_complete_aio(RADOSCB *rcb)
 
     g_free(rcb);
 
-    if (!LIBRBD_USE_IOVEC) {
-        if (acb->cmd == RBD_AIO_READ) {
-            qemu_iovec_from_buf(acb->qiov, 0, acb->bounce, acb->qiov->size);
-        }
-        qemu_vfree(acb->bounce);
-    }
-
     acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
 
     qemu_aio_unref(acb);
@@ -XXX,XX +XXX,XX @@ static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
                                      rbd_finish_bh, rcb);
 }
 
-static int rbd_aio_discard_wrapper(rbd_image_t image,
-                                   uint64_t off,
-                                   uint64_t len,
-                                   rbd_completion_t comp)
-{
-#ifdef LIBRBD_SUPPORTS_DISCARD
-    return rbd_aio_discard(image, off, len, comp);
-#else
-    return -ENOTSUP;
-#endif
-}
-
-static int rbd_aio_flush_wrapper(rbd_image_t image,
-                                 rbd_completion_t comp)
-{
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
-    return rbd_aio_flush(image, comp);
-#else
-    return -ENOTSUP;
-#endif
-}
-
 static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
                                  int64_t off,
                                  QEMUIOVector *qiov,
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
 
     rcb = g_new(RADOSCB, 1);
 
-    if (!LIBRBD_USE_IOVEC) {
-        if (cmd == RBD_AIO_DISCARD || cmd == RBD_AIO_FLUSH) {
-            acb->bounce = NULL;
-        } else {
-            acb->bounce = qemu_try_blockalign(bs, qiov->size);
-            if (acb->bounce == NULL) {
-                goto failed;
-            }
-        }
-        if (cmd == RBD_AIO_WRITE) {
-            qemu_iovec_to_buf(acb->qiov, 0, acb->bounce, qiov->size);
-        }
-        rcb->buf = acb->bounce;
-    }
-
     acb->ret = 0;
     acb->error = 0;
     acb->s = s;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
     }
 
     switch (cmd) {
-    case RBD_AIO_WRITE: {
+    case RBD_AIO_WRITE:
         /*
          * RBD APIs don't allow us to write more than actual size, so in order
          * to support growing images, we resize the image before write
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
                 goto failed_completion;
             }
         }
-#ifdef LIBRBD_SUPPORTS_IOVEC
-            r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
-#else
-            r = rbd_aio_write(s->image, off, size, rcb->buf, c);
-#endif
+        r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
         break;
-    }
     case RBD_AIO_READ:
-#ifdef LIBRBD_SUPPORTS_IOVEC
-            r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
-#else
-            r = rbd_aio_read(s->image, off, size, rcb->buf, c);
-#endif
+        r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
         break;
     case RBD_AIO_DISCARD:
-        r = rbd_aio_discard_wrapper(s->image, off, size, c);
+        r = rbd_aio_discard(s->image, off, size, c);
         break;
     case RBD_AIO_FLUSH:
-        r = rbd_aio_flush_wrapper(s->image, c);
+        r = rbd_aio_flush(s->image, c);
         break;
     default:
         r = -EINVAL;
@@ -XXX,XX +XXX,XX @@ failed_completion:
     rbd_aio_release(c);
 failed:
     g_free(rcb);
-    if (!LIBRBD_USE_IOVEC) {
-        qemu_vfree(acb->bounce);
-    }
 
     qemu_aio_unref(acb);
     return NULL;
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_pwritev(BlockDriverState *bs,
                          RBD_AIO_WRITE);
 }
 
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
 static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
                                       BlockCompletionFunc *cb,
                                       void *opaque)
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
     return rbd_start_aio(bs, 0, NULL, 0, cb, opaque, RBD_AIO_FLUSH);
 }
 
-#else
-
-static int qemu_rbd_co_flush(BlockDriverState *bs)
-{
-#if LIBRBD_VERSION_CODE >= LIBRBD_VERSION(0, 1, 1)
-    /* rbd_flush added in 0.1.1 */
-    BDRVRBDState *s = bs->opaque;
-    return rbd_flush(s->image);
-#else
-    return 0;
-#endif
-}
-#endif
-
 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
     BDRVRBDState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
     return snap_count;
 }
 
-#ifdef LIBRBD_SUPPORTS_DISCARD
 static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
                                          int64_t offset,
                                          int bytes,
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
     return rbd_start_aio(bs, offset, NULL, bytes, cb, opaque,
                          RBD_AIO_DISCARD);
 }
-#endif
 
-#ifdef LIBRBD_SUPPORTS_INVALIDATE
 static void coroutine_fn qemu_rbd_co_invalidate_cache(BlockDriverState *bs,
                                                       Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static void coroutine_fn qemu_rbd_co_invalidate_cache(BlockDriverState *bs,
         error_setg_errno(errp, -r, "Failed to invalidate the cache");
     }
 }
-#endif
 
 static QemuOptsList qemu_rbd_create_opts = {
     .name = "rbd-create-opts",
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
     .bdrv_aio_preadv        = qemu_rbd_aio_preadv,
     .bdrv_aio_pwritev       = qemu_rbd_aio_pwritev,
 
-#ifdef LIBRBD_SUPPORTS_AIO_FLUSH
     .bdrv_aio_flush         = qemu_rbd_aio_flush,
-#else
-    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
-#endif
-
-#ifdef LIBRBD_SUPPORTS_DISCARD
     .bdrv_aio_pdiscard      = qemu_rbd_aio_pdiscard,
-#endif
 
     .bdrv_snapshot_create   = qemu_rbd_snap_create,
     .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
     .bdrv_snapshot_list     = qemu_rbd_snap_list,
     .bdrv_snapshot_goto     = qemu_rbd_snap_rollback,
-#ifdef LIBRBD_SUPPORTS_INVALIDATE
     .bdrv_co_invalidate_cache = qemu_rbd_co_invalidate_cache,
-#endif
 
     .strong_runtime_opts    = qemu_rbd_strong_runtime_opts,
 };
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('rbd').auto() or have_block
       int main(void) {
         rados_t cluster;
         rados_create(&cluster, NULL);
+        #if LIBRBD_VERSION_CODE < LIBRBD_VERSION(1, 12, 0)
+        #error
+        #endif
         return 0;
       }''', dependencies: [librbd, librados])
       rbd = declare_dependency(dependencies: [librbd, librados])
     elif get_option('rbd').enabled()
-      error('could not link librados')
+      error('librbd >= 1.12.0 required')
     else
-      warning('could not link librados, disabling')
+      warning('librbd >= 1.12.0 not found, disabling')
     endif
   endif
 endif
-- 
2.31.1

From: Peter Lieven <pl@kamp.de>

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Message-Id: <20210702172356.11574-3-idryomov@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c | 18 +++++++-----------
 1 file changed, 7 insertions(+), 11 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVRBDState {
     char *snap;
     char *namespace;
     uint64_t image_size;
+    uint64_t object_size;
 } BDRVRBDState;
 
 static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
     const QDictEntry *e;
     Error *local_err = NULL;
     char *keypairs, *secretid;
+    rbd_image_info_t info;
     int r;
 
     keypairs = g_strdup(qdict_get_try_str(options, "=keyvalue-pairs"));
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
 #endif
     }
 
-    r = rbd_get_size(s->image, &s->image_size);
+    r = rbd_stat(s->image, &info, sizeof(info));
     if (r < 0) {
-        error_setg_errno(errp, -r, "error getting image size from %s",
+        error_setg_errno(errp, -r, "error getting image info from %s",
                          s->image_name);
         goto failed_post_open;
     }
+    s->image_size = info.size;
+    s->object_size = info.obj_size;
 
     /* If we are using an rbd snapshot, we must be r/o, otherwise
      * leave as-is */
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
     BDRVRBDState *s = bs->opaque;
-    rbd_image_info_t info;
-    int r;
-
-    r = rbd_stat(s->image, &info, sizeof(info));
-    if (r < 0) {
-        return r;
-    }
-
-    bdi->cluster_size = info.obj_size;
+    bdi->cluster_size = s->object_size;
     return 0;
 }
 
-- 
2.31.1

From: Peter Lieven <pl@kamp.de>

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Message-Id: <20210702172356.11574-5-idryomov@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c | 252 +++++++++++++++++++---------------------------------
 1 file changed, 90 insertions(+), 162 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     RBD_AIO_FLUSH
 } RBDAIOCmd;
 
-typedef struct RBDAIOCB {
-    BlockAIOCB common;
-    int64_t ret;
-    QEMUIOVector *qiov;
-    RBDAIOCmd cmd;
-    int error;
-    struct BDRVRBDState *s;
-} RBDAIOCB;
-
-typedef struct RADOSCB {
-    RBDAIOCB *acb;
-    struct BDRVRBDState *s;
-    int64_t size;
-    int64_t ret;
-} RADOSCB;
-
 typedef struct BDRVRBDState {
     rados_t cluster;
     rados_ioctx_t io_ctx;
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVRBDState {
     uint64_t object_size;
 } BDRVRBDState;
 
+typedef struct RBDTask {
+    BlockDriverState *bs;
+    Coroutine *co;
+    bool complete;
+    int64_t ret;
+} RBDTask;
+
 static int qemu_rbd_connect(rados_t *cluster, rados_ioctx_t *io_ctx,
                             BlockdevOptionsRbd *opts, bool cache,
                             const char *keypairs, const char *secretid,
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_set_keypairs(rados_t cluster, const char *keypairs_json,
     return ret;
 }
 
-static void qemu_rbd_memset(RADOSCB *rcb, int64_t offs)
-{
-    RBDAIOCB *acb = rcb->acb;
-    iov_memset(acb->qiov->iov, acb->qiov->niov, offs, 0,
-               acb->qiov->size - offs);
-}
-
 #ifdef LIBRBD_SUPPORTS_ENCRYPTION
 static int qemu_rbd_convert_luks_options(
         RbdEncryptionOptionsLUKSBase *luks_opts,
@@ -XXX,XX +XXX,XX @@ exit:
     return ret;
 }
 
-/*
- * This aio completion is being called from rbd_finish_bh() and runs in qemu
- * BH context.
- */
-static void qemu_rbd_complete_aio(RADOSCB *rcb)
-{
-    RBDAIOCB *acb = rcb->acb;
-    int64_t r;
-
-    r = rcb->ret;
-
-    if (acb->cmd != RBD_AIO_READ) {
-        if (r < 0) {
-            acb->ret = r;
-            acb->error = 1;
-        } else if (!acb->error) {
-            acb->ret = rcb->size;
-        }
-    } else {
-        if (r < 0) {
-            qemu_rbd_memset(rcb, 0);
-            acb->ret = r;
-            acb->error = 1;
-        } else if (r < rcb->size) {
-            qemu_rbd_memset(rcb, r);
-            if (!acb->error) {
-                acb->ret = rcb->size;
-            }
-        } else if (!acb->error) {
-            acb->ret = r;
-        }
-    }
-
-    g_free(rcb);
-
-    acb->common.cb(acb->common.opaque, (acb->ret > 0 ? 0 : acb->ret));
-
-    qemu_aio_unref(acb);
-}
-
 static char *qemu_rbd_mon_host(BlockdevOptionsRbd *opts, Error **errp)
 {
     const char **vals;
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_resize(BlockDriverState *bs, uint64_t size)
     return 0;
 }
 
-static const AIOCBInfo rbd_aiocb_info = {
-    .aiocb_size = sizeof(RBDAIOCB),
-};
-
-static void rbd_finish_bh(void *opaque)
+static void qemu_rbd_finish_bh(void *opaque)
 {
-    RADOSCB *rcb = opaque;
-    qemu_rbd_complete_aio(rcb);
+    RBDTask *task = opaque;
+    task->complete = 1;
+    aio_co_wake(task->co);
 }
 
 /*
- * This is the callback function for rbd_aio_read and _write
+ * This is the completion callback function for all rbd aio calls
+ * started from qemu_rbd_start_co().
  *
  * Note: this function is being called from a non qemu thread so
  * we need to be careful about what we do here. Generally we only
  * schedule a BH, and do the rest of the io completion handling
- * from rbd_finish_bh() which runs in a qemu context.
+ * from qemu_rbd_finish_bh() which runs in a qemu context.
  */
-static void rbd_finish_aiocb(rbd_completion_t c, RADOSCB *rcb)
+static void qemu_rbd_completion_cb(rbd_completion_t c, RBDTask *task)
 {
-    RBDAIOCB *acb = rcb->acb;
-
-    rcb->ret = rbd_aio_get_return_value(c);
+    task->ret = rbd_aio_get_return_value(c);
     rbd_aio_release(c);
-
-    replay_bh_schedule_oneshot_event(bdrv_get_aio_context(acb->common.bs),
-                                     rbd_finish_bh, rcb);
+    aio_bh_schedule_oneshot(bdrv_get_aio_context(task->bs),
+                            qemu_rbd_finish_bh, task);
 }
 
-static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
-                                 int64_t off,
-                                 QEMUIOVector *qiov,
-                                 int64_t size,
-                                 BlockCompletionFunc *cb,
-                                 void *opaque,
-                                 RBDAIOCmd cmd)
+static int coroutine_fn qemu_rbd_start_co(BlockDriverState *bs,
+                                          uint64_t offset,
+                                          uint64_t bytes,
+                                          QEMUIOVector *qiov,
+                                          int flags,
+                                          RBDAIOCmd cmd)
 {
-    RBDAIOCB *acb;
-    RADOSCB *rcb = NULL;
+    BDRVRBDState *s = bs->opaque;
+    RBDTask task = { .bs = bs, .co = qemu_coroutine_self() };
     rbd_completion_t c;
     int r;
 
-    BDRVRBDState *s = bs->opaque;
-
-    acb = qemu_aio_get(&rbd_aiocb_info, bs, cb, opaque);
-    acb->cmd = cmd;
-    acb->qiov = qiov;
-    assert(!qiov || qiov->size == size);
-
-    rcb = g_new(RADOSCB, 1);
+    assert(!qiov || qiov->size == bytes);
 
-    acb->ret = 0;
-    acb->error = 0;
-    acb->s = s;
-
-    rcb->acb = acb;
-    rcb->s = acb->s;
-    rcb->size = size;
-    r = rbd_aio_create_completion(rcb, (rbd_callback_t) rbd_finish_aiocb, &c);
+    r = rbd_aio_create_completion(&task,
+                                  (rbd_callback_t) qemu_rbd_completion_cb, &c);
     if (r < 0) {
-        goto failed;
+        return r;
     }
 
     switch (cmd) {
-    case RBD_AIO_WRITE:
-        /*
-         * RBD APIs don't allow us to write more than actual size, so in order
-         * to support growing images, we resize the image before write
-         * operations that exceed the current size.
-         */
-        if (off + size > s->image_size) {
-            r = qemu_rbd_resize(bs, off + size);
-            if (r < 0) {
-                goto failed_completion;
-            }
-        }
-        r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, off, c);
-        break;
     case RBD_AIO_READ:
-        r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, off, c);
+        r = rbd_aio_readv(s->image, qiov->iov, qiov->niov, offset, c);
+        break;
+    case RBD_AIO_WRITE:
+        r = rbd_aio_writev(s->image, qiov->iov, qiov->niov, offset, c);
         break;
     case RBD_AIO_DISCARD:
-        r = rbd_aio_discard(s->image, off, size, c);
+        r = rbd_aio_discard(s->image, offset, bytes, c);
         break;
     case RBD_AIO_FLUSH:
         r = rbd_aio_flush(s->image, c);
@@ -XXX,XX +XXX,XX @@ static BlockAIOCB *rbd_start_aio(BlockDriverState *bs,
     }
 
     if (r < 0) {
-        goto failed_completion;
+        error_report("rbd request failed early: cmd %d offset %" PRIu64
+                     " bytes %" PRIu64 " flags %d r %d (%s)", cmd, offset,
+                     bytes, flags, r, strerror(-r));
+        rbd_aio_release(c);
+        return r;
     }
-    return &acb->common;
 
-failed_completion:
-    rbd_aio_release(c);
-failed:
-    g_free(rcb);
+    while (!task.complete) {
+        qemu_coroutine_yield();
+    }
 
-    qemu_aio_unref(acb);
-    return NULL;
+    if (task.ret < 0) {
+        error_report("rbd request failed: cmd %d offset %" PRIu64 " bytes %"
+                     PRIu64 " flags %d task.ret %" PRIi64 " (%s)", cmd, offset,
+                     bytes, flags, task.ret, strerror(-task.ret));
+        return task.ret;
+    }
+
+    /* zero pad short reads */
+    if (cmd == RBD_AIO_READ && task.ret < qiov->size) {
+        qemu_iovec_memset(qiov, task.ret, 0, qiov->size - task.ret);
+    }
+
+    return 0;
+}
+
+static int
+coroutine_fn qemu_rbd_co_preadv(BlockDriverState *bs, uint64_t offset,
+                               uint64_t bytes, QEMUIOVector *qiov,
+                               int flags)
+{
+    return qemu_rbd_start_co(bs, offset, bytes, qiov, flags, RBD_AIO_READ);
 }
 
-static BlockAIOCB *qemu_rbd_aio_preadv(BlockDriverState *bs,
-                                       uint64_t offset, uint64_t bytes,
-                                       QEMUIOVector *qiov, int flags,
-                                       BlockCompletionFunc *cb,
-                                       void *opaque)
+static int
+coroutine_fn qemu_rbd_co_pwritev(BlockDriverState *bs, uint64_t offset,
+                                 uint64_t bytes, QEMUIOVector *qiov,
+                                 int flags)
 {
-    return rbd_start_aio(bs, offset, qiov, bytes, cb, opaque,
-                         RBD_AIO_READ);
+    BDRVRBDState *s = bs->opaque;
+    /*
+     * RBD APIs don't allow us to write more than actual size, so in order
+     * to support growing images, we resize the image before write
+     * operations that exceed the current size.
+     */
+    if (offset + bytes > s->image_size) {
+        int r = qemu_rbd_resize(bs, offset + bytes);
+        if (r < 0) {
+            return r;
+        }
+    }
+    return qemu_rbd_start_co(bs, offset, bytes, qiov, flags, RBD_AIO_WRITE);
 }
 
-static BlockAIOCB *qemu_rbd_aio_pwritev(BlockDriverState *bs,
-                                        uint64_t offset, uint64_t bytes,
-                                        QEMUIOVector *qiov, int flags,
-                                        BlockCompletionFunc *cb,
-                                        void *opaque)
+static int coroutine_fn qemu_rbd_co_flush(BlockDriverState *bs)
 {
-    return rbd_start_aio(bs, offset, qiov, bytes, cb, opaque,
-                         RBD_AIO_WRITE);
+    return qemu_rbd_start_co(bs, 0, 0, NULL, 0, RBD_AIO_FLUSH);
 }
 
-static BlockAIOCB *qemu_rbd_aio_flush(BlockDriverState *bs,
-                                      BlockCompletionFunc *cb,
-                                      void *opaque)
+static int coroutine_fn qemu_rbd_co_pdiscard(BlockDriverState *bs,
+                                             int64_t offset, int count)
 {
-    return rbd_start_aio(bs, 0, NULL, 0, cb, opaque, RBD_AIO_FLUSH);
+    return qemu_rbd_start_co(bs, offset, count, NULL, 0, RBD_AIO_DISCARD);
 }
 
 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_snap_list(BlockDriverState *bs,
     return snap_count;
 }
 
-static BlockAIOCB *qemu_rbd_aio_pdiscard(BlockDriverState *bs,
-                                         int64_t offset,
-                                         int bytes,
-                                         BlockCompletionFunc *cb,
-                                         void *opaque)
-{
-    return rbd_start_aio(bs, offset, NULL, bytes, cb, opaque,
-                         RBD_AIO_DISCARD);
-}
-
 static void coroutine_fn qemu_rbd_co_invalidate_cache(BlockDriverState *bs,
                                                       Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
     .bdrv_co_truncate       = qemu_rbd_co_truncate,
     .protocol_name          = "rbd",
 
-    .bdrv_aio_preadv        = qemu_rbd_aio_preadv,
-    .bdrv_aio_pwritev       = qemu_rbd_aio_pwritev,
-
-    .bdrv_aio_flush         = qemu_rbd_aio_flush,
-    .bdrv_aio_pdiscard      = qemu_rbd_aio_pdiscard,
+    .bdrv_co_preadv         = qemu_rbd_co_preadv,
+    .bdrv_co_pwritev        = qemu_rbd_co_pwritev,
+    .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
+    .bdrv_co_pdiscard       = qemu_rbd_co_pdiscard,
 
     .bdrv_snapshot_create   = qemu_rbd_snap_create,
     .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
-- 
2.31.1

From: Peter Lieven <pl@kamp.de>

This patch wittingly sets BDRV_REQ_NO_FALLBACK and silently ignores
BDRV_REQ_MAY_UNMAP for older librbd versions.

The rationale for this is as follows (citing Ilya Dryomov current RBD
maintainer):

---8<---
a) remove the BDRV_REQ_MAY_UNMAP check in qemu_rbd_co_pwrite_zeroes()
   and as a consequence always unmap if librbd is too old

It's not clear what qemu's expectation is but in general Write
   Zeroes is allowed to unmap.  The only guarantee is that subsequent
   reads return zeroes, everything else is a hint.  This is how it is
   specified in the kernel and in the NVMe spec.

In particular, block/nvme.c implements it as follows:

if (flags & BDRV_REQ_MAY_UNMAP) {
       cdw12 |= (1 << 25);
   }

This sets the Deallocate bit.  But if it's not set, the device may
   still deallocate:

"""
   If the Deallocate bit (CDW12.DEAC) is set to '1' in a Write Zeroes
   command, and the namespace supports clearing all bytes to 0h in the
   values read (e.g., bits 2:0 in the DLFEAT field are set to 001b)
   from a deallocated logical block and its metadata (excluding
   protection information), then for each specified logical block, the
   controller:
   - should deallocate that logical block;

...

If the Deallocate bit is cleared to '0' in a Write Zeroes command,
   and the namespace supports clearing all bytes to 0h in the values
   read (e.g., bits 2:0 in the DLFEAT field are set to 001b) from
   a deallocated logical block and its metadata (excluding protection
   information), then, for each specified logical block, the
   controller:
   - may deallocate that logical block;
   """

https://nvmexpress.org/wp-content/uploads/NVM-Express-NVM-Command-Set-Specification-2021.06.02-Ratified-1.pdf

b) set BDRV_REQ_NO_FALLBACK in supported_zero_flags

Again, it's not clear what qemu expects here, but without it we end
   up in a ridiculous situation where specifying the "don't allow slow
   fallback" switch immediately fails all efficient zeroing requests on
   a device where Write Zeroes is always efficient:

$ qemu-io -c 'help write' | grep -- '-[zun]'
    -n, -- with -z, don't allow slow fallback
    -u, -- with -z, allow unmapping
    -z, -- write zeroes using blk_co_pwrite_zeroes

$ qemu-io -f rbd -c 'write -z -u -n 0 1M' rbd:foo/bar
   write failed: Operation not supported
--->8---

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Message-Id: <20210702172356.11574-6-idryomov@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c | 32 +++++++++++++++++++++++++++++++-
 1 file changed, 31 insertions(+), 1 deletion(-)

diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ typedef enum {
     RBD_AIO_READ,
     RBD_AIO_WRITE,
     RBD_AIO_DISCARD,
-    RBD_AIO_FLUSH
+    RBD_AIO_FLUSH,
+    RBD_AIO_WRITE_ZEROES
 } RBDAIOCmd;
 
 typedef struct BDRVRBDState {
@@ -XXX,XX +XXX,XX @@ static int qemu_rbd_open(BlockDriverState *bs, QDict *options, int flags,
         }
     }
 
+#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
+    bs->supported_zero_flags = BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK;
+#endif
+
     /* When extending regular files, we get zeros from the OS */
     bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_start_co(BlockDriverState *bs,
     case RBD_AIO_FLUSH:
         r = rbd_aio_flush(s->image, c);
         break;
+#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
+    case RBD_AIO_WRITE_ZEROES: {
+        int zero_flags = 0;
+#ifdef RBD_WRITE_ZEROES_FLAG_THICK_PROVISION
+        if (!(flags & BDRV_REQ_MAY_UNMAP)) {
+            zero_flags = RBD_WRITE_ZEROES_FLAG_THICK_PROVISION;
+        }
+#endif
+        r = rbd_aio_write_zeroes(s->image, offset, bytes, c, zero_flags, 0);
+        break;
+    }
+#endif
     default:
         r = -EINVAL;
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn qemu_rbd_co_pdiscard(BlockDriverState *bs,
     return qemu_rbd_start_co(bs, offset, count, NULL, 0, RBD_AIO_DISCARD);
 }
 
+#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
+static int
+coroutine_fn qemu_rbd_co_pwrite_zeroes(BlockDriverState *bs, int64_t offset,
+                                      int count, BdrvRequestFlags flags)
+{
+    return qemu_rbd_start_co(bs, offset, count, NULL, flags,
+                             RBD_AIO_WRITE_ZEROES);
+}
+#endif
+
 static int qemu_rbd_getinfo(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
     BDRVRBDState *s = bs->opaque;
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
     .bdrv_co_pwritev        = qemu_rbd_co_pwritev,
     .bdrv_co_flush_to_disk  = qemu_rbd_co_flush,
     .bdrv_co_pdiscard       = qemu_rbd_co_pdiscard,
+#ifdef LIBRBD_SUPPORTS_WRITE_ZEROES
+    .bdrv_co_pwrite_zeroes  = qemu_rbd_co_pwrite_zeroes,
+#endif
 
     .bdrv_snapshot_create   = qemu_rbd_snap_create,
     .bdrv_snapshot_delete   = qemu_rbd_snap_remove,
-- 
2.31.1

From: Peter Lieven <pl@kamp.de>

librbd supports 1 byte alignment for all aio operations.

Currently, there is no API call to query limits from the Ceph
ObjectStore backend.  So drop the bdrv_refresh_limits completely
until there is such an API call.

Signed-off-by: Peter Lieven <pl@kamp.de>
Reviewed-by: Ilya Dryomov <idryomov@gmail.com>
Message-Id: <20210702172356.11574-7-idryomov@gmail.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/rbd.c | 9 ---------
 1 file changed, 9 deletions(-)

diff --git a/block/rbd.c b/block/rbd.c
index XXXXXXX..XXXXXXX 100644
--- a/block/rbd.c
+++ b/block/rbd.c
@@ -XXX,XX +XXX,XX @@ done:
     return;
 }
 
-
-static void qemu_rbd_refresh_limits(BlockDriverState *bs, Error **errp)
-{
-    /* XXX Does RBD support AIO on less than 512-byte alignment? */
-    bs->bl.request_alignment = 512;
-}
-
-
 static int qemu_rbd_set_auth(rados_t cluster, BlockdevOptionsRbd *opts,
                              Error **errp)
 {
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_rbd = {
     .format_name            = "rbd",
     .instance_size          = sizeof(BDRVRBDState),
     .bdrv_parse_filename    = qemu_rbd_parse_filename,
-    .bdrv_refresh_limits    = qemu_rbd_refresh_limits,
     .bdrv_file_open         = qemu_rbd_open,
     .bdrv_close             = qemu_rbd_close,
     .bdrv_reopen_prepare    = qemu_rbd_reopen_prepare,
-- 
2.31.1

From: Heinrich Schuchardt <xypron.glpk@gmx.de>

uri_free() checks if its argument is NULL in uri_clean() and g_free().
There is no need to check the argument before the call.

Signed-off-by: Heinrich Schuchardt <xypron.glpk@gmx.de>
Message-Id: <20210629063602.4239-1-xypron.glpk@gmx.de>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Richard W.M. Jones <rjones@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/nfs.c |  4 +---
 block/ssh.c |  4 +---
 util/uri.c  | 22 ++++++----------------
 3 files changed, 8 insertions(+), 22 deletions(-)

diff --git a/block/nfs.c b/block/nfs.c
index XXXXXXX..XXXXXXX 100644
--- a/block/nfs.c
+++ b/block/nfs.c
@@ -XXX,XX +XXX,XX @@ out:
     if (qp) {
         query_params_free(qp);
     }
-    if (uri) {
-        uri_free(uri);
-    }
+    uri_free(uri);
     return ret;
 }
 
diff --git a/block/ssh.c b/block/ssh.c
index XXXXXXX..XXXXXXX 100644
--- a/block/ssh.c
+++ b/block/ssh.c
@@ -XXX,XX +XXX,XX @@ static int parse_uri(const char *filename, QDict *options, Error **errp)
     return 0;
 
  err:
-    if (uri) {
-      uri_free(uri);
-    }
+    uri_free(uri);
     return -EINVAL;
 }
 
diff --git a/util/uri.c b/util/uri.c
index XXXXXXX..XXXXXXX 100644
--- a/util/uri.c
+++ b/util/uri.c
@@ -XXX,XX +XXX,XX @@ static void uri_clean(URI *uri)
 
 /**
  * uri_free:
- * @uri:  pointer to an URI
+ * @uri:  pointer to an URI, NULL is ignored
  *
  * Free up the URI struct
  */
@@ -XXX,XX +XXX,XX @@ step_7:
     val = uri_to_string(res);
 
 done:
-    if (ref != NULL) {
-        uri_free(ref);
-    }
-    if (bas != NULL) {
-        uri_free(bas);
-    }
-    if (res != NULL) {
-        uri_free(res);
-    }
+    uri_free(ref);
+    uri_free(bas);
+    uri_free(res);
     return val;
 }
 
@@ -XXX,XX +XXX,XX @@ done:
     if (remove_path != 0) {
         ref->path = NULL;
     }
-    if (ref != NULL) {
-        uri_free(ref);
-    }
-    if (bas != NULL) {
-        uri_free(bas);
-    }
+    uri_free(ref);
+    uri_free(bas);
 
     return val;
 }
-- 
2.31.1

From: Max Reitz <mreitz@redhat.com>

We do not do any permission checks in fuse_open(), so let the kernel do
them.  We already let fuse_getattr() report the proper UNIX permissions,
so this should work the way we want.

This causes a change in 308's reference output, because now opening a
non-writable export with O_RDWR fails already, instead of only actually
attempting to write to it.  (That is an improvement.)

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20210625142317.271673-2-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/export/fuse.c        | 8 ++++++--
 tests/qemu-iotests/308     | 3 ++-
 tests/qemu-iotests/308.out | 2 +-
 3 files changed, 9 insertions(+), 4 deletions(-)

diff --git a/block/export/fuse.c b/block/export/fuse.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/fuse.c
+++ b/block/export/fuse.c
@@ -XXX,XX +XXX,XX @@ static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
     struct fuse_args fuse_args;
     int ret;
 
-    /* Needs to match what fuse_init() sets.  Only max_read must be supplied. */
-    mount_opts = g_strdup_printf("max_read=%zu", FUSE_MAX_BOUNCE_BYTES);
+    /*
+     * max_read needs to match what fuse_init() sets.
+     * max_write need not be supplied.
+     */
+    mount_opts = g_strdup_printf("max_read=%zu,default_permissions",
+                                 FUSE_MAX_BOUNCE_BYTES);
 
     fuse_argv[0] = ""; /* Dummy program name */
     fuse_argv[1] = "-o";
diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/308
+++ b/tests/qemu-iotests/308
@@ -XXX,XX +XXX,XX @@ echo '=== Writable export ==='
 fuse_export_add 'export-mp' "'mountpoint': '$EXT_MP', 'writable': true"
 
 # Check that writing to the read-only export fails
-$QEMU_IO -f raw -c 'write -P 42 1M 64k' "$TEST_IMG" | _filter_qemu_io
+$QEMU_IO -f raw -c 'write -P 42 1M 64k' "$TEST_IMG" 2>&1 \
+    | _filter_qemu_io | _filter_testdir | _filter_imgfmt
 
 # But here it should work
 $QEMU_IO -f raw -c 'write -P 42 1M 64k' "$EXT_MP" | _filter_qemu_io
diff --git a/tests/qemu-iotests/308.out b/tests/qemu-iotests/308.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/308.out
+++ b/tests/qemu-iotests/308.out
@@ -XXX,XX +XXX,XX @@ virtual size: 0 B (0 bytes)
               'mountpoint': 'TEST_DIR/t.IMGFMT.fuse', 'writable': true
           } }
 {"return": {}}
-write failed: Permission denied
+qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open 'TEST_DIR/t.IMGFMT': Permission denied
 wrote 65536/65536 bytes at offset 1048576
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 1048576
-- 
2.31.1

From: Max Reitz <mreitz@redhat.com>

Without the allow_other mount option, no user (not even root) but the
one who started qemu/the storage daemon can access the export.  Allow
users to configure the export such that such accesses are possible.

While allow_other is probably what users want, we cannot make it an
unconditional default, because passing it is only possible (for non-root
users) if the global fuse.conf configuration file allows it.  Thus, the
default is an 'auto' mode, in which we first try with allow_other, and
then fall back to without.

FuseExport.allow_other reports whether allow_other was actually used as
a mount option or not.  Currently, this information is not used, but a
future patch will let this field decide whether e.g. an export's UID and
GID can be changed through chmod.

One notable thing about 'auto' mode is that libfuse may print error
messages directly to stderr, and so may fusermount (which it executes).
Our export code cannot really filter or hide them.  Therefore, if 'auto'
fails its first attempt and has to fall back, fusermount will print an
error message that mounting with allow_other failed.

This behavior necessitates a change to iotest 308, namely we need to
filter out this error message (because if the first attempt at mounting
with allow_other succeeds, there will be no such message).

Furthermore, common.rc's _make_test_img should use allow-other=off for
FUSE exports, because iotests generally do not need to access images
from other users, so allow-other=on or allow-other=auto have no
advantage.  OTOH, allow-other=on will not work on systems where
user_allow_other is disabled, and with allow-other=auto, we get said
error message that we would need to filter out again.  Just disabling
allow-other is simplest.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20210625142317.271673-3-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qapi/block-export.json       | 33 ++++++++++++++++++++++++++++++++-
 block/export/fuse.c          | 28 +++++++++++++++++++++++-----
 tests/qemu-iotests/308       |  6 +++++-
 tests/qemu-iotests/common.rc |  6 +++++-
 4 files changed, 65 insertions(+), 8 deletions(-)

diff --git a/qapi/block-export.json b/qapi/block-export.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-export.json
+++ b/qapi/block-export.json
@@ -XXX,XX +XXX,XX @@
 	    '*logical-block-size': 'size',
             '*num-queues': 'uint16'} }
 
+##
+# @FuseExportAllowOther:
+#
+# Possible allow_other modes for FUSE exports.
+#
+# @off: Do not pass allow_other as a mount option.
+#
+# @on: Pass allow_other as a mount option.
+#
+# @auto: Try mounting with allow_other first, and if that fails, retry
+#        without allow_other.
+#
+# Since: 6.1
+##
+{ 'enum': 'FuseExportAllowOther',
+  'data': ['off', 'on', 'auto'] }
+
 ##
 # @BlockExportOptionsFuse:
 #
@@ -XXX,XX +XXX,XX @@
 # @growable: Whether writes beyond the EOF should grow the block node
 #            accordingly. (default: false)
 #
+# @allow-other: If this is off, only qemu's user is allowed access to
+#               this export.  That cannot be changed even with chmod or
+#               chown.
+#               Enabling this option will allow other users access to
+#               the export with the FUSE mount option "allow_other".
+#               Note that using allow_other as a non-root user requires
+#               user_allow_other to be enabled in the global fuse.conf
+#               configuration file.
+#               In auto mode (the default), the FUSE export driver will
+#               first attempt to mount the export with allow_other, and
+#               if that fails, try again without.
+#               (since 6.1; default: auto)
+#
 # Since: 6.0
 ##
 { 'struct': 'BlockExportOptionsFuse',
   'data': { 'mountpoint': 'str',
-            '*growable': 'bool' },
+            '*growable': 'bool',
+            '*allow-other': 'FuseExportAllowOther' },
   'if': 'defined(CONFIG_FUSE)' }
 
 ##
diff --git a/block/export/fuse.c b/block/export/fuse.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/fuse.c
+++ b/block/export/fuse.c
@@ -XXX,XX +XXX,XX @@ typedef struct FuseExport {
     char *mountpoint;
     bool writable;
     bool growable;
+    /* Whether allow_other was used as a mount option or not */
+    bool allow_other;
 } FuseExport;
 
 static GHashTable *exports;
@@ -XXX,XX +XXX,XX @@ static void fuse_export_delete(BlockExport *exp);
 static void init_exports_table(void);
 
 static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
-                             Error **errp);
+                             bool allow_other, Error **errp);
 static void read_from_fuse_export(void *opaque);
 
 static bool is_regular_file(const char *path, Error **errp);
@@ -XXX,XX +XXX,XX @@ static int fuse_export_create(BlockExport *blk_exp,
     exp->writable = blk_exp_args->writable;
     exp->growable = args->growable;
 
-    ret = setup_fuse_export(exp, args->mountpoint, errp);
+    /* set default */
+    if (!args->has_allow_other) {
+        args->allow_other = FUSE_EXPORT_ALLOW_OTHER_AUTO;
+    }
+
+    if (args->allow_other == FUSE_EXPORT_ALLOW_OTHER_AUTO) {
+        /* Ignore errors on our first attempt */
+        ret = setup_fuse_export(exp, args->mountpoint, true, NULL);
+        exp->allow_other = ret == 0;
+        if (ret < 0) {
+            ret = setup_fuse_export(exp, args->mountpoint, false, errp);
+        }
+    } else {
+        exp->allow_other = args->allow_other == FUSE_EXPORT_ALLOW_OTHER_ON;
+        ret = setup_fuse_export(exp, args->mountpoint, exp->allow_other, errp);
+    }
     if (ret < 0) {
         goto fail;
     }
@@ -XXX,XX +XXX,XX @@ static void init_exports_table(void)
  * Create exp->fuse_session and mount it.
  */
 static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
-                             Error **errp)
+                             bool allow_other, Error **errp)
 {
     const char *fuse_argv[4];
     char *mount_opts;
@@ -XXX,XX +XXX,XX @@ static int setup_fuse_export(FuseExport *exp, const char *mountpoint,
      * max_read needs to match what fuse_init() sets.
      * max_write need not be supplied.
      */
-    mount_opts = g_strdup_printf("max_read=%zu,default_permissions",
-                                 FUSE_MAX_BOUNCE_BYTES);
+    mount_opts = g_strdup_printf("max_read=%zu,default_permissions%s",
+                                 FUSE_MAX_BOUNCE_BYTES,
+                                 allow_other ? ",allow_other" : "");
 
     fuse_argv[0] = ""; /* Dummy program name */
     fuse_argv[1] = "-o";
diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/308
+++ b/tests/qemu-iotests/308
@@ -XXX,XX +XXX,XX @@ _supported_os Linux # We need /dev/urandom
 # $4: Node to export (defaults to 'node-format')
 fuse_export_add()
 {
+    # The grep -v is a filter for errors when /etc/fuse.conf does not contain
+    # user_allow_other.  (The error is benign, but it is printed by fusermount
+    # on the first mount attempt, so our export code cannot hide it.)
     _send_qemu_cmd $QEMU_HANDLE \
         "{'execute': 'block-export-add',
           'arguments': {
@@ -XXX,XX +XXX,XX @@ fuse_export_add()
               $2
           } }" \
         "${3:-return}" \
-        | _filter_imgfmt
+        | _filter_imgfmt \
+        | grep -v 'option allow_other only allowed if'
 }
 
 # $1: Export ID
diff --git a/tests/qemu-iotests/common.rc b/tests/qemu-iotests/common.rc
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/common.rc
+++ b/tests/qemu-iotests/common.rc
@@ -XXX,XX +XXX,XX @@ _make_test_img()
         # Usually, users would export formatted nodes.  But we present fuse as a
         # protocol-level driver here, so we have to leave the format to the
         # client.
+        # Switch off allow-other, because in general we do not need it for
+        # iotests.  The default allow-other=auto has the downside of printing a
+        # fusermount error on its first attempt if allow_other is not
+        # permissible, which we would need to filter.
         QSD_NEED_PID=y $QSD \
               --blockdev file,node-name=export-node,filename=$img_name,discard=unmap \
-              --export fuse,id=fuse-export,node-name=export-node,mountpoint="$export_mp",writable=on,growable=on \
+              --export fuse,id=fuse-export,node-name=export-node,mountpoint="$export_mp",writable=on,growable=on,allow-other=off \
               &
 
         pidfile="$QEMU_TEST_DIR/qemu-storage-daemon.pid"
-- 
2.31.1

From: Max Reitz <mreitz@redhat.com>

In order to support changing other attributes than the file size in
fuse_setattr(), we have to give each its own independent branch.  This
also applies to the only attribute we do support right now.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210625142317.271673-4-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/export/fuse.c | 20 +++++++++++---------
 1 file changed, 11 insertions(+), 9 deletions(-)

diff --git a/block/export/fuse.c b/block/export/fuse.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/fuse.c
+++ b/block/export/fuse.c
@@ -XXX,XX +XXX,XX @@ static void fuse_setattr(fuse_req_t req, fuse_ino_t inode, struct stat *statbuf,
     FuseExport *exp = fuse_req_userdata(req);
     int ret;
 
-    if (!exp->writable) {
-        fuse_reply_err(req, EACCES);
-        return;
-    }
-
     if (to_set & ~FUSE_SET_ATTR_SIZE) {
         fuse_reply_err(req, ENOTSUP);
         return;
     }
 
-    ret = fuse_do_truncate(exp, statbuf->st_size, true, PREALLOC_MODE_OFF);
-    if (ret < 0) {
-        fuse_reply_err(req, -ret);
-        return;
+    if (to_set & FUSE_SET_ATTR_SIZE) {
+        if (!exp->writable) {
+            fuse_reply_err(req, EACCES);
+            return;
+        }
+
+        ret = fuse_do_truncate(exp, statbuf->st_size, true, PREALLOC_MODE_OFF);
+        if (ret < 0) {
+            fuse_reply_err(req, -ret);
+            return;
+        }
     }
 
     fuse_getattr(req, inode, fi);
-- 
2.31.1

From: Max Reitz <mreitz@redhat.com>

Allow changing the file mode, UID, and GID through SETATTR.

Without allow_other, UID and GID are not allowed to be changed, because
it would not make sense.  Also, changing group or others' permissions
is not allowed either.

For read-only exports, +w cannot be set.

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20210625142317.271673-5-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/export/fuse.c | 73 ++++++++++++++++++++++++++++++++++++++-------
 1 file changed, 62 insertions(+), 11 deletions(-)

diff --git a/block/export/fuse.c b/block/export/fuse.c
index XXXXXXX..XXXXXXX 100644
--- a/block/export/fuse.c
+++ b/block/export/fuse.c
@@ -XXX,XX +XXX,XX @@ typedef struct FuseExport {
     bool growable;
     /* Whether allow_other was used as a mount option or not */
     bool allow_other;
+
+    mode_t st_mode;
+    uid_t st_uid;
+    gid_t st_gid;
 } FuseExport;
 
 static GHashTable *exports;
@@ -XXX,XX +XXX,XX @@ static int fuse_export_create(BlockExport *blk_exp,
         args->allow_other = FUSE_EXPORT_ALLOW_OTHER_AUTO;
     }
 
+    exp->st_mode = S_IFREG | S_IRUSR;
+    if (exp->writable) {
+        exp->st_mode |= S_IWUSR;
+    }
+    exp->st_uid = getuid();
+    exp->st_gid = getgid();
+
     if (args->allow_other == FUSE_EXPORT_ALLOW_OTHER_AUTO) {
         /* Ignore errors on our first attempt */
         ret = setup_fuse_export(exp, args->mountpoint, true, NULL);
@@ -XXX,XX +XXX,XX @@ static void fuse_getattr(fuse_req_t req, fuse_ino_t inode,
     int64_t length, allocated_blocks;
     time_t now = time(NULL);
     FuseExport *exp = fuse_req_userdata(req);
-    mode_t mode;
 
     length = blk_getlength(exp->common.blk);
     if (length < 0) {
@@ -XXX,XX +XXX,XX @@ static void fuse_getattr(fuse_req_t req, fuse_ino_t inode,
         allocated_blocks = DIV_ROUND_UP(allocated_blocks, 512);
     }
 
-    mode = S_IFREG | S_IRUSR;
-    if (exp->writable) {
-        mode |= S_IWUSR;
-    }
-
     statbuf = (struct stat) {
         .st_ino     = inode,
-        .st_mode    = mode,
+        .st_mode    = exp->st_mode,
         .st_nlink   = 1,
-        .st_uid     = getuid(),
-        .st_gid     = getgid(),
+        .st_uid     = exp->st_uid,
+        .st_gid     = exp->st_gid,
         .st_size    = length,
         .st_blksize = blk_bs(exp->common.blk)->bl.request_alignment,
         .st_blocks  = allocated_blocks,
@@ -XXX,XX +XXX,XX @@ static int fuse_do_truncate(const FuseExport *exp, int64_t size,
 }
 
 /**
- * Let clients set file attributes.  Only resizing is supported.
+ * Let clients set file attributes.  Only resizing and changing
+ * permissions (st_mode, st_uid, st_gid) is allowed.
+ * Changing permissions is only allowed as far as it will actually
+ * permit access: Read-only exports cannot be given +w, and exports
+ * without allow_other cannot be given a different UID or GID, and
+ * they cannot be given non-owner access.
  */
 static void fuse_setattr(fuse_req_t req, fuse_ino_t inode, struct stat *statbuf,
                          int to_set, struct fuse_file_info *fi)
 {
     FuseExport *exp = fuse_req_userdata(req);
+    int supported_attrs;
     int ret;
 
-    if (to_set & ~FUSE_SET_ATTR_SIZE) {
+    supported_attrs = FUSE_SET_ATTR_SIZE | FUSE_SET_ATTR_MODE;
+    if (exp->allow_other) {
+        supported_attrs |= FUSE_SET_ATTR_UID | FUSE_SET_ATTR_GID;
+    }
+
+    if (to_set & ~supported_attrs) {
         fuse_reply_err(req, ENOTSUP);
         return;
     }
 
+    /* Do some argument checks first before committing to anything */
+    if (to_set & FUSE_SET_ATTR_MODE) {
+        /*
+         * Without allow_other, non-owners can never access the export, so do
+         * not allow setting permissions for them
+         */
+        if (!exp->allow_other &&
+            (statbuf->st_mode & (S_IRWXG | S_IRWXO)) != 0)
+        {
+            fuse_reply_err(req, EPERM);
+            return;
+        }
+
+        /* +w for read-only exports makes no sense, disallow it */
+        if (!exp->writable &&
+            (statbuf->st_mode & (S_IWUSR | S_IWGRP | S_IWOTH)) != 0)
+        {
+            fuse_reply_err(req, EROFS);
+            return;
+        }
+    }
+
     if (to_set & FUSE_SET_ATTR_SIZE) {
         if (!exp->writable) {
             fuse_reply_err(req, EACCES);
@@ -XXX,XX +XXX,XX @@ static void fuse_setattr(fuse_req_t req, fuse_ino_t inode, struct stat *statbuf,
         }
     }
 
+    if (to_set & FUSE_SET_ATTR_MODE) {
+        /* Ignore FUSE-supplied file type, only change the mode */
+        exp->st_mode = (statbuf->st_mode & 07777) | S_IFREG;
+    }
+
+    if (to_set & FUSE_SET_ATTR_UID) {
+        exp->st_uid = statbuf->st_uid;
+    }
+
+    if (to_set & FUSE_SET_ATTR_GID) {
+        exp->st_gid = statbuf->st_gid;
+    }
+
     fuse_getattr(req, inode, fi);
 }
 
-- 
2.31.1

From: Max Reitz <mreitz@redhat.com>

Test that +w on read-only FUSE exports returns an EROFS error.  u+x on
the other hand should work.  (There is no special reason to choose u+x
here, it simply is like +w another flag that is not set by default.)

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20210625142317.271673-6-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/308     | 11 +++++++++++
 tests/qemu-iotests/308.out |  4 ++++
 2 files changed, 15 insertions(+)

diff --git a/tests/qemu-iotests/308 b/tests/qemu-iotests/308
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/308
+++ b/tests/qemu-iotests/308
@@ -XXX,XX +XXX,XX @@ fuse_export_add 'export-mp' "'mountpoint': '$EXT_MP'"
 # Check that the export presents the same data as the original image
 $QEMU_IMG compare -f raw -F $IMGFMT -U "$EXT_MP" "$TEST_IMG"
 
+# Some quick chmod tests
+stat -c 'Permissions pre-chmod: %a' "$EXT_MP"
+
+# Verify that we cannot set +w
+chmod u+w "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
+stat -c 'Permissions post-+w: %a' "$EXT_MP"
+
+# But that we can set, say, +x (if we are so inclined)
+chmod u+x "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
+stat -c 'Permissions post-+x: %a' "$EXT_MP"
+
 echo
 echo '=== Mount over existing file ==='
 
diff --git a/tests/qemu-iotests/308.out b/tests/qemu-iotests/308.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/308.out
+++ b/tests/qemu-iotests/308.out
@@ -XXX,XX +XXX,XX @@ wrote 67108864/67108864 bytes at offset 0
           } }
 {"return": {}}
 Images are identical.
+Permissions pre-chmod: 400
+chmod: changing permissions of 'TEST_DIR/t.IMGFMT.fuse': Read-only file system
+Permissions post-+w: 400
+Permissions post-+x: 500
 
 === Mount over existing file ===
 {'execute': 'block-export-add',
-- 
2.31.1

From: Max Reitz <mreitz@redhat.com>

Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20210625142317.271673-7-mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/tests/fuse-allow-other     | 168 ++++++++++++++++++
 tests/qemu-iotests/tests/fuse-allow-other.out |  88 +++++++++
 2 files changed, 256 insertions(+)
 create mode 100755 tests/qemu-iotests/tests/fuse-allow-other
 create mode 100644 tests/qemu-iotests/tests/fuse-allow-other.out

diff --git a/tests/qemu-iotests/tests/fuse-allow-other b/tests/qemu-iotests/tests/fuse-allow-other
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/tests/fuse-allow-other
@@ -XXX,XX +XXX,XX @@
+#!/usr/bin/env bash
+# group: rw
+#
+# Test FUSE exports' allow-other option
+#
+# Copyright (C) 2021 Red Hat, Inc.
+#
+# This program is free software; you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation; either version 2 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+seq=$(basename "$0")
+echo "QA output created by $seq"
+
+status=1	# failure is the default!
+
+_cleanup()
+{
+    _cleanup_qemu
+    _cleanup_test_img
+    rm -f "$EXT_MP"
+}
+trap "_cleanup; exit \$status" 0 1 2 3 15
+
+# get standard environment, filters and checks
+. ../common.rc
+. ../common.filter
+. ../common.qemu
+
+_supported_fmt generic
+
+_supported_proto file # We create the FUSE export manually
+
+sudo -n -u nobody true || \
+    _notrun 'Password-less sudo as nobody required to test allow_other'
+
+# $1: Export ID
+# $2: Options (beyond the node-name and ID)
+# $3: Expected return value (defaults to 'return')
+# $4: Node to export (defaults to 'node-format')
+fuse_export_add()
+{
+    allow_other_not_supported='option allow_other only allowed if'
+
+    output=$(
+        success_or_failure=yes _send_qemu_cmd $QEMU_HANDLE \
+            "{'execute': 'block-export-add',
+              'arguments': {
+                  'type': 'fuse',
+                  'id': '$1',
+                  'node-name': '${4:-node-format}',
+                  $2
+              } }" \
+            "${3:-return}" \
+            "$allow_other_not_supported" \
+            | _filter_imgfmt
+    )
+
+    if echo "$output" | grep -q "$allow_other_not_supported"; then
+        # Shut down qemu gracefully so it can unmount the export
+        _send_qemu_cmd $QEMU_HANDLE \
+            "{'execute': 'quit'}" \
+            'return'
+
+        wait=yes _cleanup_qemu
+
+        _notrun "allow_other not supported"
+    fi
+
+    echo "$output"
+}
+
+EXT_MP="$TEST_DIR/fuse-export"
+
+_make_test_img 64k
+touch "$EXT_MP"
+
+echo
+echo '=== Test permissions ==='
+
+# $1: allow-other value ('on'/'off'/'auto')
+run_permission_test()
+{
+    _launch_qemu \
+        -blockdev \
+        "$IMGFMT,node-name=node-format,file.driver=file,file.filename=$TEST_IMG"
+
+    _send_qemu_cmd $QEMU_HANDLE \
+        "{'execute': 'qmp_capabilities'}" \
+        'return'
+
+    fuse_export_add 'export' \
+        "'mountpoint': '$EXT_MP',
+         'allow-other': '$1'"
+
+    # Should always work
+    echo '(Removing all permissions)'
+    chmod 000 "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
+    stat -c 'Permissions post-chmod: %a' "$EXT_MP"
+
+    # Should always work
+    echo '(Granting u+r)'
+    chmod u+r "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
+    stat -c 'Permissions post-chmod: %a' "$EXT_MP"
+
+    # Should only work with allow-other: Otherwise, no permissions can be
+    # granted to the group or others
+    echo '(Granting read permissions for everyone)'
+    chmod 444 "$EXT_MP" 2>&1 | _filter_testdir | _filter_imgfmt
+    stat -c 'Permissions post-chmod: %a' "$EXT_MP"
+
+    echo 'Doing operations as nobody:'
+    # Change to TEST_DIR, so nobody will not have to attempt a lookup
+    pushd "$TEST_DIR" >/dev/null
+
+    # This is already prevented by the permissions (without allow-other, FUSE
+    # exports always have o-r), but test it anyway
+    sudo -n -u nobody cat fuse-export >/dev/null
+
+    # If the only problem were the lack of permissions, we should still be able
+    # to stat the export as nobody; it should not work without allow-other,
+    # though
+    sudo -n -u nobody \
+        stat -c 'Permissions seen by nobody: %a' fuse-export 2>&1 \
+        | _filter_imgfmt
+
+    # To prove the point, revoke read permissions for others and try again
+    chmod o-r fuse-export 2>&1 | _filter_testdir | _filter_imgfmt
+
+    # Should fail
+    sudo -n -u nobody cat fuse-export >/dev/null
+    # Should work with allow_other
+    sudo -n -u nobody \
+        stat -c 'Permissions seen by nobody: %a' fuse-export 2>&1 \
+        | _filter_imgfmt
+
+    popd >/dev/null
+
+    _send_qemu_cmd $QEMU_HANDLE \
+        "{'execute': 'quit'}" \
+        'return'
+
+    wait=yes _cleanup_qemu
+}
+
+# 'auto' should behave exactly like 'on', because 'on' tests that
+# allow_other works (otherwise, this test is skipped)
+for ao in off on auto; do
+    echo
+    echo "--- allow-other=$ao ---"
+
+    run_permission_test "$ao"
+done
+
+# success, all done
+echo "*** done"
+rm -f $seq.full
+status=0
diff --git a/tests/qemu-iotests/tests/fuse-allow-other.out b/tests/qemu-iotests/tests/fuse-allow-other.out
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qemu-iotests/tests/fuse-allow-other.out
@@ -XXX,XX +XXX,XX @@
+QA output created by fuse-allow-other
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=65536
+
+=== Test permissions ===
+
+--- allow-other=off ---
+{'execute': 'qmp_capabilities'}
+{"return": {}}
+{'execute': 'block-export-add',
+              'arguments': {
+                  'type': 'fuse',
+                  'id': 'export',
+                  'node-name': 'node-format',
+                  'mountpoint': 'TEST_DIR/fuse-export',
+         'allow-other': 'off'
+              } }
+{"return": {}}
+(Removing all permissions)
+Permissions post-chmod: 0
+(Granting u+r)
+Permissions post-chmod: 400
+(Granting read permissions for everyone)
+chmod: changing permissions of 'TEST_DIR/fuse-export': Operation not permitted
+Permissions post-chmod: 400
+Doing operations as nobody:
+cat: fuse-export: Permission denied
+stat: cannot statx 'fuse-export': Permission denied
+cat: fuse-export: Permission denied
+stat: cannot statx 'fuse-export': Permission denied
+{'execute': 'quit'}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
+
+--- allow-other=on ---
+{'execute': 'qmp_capabilities'}
+{"return": {}}
+{'execute': 'block-export-add',
+              'arguments': {
+                  'type': 'fuse',
+                  'id': 'export',
+                  'node-name': 'node-format',
+                  'mountpoint': 'TEST_DIR/fuse-export',
+         'allow-other': 'on'
+              } }
+{"return": {}}
+(Removing all permissions)
+Permissions post-chmod: 0
+(Granting u+r)
+Permissions post-chmod: 400
+(Granting read permissions for everyone)
+Permissions post-chmod: 444
+Doing operations as nobody:
+Permissions seen by nobody: 444
+cat: fuse-export: Permission denied
+Permissions seen by nobody: 440
+{'execute': 'quit'}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
+
+--- allow-other=auto ---
+{'execute': 'qmp_capabilities'}
+{"return": {}}
+{'execute': 'block-export-add',
+              'arguments': {
+                  'type': 'fuse',
+                  'id': 'export',
+                  'node-name': 'node-format',
+                  'mountpoint': 'TEST_DIR/fuse-export',
+         'allow-other': 'auto'
+              } }
+{"return": {}}
+(Removing all permissions)
+Permissions post-chmod: 0
+(Granting u+r)
+Permissions post-chmod: 400
+(Granting read permissions for everyone)
+Permissions post-chmod: 444
+Doing operations as nobody:
+Permissions seen by nobody: 444
+cat: fuse-export: Permission denied
+Permissions seen by nobody: 440
+{'execute': 'quit'}
+{"return": {}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "SHUTDOWN", "data": {"guest": false, "reason": "host-qmp-quit"}}
+{"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export"}}
+*** done
-- 
2.31.1

dev->max_queues was never initialised for backends that don't support
VHOST_USER_PROTOCOL_F_MQ, so it would use 0 as the maximum number of
queues to check against and consequently fail for any such backend.

Set it to 1 if the backend doesn't have multiqueue support.

Fixes: c90bd505a3e8210c23d69fecab9ee6f56ec4a161
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210705171429.29286-1-kwolf@redhat.com>
Reviewed-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/virtio/vhost-user.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/virtio/vhost-user.c b/hw/virtio/vhost-user.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/vhost-user.c
+++ b/hw/virtio/vhost-user.c
@@ -XXX,XX +XXX,XX @@ static int vhost_user_backend_init(struct vhost_dev *dev, void *opaque,
             if (err < 0) {
                 return -EPROTO;
             }
+        } else {
+            dev->max_queues = 1;
         }
+
         if (dev->num_queues && dev->max_queues < dev->num_queues) {
             error_setg(errp, "The maximum number of queues supported by the "
                        "backend is %" PRIu64, dev->max_queues);
-- 
2.31.1

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

drive_backup_prepare() does bdrv_drained_begin() in hope that
bdrv_drained_end() will be called in drive_backup_clean(). Still we
need to set state->bs for this to work. That's done too late: a lot of
failure paths in drive_backup_prepare() miss setting state->bs. Fix
that.

Fixes: 2288ccfac96281c316db942d10e3f921c1373064
Fixes: https://gitlab.com/qemu-project/qemu/-/issues/399
Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210608171852.250775-1-vsementsov@virtuozzo.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 blockdev.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
     aio_context = bdrv_get_aio_context(bs);
     aio_context_acquire(aio_context);
 
+    state->bs = bs;
     /* Paired with .clean() */
     bdrv_drained_begin(bs);
 
@@ -XXX,XX +XXX,XX @@ static void drive_backup_prepare(BlkActionState *common, Error **errp)
         }
     }
 
-    state->bs = bs;
-
     state->job = do_backup_common(qapi_DriveBackup_base(backup),
                                   bs, target_bs, aio_context,
                                   common->block_job_txn, errp);
-- 
2.31.1

From: Eric Blake <eblake@redhat.com>

This was deprecated back in bc5ee6da7 (qcow2: Deprecate use of
qemu-img amend to change backing file), and no one in the meantime has
given any reasons why it should be supported.  Time to make change
attempts a hard error (but for convenience, specifying the _same_
backing chain is not forbidden).  Update a couple of iotests to match.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20210503213600.569128-2-eblake@redhat.com>
Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/system/deprecated.rst       | 12 ------------
 docs/system/removed-features.rst | 12 ++++++++++++
 block/qcow2.c                    | 13 ++++---------
 tests/qemu-iotests/061           |  3 +++
 tests/qemu-iotests/061.out       |  3 ++-
 tests/qemu-iotests/082.out       |  6 ++++--
 6 files changed, 25 insertions(+), 24 deletions(-)

From: Eric Blake <eblake@redhat.com>

Back in commit d9f059aa6c (qemu-img: Deprecate use of -b without -F),
we deprecated the ability to create a file with a backing image that
requires qemu to perform format probing.  Qemu can still probe older
files for backwards compatibility, but it is time to finish off the
ability to create such images, due to the potential security risk they
present.  Update a couple of iotests affected by the change.

Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20210503213600.569128-3-eblake@redhat.com>
Reviewed-by: Connor Kuehl <ckuehl@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/system/deprecated.rst       | 20 -----------------
 docs/system/removed-features.rst | 19 ++++++++++++++++
 block.c                          | 37 ++++++++++----------------------
 qemu-img.c                       |  6 ++++--
 tests/qemu-iotests/040           |  4 ++--
 tests/qemu-iotests/041           |  6 ++++--
 tests/qemu-iotests/114           | 18 ++++++++--------
 tests/qemu-iotests/114.out       | 11 ++++------
 tests/qemu-iotests/301           |  4 +---
 tests/qemu-iotests/301.out       | 16 ++------------
 10 files changed, 56 insertions(+), 85 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ this CPU is also deprecated.
 Related binaries
 ----------------
 
-qemu-img backing file without format (since 5.1)
-''''''''''''''''''''''''''''''''''''''''''''''''
-
-The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
-convert`` to create or modify an image that depends on a backing file
-now recommends that an explicit backing format be provided.  This is
-for safety: if QEMU probes a different format than what you thought,
-the data presented to the guest will be corrupt; similarly, presenting
-a raw image to a guest allows a potential security exploit if a future
-probe sees a non-raw image based on guest writes.
-
-To avoid the warning message, or even future refusal to create an
-unsafe image, you must pass ``-o backing_fmt=`` (or the shorthand
-``-F`` during create) to specify the intended backing format.  You may
-use ``qemu-img rebase -u`` to retroactively add a backing format to an
-existing image.  However, be aware that there are already potential
-security risks to blindly using ``qemu-img info`` to probe the format
-of an untrusted backing image, when deciding what format to add into
-an existing image.
-
 Backwards compatibility
 -----------------------
 
diff --git a/docs/system/removed-features.rst b/docs/system/removed-features.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/removed-features.rst
+++ b/docs/system/removed-features.rst
@@ -XXX,XX +XXX,XX @@ backing chain should be performed with ``qemu-img rebase -u`` either
 before or after the remaining changes being performed by amend, as
 appropriate.
 
+qemu-img backing file without format (removed in 6.1)
+'''''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The use of ``qemu-img create``, ``qemu-img rebase``, or ``qemu-img
+convert`` to create or modify an image that depends on a backing file
+now requires that an explicit backing format be provided.  This is
+for safety: if QEMU probes a different format than what you thought,
+the data presented to the guest will be corrupt; similarly, presenting
+a raw image to a guest allows a potential security exploit if a future
+probe sees a non-raw image based on guest writes.
+
+To avoid creating unsafe backing chains, you must pass ``-o
+backing_fmt=`` (or the shorthand ``-F`` during create) to specify the
+intended backing format.  You may use ``qemu-img rebase -u`` to
+retroactively add a backing format to an existing image.  However, be
+aware that there are already potential security risks to blindly using
+``qemu-img info`` to probe the format of an untrusted backing image,
+when deciding what format to add into an existing image.
+
 Block devices
 -------------
 
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ int coroutine_fn bdrv_co_check(BlockDriverState *bs,
  * -ENOTSUP - format driver doesn't support changing the backing file
  */
 int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
-                             const char *backing_fmt, bool warn)
+                             const char *backing_fmt, bool require)
 {
     BlockDriver *drv = bs->drv;
     int ret;
@@ -XXX,XX +XXX,XX @@ int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
         return -EINVAL;
     }
 
-    if (warn && backing_file && !backing_fmt) {
-        warn_report("Deprecated use of backing file without explicit "
-                    "backing format, use of this image requires "
-                    "potentially unsafe format probing");
+    if (require && backing_file && !backing_fmt) {
+        return -EINVAL;
     }
 
     if (drv->bdrv_change_backing_file != NULL) {
@@ -XXX,XX +XXX,XX @@ void bdrv_img_create(const char *filename, const char *fmt,
             goto out;
         } else {
             if (!backing_fmt) {
-                warn_report("Deprecated use of backing file without explicit "
-                            "backing format (detected format of %s)",
-                            bs->drv->format_name);
-                if (bs->drv != &bdrv_raw) {
-                    /*
-                     * A probe of raw deserves the most attention:
-                     * leaving the backing format out of the image
-                     * will ensure bs->probed is set (ensuring we
-                     * don't accidentally commit into the backing
-                     * file), and allow more spots to warn the users
-                     * to fix their toolchain when opening this image
-                     * later.  For other images, we can safely record
-                     * the format that we probed.
-                     */
-                    backing_fmt = bs->drv->format_name;
-                    qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, backing_fmt,
-                                 NULL);
-                }
+                error_setg(&local_err,
+                           "Backing file specified without backing format");
+                error_append_hint(&local_err, "Detected format of %s.",
+                                  bs->drv->format_name);
+                goto out;
             }
             if (size == -1) {
                 /* Opened BS, have no size */
@@ -XXX,XX +XXX,XX @@ void bdrv_img_create(const char *filename, const char *fmt,
         }
         /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
     } else if (backing_file && !backing_fmt) {
-        warn_report("Deprecated use of unopened backing file without "
-                    "explicit backing format, use of this image requires "
-                    "potentially unsafe format probing");
+        error_setg(&local_err,
+                   "Backing file specified without backing format");
+        goto out;
     }
 
     if (size == -1) {
diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_convert(int argc, char **argv)
 
     if (out_baseimg_param) {
         if (!qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT)) {
-            warn_report("Deprecated use of backing file without explicit "
-                        "backing format");
+            error_report("Use of backing file requires explicit "
+                         "backing format");
+            ret = -1;
+            goto out;
         }
     }
 
diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/040
+++ b/tests/qemu-iotests/040
@@ -XXX,XX +XXX,XX @@ class TestCommitWithOverriddenBacking(iotests.QMPTestCase):
     def setUp(self):
         qemu_img('create', '-f', iotests.imgfmt, self.img_base_a, '1M')
         qemu_img('create', '-f', iotests.imgfmt, self.img_base_b, '1M')
-        qemu_img('create', '-f', iotests.imgfmt, '-b', self.img_base_a, \
-                 self.img_top)
+        qemu_img('create', '-f', iotests.imgfmt, '-b', self.img_base_a,
+                 '-F', iotests.imgfmt, self.img_top)
 
         self.vm = iotests.VM()
         self.vm.launch()
diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -XXX,XX +XXX,XX @@ class TestReplaces(iotests.QMPTestCase):
 class TestFilters(iotests.QMPTestCase):
     def setUp(self):
         qemu_img('create', '-f', iotests.imgfmt, backing_img, '1M')
-        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img, test_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img, target_img)
+        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img,
+                 '-F', iotests.imgfmt, test_img)
+        qemu_img('create', '-f', iotests.imgfmt, '-b', backing_img,
+                 '-F', iotests.imgfmt, target_img)
 
         qemu_io('-c', 'write -P 1 0 512k', backing_img)
         qemu_io('-c', 'write -P 2 512k 512k', test_img)
diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/114
+++ b/tests/qemu-iotests/114
@@ -XXX,XX +XXX,XX @@ _supported_os Linux
 # qcow2.py does not work too well with external data files
 _unsupported_imgopts data_file
 
-# Intentionally specify backing file without backing format; demonstrate
-# the difference in warning messages when backing file could be probed.
-# Note that only a non-raw probe result will affect the resulting image.
+# Older qemu-img could set up backing file without backing format; modern
+# qemu can't but we can use qcow2.py to simulate older files.
 truncate -s $((64 * 1024 * 1024)) "$TEST_IMG.orig"
-_make_test_img -b "$TEST_IMG.orig" 64M
+_make_test_img -b "$TEST_IMG.orig" -F raw 64M
+$PYTHON qcow2.py "$TEST_IMG" del-header-ext 0xE2792ACA
 
 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
 $QEMU_IMG convert -O qcow2 -B "$TEST_IMG.orig" "$TEST_IMG.orig" "$TEST_IMG"
-_make_test_img -b "$TEST_IMG.base" 64M
-_make_test_img -u -b "$TEST_IMG.base" 64M
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 64M
+_make_test_img -u -b "$TEST_IMG.base" -F $IMGFMT 64M
 
 # Set an invalid backing file format
 $PYTHON qcow2.py "$TEST_IMG" add-header-ext 0xE2792ACA "foo"
@@ -XXX,XX +XXX,XX @@ _img_info
 $QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
 $QEMU_IO -c "open -o backing.driver=$IMGFMT $TEST_IMG" -c "read 0 4k" | _filter_qemu_io
 
-# Rebase the image, to show that omitting backing format triggers a warning,
-# but probing now lets us use the backing file.
-$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG"
+# Rebase the image, to show that backing format is required.
+($QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG" 2>&1 && echo "unexpected pass") | _filter_testdir
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" -F $IMGFMT "$TEST_IMG"
 $QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
 
 # success, all done
diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/114.out
+++ b/tests/qemu-iotests/114.out
@@ -XXX,XX +XXX,XX @@
 QA output created by 114
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig backing_fmt=raw
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-qemu-img: warning: Deprecated use of backing file without explicit backing format
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
+qemu-img: Use of backing file requires explicit backing format
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-qemu-img: warning: Deprecated use of unopened backing file without explicit backing format, use of this image requires potentially unsafe format probing
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
 virtual size: 64 MiB (67108864 bytes)
@@ -XXX,XX +XXX,XX @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
 no file open, try 'help open'
 read 4096/4096 bytes at offset 0
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing
+qemu-img: Could not change the backing file to 'TEST_DIR/t.qcow2.base': Invalid argument
 read 4096/4096 bytes at offset 0
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 *** done
diff --git a/tests/qemu-iotests/301 b/tests/qemu-iotests/301
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/301
+++ b/tests/qemu-iotests/301
@@ -XXX,XX +XXX,XX @@
 #
 # Test qcow backing file warnings
 #
-# Copyright (C) 2020 Red Hat, Inc.
+# Copyright (C) 2020-2021 Red Hat, Inc.
 #
 # This program is free software; you can redistribute it and/or modify
 # it under the terms of the GNU General Public License as published by
@@ -XXX,XX +XXX,XX @@ echo "== qcow backed by qcow =="
 
 TEST_IMG="$TEST_IMG.base" _make_test_img $size
 _make_test_img -b "$TEST_IMG.base" $size
-_img_info
 _make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
 _img_info
 
@@ -XXX,XX +XXX,XX @@ echo "== qcow backed by raw =="
 rm "$TEST_IMG.base"
 truncate --size=$size "$TEST_IMG.base"
 _make_test_img -b "$TEST_IMG.base" $size
-_img_info
 _make_test_img -b "$TEST_IMG.base" -F raw $size
 _img_info
 
diff --git a/tests/qemu-iotests/301.out b/tests/qemu-iotests/301.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/301.out
+++ b/tests/qemu-iotests/301.out
@@ -XXX,XX +XXX,XX @@ QA output created by 301
 
 == qcow backed by qcow ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-image: TEST_DIR/t.IMGFMT
-file format: IMGFMT
-virtual size: 32 MiB (33554432 bytes)
-cluster_size: 512
-backing file: TEST_DIR/t.IMGFMT.base
+qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
@@ -XXX,XX +XXX,XX @@ cluster_size: 512
 backing file: TEST_DIR/t.IMGFMT.base
 
 == qcow backed by raw ==
-qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
-image: TEST_DIR/t.IMGFMT
-file format: IMGFMT
-virtual size: 32 MiB (33554432 bytes)
-cluster_size: 512
-backing file: TEST_DIR/t.IMGFMT.base
+qemu-img: TEST_DIR/t.IMGFMT: Backing file specified without backing format
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=raw
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
-- 
2.31.1

From: Eric Blake <eblake@redhat.com>

When removeing support for qemu-img being able to create backing
chains without embedded backing formats, we caused a poor error
message as caught by iotest 114.  Improve the situation to inform the
user what went wrong.

Suggested-by: Kevin Wolf <kwolf@redhat.com>
Signed-off-by: Eric Blake <eblake@redhat.com>
Message-Id: <20210708155228.2666172-1-eblake@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c                 | 3 +++
 tests/qemu-iotests/114.out | 2 +-
 2 files changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static int img_rebase(int argc, char **argv)
     if (ret == -ENOSPC) {
         error_report("Could not change the backing file to '%s': No "
                      "space left in the file header", out_baseimg);
+    } else if (ret == -EINVAL && out_baseimg && !out_basefmt) {
+        error_report("Could not change the backing file to '%s': backing "
+                     "format must be specified", out_baseimg);
     } else if (ret < 0) {
         error_report("Could not change the backing file to '%s': %s",
             out_baseimg, strerror(-ret));
diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/114.out
+++ b/tests/qemu-iotests/114.out
@@ -XXX,XX +XXX,XX @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
 no file open, try 'help open'
 read 4096/4096 bytes at offset 0
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-qemu-img: Could not change the backing file to 'TEST_DIR/t.qcow2.base': Invalid argument
+qemu-img: Could not change the backing file to 'TEST_DIR/t.qcow2.base': backing format must be specified
 read 4096/4096 bytes at offset 0
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 *** done
-- 
2.31.1

Without an external data file, s->data_file is a second pointer with the
same value as bs->file. When changing bs->file to a different BdrvChild
and freeing the old BdrvChild, s->data_file must also be updated,
otherwise it points to freed memory and causes crashes.

This problem was caught by iotests case 245.

Fixes: df2b7086f169239ebad5d150efa29c9bb6d4f820
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210708114709.206487-2-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/qcow2.c | 29 +++++++++++++++++++++++++++++
 1 file changed, 29 insertions(+)

diff --git a/block/qcow2.c b/block/qcow2.c
index XXXXXXX..XXXXXXX 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -XXX,XX +XXX,XX @@ static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
 static int qcow2_reopen_prepare(BDRVReopenState *state,
                                 BlockReopenQueue *queue, Error **errp)
 {
+    BDRVQcow2State *s = state->bs->opaque;
     Qcow2ReopenState *r;
     int ret;
 
@@ -XXX,XX +XXX,XX @@ static int qcow2_reopen_prepare(BDRVReopenState *state,
         }
     }
 
+    /*
+     * Without an external data file, s->data_file points to the same BdrvChild
+     * as bs->file. It needs to be resynced after reopen because bs->file may
+     * be changed. We can't use it in the meantime.
+     */
+    if (!has_data_file(state->bs)) {
+        assert(s->data_file == state->bs->file);
+        s->data_file = NULL;
+    }
+
     return 0;
 
 fail:
@@ -XXX,XX +XXX,XX @@ fail:
 
 static void qcow2_reopen_commit(BDRVReopenState *state)
 {
+    BDRVQcow2State *s = state->bs->opaque;
+
     qcow2_update_options_commit(state->bs, state->opaque);
+    if (!s->data_file) {
+        /*
+         * If we don't have an external data file, s->data_file was cleared by
+         * qcow2_reopen_prepare() and needs to be updated.
+         */
+        s->data_file = state->bs->file;
+    }
     g_free(state->opaque);
 }
 
@@ -XXX,XX +XXX,XX @@ static void qcow2_reopen_commit_post(BDRVReopenState *state)
 
 static void qcow2_reopen_abort(BDRVReopenState *state)
 {
+    BDRVQcow2State *s = state->bs->opaque;
+
+    if (!s->data_file) {
+        /*
+         * If we don't have an external data file, s->data_file was cleared by
+         * qcow2_reopen_prepare() and needs to be restored.
+         */
+        s->data_file = state->bs->file;
+    }
     qcow2_update_options_abort(state->bs, state->opaque);
     g_free(state->opaque);
 }
-- 
2.31.1

From: Alberto Garcia <berto@igalia.com>

Move the code to free a BlockReopenQueue to a separate function.
It will be used in a subsequent patch.

[ kwolf: Also free explicit_options and options, and explicitly
  qobject_ref() the value when it continues to be used. This makes
  future memory leaks less likely. ]

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_new_open_driver(BlockDriver *drv, const char *node_name,
 BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
                                     BlockDriverState *bs, QDict *options,
                                     bool keep_old_opts);
+void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue);
 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
                               Error **errp);
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
                                    NULL, 0, keep_old_opts);
 }
 
+void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
+{
+    if (bs_queue) {
+        BlockReopenQueueEntry *bs_entry, *next;
+        QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
+            qobject_unref(bs_entry->state.explicit_options);
+            qobject_unref(bs_entry->state.options);
+            g_free(bs_entry);
+        }
+        g_free(bs_queue);
+    }
+}
+
 /*
  * Reopen multiple BlockDriverStates atomically & transactionally.
  *
@@ -XXX,XX +XXX,XX @@ abort:
         if (bs_entry->prepared) {
             bdrv_reopen_abort(&bs_entry->state);
         }
-        qobject_unref(bs_entry->state.explicit_options);
-        qobject_unref(bs_entry->state.options);
     }
 
 cleanup:
-    QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-        g_free(bs_entry);
-    }
-    g_free(bs_queue);
+    bdrv_reopen_queue_free(bs_queue);
 
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
     /* set BDS specific flags now */
     qobject_unref(bs->explicit_options);
     qobject_unref(bs->options);
+    qobject_ref(reopen_state->explicit_options);
+    qobject_ref(reopen_state->options);
 
     bs->explicit_options   = reopen_state->explicit_options;
     bs->options            = reopen_state->options;
-- 
2.31.1

As the BlockReopenQueue can contain nodes in multiple AioContexts, only
one of which may be locked when AIO_WAIT_WHILE() can be called, we can't
let the caller lock the right contexts. Instead, individually lock the
AioContext of a single node when iterating the queue.

Reintroduce bdrv_reopen() as a wrapper for reopening a single node that
drains the node and temporarily drops the AioContext lock for
bdrv_reopen_multiple().

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210708114709.206487-4-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h |  2 ++
 block.c               | 49 ++++++++++++++++++++++++++++++++++++-------
 block/replication.c   |  7 +++++++
 blockdev.c            |  5 +++++
 qemu-io-cmds.c        |  7 +------
 5 files changed, 57 insertions(+), 13 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
                                     bool keep_old_opts);
 void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue);
 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
+int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
+                Error **errp);
 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
                               Error **errp);
 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ void bdrv_reopen_queue_free(BlockReopenQueue *bs_queue)
  *
  * All affected nodes must be drained between bdrv_reopen_queue() and
  * bdrv_reopen_multiple().
+ *
+ * To be called from the main thread, with all other AioContexts unlocked.
  */
 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
 {
     int ret = -1;
     BlockReopenQueueEntry *bs_entry, *next;
+    AioContext *ctx;
     Transaction *tran = tran_new();
     g_autoptr(GHashTable) found = NULL;
     g_autoptr(GSList) refresh_list = NULL;
 
+    assert(qemu_get_current_aio_context() == qemu_get_aio_context());
     assert(bs_queue != NULL);
 
     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
+        ctx = bdrv_get_aio_context(bs_entry->state.bs);
+        aio_context_acquire(ctx);
         ret = bdrv_flush(bs_entry->state.bs);
+        aio_context_release(ctx);
         if (ret < 0) {
             error_setg_errno(errp, -ret, "Error flushing drive");
             goto abort;
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
 
     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
         assert(bs_entry->state.bs->quiesce_counter > 0);
+        ctx = bdrv_get_aio_context(bs_entry->state.bs);
+        aio_context_acquire(ctx);
         ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
+        aio_context_release(ctx);
         if (ret < 0) {
             goto abort;
         }
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
      * to first element.
      */
     QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
+        ctx = bdrv_get_aio_context(bs_entry->state.bs);
+        aio_context_acquire(ctx);
         bdrv_reopen_commit(&bs_entry->state);
+        aio_context_release(ctx);
     }
 
     tran_commit(tran);
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
         BlockDriverState *bs = bs_entry->state.bs;
 
         if (bs->drv->bdrv_reopen_commit_post) {
+            ctx = bdrv_get_aio_context(bs);
+            aio_context_acquire(ctx);
             bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
+            aio_context_release(ctx);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ abort:
     tran_abort(tran);
     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
         if (bs_entry->prepared) {
+            ctx = bdrv_get_aio_context(bs_entry->state.bs);
+            aio_context_acquire(ctx);
             bdrv_reopen_abort(&bs_entry->state);
+            aio_context_release(ctx);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ cleanup:
     return ret;
 }
 
-int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
-                              Error **errp)
+int bdrv_reopen(BlockDriverState *bs, QDict *opts, bool keep_old_opts,
+                Error **errp)
 {
-    int ret;
+    AioContext *ctx = bdrv_get_aio_context(bs);
     BlockReopenQueue *queue;
-    QDict *opts = qdict_new();
-
-    qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
+    int ret;
 
     bdrv_subtree_drained_begin(bs);
-    queue = bdrv_reopen_queue(NULL, bs, opts, true);
+    if (ctx != qemu_get_aio_context()) {
+        aio_context_release(ctx);
+    }
+
+    queue = bdrv_reopen_queue(NULL, bs, opts, keep_old_opts);
     ret = bdrv_reopen_multiple(queue, errp);
+
+    if (ctx != qemu_get_aio_context()) {
+        aio_context_acquire(ctx);
+    }
     bdrv_subtree_drained_end(bs);
 
     return ret;
 }
 
+int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
+                              Error **errp)
+{
+    QDict *opts = qdict_new();
+
+    qdict_put_bool(opts, BDRV_OPT_READ_ONLY, read_only);
+
+    return bdrv_reopen(bs, opts, true, errp);
+}
+
 /*
  * Take a BDRVReopenState and check if the value of 'backing' in the
  * reopen_state->options QDict is valid or not.
diff --git a/block/replication.c b/block/replication.c
index XXXXXXX..XXXXXXX 100644
--- a/block/replication.c
+++ b/block/replication.c
@@ -XXX,XX +XXX,XX @@ static void reopen_backing_file(BlockDriverState *bs, bool writable,
     }
 
     if (reopen_queue) {
+        AioContext *ctx = bdrv_get_aio_context(bs);
+        if (ctx != qemu_get_aio_context()) {
+            aio_context_release(ctx);
+        }
         bdrv_reopen_multiple(reopen_queue, errp);
+        if (ctx != qemu_get_aio_context()) {
+            aio_context_acquire(ctx);
+        }
     }
 
     bdrv_subtree_drained_end(s->hidden_disk->bs);
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ void qmp_x_blockdev_reopen(BlockdevOptions *options, Error **errp)
     ctx = bdrv_get_aio_context(bs);
     aio_context_acquire(ctx);
     bdrv_subtree_drained_begin(bs);
+    aio_context_release(ctx);
+
     queue = bdrv_reopen_queue(NULL, bs, qdict, false);
     bdrv_reopen_multiple(queue, errp);
+
+    ctx = bdrv_get_aio_context(bs);
+    aio_context_acquire(ctx);
     bdrv_subtree_drained_end(bs);
     aio_context_release(ctx);
 
diff --git a/qemu-io-cmds.c b/qemu-io-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-io-cmds.c
+++ b/qemu-io-cmds.c
@@ -XXX,XX +XXX,XX @@ static int reopen_f(BlockBackend *blk, int argc, char **argv)
     bool writethrough = !blk_enable_write_cache(blk);
     bool has_rw_option = false;
     bool has_cache_option = false;
-
-    BlockReopenQueue *brq;
     Error *local_err = NULL;
 
     while ((c = getopt(argc, argv, "c:o:rw")) != -1) {
@@ -XXX,XX +XXX,XX @@ static int reopen_f(BlockBackend *blk, int argc, char **argv)
         qdict_put_bool(opts, BDRV_OPT_CACHE_NO_FLUSH, flags & BDRV_O_NO_FLUSH);
     }
 
-    bdrv_subtree_drained_begin(bs);
-    brq = bdrv_reopen_queue(NULL, bs, opts, true);
-    bdrv_reopen_multiple(brq, &local_err);
-    bdrv_subtree_drained_end(bs);
+    bdrv_reopen(bs, opts, true, &local_err);
 
     if (local_err) {
         error_report_err(local_err);
-- 
2.31.1

From: Alberto Garcia <berto@igalia.com>

[ kwolf: Fixed AioContext locking ]

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210708114709.206487-5-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qapi/block-core.json                          | 18 +++--
 blockdev.c                                    | 81 ++++++++++---------
 tests/qemu-iotests/155                        |  9 ++-
 tests/qemu-iotests/165                        |  4 +-
 tests/qemu-iotests/245                        | 27 ++++---
 tests/qemu-iotests/248                        |  2 +-
 tests/qemu-iotests/248.out                    |  2 +-
 tests/qemu-iotests/296                        |  9 ++-
 tests/qemu-iotests/298                        |  4 +-
 .../tests/remove-bitmap-from-backing          | 18 +++--
 10 files changed, 99 insertions(+), 75 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 ##
 # @x-blockdev-reopen:
 #
-# Reopens a block device using the given set of options. Any option
-# not specified will be reset to its default value regardless of its
-# previous status. If an option cannot be changed or a particular
+# Reopens one or more block devices using the given set of options.
+# Any option not specified will be reset to its default value regardless
+# of its previous status. If an option cannot be changed or a particular
 # driver does not support reopening then the command will return an
-# error.
+# error. All devices in the list are reopened in one transaction, so
+# if one of them fails then the whole transaction is cancelled.
 #
-# The top-level @node-name option (from BlockdevOptions) must be
+# The command receives a list of block devices to reopen. For each one
+# of them, the top-level @node-name option (from BlockdevOptions) must be
 # specified and is used to select the block device to be reopened.
 # Other @node-name options must be either omitted or set to the
 # current name of the appropriate node. This command won't change any
@@ -XXX,XX +XXX,XX @@
 #
 #  4) NULL: the current child (if any) is detached.
 #
-# Options (1) and (2) are supported in all cases, but at the moment
-# only @backing allows replacing or detaching an existing child.
+# Options (1) and (2) are supported in all cases. Option (3) is
+# supported for @file and @backing, and option (4) for @backing only.
 #
 # Unlike with blockdev-add, the @backing option must always be present
 # unless the node being reopened does not have a backing file and its
@@ -XXX,XX +XXX,XX @@
 # Since: 4.0
 ##
 { 'command': 'x-blockdev-reopen',
-  'data': 'BlockdevOptions', 'boxed': true }
+  'data': { 'options': ['BlockdevOptions'] } }
 
 ##
 # @blockdev-del:
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ fail:
     visit_free(v);
 }
 
-void qmp_x_blockdev_reopen(BlockdevOptions *options, Error **errp)
-{
-    BlockDriverState *bs;
-    AioContext *ctx;
-    QObject *obj;
-    Visitor *v = qobject_output_visitor_new(&obj);
-    BlockReopenQueue *queue;
-    QDict *qdict;
+void qmp_x_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+{
+    BlockReopenQueue *queue = NULL;
+    GSList *drained = NULL;
+
+    /* Add each one of the BDS that we want to reopen to the queue */
+    for (; reopen_list != NULL; reopen_list = reopen_list->next) {
+        BlockdevOptions *options = reopen_list->value;
+        BlockDriverState *bs;
+        AioContext *ctx;
+        QObject *obj;
+        Visitor *v;
+        QDict *qdict;
+
+        /* Check for the selected node name */
+        if (!options->has_node_name) {
+            error_setg(errp, "node-name not specified");
+            goto fail;
+        }
 
-    /* Check for the selected node name */
-    if (!options->has_node_name) {
-        error_setg(errp, "node-name not specified");
-        goto fail;
-    }
+        bs = bdrv_find_node(options->node_name);
+        if (!bs) {
+            error_setg(errp, "Failed to find node with node-name='%s'",
+                       options->node_name);
+            goto fail;
+        }
 
-    bs = bdrv_find_node(options->node_name);
-    if (!bs) {
-        error_setg(errp, "Failed to find node with node-name='%s'",
-                   options->node_name);
-        goto fail;
-    }
+        /* Put all options in a QDict and flatten it */
+        v = qobject_output_visitor_new(&obj);
+        visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
+        visit_complete(v, &obj);
+        visit_free(v);
 
-    /* Put all options in a QDict and flatten it */
-    visit_type_BlockdevOptions(v, NULL, &options, &error_abort);
-    visit_complete(v, &obj);
-    qdict = qobject_to(QDict, obj);
+        qdict = qobject_to(QDict, obj);
 
-    qdict_flatten(qdict);
+        qdict_flatten(qdict);
 
-    /* Perform the reopen operation */
-    ctx = bdrv_get_aio_context(bs);
-    aio_context_acquire(ctx);
-    bdrv_subtree_drained_begin(bs);
-    aio_context_release(ctx);
+        ctx = bdrv_get_aio_context(bs);
+        aio_context_acquire(ctx);
 
-    queue = bdrv_reopen_queue(NULL, bs, qdict, false);
-    bdrv_reopen_multiple(queue, errp);
+        bdrv_subtree_drained_begin(bs);
+        queue = bdrv_reopen_queue(queue, bs, qdict, false);
+        drained = g_slist_prepend(drained, bs);
 
-    ctx = bdrv_get_aio_context(bs);
-    aio_context_acquire(ctx);
-    bdrv_subtree_drained_end(bs);
-    aio_context_release(ctx);
+        aio_context_release(ctx);
+    }
+
+    /* Perform the reopen operation */
+    bdrv_reopen_multiple(queue, errp);
+    queue = NULL;
 
 fail:
-    visit_free(v);
+    bdrv_reopen_queue_free(queue);
+    g_slist_free_full(drained, (GDestroyNotify) bdrv_subtree_drained_end);
 }
 
 void qmp_blockdev_del(const char *node_name, Error **errp)
diff --git a/tests/qemu-iotests/155 b/tests/qemu-iotests/155
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/155
+++ b/tests/qemu-iotests/155
@@ -XXX,XX +XXX,XX @@ class TestBlockdevMirrorReopen(MirrorBaseClass):
             result = self.vm.qmp('blockdev-add', node_name="backing",
                                  driver="null-co")
             self.assert_qmp(result, 'return', {})
-            result = self.vm.qmp('x-blockdev-reopen', node_name="target",
-                                 driver=iotests.imgfmt, file="target-file",
-                                 backing="backing")
+            result = self.vm.qmp('x-blockdev-reopen', options=[{
+                                     'node-name': "target",
+                                     'driver': iotests.imgfmt,
+                                     'file': "target-file",
+                                     'backing': "backing"
+                                 }])
             self.assert_qmp(result, 'return', {})
 
 class TestBlockdevMirrorReopenIothread(TestBlockdevMirrorReopen):
diff --git a/tests/qemu-iotests/165 b/tests/qemu-iotests/165
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/165
+++ b/tests/qemu-iotests/165
@@ -XXX,XX +XXX,XX @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
         assert sha256_1 == self.getSha256()
 
         # Reopen to RW
-        result = self.vm.qmp('x-blockdev-reopen', **{
+        result = self.vm.qmp('x-blockdev-reopen', options=[{
             'node-name': 'node0',
             'driver': iotests.imgfmt,
             'file': {
@@ -XXX,XX +XXX,XX @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
                 'filename': disk
             },
             'read-only': False
-        })
+        }])
         self.assert_qmp(result, 'return', {})
 
         # Check that bitmap is reopened to RW and we can write to it.
diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/245
+++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                          "Expected output of %d qemu-io commands, found %d" %
                          (found, self.total_io_cmds))
 
-    # Run x-blockdev-reopen with 'opts' but applying 'newopts'
-    # on top of it. The original 'opts' dict is unmodified
+    # Run x-blockdev-reopen on a list of block devices
+    def reopenMultiple(self, opts, errmsg = None):
+        result = self.vm.qmp('x-blockdev-reopen', conv_keys=False, options=opts)
+        if errmsg:
+            self.assert_qmp(result, 'error/class', 'GenericError')
+            self.assert_qmp(result, 'error/desc', errmsg)
+        else:
+            self.assert_qmp(result, 'return', {})
+
+    # Run x-blockdev-reopen on a single block device (specified by
+    # 'opts') but applying 'newopts' on top of it. The original 'opts'
+    # dict is unmodified
     def reopen(self, opts, newopts = {}, errmsg = None):
         opts = copy.deepcopy(opts)
 
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                 subdict = opts[prefix]
             subdict[key] = value
 
-        result = self.vm.qmp('x-blockdev-reopen', conv_keys = False, **opts)
-        if errmsg:
-            self.assert_qmp(result, 'error/class', 'GenericError')
-            self.assert_qmp(result, 'error/desc', errmsg)
-        else:
-            self.assert_qmp(result, 'return', {})
+        self.reopenMultiple([ opts ], errmsg)
 
 
     # Run query-named-block-nodes and return the specified entry
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
         # We cannot change any of these
         self.reopen(opts, {'node-name': 'not-found'}, "Failed to find node with node-name='not-found'")
         self.reopen(opts, {'node-name': ''}, "Failed to find node with node-name=''")
-        self.reopen(opts, {'node-name': None}, "Invalid parameter type for 'node-name', expected: string")
+        self.reopen(opts, {'node-name': None}, "Invalid parameter type for 'options[0].node-name', expected: string")
         self.reopen(opts, {'driver': 'raw'}, "Cannot change the option 'driver'")
         self.reopen(opts, {'driver': ''}, "Invalid parameter ''")
-        self.reopen(opts, {'driver': None}, "Invalid parameter type for 'driver', expected: string")
+        self.reopen(opts, {'driver': None}, "Invalid parameter type for 'options[0].driver', expected: string")
         self.reopen(opts, {'file': 'not-found'}, "Cannot find device='' nor node-name='not-found'")
         self.reopen(opts, {'file': ''}, "Cannot find device='' nor node-name=''")
         self.reopen(opts, {'file': None}, "Invalid parameter type for 'file', expected: BlockdevRef")
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
         self.reopen(opts, {'file.filename': hd_path[1]}, "Cannot change the option 'filename'")
         self.reopen(opts, {'file.aio': 'native'}, "Cannot change the option 'aio'")
         self.reopen(opts, {'file.locking': 'off'}, "Cannot change the option 'locking'")
-        self.reopen(opts, {'file.filename': None}, "Invalid parameter type for 'file.filename', expected: string")
+        self.reopen(opts, {'file.filename': None}, "Invalid parameter type for 'options[0].file.filename', expected: string")
 
         # node-name is optional in BlockdevOptions, but x-blockdev-reopen needs it
         del opts['node-name']
diff --git a/tests/qemu-iotests/248 b/tests/qemu-iotests/248
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/248
+++ b/tests/qemu-iotests/248
@@ -XXX,XX +XXX,XX @@ vm.get_qmp_events()
 
 del blockdev_opts['file']['size']
 vm.qmp_log('x-blockdev-reopen', filters=[filter_qmp_testfiles],
-           **blockdev_opts)
+           options = [ blockdev_opts ])
 
 vm.qmp_log('block-job-resume', device='drive0')
 vm.event_wait('JOB_STATUS_CHANGE', timeout=1.0,
diff --git a/tests/qemu-iotests/248.out b/tests/qemu-iotests/248.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/248.out
+++ b/tests/qemu-iotests/248.out
@@ -XXX,XX +XXX,XX @@
 {"return": {}}
 {"execute": "blockdev-mirror", "arguments": {"device": "drive0", "on-target-error": "enospc", "sync": "full", "target": "target"}}
 {"return": {}}
-{"execute": "x-blockdev-reopen", "arguments": {"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}}
+{"execute": "x-blockdev-reopen", "arguments": {"options": [{"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}]}}
 {"return": {}}
 {"execute": "block-job-resume", "arguments": {"device": "drive0"}}
 {"return": {}}
diff --git a/tests/qemu-iotests/296 b/tests/qemu-iotests/296
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/296
+++ b/tests/qemu-iotests/296
@@ -XXX,XX +XXX,XX @@ class EncryptionSetupTestCase(iotests.QMPTestCase):
 
         command = 'x-blockdev-reopen' if reOpen else 'blockdev-add'
 
-        result = vm.qmp(command, **
-            {
+        opts = {
                 'driver': iotests.imgfmt,
                 'node-name': id,
                 'read-only': readOnly,
@@ -XXX,XX +XXX,XX @@ class EncryptionSetupTestCase(iotests.QMPTestCase):
                     'filename': test_img,
                 }
             }
-        )
+
+        if reOpen:
+            result = vm.qmp(command, options=[opts])
+        else:
+            result = vm.qmp(command, **opts)
         self.assert_qmp(result, 'return', {})
 
 
diff --git a/tests/qemu-iotests/298 b/tests/qemu-iotests/298
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/298
+++ b/tests/qemu-iotests/298
@@ -XXX,XX +XXX,XX @@ class TestPreallocateFilter(TestPreallocateBase):
         self.check_big()
 
     def test_reopen_opts(self):
-        result = self.vm.qmp('x-blockdev-reopen', **{
+        result = self.vm.qmp('x-blockdev-reopen', options=[{
             'node-name': 'disk',
             'driver': iotests.imgfmt,
             'file': {
@@ -XXX,XX +XXX,XX @@ class TestPreallocateFilter(TestPreallocateBase):
                     'filename': disk
                 }
             }
-        })
+        }])
         self.assert_qmp(result, 'return', {})
 
         self.vm.hmp_qemu_io('drive0', 'write 0 1M')
diff --git a/tests/qemu-iotests/tests/remove-bitmap-from-backing b/tests/qemu-iotests/tests/remove-bitmap-from-backing
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/tests/remove-bitmap-from-backing
+++ b/tests/qemu-iotests/tests/remove-bitmap-from-backing
@@ -XXX,XX +XXX,XX @@ log('Trying to remove persistent bitmap from r-o base node, should fail:')
 vm.qmp_log('block-dirty-bitmap-remove', node='base', name='bitmap0')
 
 new_base_opts = {
-    'node-name': 'base',
-    'driver': 'qcow2',
-    'file': {
-        'driver': 'file',
-        'filename':  base
-    },
-    'read-only': False
+    'options': [{
+        'node-name': 'base',
+        'driver': 'qcow2',
+        'file': {
+            'driver': 'file',
+            'filename':  base
+        },
+        'read-only': False
+    }]
 }
 
 # Don't want to bother with filtering qmp_log for reopen command
@@ -XXX,XX +XXX,XX @@ if result != {'return': {}}:
 log('Remove persistent bitmap from base node reopened to RW:')
 vm.qmp_log('block-dirty-bitmap-remove', node='base', name='bitmap0')
 
-new_base_opts['read-only'] = True
+new_base_opts['options'][0]['read-only'] = True
 result = vm.qmp('x-blockdev-reopen', **new_base_opts)
 if result != {'return': {}}:
     log('Failed to reopen: ' + str(result))
-- 
2.31.1

From: Alberto Garcia <berto@igalia.com>

This test swaps the images used by two active block devices.

This is now possible thanks to the new ability to run
x-blockdev-reopen on multiple devices at the same time.

diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/245
+++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                                          '-c', 'read -P 0x40 0x40008 1',
                                          '-c', 'read -P 0x80 0x40010 1', hd_path[0])
 
+    # Swap the disk images of two active block devices
+    def test_swap_files(self):
+        # Add hd0 and hd2 (none of them with backing files)
+        opts0 = hd_opts(0)
+        result = self.vm.qmp('blockdev-add', conv_keys = False, **opts0)
+        self.assert_qmp(result, 'return', {})
+
+        opts2 = hd_opts(2)
+        result = self.vm.qmp('blockdev-add', conv_keys = False, **opts2)
+        self.assert_qmp(result, 'return', {})
+
+        # Write different data to both block devices
+        self.run_qemu_io("hd0", "write -P 0xa0 0 1k")
+        self.run_qemu_io("hd2", "write -P 0xa2 0 1k")
+
+        # Check that the data reads correctly
+        self.run_qemu_io("hd0", "read  -P 0xa0 0 1k")
+        self.run_qemu_io("hd2", "read  -P 0xa2 0 1k")
+
+        # It's not possible to make a block device use an image that
+        # is already being used by the other device.
+        self.reopen(opts0, {'file': 'hd2-file'},
+                    "Permission conflict on node 'hd2-file': permissions "
+                    "'write, resize' are both required by node 'hd2' (uses "
+                    "node 'hd2-file' as 'file' child) and unshared by node "
+                    "'hd0' (uses node 'hd2-file' as 'file' child).")
+        self.reopen(opts2, {'file': 'hd0-file'},
+                    "Permission conflict on node 'hd0-file': permissions "
+                    "'write, resize' are both required by node 'hd0' (uses "
+                    "node 'hd0-file' as 'file' child) and unshared by node "
+                    "'hd2' (uses node 'hd0-file' as 'file' child).")
+
+        # But we can swap the images if we reopen both devices at the
+        # same time
+        opts0['file'] = 'hd2-file'
+        opts2['file'] = 'hd0-file'
+        self.reopenMultiple([opts0, opts2])
+        self.run_qemu_io("hd0", "read  -P 0xa2 0 1k")
+        self.run_qemu_io("hd2", "read  -P 0xa0 0 1k")
+
+        # And we can of course come back to the original state
+        opts0['file'] = 'hd0-file'
+        opts2['file'] = 'hd2-file'
+        self.reopenMultiple([opts0, opts2])
+        self.run_qemu_io("hd0", "read  -P 0xa0 0 1k")
+        self.run_qemu_io("hd2", "read  -P 0xa2 0 1k")
+
     # Misc reopen tests with different block drivers
     @iotests.skip_if_unsupported(['quorum', 'throttle'])
     def test_misc_drivers(self):
diff --git a/tests/qemu-iotests/245.out b/tests/qemu-iotests/245.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/245.out
+++ b/tests/qemu-iotests/245.out
@@ -XXX,XX +XXX,XX @@ read 1/1 bytes at offset 262152
 read 1/1 bytes at offset 262160
 1 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 
-..............
+...............
 ----------------------------------------------------------------------
-Ran 24 tests
+Ran 25 tests
 
 OK
-- 
2.31.1

From: Alberto Garcia <berto@igalia.com>

This patch drops the 'x-' prefix from x-blockdev-reopen.

Signed-off-by: Alberto Garcia <berto@igalia.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210708114709.206487-7-kwolf@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qapi/block-core.json                                |  6 +++---
 blockdev.c                                          |  2 +-
 tests/qemu-iotests/155                              |  2 +-
 tests/qemu-iotests/165                              |  2 +-
 tests/qemu-iotests/245                              | 10 +++++-----
 tests/qemu-iotests/248                              |  2 +-
 tests/qemu-iotests/248.out                          |  2 +-
 tests/qemu-iotests/296                              |  2 +-
 tests/qemu-iotests/298                              |  2 +-
 tests/qemu-iotests/tests/remove-bitmap-from-backing |  4 ++--
 10 files changed, 17 insertions(+), 17 deletions(-)

diff --git a/qapi/block-core.json b/qapi/block-core.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/block-core.json
+++ b/qapi/block-core.json
@@ -XXX,XX +XXX,XX @@
 { 'command': 'blockdev-add', 'data': 'BlockdevOptions', 'boxed': true }
 
 ##
-# @x-blockdev-reopen:
+# @blockdev-reopen:
 #
 # Reopens one or more block devices using the given set of options.
 # Any option not specified will be reset to its default value regardless
@@ -XXX,XX +XXX,XX @@
 # image does not have a default backing file name as part of its
 # metadata.
 #
-# Since: 4.0
+# Since: 6.1
 ##
-{ 'command': 'x-blockdev-reopen',
+{ 'command': 'blockdev-reopen',
   'data': { 'options': ['BlockdevOptions'] } }
 
 ##
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ fail:
     visit_free(v);
 }
 
-void qmp_x_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
+void qmp_blockdev_reopen(BlockdevOptionsList *reopen_list, Error **errp)
 {
     BlockReopenQueue *queue = NULL;
     GSList *drained = NULL;
diff --git a/tests/qemu-iotests/155 b/tests/qemu-iotests/155
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/155
+++ b/tests/qemu-iotests/155
@@ -XXX,XX +XXX,XX @@ class TestBlockdevMirrorReopen(MirrorBaseClass):
             result = self.vm.qmp('blockdev-add', node_name="backing",
                                  driver="null-co")
             self.assert_qmp(result, 'return', {})
-            result = self.vm.qmp('x-blockdev-reopen', options=[{
+            result = self.vm.qmp('blockdev-reopen', options=[{
                                      'node-name': "target",
                                      'driver': iotests.imgfmt,
                                      'file': "target-file",
diff --git a/tests/qemu-iotests/165 b/tests/qemu-iotests/165
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/165
+++ b/tests/qemu-iotests/165
@@ -XXX,XX +XXX,XX @@ class TestPersistentDirtyBitmap(iotests.QMPTestCase):
         assert sha256_1 == self.getSha256()
 
         # Reopen to RW
-        result = self.vm.qmp('x-blockdev-reopen', options=[{
+        result = self.vm.qmp('blockdev-reopen', options=[{
             'node-name': 'node0',
             'driver': iotests.imgfmt,
             'file': {
diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/245
+++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@
 #!/usr/bin/env python3
 # group: rw
 #
-# Test cases for the QMP 'x-blockdev-reopen' command
+# Test cases for the QMP 'blockdev-reopen' command
 #
 # Copyright (C) 2018-2019 Igalia, S.L.
 # Author: Alberto Garcia <berto@igalia.com>
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
                          "Expected output of %d qemu-io commands, found %d" %
                          (found, self.total_io_cmds))
 
-    # Run x-blockdev-reopen on a list of block devices
+    # Run blockdev-reopen on a list of block devices
     def reopenMultiple(self, opts, errmsg = None):
-        result = self.vm.qmp('x-blockdev-reopen', conv_keys=False, options=opts)
+        result = self.vm.qmp('blockdev-reopen', conv_keys=False, options=opts)
         if errmsg:
             self.assert_qmp(result, 'error/class', 'GenericError')
             self.assert_qmp(result, 'error/desc', errmsg)
         else:
             self.assert_qmp(result, 'return', {})
 
-    # Run x-blockdev-reopen on a single block device (specified by
+    # Run blockdev-reopen on a single block device (specified by
     # 'opts') but applying 'newopts' on top of it. The original 'opts'
     # dict is unmodified
     def reopen(self, opts, newopts = {}, errmsg = None):
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
         self.reopen(opts, {'file.locking': 'off'}, "Cannot change the option 'locking'")
         self.reopen(opts, {'file.filename': None}, "Invalid parameter type for 'options[0].file.filename', expected: string")
 
-        # node-name is optional in BlockdevOptions, but x-blockdev-reopen needs it
+        # node-name is optional in BlockdevOptions, but blockdev-reopen needs it
         del opts['node-name']
         self.reopen(opts, {}, "node-name not specified")
 
diff --git a/tests/qemu-iotests/248 b/tests/qemu-iotests/248
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/248
+++ b/tests/qemu-iotests/248
@@ -XXX,XX +XXX,XX @@ vm.event_wait('JOB_STATUS_CHANGE', timeout=3.0,
 vm.get_qmp_events()
 
 del blockdev_opts['file']['size']
-vm.qmp_log('x-blockdev-reopen', filters=[filter_qmp_testfiles],
+vm.qmp_log('blockdev-reopen', filters=[filter_qmp_testfiles],
            options = [ blockdev_opts ])
 
 vm.qmp_log('block-job-resume', device='drive0')
diff --git a/tests/qemu-iotests/248.out b/tests/qemu-iotests/248.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/248.out
+++ b/tests/qemu-iotests/248.out
@@ -XXX,XX +XXX,XX @@
 {"return": {}}
 {"execute": "blockdev-mirror", "arguments": {"device": "drive0", "on-target-error": "enospc", "sync": "full", "target": "target"}}
 {"return": {}}
-{"execute": "x-blockdev-reopen", "arguments": {"options": [{"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}]}}
+{"execute": "blockdev-reopen", "arguments": {"options": [{"driver": "qcow2", "file": {"driver": "raw", "file": {"driver": "file", "filename": "TEST_DIR/PID-target"}}, "node-name": "target"}]}}
 {"return": {}}
 {"execute": "block-job-resume", "arguments": {"device": "drive0"}}
 {"return": {}}
diff --git a/tests/qemu-iotests/296 b/tests/qemu-iotests/296
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/296
+++ b/tests/qemu-iotests/296
@@ -XXX,XX +XXX,XX @@ class EncryptionSetupTestCase(iotests.QMPTestCase):
     def openImageQmp(self, vm, id, file, secret,
                      readOnly = False, reOpen = False):
 
-        command = 'x-blockdev-reopen' if reOpen else 'blockdev-add'
+        command = 'blockdev-reopen' if reOpen else 'blockdev-add'
 
         opts = {
                 'driver': iotests.imgfmt,
diff --git a/tests/qemu-iotests/298 b/tests/qemu-iotests/298
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/298
+++ b/tests/qemu-iotests/298
@@ -XXX,XX +XXX,XX @@ class TestPreallocateFilter(TestPreallocateBase):
         self.check_big()
 
     def test_reopen_opts(self):
-        result = self.vm.qmp('x-blockdev-reopen', options=[{
+        result = self.vm.qmp('blockdev-reopen', options=[{
             'node-name': 'disk',
             'driver': iotests.imgfmt,
             'file': {
diff --git a/tests/qemu-iotests/tests/remove-bitmap-from-backing b/tests/qemu-iotests/tests/remove-bitmap-from-backing
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/tests/remove-bitmap-from-backing
+++ b/tests/qemu-iotests/tests/remove-bitmap-from-backing
@@ -XXX,XX +XXX,XX @@ new_base_opts = {
 }
 
 # Don't want to bother with filtering qmp_log for reopen command
-result = vm.qmp('x-blockdev-reopen', **new_base_opts)
+result = vm.qmp('blockdev-reopen', **new_base_opts)
 if result != {'return': {}}:
     log('Failed to reopen: ' + str(result))
 
@@ -XXX,XX +XXX,XX @@ log('Remove persistent bitmap from base node reopened to RW:')
 vm.qmp_log('block-dirty-bitmap-remove', node='base', name='bitmap0')
 
 new_base_opts['options'][0]['read-only'] = True
-result = vm.qmp('x-blockdev-reopen', **new_base_opts)
+result = vm.qmp('blockdev-reopen', **new_base_opts)
 if result != {'return': {}}:
     log('Failed to reopen: ' + str(result))
 
-- 
2.31.1