Series comparison

-[PULL 00/17] Block layer patches
+[PULL 00/39] Block layer patches
-The following changes since commit 75ee62ac606bfc9eb59310b9446df3434bf6e8c2:
+The following changes since commit ccdf06c1db192152ac70a1dd974c624f566cb7d4:
-  Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2020-12-17 18:53:36 +0000)
+  Open 6.1 development tree (2021-04-30 11:15:40 +0100)
 are available in the Git repository at:
   git://repo.or.cz/qemu/kevin.git tags/for-upstream
-for you to fetch changes up to be7c5ddd0d80e2d6cf8e3ef12c049851d28d9c26:
+for you to fetch changes up to 68bf7336533faa6aa90fdd4558edddbf5d8ef814:
-  block/vpc: Use sizeof() instead of HEADER_SIZE for footer size (2020-12-18 12:43:30 +0100)
+  vhost-user-blk: Fail gracefully on too large queue size (2021-04-30 12:27:48 +0200)
 ----------------------------------------------------------------
-Block layer patches:
+Block layer patches
-- Add qemu-storage-daemon documentation
+- Fix permission update order problems with block graph changes
-- hw/block/nand: Decommission the NAND museum
+- qemu-img convert: Unshare write permission for source
-- vpc: Clean up some buffer abuse
+- vhost-user-blk: Fail gracefully on too large queue size
 - nfs: fix int overflow in nfs_client_open_qdict
 - Several iotests fixes
 ----------------------------------------------------------------
-Markus Armbruster (9):
+Kevin Wolf (3):
-      block/vpc: Make vpc_open() read the full dynamic header
+      block: Add BDRV_O_NO_SHARE for blk_new_open()
-      block/vpc: Don't abuse the footer buffer as BAT sector buffer
+      qemu-img convert: Unshare write permission for source
-      block/vpc: Don't abuse the footer buffer for dynamic header
+      vhost-user-blk: Fail gracefully on too large queue size
       block/vpc: Make vpc_checksum() take void *
       block/vpc: Pad VHDDynDiskHeader, replace uint8_t[] buffers
       block/vpc: Use sizeof() instead of 1024 for dynamic header size
       block/vpc: Pad VHDFooter, replace uint8_t[] buffers
       block/vpc: Pass footer buffers as VHDFooter * instead of uint8_t *
       block/vpc: Use sizeof() instead of HEADER_SIZE for footer size
-Max Reitz (1):
+Vladimir Sementsov-Ogievskiy (36):
-      iotests/210: Fix reference output
+      tests/test-bdrv-graph-mod: add test_parallel_exclusive_write
       tests/test-bdrv-graph-mod: add test_parallel_perm_update
       tests/test-bdrv-graph-mod: add test_append_greedy_filter
       block: bdrv_append(): don't consume reference
       block: BdrvChildClass: add .get_parent_aio_context handler
       block: drop ctx argument from bdrv_root_attach_child
       block: make bdrv_reopen_{prepare,commit,abort} private
       util: add transactions.c
       block: bdrv_refresh_perms: check for parents permissions conflict
       block: refactor bdrv_child* permission functions
       block: rewrite bdrv_child_try_set_perm() using bdrv_refresh_perms()
       block: inline bdrv_child_*() permission functions calls
       block: use topological sort for permission update
       block: add bdrv_drv_set_perm transaction action
       block: add bdrv_list_* permission update functions
       block: add bdrv_replace_child_safe() transaction action
       block: fix bdrv_replace_node_common
       block: add bdrv_attach_child_common() transaction action
       block: add bdrv_attach_child_noperm() transaction action
       block: split out bdrv_replace_node_noperm()
       block: adapt bdrv_append() for inserting filters
       block: add bdrv_remove_filter_or_cow transaction action
       block: introduce bdrv_drop_filter()
       block/backup-top: drop .active
       block: drop ignore_children for permission update functions
       block: make bdrv_unset_inherits_from to be a transaction action
       block: make bdrv_refresh_limits() to be a transaction action
       block: add bdrv_set_backing_noperm() transaction action
       block: bdrv_reopen_multiple(): move bdrv_flush to separate pre-prepare
       block: bdrv_reopen_multiple: refresh permissions on updated graph
       block: drop unused permission update functions
       block: inline bdrv_check_perm_common()
       block: inline bdrv_replace_child()
       block: refactor bdrv_child_set_perm_safe() transaction action
       block: rename bdrv_replace_child_safe() to bdrv_replace_child()
       block: refactor bdrv_node_check_perm()
-Peter Lieven (1):
+ include/block/block.h                 |   14 +-
-      block/nfs: fix int overflow in nfs_client_open_qdict
+ include/block/block_int.h             |    8 +-
+ include/qemu/transactions.h           |   63 ++
-Philippe Mathieu-Daudé (1):
+ block.c                               | 1329 ++++++++++++++++++++-------------
-      hw/block/nand: Decommission the NAND museum
+ block/backup-top.c                    |   48 +-
+ block/block-backend.c                 |   30 +-
-Stefan Hajnoczi (3):
+ block/commit.c                        |    1 +
-      docs: generate qemu-storage-daemon-qmp-ref(7) man page
+ block/file-posix.c                    |   91 +--
-      docs: add qemu-storage-daemon(1) man page
+ block/io.c                            |   31 +-
-      MAINTAINERS: add Kevin Wolf as storage daemon maintainer
+ block/mirror.c                        |    3 -
+ blockdev.c                            |    4 -
-Vladimir Sementsov-Ogievskiy (2):
+ blockjob.c                            |   11 +-
-      iotests: make _filter_qom_path more strict
+ hw/block/vhost-user-blk.c             |    5 +
-      iotests:172: use _filter_qom_path
+ qemu-img.c                            |    2 +-
+ tests/unit/test-bdrv-drain.c          |    2 +-
- docs/interop/conf.py                         |   2 +
+ tests/unit/test-bdrv-graph-mod.c      |  209 +++++-
- docs/interop/index.rst                       |   1 +
+ util/transactions.c                   |   96 +++
- docs/interop/qemu-storage-daemon-qmp-ref.rst |  13 +++
+ MAINTAINERS                           |    6 +
- docs/meson.build                             |   1 +
+ tests/qemu-iotests/245                |    2 +-
- docs/tools/conf.py                           |   2 +
+ tests/qemu-iotests/283.out            |    2 +-
- docs/tools/index.rst                         |   1 +
+ tests/qemu-iotests/tests/qsd-jobs.out |    2 +-
- docs/tools/qemu-storage-daemon.rst           | 148 ++++++++++++++++++++++++++
+ util/meson.build                      |    1 +
- block/nfs.c                                  |   2 +-
+files changed, 1280 insertions(+), 680 deletions(-)
- block/vpc.c                                  | 146 +++++++++++++------------
+ create mode 100644 include/qemu/transactions.h
- hw/block/nand.c                              |  12 +--
+ create mode 100644 util/transactions.c
  MAINTAINERS                                  |   9 ++
  storage-daemon/qapi/qapi-schema.json         |   3 +
  tests/qemu-iotests/172                       |   2 +-
  tests/qemu-iotests/172.out                   | 152 +++++++++++++--------------
  tests/qemu-iotests/186.out                   |  56 +++++-----
  tests/qemu-iotests/210.out                   |   2 +-
  tests/qemu-iotests/common.filter             |   2 +-
 files changed, 361 insertions(+), 193 deletions(-)
  create mode 100644 docs/interop/qemu-storage-daemon-qmp-ref.rst
  create mode 100644 docs/tools/qemu-storage-daemon.rst

-New patch
+[PULL 01/39] tests/test-bdrv-graph-mod: add test_parallel_exclusive_write
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add the test that shows that concept of ignore_children is incomplete.
+Actually, when we want to update something, ignoring permission of some
+existing BdrvChild, we should ignore also the propagated effect of this
+child to the other children. But that's not done. Better approach
+(update permissions on already updated graph) will be implemented
+later.
+Now the test fails, so it's added with -d argument to not break make
+check.
+Test fails with
+ "Conflicts with use by fl1 as 'backing', which does not allow 'write' on base"
+because when updating permissions we can ignore original top->fl1
+BdrvChild. But we don't ignore exclusive write permission in fl1->base
+BdrvChild, which is propagated. Correct thing to do is make graph
+change first and then do permission update from the top node.
+To run test do
+  ./test-bdrv-graph-mod -d -p /bdrv-graph-mod/parallel-exclusive-write
+from <build-directory>/tests.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-2-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/unit/test-bdrv-graph-mod.c | 70 +++++++++++++++++++++++++++++++-
+file changed, 69 insertions(+), 1 deletion(-)
+diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/test-bdrv-graph-mod.c
++++ b/tests/unit/test-bdrv-graph-mod.c
+@@ -XXX,XX +XXX,XX @@
+ /*
+  * Block node graph modifications tests
+  *
+- * Copyright (c) 2019 Virtuozzo International GmbH. All rights reserved.
++ * Copyright (c) 2019-2021 Virtuozzo International GmbH. All rights reserved.
+  *
+  * This program is free software; you can redistribute it and/or modify
+  * it under the terms of the GNU General Public License as published by
+@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_no_perm = {
+     .bdrv_child_perm = no_perm_default_perms,
+ };
++static void exclusive_write_perms(BlockDriverState *bs, BdrvChild *c,
++                                  BdrvChildRole role,
++                                  BlockReopenQueue *reopen_queue,
++                                  uint64_t perm, uint64_t shared,
++                                  uint64_t *nperm, uint64_t *nshared)
++{
++    *nperm = BLK_PERM_WRITE;
++    *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
++}
++
++static BlockDriver bdrv_exclusive_writer = {
++    .format_name = "exclusive-writer",
++    .bdrv_child_perm = exclusive_write_perms,
++};
++
+ static BlockDriverState *no_perm_node(const char *name)
+ {
+     return bdrv_new_open_driver(&bdrv_no_perm, name, BDRV_O_RDWR, &error_abort);
+@@ -XXX,XX +XXX,XX @@ static BlockDriverState *pass_through_node(const char *name)
+                                 BDRV_O_RDWR, &error_abort);
+ }
++static BlockDriverState *exclusive_writer_node(const char *name)
++{
++    return bdrv_new_open_driver(&bdrv_exclusive_writer, name,
++                                BDRV_O_RDWR, &error_abort);
++}
++
+ /*
+  * test_update_perm_tree
+  *
+@@ -XXX,XX +XXX,XX @@ static void test_should_update_child(void)
+     blk_unref(root);
+ }
++/*
++ * test_parallel_exclusive_write
++ *
++ * Check that when we replace node, old permissions of the node being removed
++ * doesn't break the replacement.
++ */
++static void test_parallel_exclusive_write(void)
++{
++    BlockDriverState *top = exclusive_writer_node("top");
++    BlockDriverState *base = no_perm_node("base");
++    BlockDriverState *fl1 = pass_through_node("fl1");
++    BlockDriverState *fl2 = pass_through_node("fl2");
++
++    /*
++     * bdrv_attach_child() eats child bs reference, so we need two @base
++     * references for two filters:
++     */
++    bdrv_ref(base);
++
++    bdrv_attach_child(top, fl1, "backing", &child_of_bds, BDRV_CHILD_DATA,
++                      &error_abort);
++    bdrv_attach_child(fl1, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
++                      &error_abort);
++    bdrv_attach_child(fl2, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
++                      &error_abort);
++
++    bdrv_replace_node(fl1, fl2, &error_abort);
++
++    bdrv_unref(fl2);
++    bdrv_unref(top);
++}
++
+ int main(int argc, char *argv[])
+ {
++    int i;
++    bool debug = false;
++
++    for (i = 1; i < argc; i++) {
++        if (!strcmp(argv[i], "-d")) {
++            debug = true;
++            break;
++        }
++    }
++
+     bdrv_init();
+     qemu_init_main_loop(&error_abort);
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+     g_test_add_func("/bdrv-graph-mod/should-update-child",
+                     test_should_update_child);
++    if (debug) {
++        g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
++                        test_parallel_exclusive_write);
++    }
++
+     return g_test_run();
+ }
+--
+.30.2

-New patch
+[PULL 02/39] tests/test-bdrv-graph-mod: add test_parallel_perm_update
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add test to show that simple DFS recursion order is not correct for
+permission update. Correct order is topological-sort order, which will
+be introduced later.
+Consider the block driver which has two filter children: one active
+with exclusive write access and one inactive with no specific
+permissions.
+And, these two children has a common base child, like this:
+┌─────┐     ┌──────┐
+│ fl2 │ ◀── │ top  │
+└─────┘     └──────┘
+  │           │
+  │           │ w
+  │           ▼
+  │         ┌──────┐
+  │         │ fl1  │
+  │         └──────┘
+  │           │
+  │           │ w
+  │           ▼
+  │         ┌──────┐
+  └───────▶ │ base │
+            └──────┘
+So, exclusive write is propagated.
+Assume, we want to make fl2 active instead of fl1.
+So, we set some option for top driver and do permission update.
+If permission update (remember, it's DFS) goes first through
+top->fl1->base branch it will succeed: it firstly drop exclusive write
+permissions and than apply them for another BdrvChildren.
+But if permission update goes first through top->fl2->base branch it
+will fail, as when we try to update fl2->base child, old not yet
+updated fl1->base child will be in conflict.
+Now test fails, so it runs only with -d flag. To run do
+  ./test-bdrv-graph-mod -d -p /bdrv-graph-mod/parallel-perm-update
+from <build-directory>/tests.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-3-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/unit/test-bdrv-graph-mod.c | 116 +++++++++++++++++++++++++++++++
+file changed, 116 insertions(+)
+diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/test-bdrv-graph-mod.c
++++ b/tests/unit/test-bdrv-graph-mod.c
+@@ -XXX,XX +XXX,XX @@ static void test_parallel_exclusive_write(void)
+     bdrv_unref(top);
+ }
++static void write_to_file_perms(BlockDriverState *bs, BdrvChild *c,
++                                     BdrvChildRole role,
++                                     BlockReopenQueue *reopen_queue,
++                                     uint64_t perm, uint64_t shared,
++                                     uint64_t *nperm, uint64_t *nshared)
++{
++    if (bs->file && c == bs->file) {
++        *nperm = BLK_PERM_WRITE;
++        *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
++    } else {
++        *nperm = 0;
++        *nshared = BLK_PERM_ALL;
++    }
++}
++
++static BlockDriver bdrv_write_to_file = {
++    .format_name = "tricky-perm",
++    .bdrv_child_perm = write_to_file_perms,
++};
++
++
++/*
++ * The following test shows that topological-sort order is required for
++ * permission update, simple DFS is not enough.
++ *
++ * Consider the block driver which has two filter children: one active
++ * with exclusive write access and one inactive with no specific
++ * permissions.
++ *
++ * And, these two children has a common base child, like this:
++ *
++ * ┌─────┐     ┌──────┐
++ * │ fl2 │ ◀── │ top  │
++ * └─────┘     └──────┘
++ *   │           │
++ *   │           │ w
++ *   │           ▼
++ *   │         ┌──────┐
++ *   │         │ fl1  │
++ *   │         └──────┘
++ *   │           │
++ *   │           │ w
++ *   │           ▼
++ *   │         ┌──────┐
++ *   └───────▶ │ base │
++ *             └──────┘
++ *
++ * So, exclusive write is propagated.
++ *
++ * Assume, we want to make fl2 active instead of fl1.
++ * So, we set some option for top driver and do permission update.
++ *
++ * With simple DFS, if permission update goes first through
++ * top->fl1->base branch it will succeed: it firstly drop exclusive write
++ * permissions and than apply them for another BdrvChildren.
++ * But if permission update goes first through top->fl2->base branch it
++ * will fail, as when we try to update fl2->base child, old not yet
++ * updated fl1->base child will be in conflict.
++ *
++ * With topological-sort order we always update parents before children, so fl1
++ * and fl2 are both updated when we update base and there is no conflict.
++ */
++static void test_parallel_perm_update(void)
++{
++    BlockDriverState *top = no_perm_node("top");
++    BlockDriverState *tricky =
++            bdrv_new_open_driver(&bdrv_write_to_file, "tricky", BDRV_O_RDWR,
++                                 &error_abort);
++    BlockDriverState *base = no_perm_node("base");
++    BlockDriverState *fl1 = pass_through_node("fl1");
++    BlockDriverState *fl2 = pass_through_node("fl2");
++    BdrvChild *c_fl1, *c_fl2;
++
++    /*
++     * bdrv_attach_child() eats child bs reference, so we need two @base
++     * references for two filters:
++     */
++    bdrv_ref(base);
++
++    bdrv_attach_child(top, tricky, "file", &child_of_bds, BDRV_CHILD_DATA,
++                      &error_abort);
++    c_fl1 = bdrv_attach_child(tricky, fl1, "first", &child_of_bds,
++                              BDRV_CHILD_FILTERED, &error_abort);
++    c_fl2 = bdrv_attach_child(tricky, fl2, "second", &child_of_bds,
++                              BDRV_CHILD_FILTERED, &error_abort);
++    bdrv_attach_child(fl1, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
++                      &error_abort);
++    bdrv_attach_child(fl2, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
++                      &error_abort);
++
++    /* Select fl1 as first child to be active */
++    tricky->file = c_fl1;
++    bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
++
++    assert(c_fl1->perm & BLK_PERM_WRITE);
++    assert(!(c_fl2->perm & BLK_PERM_WRITE));
++
++    /* Now, try to switch active child and update permissions */
++    tricky->file = c_fl2;
++    bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
++
++    assert(c_fl2->perm & BLK_PERM_WRITE);
++    assert(!(c_fl1->perm & BLK_PERM_WRITE));
++
++    /* Switch once more, to not care about real child order in the list */
++    tricky->file = c_fl1;
++    bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
++
++    assert(c_fl1->perm & BLK_PERM_WRITE);
++    assert(!(c_fl2->perm & BLK_PERM_WRITE));
++
++    bdrv_unref(top);
++}
++
+ int main(int argc, char *argv[])
+ {
+     int i;
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+     if (debug) {
+         g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
+                         test_parallel_exclusive_write);
++        g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
++                        test_parallel_perm_update);
+     }
+     return g_test_run();
+--
+.30.2

-New patch
+[PULL 03/39] tests/test-bdrv-graph-mod: add test_append_greedy_filter
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+bdrv_append() is not quite good for inserting filters: it does extra
+permission update in intermediate state, where filter get it filtered
+child but is not yet replace it in a backing chain.
+Some filters (for example backup-top) may want permissions even when
+have no parents. And described intermediate state becomes invalid.
+That's (half a) reason, why we need "inactive" state for backup-top
+filter.
+bdrv_append() will be improved later, now let's add a unit test.
+Now test fails, so it runs only with -d flag. To run do
+  ./test-bdrv-graph-mod -d -p /bdrv-graph-mod/append-greedy-filter
+from <build-directory>/tests.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-4-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ tests/unit/test-bdrv-graph-mod.c | 33 ++++++++++++++++++++++++++++++++
+file changed, 33 insertions(+)
+diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/test-bdrv-graph-mod.c
++++ b/tests/unit/test-bdrv-graph-mod.c
+@@ -XXX,XX +XXX,XX @@ static void test_parallel_perm_update(void)
+     bdrv_unref(top);
+ }
++/*
++ * It's possible that filter required permissions allows to insert it to backing
++ * chain, like:
++ *
++ *  1.  [top] -> [filter] -> [base]
++ *
++ * but doesn't allow to add it as a branch:
++ *
++ *  2.  [filter] --\
++ *                 v
++ *      [top] -> [base]
++ *
++ * So, inserting such filter should do all graph modifications and only then
++ * update permissions. If we try to go through intermediate state [2] and update
++ * permissions on it we'll fail.
++ *
++ * Let's check that bdrv_append() can append such a filter.
++ */
++static void test_append_greedy_filter(void)
++{
++    BlockDriverState *top = exclusive_writer_node("top");
++    BlockDriverState *base = no_perm_node("base");
++    BlockDriverState *fl = exclusive_writer_node("fl1");
++
++    bdrv_attach_child(top, base, "backing", &child_of_bds, BDRV_CHILD_COW,
++                      &error_abort);
++
++    bdrv_append(fl, base, &error_abort);
++    bdrv_unref(top);
++}
++
+ int main(int argc, char *argv[])
+ {
+     int i;
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+                         test_parallel_exclusive_write);
+         g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
+                         test_parallel_perm_update);
++        g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
++                        test_append_greedy_filter);
+     }
+     return g_test_run();
+--
+.30.2

-New patch
+[PULL 04/39] block: bdrv_append(): don't consume reference
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+We have too much comments for this feature. It seems better just don't
+do it. Most of real users (tests don't count) have to create additional
+reference.
+Drop also comment in external_snapshot_prepare:
+ - bdrv_append doesn't "remove" old bs in common sense, it sounds
+   strange
+ - the fact that bdrv_append can fail is obvious from the context
+ - the fact that we must rollback all changes in transaction abort is
+   known (it's the direct role of abort)
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-5-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c                          | 25 +++----------------------
+ block/backup-top.c               |  1 -
+ block/commit.c                   |  1 +
+ block/mirror.c                   |  3 ---
+ blockdev.c                       |  4 ----
+ tests/unit/test-bdrv-drain.c     |  2 +-
+ tests/unit/test-bdrv-graph-mod.c |  3 +++
+files changed, 8 insertions(+), 31 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
+         goto out;
+     }
+-    /* bdrv_append() consumes a strong reference to bs_snapshot
+-     * (i.e. it will call bdrv_unref() on it) even on error, so in
+-     * order to be able to return one, we have to increase
+-     * bs_snapshot's refcount here */
+-    bdrv_ref(bs_snapshot);
+     ret = bdrv_append(bs_snapshot, bs, errp);
+     if (ret < 0) {
+         bs_snapshot = NULL;
+@@ -XXX,XX +XXX,XX @@ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
+  * bs_new must not be attached to a BlockBackend.
+  *
+  * This function does not create any image files.
+- *
+- * bdrv_append() takes ownership of a bs_new reference and unrefs it because
+- * that's what the callers commonly need. bs_new will be referenced by the old
+- * parents of bs_top after bdrv_append() returns. If the caller needs to keep a
+- * reference of its own, it must call bdrv_ref().
+  */
+ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
+                 Error **errp)
+ {
+     int ret = bdrv_set_backing_hd(bs_new, bs_top, errp);
+     if (ret < 0) {
+-        goto out;
++        return ret;
+     }
+     ret = bdrv_replace_node(bs_top, bs_new, errp);
+     if (ret < 0) {
+         bdrv_set_backing_hd(bs_new, NULL, &error_abort);
+-        goto out;
++        return ret;
+     }
+-    ret = 0;
+-
+-out:
+-    /*
+-     * bs_new is now referenced by its new parents, we don't need the
+-     * additional reference any more.
+-     */
+-    bdrv_unref(bs_new);
+-
+-    return ret;
++    return 0;
+ }
+ static void bdrv_delete(BlockDriverState *bs)
+diff --git a/block/backup-top.c b/block/backup-top.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     bdrv_drained_begin(source);
+-    bdrv_ref(top);
+     ret = bdrv_append(top, source, errp);
+     if (ret < 0) {
+         error_prepend(errp, "Cannot append backup-top filter: ");
+diff --git a/block/commit.c b/block/commit.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/commit.c
++++ b/block/commit.c
+@@ -XXX,XX +XXX,XX @@ void commit_start(const char *job_id, BlockDriverState *bs,
+     commit_top_bs->total_sectors = top->total_sectors;
+     ret = bdrv_append(commit_top_bs, top, errp);
++    bdrv_unref(commit_top_bs); /* referenced by new parents or failed */
+     if (ret < 0) {
+         commit_top_bs = NULL;
+         goto fail;
+diff --git a/block/mirror.c b/block/mirror.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/mirror.c
++++ b/block/mirror.c
+@@ -XXX,XX +XXX,XX @@ static BlockJob *mirror_start_job(
+     bs_opaque->is_commit = target_is_backing;
+-    /* bdrv_append takes ownership of the mirror_top_bs reference, need to keep
+-     * it alive until block_job_create() succeeds even if bs has no parent. */
+-    bdrv_ref(mirror_top_bs);
+     bdrv_drained_begin(bs);
+     ret = bdrv_append(mirror_top_bs, bs, errp);
+     bdrv_drained_end(bs);
+diff --git a/blockdev.c b/blockdev.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockdev.c
++++ b/blockdev.c
+@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
+         goto out;
+     }
+-    /* This removes our old bs and adds the new bs. This is an operation that
+-     * can fail, so we need to do it in .prepare; undoing it for abort is
+-     * always possible. */
+-    bdrv_ref(state->new_bs);
+     ret = bdrv_append(state->new_bs, state->old_bs, errp);
+     if (ret < 0) {
+         goto out;
+diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/test-bdrv-drain.c
++++ b/tests/unit/test-bdrv-drain.c
+@@ -XXX,XX +XXX,XX @@ static void test_append_to_drained(void)
+     g_assert_cmpint(base_s->drain_count, ==, 1);
+     g_assert_cmpint(base->in_flight, ==, 0);
+-    /* Takes ownership of overlay, so we don't have to unref it later */
+     bdrv_append(overlay, base, &error_abort);
+     g_assert_cmpint(base->in_flight, ==, 0);
+     g_assert_cmpint(overlay->in_flight, ==, 0);
+@@ -XXX,XX +XXX,XX @@ static void test_append_to_drained(void)
+     g_assert_cmpint(overlay->quiesce_counter, ==, 0);
+     g_assert_cmpint(overlay_s->drain_count, ==, 0);
++    bdrv_unref(overlay);
+     bdrv_unref(base);
+     blk_unref(blk);
+ }
+diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/test-bdrv-graph-mod.c
++++ b/tests/unit/test-bdrv-graph-mod.c
+@@ -XXX,XX +XXX,XX @@ static void test_update_perm_tree(void)
+     ret = bdrv_append(filter, bs, NULL);
+     g_assert_cmpint(ret, <, 0);
++    bdrv_unref(filter);
+     blk_unref(root);
+ }
+@@ -XXX,XX +XXX,XX @@ static void test_should_update_child(void)
+     bdrv_append(filter, bs, &error_abort);
+     g_assert(target->backing->bs == bs);
++    bdrv_unref(filter);
+     bdrv_unref(bs);
+     blk_unref(root);
+ }
+@@ -XXX,XX +XXX,XX @@ static void test_append_greedy_filter(void)
+                       &error_abort);
+     bdrv_append(fl, base, &error_abort);
++    bdrv_unref(fl);
+     bdrv_unref(top);
+ }
+--
+.30.2

-New patch
+[PULL 05/39] block: BdrvChildClass: add .get_parent_aio_context handler
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add new handler to get aio context and implement it in all child
+classes. Add corresponding public interface to be used soon.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-6-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/block/block.h     |  2 ++
+ include/block/block_int.h |  2 ++
+ block.c                   | 13 +++++++++++++
+ block/block-backend.c     |  9 +++++++++
+ blockjob.c                |  8 ++++++++
+files changed, 34 insertions(+)
+diff --git a/include/block/block.h b/include/block/block.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block.h
++++ b/include/block/block.h
+@@ -XXX,XX +XXX,XX @@ bool bdrv_child_can_set_aio_context(BdrvChild *c, AioContext *ctx,
+                                     GSList **ignore, Error **errp);
+ bool bdrv_can_set_aio_context(BlockDriverState *bs, AioContext *ctx,
+                               GSList **ignore, Error **errp);
++AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c);
++
+ int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz);
+ int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo);
+diff --git a/include/block/block_int.h b/include/block/block_int.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block_int.h
++++ b/include/block/block_int.h
+@@ -XXX,XX +XXX,XX @@ struct BdrvChildClass {
+     bool (*can_set_aio_ctx)(BdrvChild *child, AioContext *ctx,
+                             GSList **ignore, Error **errp);
+     void (*set_aio_ctx)(BdrvChild *child, AioContext *ctx, GSList **ignore);
++
++    AioContext *(*get_parent_aio_context)(BdrvChild *child);
+ };
+ extern const BdrvChildClass child_of_bds;
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
+     return 0;
+ }
++static AioContext *bdrv_child_cb_get_parent_aio_context(BdrvChild *c)
++{
++    BlockDriverState *bs = c->opaque;
++
++    return bdrv_get_aio_context(bs);
++}
++
+ const BdrvChildClass child_of_bds = {
+     .parent_is_bds   = true,
+     .get_parent_desc = bdrv_child_get_parent_desc,
+@@ -XXX,XX +XXX,XX @@ const BdrvChildClass child_of_bds = {
+     .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
+     .set_aio_ctx     = bdrv_child_cb_set_aio_ctx,
+     .update_filename = bdrv_child_cb_update_filename,
++    .get_parent_aio_context = bdrv_child_cb_get_parent_aio_context,
+ };
++AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c)
++{
++    return c->klass->get_parent_aio_context(c);
++}
++
+ static int bdrv_open_flags(BlockDriverState *bs, int flags)
+ {
+     int open_flags = flags;
+diff --git a/block/block-backend.c b/block/block-backend.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-backend.c
++++ b/block/block-backend.c
+@@ -XXX,XX +XXX,XX @@ static void blk_root_detach(BdrvChild *child)
+     }
+ }
++static AioContext *blk_root_get_parent_aio_context(BdrvChild *c)
++{
++    BlockBackend *blk = c->opaque;
++
++    return blk_get_aio_context(blk);
++}
++
+ static const BdrvChildClass child_root = {
+     .inherit_options    = blk_root_inherit_options,
+@@ -XXX,XX +XXX,XX @@ static const BdrvChildClass child_root = {
+     .can_set_aio_ctx    = blk_root_can_set_aio_ctx,
+     .set_aio_ctx        = blk_root_set_aio_ctx,
++
++    .get_parent_aio_context = blk_root_get_parent_aio_context,
+ };
+ /*
+diff --git a/blockjob.c b/blockjob.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockjob.c
++++ b/blockjob.c
+@@ -XXX,XX +XXX,XX @@ static void child_job_set_aio_ctx(BdrvChild *c, AioContext *ctx,
+     job->job.aio_context = ctx;
+ }
++static AioContext *child_job_get_parent_aio_context(BdrvChild *c)
++{
++    BlockJob *job = c->opaque;
++
++    return job->job.aio_context;
++}
++
+ static const BdrvChildClass child_job = {
+     .get_parent_desc    = child_job_get_parent_desc,
+     .drained_begin      = child_job_drained_begin,
+@@ -XXX,XX +XXX,XX @@ static const BdrvChildClass child_job = {
+     .can_set_aio_ctx    = child_job_can_set_aio_ctx,
+     .set_aio_ctx        = child_job_set_aio_ctx,
+     .stay_at_node       = true,
++    .get_parent_aio_context = child_job_get_parent_aio_context,
+ };
+ void block_job_remove_all_bdrv(BlockJob *job)
+--
+.30.2

-New patch
+[PULL 06/39] block: drop ctx argument from bdrv_root_attach_child
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Passing parent aio context is redundant, as child_class and parent
+opaque pointer are enough to retrieve it. Drop the argument and use new
+bdrv_child_get_parent_aio_context() interface.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-7-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/block/block_int.h | 1 -
+ block.c                   | 8 +++++---
+ block/block-backend.c     | 4 ++--
+ blockjob.c                | 3 +--
+files changed, 8 insertions(+), 8 deletions(-)
+diff --git a/include/block/block_int.h b/include/block/block_int.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block_int.h
++++ b/include/block/block_int.h
+@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
+                                   const char *child_name,
+                                   const BdrvChildClass *child_class,
+                                   BdrvChildRole child_role,
+-                                  AioContext *ctx,
+                                   uint64_t perm, uint64_t shared_perm,
+                                   void *opaque, Error **errp);
+ void bdrv_root_unref_child(BdrvChild *child);
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
+                                   const char *child_name,
+                                   const BdrvChildClass *child_class,
+                                   BdrvChildRole child_role,
+-                                  AioContext *ctx,
+                                   uint64_t perm, uint64_t shared_perm,
+                                   void *opaque, Error **errp)
+ {
+     BdrvChild *child;
+     Error *local_err = NULL;
+     int ret;
++    AioContext *ctx;
+     ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, errp);
+     if (ret < 0) {
+@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
+         .opaque         = opaque,
+     };
++    ctx = bdrv_child_get_parent_aio_context(child);
++
+     /* If the AioContexts don't match, first try to move the subtree of
+      * child_bs into the AioContext of the new parent. If this doesn't work,
+      * try moving the parent into the AioContext of child_bs instead. */
+@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
+                     perm, shared_perm, &perm, &shared_perm);
+     child = bdrv_root_attach_child(child_bs, child_name, child_class,
+-                                   child_role, bdrv_get_aio_context(parent_bs),
+-                                   perm, shared_perm, parent_bs, errp);
++                                   child_role, perm, shared_perm, parent_bs,
++                                   errp);
+     if (child == NULL) {
+         return NULL;
+     }
+diff --git a/block/block-backend.c b/block/block-backend.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/block-backend.c
++++ b/block/block-backend.c
+@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
+     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
+                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
+-                                       blk->ctx, perm, BLK_PERM_ALL, blk, errp);
++                                       perm, BLK_PERM_ALL, blk, errp);
+     if (!blk->root) {
+         blk_unref(blk);
+         return NULL;
+@@ -XXX,XX +XXX,XX @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
+     bdrv_ref(bs);
+     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
+                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
+-                                       blk->ctx, blk->perm, blk->shared_perm,
++                                       blk->perm, blk->shared_perm,
+                                        blk, errp);
+     if (blk->root == NULL) {
+         return -EPERM;
+diff --git a/blockjob.c b/blockjob.c
+index XXXXXXX..XXXXXXX 100644
+--- a/blockjob.c
++++ b/blockjob.c
+@@ -XXX,XX +XXX,XX @@ int block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
+     if (need_context_ops && job->job.aio_context != qemu_get_aio_context()) {
+         aio_context_release(job->job.aio_context);
+     }
+-    c = bdrv_root_attach_child(bs, name, &child_job, 0,
+-                               job->job.aio_context, perm, shared_perm, job,
++    c = bdrv_root_attach_child(bs, name, &child_job, 0, perm, shared_perm, job,
+                                errp);
+     if (need_context_ops && job->job.aio_context != qemu_get_aio_context()) {
+         aio_context_acquire(job->job.aio_context);
+--
+.30.2

-New patch
+[PULL 07/39] block: make bdrv_reopen_{prepare,commit,abort} private
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+These functions are called only from bdrv_reopen_multiple() in block.c.
+No reason to publish them.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-8-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/block/block.h |  4 ----
+ block.c               | 13 +++++++++----
+files changed, 9 insertions(+), 8 deletions(-)
+diff --git a/include/block/block.h b/include/block/block.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block.h
++++ b/include/block/block.h
+@@ -XXX,XX +XXX,XX @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
+ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
+ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
+                               Error **errp);
+-int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
+-                        BlockReopenQueue *queue, Error **errp);
+-void bdrv_reopen_commit(BDRVReopenState *reopen_state);
+-void bdrv_reopen_abort(BDRVReopenState *reopen_state);
+ int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
+                        int64_t bytes, BdrvRequestFlags flags);
+ int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags);
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
+                                            BdrvChildRole child_role,
+                                            Error **errp);
++static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
++                               *queue, Error **errp);
++static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
++static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
++
+ /* If non-zero, use only whitelisted block drivers */
+ static int use_bdrv_whitelist;
+@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
+  * commit() for any other BDS that have been left in a prepare() state
+  *
+  */
+-int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
+-                        Error **errp)
++static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
++                               BlockReopenQueue *queue, Error **errp)
+ {
+     int ret = -1;
+     int old_flags;
+@@ -XXX,XX +XXX,XX @@ error:
+  * makes them final by swapping the staging BlockDriverState contents into
+  * the active BlockDriverState contents.
+  */
+-void bdrv_reopen_commit(BDRVReopenState *reopen_state)
++static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
+ {
+     BlockDriver *drv;
+     BlockDriverState *bs;
+@@ -XXX,XX +XXX,XX @@ void bdrv_reopen_commit(BDRVReopenState *reopen_state)
+  * Abort the reopen, and delete and free the staged changes in
+  * reopen_state
+  */
+-void bdrv_reopen_abort(BDRVReopenState *reopen_state)
++static void bdrv_reopen_abort(BDRVReopenState *reopen_state)
+ {
+     BlockDriver *drv;
+--
+.30.2

-[PULL 06/17] MAINTAINERS: add Kevin Wolf as storage daemon maintainer
+[PULL 08/39] util: add transactions.c
-From: Stefan Hajnoczi <stefanha@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-The MAINTAINERS file was not updated when the storage daemon was merged.
+Add simple transaction API to use in further update of block graph
+operations.
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
-Acked-by: Kevin Wolf <kwolf@redhat.com>
+Supposed usage is:
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Message-Id: <20201209103802.350848-4-stefanha@redhat.com>
+- "prepare" is main function of the action and it should make the main
   effect of the action to be visible for the following actions, keeping
   possibility of roll-back, saving necessary things in action state,
   which is prepended to the action list (to do that, prepare func
   should call tran_add()). So, driver struct doesn't include "prepare"
   field, as it is supposed to be called directly.
 - commit/rollback is supposed to be called for the list of action
   states, to commit/rollback all the actions in reverse order
 - When possible "commit" should not make visible effect for other
   actions, which make possible transparent logical interaction between
   actions.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-9-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- MAINTAINERS | 9 +++++++++
+ include/qemu/transactions.h | 63 ++++++++++++++++++++++++
-file changed, 9 insertions(+)
+ util/transactions.c         | 96 +++++++++++++++++++++++++++++++++++++
+ MAINTAINERS                 |  6 +++
  util/meson.build            |  1 +
 files changed, 166 insertions(+)
  create mode 100644 include/qemu/transactions.h
  create mode 100644 util/transactions.c
 diff --git a/include/qemu/transactions.h b/include/qemu/transactions.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/include/qemu/transactions.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Simple transactions API
 + *
 + * Copyright (c) 2021 Virtuozzo International GmbH.
 + *
 + * Author:
 + *  Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program. If not, see <http://www.gnu.org/licenses/>.
 + *
 + *
 + * = Generic transaction API =
 + *
 + * The intended usage is the following: you create "prepare" functions, which
 + * represents the actions. They will usually have Transaction* argument, and
 + * call tran_add() to register finalization callbacks. For finalization
 + * callbacks, prepare corresponding TransactionActionDrv structures.
 + *
 + * Then, when you need to make a transaction, create an empty Transaction by
 + * tran_create(), call your "prepare" functions on it, and finally call
 + * tran_abort() or tran_commit() to finalize the transaction by corresponding
 + * finalization actions in reverse order.
 + */
 +
 +#ifndef QEMU_TRANSACTIONS_H
 +#define QEMU_TRANSACTIONS_H
 +
 +#include <gmodule.h>
 +
 +typedef struct TransactionActionDrv {
 +    void (*abort)(void *opaque);
 +    void (*commit)(void *opaque);
 +    void (*clean)(void *opaque);
 +} TransactionActionDrv;
 +
 +typedef struct Transaction Transaction;
 +
 +Transaction *tran_new(void);
 +void tran_add(Transaction *tran, TransactionActionDrv *drv, void *opaque);
 +void tran_abort(Transaction *tran);
 +void tran_commit(Transaction *tran);
 +
 +static inline void tran_finalize(Transaction *tran, int ret)
 +{
 +    if (ret < 0) {
 +        tran_abort(tran);
 +    } else {
 +        tran_commit(tran);
 +    }
 +}
 +
 +#endif /* QEMU_TRANSACTIONS_H */
 diff --git a/util/transactions.c b/util/transactions.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/util/transactions.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * Simple transactions API
 + *
 + * Copyright (c) 2021 Virtuozzo International GmbH.
 + *
 + * Author:
 + *  Sementsov-Ogievskiy Vladimir <vsementsov@virtuozzo.com>
 + *
 + * This program is free software; you can redistribute it and/or modify
 + * it under the terms of the GNU General Public License as published by
 + * the Free Software Foundation; either version 2 of the License, or
 + * (at your option) any later version.
 + *
 + * This program is distributed in the hope that it will be useful,
 + * but WITHOUT ANY WARRANTY; without even the implied warranty of
 + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
 + * GNU General Public License for more details.
 + *
 + * You should have received a copy of the GNU General Public License
 + * along with this program. If not, see <http://www.gnu.org/licenses/>.
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "qemu/transactions.h"
 +#include "qemu/queue.h"
 +
 +typedef struct TransactionAction {
 +    TransactionActionDrv *drv;
 +    void *opaque;
 +    QSLIST_ENTRY(TransactionAction) entry;
 +} TransactionAction;
 +
 +struct Transaction {
 +    QSLIST_HEAD(, TransactionAction) actions;
 +};
 +
 +Transaction *tran_new(void)
 +{
 +    Transaction *tran = g_new(Transaction, 1);
 +
 +    QSLIST_INIT(&tran->actions);
 +
 +    return tran;
 +}
 +
 +void tran_add(Transaction *tran, TransactionActionDrv *drv, void *opaque)
 +{
 +    TransactionAction *act;
 +
 +    act = g_new(TransactionAction, 1);
 +    *act = (TransactionAction) {
 +        .drv = drv,
 +        .opaque = opaque
 +    };
 +
 +    QSLIST_INSERT_HEAD(&tran->actions, act, entry);
 +}
 +
 +void tran_abort(Transaction *tran)
 +{
 +    TransactionAction *act, *next;
 +
 +    QSLIST_FOREACH_SAFE(act, &tran->actions, entry, next) {
 +        if (act->drv->abort) {
 +            act->drv->abort(act->opaque);
 +        }
 +
 +        if (act->drv->clean) {
 +            act->drv->clean(act->opaque);
 +        }
 +
 +        g_free(act);
 +    }
 +
 +    g_free(tran);
 +}
 +
 +void tran_commit(Transaction *tran)
 +{
 +    TransactionAction *act, *next;
 +
 +    QSLIST_FOREACH_SAFE(act, &tran->actions, entry, next) {
 +        if (act->drv->commit) {
 +            act->drv->commit(act->opaque);
 +        }
 +
 +        if (act->drv->clean) {
 +            act->drv->clean(act->opaque);
 +        }
 +
 +        g_free(act);
 +    }
 +
 +    g_free(tran);
 +}
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ F: qobject/block-qdict.c
+@@ -XXX,XX +XXX,XX @@ M: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
- F: tests/check-block-qdict.c
+ S: Maintained
- T: git https://repo.or.cz/qemu/kevin.git block
+ F: scripts/simplebench/
-+Storage daemon
++Transactions helper
-+M: Kevin Wolf <kwolf@redhat.com>
++M: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-+L: qemu-block@nongnu.org
++S: Maintained
-+S: Supported
++F: include/qemu/transactions.h
-+F: storage-daemon/
++F: util/transactions.c
-+F: docs/interop/qemu-storage-daemon-qmp-ref.rst
++
-+F: docs/tools/qemu-storage-daemon.rst
+ QAPI
-+T: git https://repo.or.cz/qemu/kevin.git block
+ M: Markus Armbruster <armbru@redhat.com>
-+
+ M: Michael Roth <michael.roth@amd.com>
- Block I/O path
+diff --git a/util/meson.build b/util/meson.build
- M: Stefan Hajnoczi <stefanha@redhat.com>
+index XXXXXXX..XXXXXXX 100644
- M: Fam Zheng <fam@euphon.net>
+--- a/util/meson.build
 +++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ util_ss.add(files('qsp.c'))
  util_ss.add(files('range.c'))
  util_ss.add(files('stats64.c'))
  util_ss.add(files('systemd.c'))
 +util_ss.add(files('transactions.c'))
  util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
  util_ss.add(files('guest-random.c'))
  util_ss.add(files('yank.c'))
 --
-.29.2
+.30.2

-New patch
+[PULL 09/39] block: bdrv_refresh_perms: check for parents permissions conflict
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Add additional check that node parents do not interfere with each
+other. This should not hurt existing callers and allows in further
+patch use bdrv_refresh_perms() to update a subtree of changed
+BdrvChild (check that change is correct).
+New check will substitute bdrv_check_update_perm() in following
+permissions refactoring, so keep error messages the same to avoid
+unit test result changes.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Alberto Garcia <berto@igalia.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-10-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++---------
+file changed, 54 insertions(+), 9 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ bool bdrv_is_writable(BlockDriverState *bs)
+     return bdrv_is_writable_after_reopen(bs, NULL);
+ }
++static char *bdrv_child_user_desc(BdrvChild *c)
++{
++    if (c->klass->get_parent_desc) {
++        return c->klass->get_parent_desc(c);
++    }
++
++    return g_strdup("another user");
++}
++
++static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
++{
++    g_autofree char *user = NULL;
++    g_autofree char *perm_names = NULL;
++
++    if ((b->perm & a->shared_perm) == b->perm) {
++        return true;
++    }
++
++    perm_names = bdrv_perm_names(b->perm & ~a->shared_perm);
++    user = bdrv_child_user_desc(a);
++    error_setg(errp, "Conflicts with use by %s as '%s', which does not "
++               "allow '%s' on %s",
++               user, a->name, perm_names, bdrv_get_node_name(b->bs));
++
++    return false;
++}
++
++static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
++{
++    BdrvChild *a, *b;
++
++    /*
++     * During the loop we'll look at each pair twice. That's correct because
++     * bdrv_a_allow_b() is asymmetric and we should check each pair in both
++     * directions.
++     */
++    QLIST_FOREACH(a, &bs->parents, next_parent) {
++        QLIST_FOREACH(b, &bs->parents, next_parent) {
++            if (a == b) {
++                continue;
++            }
++
++            if (!bdrv_a_allow_b(a, b, errp)) {
++                return true;
++            }
++        }
++    }
++
++    return false;
++}
++
+ static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
+                             BdrvChild *c, BdrvChildRole role,
+                             BlockReopenQueue *reopen_queue,
+@@ -XXX,XX +XXX,XX @@ void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
+     *shared_perm = cumulative_shared_perms;
+ }
+-static char *bdrv_child_user_desc(BdrvChild *c)
+-{
+-    if (c->klass->get_parent_desc) {
+-        return c->klass->get_parent_desc(c);
+-    }
+-
+-    return g_strdup("another user");
+-}
+-
+ char *bdrv_perm_names(uint64_t perm)
+ {
+     struct perm_name {
+@@ -XXX,XX +XXX,XX @@ static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
+     int ret;
+     uint64_t perm, shared_perm;
++    if (bdrv_parent_perms_conflict(bs, errp)) {
++        return -EPERM;
++    }
+     bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
+     ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, errp);
+     if (ret < 0) {
+--
+.30.2

-New patch
+[PULL 10/39] block: refactor bdrv_child* permission functions
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Split out non-recursive parts, and refactor as block graph transaction
+action.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-11-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 79 ++++++++++++++++++++++++++++++++++++++++++---------------
+file changed, 59 insertions(+), 20 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/timer.h"
+ #include "qemu/cutils.h"
+ #include "qemu/id.h"
++#include "qemu/transactions.h"
+ #include "block/coroutines.h"
+ #ifdef CONFIG_BSD
+@@ -XXX,XX +XXX,XX @@ static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
+     }
+ }
++static void bdrv_child_set_perm_commit(void *opaque)
++{
++    BdrvChild *c = opaque;
++
++    c->has_backup_perm = false;
++}
++
++static void bdrv_child_set_perm_abort(void *opaque)
++{
++    BdrvChild *c = opaque;
++    /*
++     * We may have child->has_backup_perm unset at this point, as in case of
++     * _check_ stage of permission update failure we may _check_ not the whole
++     * subtree.  Still, _abort_ is called on the whole subtree anyway.
++     */
++    if (c->has_backup_perm) {
++        c->perm = c->backup_perm;
++        c->shared_perm = c->backup_shared_perm;
++        c->has_backup_perm = false;
++    }
++}
++
++static TransactionActionDrv bdrv_child_set_pem_drv = {
++    .abort = bdrv_child_set_perm_abort,
++    .commit = bdrv_child_set_perm_commit,
++};
++
++/*
++ * With tran=NULL needs to be followed by direct call to either
++ * bdrv_child_set_perm_commit() or bdrv_child_set_perm_abort().
++ *
++ * With non-NULL tran needs to be followed by tran_abort() or tran_commit()
++ * instead.
++ */
++static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
++                                     uint64_t shared, Transaction *tran)
++{
++    if (!c->has_backup_perm) {
++        c->has_backup_perm = true;
++        c->backup_perm = c->perm;
++        c->backup_shared_perm = c->shared_perm;
++    }
++    /*
++     * Note: it's OK if c->has_backup_perm was already set, as we can find the
++     * same c twice during check_perm procedure
++     */
++
++    c->perm = perm;
++    c->shared_perm = shared;
++
++    if (tran) {
++        tran_add(tran, &bdrv_child_set_pem_drv, c);
++    }
++}
++
+ /*
+  * Check whether permissions on this node can be changed in a way that
+  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
+@@ -XXX,XX +XXX,XX @@ static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
+         return ret;
+     }
+-    if (!c->has_backup_perm) {
+-        c->has_backup_perm = true;
+-        c->backup_perm = c->perm;
+-        c->backup_shared_perm = c->shared_perm;
+-    }
+-    /*
+-     * Note: it's OK if c->has_backup_perm was already set, as we can find the
+-     * same child twice during check_perm procedure
+-     */
+-
+-    c->perm = perm;
+-    c->shared_perm = shared;
++    bdrv_child_set_perm_safe(c, perm, shared, NULL);
+     return 0;
+ }
+ static void bdrv_child_set_perm(BdrvChild *c)
+ {
+-    c->has_backup_perm = false;
+-
++    bdrv_child_set_perm_commit(c);
+     bdrv_set_perm(c->bs);
+ }
+ static void bdrv_child_abort_perm_update(BdrvChild *c)
+ {
+-    if (c->has_backup_perm) {
+-        c->perm = c->backup_perm;
+-        c->shared_perm = c->backup_shared_perm;
+-        c->has_backup_perm = false;
+-    }
+-
++    bdrv_child_set_perm_abort(c);
+     bdrv_abort_perm_update(c->bs);
+ }
+--
+.30.2

-New patch
+[PULL 11/39] block: rewrite bdrv_child_try_set_perm() using bdrv_refresh_perms()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+We are going to drop recursive bdrv_child_* functions, so stop use them
+in bdrv_child_try_set_perm() as a first step.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-12-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 14 ++++++++------
+file changed, 8 insertions(+), 6 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
+                             Error **errp)
+ {
+     Error *local_err = NULL;
++    Transaction *tran = tran_new();
+     int ret;
+-    ret = bdrv_child_check_perm(c, NULL, perm, shared, NULL, &local_err);
++    bdrv_child_set_perm_safe(c, perm, shared, tran);
++
++    ret = bdrv_refresh_perms(c->bs, &local_err);
++
++    tran_finalize(tran, ret);
++
+     if (ret < 0) {
+-        bdrv_child_abort_perm_update(c);
+         if ((perm & ~c->perm) || (c->shared_perm & ~shared)) {
+             /* tighten permissions */
+             error_propagate(errp, local_err);
+@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
+             error_free(local_err);
+             ret = 0;
+         }
+-        return ret;
+     }
+-    bdrv_child_set_perm(c);
+-
+-    return 0;
++    return ret;
+ }
+ int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
+--
+.30.2

-[PULL 16/17] block/vpc: Pass footer buffers as VHDFooter * instead of uint8_t *
+[PULL 12/39] block: inline bdrv_child_*() permission functions calls
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
+Each of them has only one caller. Open-coding simplifies further
-Message-Id: <20201217162003.1102738-9-armbru@redhat.com>
+pemission-update system changes.
-Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Alberto Garcia <berto@igalia.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-13-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 14 +++++++-------
+ block.c | 59 +++++++++++++++++----------------------------------------
-file changed, 7 insertions(+), 7 deletions(-)
+file changed, 17 insertions(+), 42 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/block.c
-+++ b/block/vpc.c
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
+@@ -XXX,XX +XXX,XX @@ static int bdrv_fill_options(QDict **options, const char *filename,
      return 0;
  }
--static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+-static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
-+static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
+-                                 uint64_t perm, uint64_t shared,
-                                int64_t total_sectors)
+-                                 GSList *ignore_children, Error **errp);
- {
+-static void bdrv_child_abort_perm_update(BdrvChild *c);
-     VHDDynDiskHeader dyndisk_header;
+-static void bdrv_child_set_perm(BdrvChild *c);
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
++static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
-     block_size = 0x200000;
++                                  uint64_t new_used_perm,
-     num_bat_entries = DIV_ROUND_UP(total_sectors, block_size / 512);
++                                  uint64_t new_shared_perm,
++                                  GSList *ignore_children,
--    ret = blk_pwrite(blk, offset, buf, HEADER_SIZE, 0);
++                                  Error **errp);
-+    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
-     if (ret < 0) {
+ typedef struct BlockReopenQueueEntry {
-         goto fail;
+      bool prepared;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
      /* Check all children */
      QLIST_FOREACH(c, &bs->children, next) {
          uint64_t cur_perm, cur_shared;
 +        GSList *cur_ignore_children;
          bdrv_child_perm(bs, c->bs, c, c->role, q,
                          cumulative_perms, cumulative_shared_perms,
                          &cur_perm, &cur_shared);
 -        ret = bdrv_child_check_perm(c, q, cur_perm, cur_shared, ignore_children,
 -                                    errp);
 +
 +        cur_ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
 +        ret = bdrv_check_update_perm(c->bs, q, cur_perm, cur_shared,
 +                                     cur_ignore_children, errp);
 +        g_slist_free(cur_ignore_children);
          if (ret < 0) {
              return ret;
          }
 +
 +        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
      }
-     offset = 1536 + ((num_bat_entries * 4 + 511) & ~511);
+     return 0;
--    ret = blk_pwrite(blk, offset, buf, HEADER_SIZE, 0);
+@@ -XXX,XX +XXX,XX @@ static void bdrv_abort_perm_update(BlockDriverState *bs)
 +    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
      if (ret < 0) {
          goto fail;
      }
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
-     return ret;
+     QLIST_FOREACH(c, &bs->children, next) {
 -        bdrv_child_abort_perm_update(c);
 +        bdrv_child_set_perm_abort(c);
 +        bdrv_abort_perm_update(c->bs);
      }
  }
--static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ static void bdrv_set_perm(BlockDriverState *bs)
-+static int create_fixed_disk(BlockBackend *blk, VHDFooter *footer,
-                              int64_t total_size, Error **errp)
+     /* Update all children */
      QLIST_FOREACH(c, &bs->children, next) {
 -        bdrv_child_set_perm(c);
 +        bdrv_child_set_perm_commit(c);
 +        bdrv_set_perm(c->bs);
      }
  }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
                             ignore_children, errp);
  }
 -/* Needs to be followed by a call to either bdrv_child_set_perm() or
 - * bdrv_child_abort_perm_update(). */
 -static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
 -                                 uint64_t perm, uint64_t shared,
 -                                 GSList *ignore_children, Error **errp)
 -{
 -    int ret;
 -
 -    ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
 -    ret = bdrv_check_update_perm(c->bs, q, perm, shared, ignore_children, errp);
 -    g_slist_free(ignore_children);
 -
 -    if (ret < 0) {
 -        return ret;
 -    }
 -
 -    bdrv_child_set_perm_safe(c, perm, shared, NULL);
 -
 -    return 0;
 -}
 -
 -static void bdrv_child_set_perm(BdrvChild *c)
 -{
 -    bdrv_child_set_perm_commit(c);
 -    bdrv_set_perm(c->bs);
 -}
 -
 -static void bdrv_child_abort_perm_update(BdrvChild *c)
 -{
 -    bdrv_child_set_perm_abort(c);
 -    bdrv_abort_perm_update(c->bs);
 -}
 -
  static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
  {
      int ret;
-@@ -XXX,XX +XXX,XX @@ static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
-         return ret;
-     }
--    ret = blk_pwrite(blk, total_size - HEADER_SIZE, buf, HEADER_SIZE, 0);
-+    ret = blk_pwrite(blk, total_size - HEADER_SIZE, footer, HEADER_SIZE, 0);
-     if (ret < 0) {
-         error_setg_errno(errp, -ret, "Unable to write VHD header");
-         return ret;
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
-     footer.checksum = cpu_to_be32(vpc_checksum(&footer, HEADER_SIZE));
-     if (disk_type == VHD_DYNAMIC) {
--        ret = create_dynamic_disk(blk, (uint8_t *)&footer, total_sectors);
-+        ret = create_dynamic_disk(blk, &footer, total_sectors);
-         if (ret < 0) {
-             error_setg(errp, "Unable to create or write VHD header");
-         }
-     } else {
--        ret = create_fixed_disk(blk, (uint8_t *)&footer, total_size, errp);
-+        ret = create_fixed_disk(blk, &footer, total_size, errp);
-     }
- out:
 --
-.29.2
+.30.2

-New patch
+[PULL 13/39] block: use topological sort for permission update
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Rewrite bdrv_check_perm(), bdrv_abort_perm_update() and bdrv_set_perm()
 to update nodes in topological sort order instead of simple DFS. With
 topologically sorted nodes, we update a node only when all its parents
 already updated. With DFS it's not so.
 Consider the following example:
     A -+
     |  |
     |  v
     |  B
     |  |
     v  |
     C<-+
 A is parent for B and C, B is parent for C.
 Obviously, to update permissions, we should go in order A B C, so, when
 we update C, all parent permissions already updated. But with current
 approach (simple recursion) we can update in sequence A C B C (C is
 updated twice). On first update of C, we consider old B permissions, so
 doing wrong thing. If it succeed, all is OK, on second C update we will
 finish with correct graph. But if the wrong thing failed, we break the
 whole process for no reason (it's possible that updated B permission
 will be less strict, but we will never check it).
 Also new approach gives a way to simultaneously and correctly update
 several nodes, we just need to run bdrv_topological_dfs() several times
 to add all nodes and their subtrees into one topologically sorted list
 (next patch will update bdrv_replace_node() in this manner).
 Test test_parallel_perm_update() is now passing, so move it out of
 debugging "if".
 We also need to support ignore_children in
 bdrv_parent_perms_conflict()
 For test 283 order of conflicting parents check is changed.
 Note also that in bdrv_check_perm() we don't check for parents conflict
 at root bs, as we may be in the middle of permission update in
 bdrv_reopen_multiple(). bdrv_reopen_multiple() will be updated soon.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-14-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  block.c                          | 116 +++++++++++++++++++++++++------
  tests/unit/test-bdrv-graph-mod.c |   4 +-
  tests/qemu-iotests/283.out       |   2 +-
 files changed, 99 insertions(+), 23 deletions(-)
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
      return false;
  }
 -static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
 +static bool bdrv_parent_perms_conflict(BlockDriverState *bs,
 +                                       GSList *ignore_children,
 +                                       Error **errp)
  {
      BdrvChild *a, *b;
@@ -XXX,XX +XXX,XX @@ static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
       * directions.
       */
      QLIST_FOREACH(a, &bs->parents, next_parent) {
 +        if (g_slist_find(ignore_children, a)) {
 +            continue;
 +        }
 +
          QLIST_FOREACH(b, &bs->parents, next_parent) {
 -            if (a == b) {
 +            if (a == b || g_slist_find(ignore_children, b)) {
                  continue;
              }
@@ -XXX,XX +XXX,XX @@ static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
      }
  }
 +/*
 + * Adds the whole subtree of @bs (including @bs itself) to the @list (except for
 + * nodes that are already in the @list, of course) so that final list is
 + * topologically sorted. Return the result (GSList @list object is updated, so
 + * don't use old reference after function call).
 + *
 + * On function start @list must be already topologically sorted and for any node
 + * in the @list the whole subtree of the node must be in the @list as well. The
 + * simplest way to satisfy this criteria: use only result of
 + * bdrv_topological_dfs() or NULL as @list parameter.
 + */
 +static GSList *bdrv_topological_dfs(GSList *list, GHashTable *found,
 +                                    BlockDriverState *bs)
 +{
 +    BdrvChild *child;
 +    g_autoptr(GHashTable) local_found = NULL;
 +
 +    if (!found) {
 +        assert(!list);
 +        found = local_found = g_hash_table_new(NULL, NULL);
 +    }
 +
 +    if (g_hash_table_contains(found, bs)) {
 +        return list;
 +    }
 +    g_hash_table_add(found, bs);
 +
 +    QLIST_FOREACH(child, &bs->children, next) {
 +        list = bdrv_topological_dfs(list, found, child->bs);
 +    }
 +
 +    return g_slist_prepend(list, bs);
 +}
 +
  static void bdrv_child_set_perm_commit(void *opaque)
  {
      BdrvChild *c = opaque;
@@ -XXX,XX +XXX,XX @@ static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
   * A call to this function must always be followed by a call to bdrv_set_perm()
   * or bdrv_abort_perm_update().
   */
 -static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
 -                           uint64_t cumulative_perms,
 -                           uint64_t cumulative_shared_perms,
 -                           GSList *ignore_children, Error **errp)
 +static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
 +                                uint64_t cumulative_perms,
 +                                uint64_t cumulative_shared_perms,
 +                                GSList *ignore_children, Error **errp)
  {
      BlockDriver *drv = bs->drv;
      BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
      /* Check all children */
      QLIST_FOREACH(c, &bs->children, next) {
          uint64_t cur_perm, cur_shared;
 -        GSList *cur_ignore_children;
          bdrv_child_perm(bs, c->bs, c, c->role, q,
                          cumulative_perms, cumulative_shared_perms,
                          &cur_perm, &cur_shared);
 +        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
 +    }
 +
 +    return 0;
 +}
 +
 +static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
 +                           uint64_t cumulative_perms,
 +                           uint64_t cumulative_shared_perms,
 +                           GSList *ignore_children, Error **errp)
 +{
 +    int ret;
 +    BlockDriverState *root = bs;
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, root);
 -        cur_ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
 -        ret = bdrv_check_update_perm(c->bs, q, cur_perm, cur_shared,
 -                                     cur_ignore_children, errp);
 -        g_slist_free(cur_ignore_children);
 +    for ( ; list; list = list->next) {
 +        bs = list->data;
 +
 +        if (bs != root) {
 +            if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
 +                return -EINVAL;
 +            }
 +
 +            bdrv_get_cumulative_perm(bs, &cumulative_perms,
 +                                     &cumulative_shared_perms);
 +        }
 +
 +        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
 +                                   cumulative_shared_perms,
 +                                   ignore_children, errp);
          if (ret < 0) {
              return ret;
          }
 -
 -        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
      }
      return 0;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
   * Notifies drivers that after a previous bdrv_check_perm() call, the
   * permission update is not performed and any preparations made for it (e.g.
   * taken file locks) need to be undone.
 - *
 - * This function recursively notifies all child nodes.
   */
 -static void bdrv_abort_perm_update(BlockDriverState *bs)
 +static void bdrv_node_abort_perm_update(BlockDriverState *bs)
  {
      BlockDriver *drv = bs->drv;
      BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static void bdrv_abort_perm_update(BlockDriverState *bs)
      QLIST_FOREACH(c, &bs->children, next) {
          bdrv_child_set_perm_abort(c);
 -        bdrv_abort_perm_update(c->bs);
      }
  }
 -static void bdrv_set_perm(BlockDriverState *bs)
 +static void bdrv_abort_perm_update(BlockDriverState *bs)
 +{
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 +
 +    for ( ; list; list = list->next) {
 +        bdrv_node_abort_perm_update((BlockDriverState *)list->data);
 +    }
 +}
 +
 +static void bdrv_node_set_perm(BlockDriverState *bs)
  {
      uint64_t cumulative_perms, cumulative_shared_perms;
      BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ static void bdrv_set_perm(BlockDriverState *bs)
      /* Update all children */
      QLIST_FOREACH(c, &bs->children, next) {
          bdrv_child_set_perm_commit(c);
 -        bdrv_set_perm(c->bs);
 +    }
 +}
 +
 +static void bdrv_set_perm(BlockDriverState *bs)
 +{
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 +
 +    for ( ; list; list = list->next) {
 +        bdrv_node_set_perm((BlockDriverState *)list->data);
      }
  }
@@ -XXX,XX +XXX,XX @@ static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
      int ret;
      uint64_t perm, shared_perm;
 -    if (bdrv_parent_perms_conflict(bs, errp)) {
 +    if (bdrv_parent_perms_conflict(bs, NULL, errp)) {
          return -EPERM;
      }
      bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
 diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/unit/test-bdrv-graph-mod.c
 +++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
      g_test_add_func("/bdrv-graph-mod/update-perm-tree", test_update_perm_tree);
      g_test_add_func("/bdrv-graph-mod/should-update-child",
                      test_should_update_child);
 +    g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
 +                    test_parallel_perm_update);
      if (debug) {
          g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
                          test_parallel_exclusive_write);
 -        g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
 -                        test_parallel_perm_update);
          g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
                          test_append_greedy_filter);
      }
 diff --git a/tests/qemu-iotests/283.out b/tests/qemu-iotests/283.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/283.out
 +++ b/tests/qemu-iotests/283.out
@@ -XXX,XX +XXX,XX @@
  {"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": "base", "node-name": "other", "take-child-perms": ["write"]}}
  {"return": {}}
  {"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
 -{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by other as 'image', which uses 'write' on base"}}
 +{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by source as 'image', which does not allow 'write' on base"}}
  === backup-top should be gone after job-finalize ===
 --
 .30.2

-New patch
+[PULL 14/39] block: add bdrv_drv_set_perm transaction action
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Refactor calling driver callbacks to a separate transaction action to
+be used later.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-15-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 70 ++++++++++++++++++++++++++++++++++++++++++++-------------
+file changed, 54 insertions(+), 16 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
+     }
+ }
++static void bdrv_drv_set_perm_commit(void *opaque)
++{
++    BlockDriverState *bs = opaque;
++    uint64_t cumulative_perms, cumulative_shared_perms;
++
++    if (bs->drv->bdrv_set_perm) {
++        bdrv_get_cumulative_perm(bs, &cumulative_perms,
++                                 &cumulative_shared_perms);
++        bs->drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
++    }
++}
++
++static void bdrv_drv_set_perm_abort(void *opaque)
++{
++    BlockDriverState *bs = opaque;
++
++    if (bs->drv->bdrv_abort_perm_update) {
++        bs->drv->bdrv_abort_perm_update(bs);
++    }
++}
++
++TransactionActionDrv bdrv_drv_set_perm_drv = {
++    .abort = bdrv_drv_set_perm_abort,
++    .commit = bdrv_drv_set_perm_commit,
++};
++
++static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
++                             uint64_t shared_perm, Transaction *tran,
++                             Error **errp)
++{
++    if (!bs->drv) {
++        return 0;
++    }
++
++    if (bs->drv->bdrv_check_perm) {
++        int ret = bs->drv->bdrv_check_perm(bs, perm, shared_perm, errp);
++        if (ret < 0) {
++            return ret;
++        }
++    }
++
++    if (tran) {
++        tran_add(tran, &bdrv_drv_set_perm_drv, bs);
++    }
++
++    return 0;
++}
++
+ /*
+  * Check whether permissions on this node can be changed in a way that
+  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
+@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
+         return 0;
+     }
+-    if (drv->bdrv_check_perm) {
+-        ret = drv->bdrv_check_perm(bs, cumulative_perms,
+-                                   cumulative_shared_perms, errp);
+-        if (ret < 0) {
+-            return ret;
+-        }
++    ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, NULL,
++                            errp);
++    if (ret < 0) {
++        return ret;
+     }
+     /* Drivers that never have children can omit .bdrv_child_perm() */
+@@ -XXX,XX +XXX,XX @@ static void bdrv_node_abort_perm_update(BlockDriverState *bs)
+         return;
+     }
+-    if (drv->bdrv_abort_perm_update) {
+-        drv->bdrv_abort_perm_update(bs);
+-    }
++    bdrv_drv_set_perm_abort(bs);
+     QLIST_FOREACH(c, &bs->children, next) {
+         bdrv_child_set_perm_abort(c);
+@@ -XXX,XX +XXX,XX @@ static void bdrv_abort_perm_update(BlockDriverState *bs)
+ static void bdrv_node_set_perm(BlockDriverState *bs)
+ {
+-    uint64_t cumulative_perms, cumulative_shared_perms;
+     BlockDriver *drv = bs->drv;
+     BdrvChild *c;
+@@ -XXX,XX +XXX,XX @@ static void bdrv_node_set_perm(BlockDriverState *bs)
+         return;
+     }
+-    bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
+-
+-    /* Update this node */
+-    if (drv->bdrv_set_perm) {
+-        drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
+-    }
++    bdrv_drv_set_perm_commit(bs);
+     /* Drivers that never have children can omit .bdrv_child_perm() */
+     if (!drv->bdrv_child_perm) {
+--
+.30.2

-New patch
+[PULL 15/39] block: add bdrv_list_* permission update functions
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Add new interface, allowing use of existing node list. It will be used
 to fix bdrv_replace_node() in the further commit.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-16-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  block.c | 106 +++++++++++++++++++++++++++++++++++++-------------------
 file changed, 71 insertions(+), 35 deletions(-)
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
  static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                  uint64_t cumulative_perms,
                                  uint64_t cumulative_shared_perms,
 -                                GSList *ignore_children, Error **errp)
 +                                GSList *ignore_children,
 +                                Transaction *tran, Error **errp)
  {
      BlockDriver *drv = bs->drv;
      BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
          return 0;
      }
 -    ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, NULL,
 +    ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, tran,
                              errp);
      if (ret < 0) {
          return ret;
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
          bdrv_child_perm(bs, c->bs, c, c->role, q,
                          cumulative_perms, cumulative_shared_perms,
                          &cur_perm, &cur_shared);
 -        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
 +        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, tran);
      }
      return 0;
  }
 -static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
 -                           uint64_t cumulative_perms,
 -                           uint64_t cumulative_shared_perms,
 -                           GSList *ignore_children, Error **errp)
 +/*
 + * If use_cumulative_perms is true, use cumulative_perms and
 + * cumulative_shared_perms for first element of the list. Otherwise just refresh
 + * all permissions.
 + */
 +static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
 +                                  bool use_cumulative_perms,
 +                                  uint64_t cumulative_perms,
 +                                  uint64_t cumulative_shared_perms,
 +                                  GSList *ignore_children,
 +                                  Transaction *tran, Error **errp)
  {
      int ret;
 -    BlockDriverState *root = bs;
 -    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, root);
 +    BlockDriverState *bs;
 -    for ( ; list; list = list->next) {
 +    if (use_cumulative_perms) {
          bs = list->data;
 -        if (bs != root) {
 -            if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
 -                return -EINVAL;
 -            }
 +        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
 +                                   cumulative_shared_perms,
 +                                   ignore_children, tran, errp);
 +        if (ret < 0) {
 +            return ret;
 +        }
 -            bdrv_get_cumulative_perm(bs, &cumulative_perms,
 -                                     &cumulative_shared_perms);
 +        list = list->next;
 +    }
 +
 +    for ( ; list; list = list->next) {
 +        bs = list->data;
 +
 +        if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
 +            return -EINVAL;
          }
 +        bdrv_get_cumulative_perm(bs, &cumulative_perms,
 +                                 &cumulative_shared_perms);
 +
          ret = bdrv_node_check_perm(bs, q, cumulative_perms,
                                     cumulative_shared_perms,
 -                                   ignore_children, errp);
 +                                   ignore_children, tran, errp);
          if (ret < 0) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
      return 0;
  }
 +static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
 +                           uint64_t cumulative_perms,
 +                           uint64_t cumulative_shared_perms,
 +                           GSList *ignore_children, Error **errp)
 +{
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 +    return bdrv_check_perm_common(list, q, true, cumulative_perms,
 +                                  cumulative_shared_perms, ignore_children,
 +                                  NULL, errp);
 +}
 +
 +static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
 +                                   Transaction *tran, Error **errp)
 +{
 +    return bdrv_check_perm_common(list, q, false, 0, 0, NULL, tran, errp);
 +}
 +
  /*
   * Notifies drivers that after a previous bdrv_check_perm() call, the
   * permission update is not performed and any preparations made for it (e.g.
@@ -XXX,XX +XXX,XX @@ static void bdrv_node_abort_perm_update(BlockDriverState *bs)
      }
  }
 -static void bdrv_abort_perm_update(BlockDriverState *bs)
 +static void bdrv_list_abort_perm_update(GSList *list)
  {
 -    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 -
      for ( ; list; list = list->next) {
          bdrv_node_abort_perm_update((BlockDriverState *)list->data);
      }
  }
 +static void bdrv_abort_perm_update(BlockDriverState *bs)
 +{
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 +    return bdrv_list_abort_perm_update(list);
 +}
 +
  static void bdrv_node_set_perm(BlockDriverState *bs)
  {
      BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ static void bdrv_node_set_perm(BlockDriverState *bs)
      }
  }
 -static void bdrv_set_perm(BlockDriverState *bs)
 +static void bdrv_list_set_perm(GSList *list)
  {
 -    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 -
      for ( ; list; list = list->next) {
          bdrv_node_set_perm((BlockDriverState *)list->data);
      }
  }
 +static void bdrv_set_perm(BlockDriverState *bs)
 +{
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 +    return bdrv_list_set_perm(list);
 +}
 +
  void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
                                uint64_t *shared_perm)
  {
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
  static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
  {
      int ret;
 -    uint64_t perm, shared_perm;
 +    Transaction *tran = tran_new();
 +    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 -    if (bdrv_parent_perms_conflict(bs, NULL, errp)) {
 -        return -EPERM;
 -    }
 -    bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
 -    ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, errp);
 -    if (ret < 0) {
 -        bdrv_abort_perm_update(bs);
 -        return ret;
 -    }
 -    bdrv_set_perm(bs);
 +    ret = bdrv_list_refresh_perms(list, NULL, tran, errp);
 +    tran_finalize(tran, ret);
 -    return 0;
 +    return ret;
  }
  int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
 --
 .30.2

-New patch
+[PULL 16/39] block: add bdrv_replace_child_safe() transaction action
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+To be used in the following commit.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-17-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
+file changed, 54 insertions(+)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
+                                            BdrvChildRole child_role,
+                                            Error **errp);
++static void bdrv_replace_child_noperm(BdrvChild *child,
++                                      BlockDriverState *new_bs);
++
+ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
+                                *queue, Error **errp);
+ static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
+@@ -XXX,XX +XXX,XX @@ static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
+     return 0;
+ }
++typedef struct BdrvReplaceChildState {
++    BdrvChild *child;
++    BlockDriverState *old_bs;
++} BdrvReplaceChildState;
++
++static void bdrv_replace_child_commit(void *opaque)
++{
++    BdrvReplaceChildState *s = opaque;
++
++    bdrv_unref(s->old_bs);
++}
++
++static void bdrv_replace_child_abort(void *opaque)
++{
++    BdrvReplaceChildState *s = opaque;
++    BlockDriverState *new_bs = s->child->bs;
++
++    /* old_bs reference is transparently moved from @s to @s->child */
++    bdrv_replace_child_noperm(s->child, s->old_bs);
++    bdrv_unref(new_bs);
++}
++
++static TransactionActionDrv bdrv_replace_child_drv = {
++    .commit = bdrv_replace_child_commit,
++    .abort = bdrv_replace_child_abort,
++    .clean = g_free,
++};
++
++/*
++ * bdrv_replace_child_safe
++ *
++ * Note: real unref of old_bs is done only on commit.
++ */
++__attribute__((unused))
++static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
++                                    Transaction *tran)
++{
++    BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
++    *s = (BdrvReplaceChildState) {
++        .child = child,
++        .old_bs = child->bs,
++    };
++    tran_add(tran, &bdrv_replace_child_drv, s);
++
++    if (new_bs) {
++        bdrv_ref(new_bs);
++    }
++    bdrv_replace_child_noperm(child, new_bs);
++    /* old_bs reference is transparently moved from @child to @s */
++}
++
+ /*
+  * Check whether permissions on this node can be changed in a way that
+  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
+--
+.30.2

-[PULL 14/17] block/vpc: Use sizeof() instead of 1024 for dynamic header size
+[PULL 17/39] block: fix bdrv_replace_node_common
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
+inore_children thing doesn't help to track all propagated permissions
-Message-Id: <20201217162003.1102738-7-armbru@redhat.com>
+of children we want to ignore. The simplest way to correctly update
-Reviewed-by: Max Reitz <mreitz@redhat.com>
+permissions is update graph first and then do permission update. In
 this case we just referesh permissions for the whole subgraph (in
 topological-sort defined order) and everything is correctly calculated
 automatically without any ignore_children.
 So, refactor bdrv_replace_node_common to first do graph update and then
 refresh the permissions.
 Test test_parallel_exclusive_write() now pass, so move it out of
 debugging "if".
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-18-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 9 +++++----
+ block.c                          | 43 +++++++++++++-------------------
-file changed, 5 insertions(+), 4 deletions(-)
+ tests/unit/test-bdrv-graph-mod.c |  4 +--
 files changed, 20 insertions(+), 27 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/block.c
-+++ b/block/vpc.c
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
+@@ -XXX,XX +XXX,XX @@ static TransactionActionDrv bdrv_replace_child_drv = {
+  *
-     if (disk_type == VHD_DYNAMIC) {
+  * Note: real unref of old_bs is done only on commit.
-         ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
+  */
--                         &dyndisk_header, 1024);
+-__attribute__((unused))
-+                         &dyndisk_header, sizeof(dyndisk_header));
+ static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
-         if (ret < 0) {
+                                     Transaction *tran)
-             error_setg(errp, "Error reading dynamic VHD header");
+ {
-             goto fail;
+@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+                                     bool auto_skip, Error **errp)
  {
      BdrvChild *c, *next;
 -    GSList *list = NULL, *p;
 -    uint64_t perm = 0, shared = BLK_PERM_ALL;
 +    Transaction *tran = tran_new();
 +    g_autoptr(GHashTable) found = NULL;
 +    g_autoptr(GSList) refresh_list = NULL;
      int ret;
      /* Make sure that @from doesn't go away until we have successfully attached
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
      assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
      bdrv_drained_begin(from);
 -    /* Put all parents into @list and calculate their cumulative permissions */
 +    /*
 +     * Do the replacement without permission update.
 +     * Replacement may influence the permissions, we should calculate new
 +     * permissions based on new graph. If we fail, we'll roll-back the
 +     * replacement.
 +     */
      QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
          assert(c->bs == from);
          if (!should_update_child(c, to)) {
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
                         c->name, from->node_name);
              goto out;
          }
 -        list = g_slist_prepend(list, c);
 -        perm |= c->perm;
 -        shared &= c->shared_perm;
 +        bdrv_replace_child_safe(c, to, tran);
      }
-     /* Prepare the Dynamic Disk Header */
+-    /* Check whether the required permissions can be granted on @to, ignoring
--    memset(&dyndisk_header, 0, 1024);
+-     * all BdrvChild in @list so that they can't block themselves. */
-+    memset(&dyndisk_header, 0, sizeof(dyndisk_header));
+-    ret = bdrv_check_update_perm(to, NULL, perm, shared, list, errp);
+-    if (ret < 0) {
-     memcpy(dyndisk_header.magic, "cxsparse", 8);
+-        bdrv_abort_perm_update(to);
+-        goto out;
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+-    }
-     dyndisk_header.block_size = cpu_to_be32(block_size);
++    found = g_hash_table_new(NULL, NULL);
-     dyndisk_header.max_table_entries = cpu_to_be32(num_bat_entries);
+-    /* Now actually perform the change. We performed the permission check for
--    dyndisk_header.checksum = cpu_to_be32(vpc_checksum(&dyndisk_header, 1024));
+-     * all elements of @list at once, so set the permissions all at once at the
-+    dyndisk_header.checksum = cpu_to_be32(
+-     * very end. */
-+        vpc_checksum(&dyndisk_header, sizeof(dyndisk_header)));
+-    for (p = list; p != NULL; p = p->next) {
+-        c = p->data;
-     /* Write the header */
++    refresh_list = bdrv_topological_dfs(refresh_list, found, to);
-     offset = 512;
++    refresh_list = bdrv_topological_dfs(refresh_list, found, from);
--    ret = blk_pwrite(blk, offset, &dyndisk_header, 1024, 0);
+-        bdrv_ref(to);
-+    ret = blk_pwrite(blk, offset, &dyndisk_header, sizeof(dyndisk_header), 0);
+-        bdrv_replace_child_noperm(c, to);
-     if (ret < 0) {
+-        bdrv_unref(from);
-         goto fail;
++    ret = bdrv_list_refresh_perms(refresh_list, NULL, tran, errp);
 +    if (ret < 0) {
 +        goto out;
      }
 -    bdrv_set_perm(to);
 -
      ret = 0;
  out:
 -    g_slist_free(list);
 +    tran_finalize(tran, ret);
 +
      bdrv_drained_end(from);
      bdrv_unref(from);
 diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/unit/test-bdrv-graph-mod.c
 +++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
                      test_should_update_child);
      g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
                      test_parallel_perm_update);
 +    g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
 +                    test_parallel_exclusive_write);
      if (debug) {
 -        g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
 -                        test_parallel_exclusive_write);
          g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
                          test_append_greedy_filter);
      }
 --
-.29.2
+.30.2

-New patch
+[PULL 18/39] block: add bdrv_attach_child_common() transaction action
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Split out no-perm part of bdrv_root_attach_child() into separate
 transaction action. bdrv_root_attach_child() now moves to new
 permission update paradigm: first update graph relations then update
 permissions.
 qsd-jobs test output updated. Seems now permission update goes in
 another order. Still, the test comment say that we only want to check
 that command doesn't crash, and it's still so.
 Error message is a bit misleading as it looks like job was added first.
 But actually in new paradigm of graph update we can't distinguish such
 things. We should update the error message, but let's not do it now.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Message-Id: <20210428151804.439460-19-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
  block.c                               | 190 ++++++++++++++++++--------
  tests/qemu-iotests/tests/qsd-jobs.out |   2 +-
 files changed, 137 insertions(+), 55 deletions(-)
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
      }
  }
 -/*
 - * This function steals the reference to child_bs from the caller.
 - * That reference is later dropped by bdrv_root_unref_child().
 - *
 - * On failure NULL is returned, errp is set and the reference to
 - * child_bs is also dropped.
 - *
 - * The caller must hold the AioContext lock @child_bs, but not that of @ctx
 - * (unless @child_bs is already in @ctx).
 - */
 -BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 -                                  const char *child_name,
 -                                  const BdrvChildClass *child_class,
 -                                  BdrvChildRole child_role,
 -                                  uint64_t perm, uint64_t shared_perm,
 -                                  void *opaque, Error **errp)
 +static void bdrv_remove_empty_child(BdrvChild *child)
  {
 -    BdrvChild *child;
 -    Error *local_err = NULL;
 -    int ret;
 -    AioContext *ctx;
 +    assert(!child->bs);
 +    QLIST_SAFE_REMOVE(child, next);
 +    g_free(child->name);
 +    g_free(child);
 +}
 -    ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, errp);
 -    if (ret < 0) {
 -        bdrv_abort_perm_update(child_bs);
 -        bdrv_unref(child_bs);
 -        return NULL;
 +typedef struct BdrvAttachChildCommonState {
 +    BdrvChild **child;
 +    AioContext *old_parent_ctx;
 +    AioContext *old_child_ctx;
 +} BdrvAttachChildCommonState;
 +
 +static void bdrv_attach_child_common_abort(void *opaque)
 +{
 +    BdrvAttachChildCommonState *s = opaque;
 +    BdrvChild *child = *s->child;
 +    BlockDriverState *bs = child->bs;
 +
 +    bdrv_replace_child_noperm(child, NULL);
 +
 +    if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
 +        bdrv_try_set_aio_context(bs, s->old_child_ctx, &error_abort);
      }
 -    child = g_new(BdrvChild, 1);
 -    *child = (BdrvChild) {
 +    if (bdrv_child_get_parent_aio_context(child) != s->old_parent_ctx) {
 +        GSList *ignore = g_slist_prepend(NULL, child);
 +
 +        child->klass->can_set_aio_ctx(child, s->old_parent_ctx, &ignore,
 +                                      &error_abort);
 +        g_slist_free(ignore);
 +        ignore = g_slist_prepend(NULL, child);
 +        child->klass->set_aio_ctx(child, s->old_parent_ctx, &ignore);
 +
 +        g_slist_free(ignore);
 +    }
 +
 +    bdrv_unref(bs);
 +    bdrv_remove_empty_child(child);
 +    *s->child = NULL;
 +}
 +
 +static TransactionActionDrv bdrv_attach_child_common_drv = {
 +    .abort = bdrv_attach_child_common_abort,
 +    .clean = g_free,
 +};
 +
 +/*
 + * Common part of attaching bdrv child to bs or to blk or to job
 + */
 +static int bdrv_attach_child_common(BlockDriverState *child_bs,
 +                                    const char *child_name,
 +                                    const BdrvChildClass *child_class,
 +                                    BdrvChildRole child_role,
 +                                    uint64_t perm, uint64_t shared_perm,
 +                                    void *opaque, BdrvChild **child,
 +                                    Transaction *tran, Error **errp)
 +{
 +    BdrvChild *new_child;
 +    AioContext *parent_ctx;
 +    AioContext *child_ctx = bdrv_get_aio_context(child_bs);
 +
 +    assert(child);
 +    assert(*child == NULL);
 +
 +    new_child = g_new(BdrvChild, 1);
 +    *new_child = (BdrvChild) {
          .bs             = NULL,
          .name           = g_strdup(child_name),
          .klass          = child_class,
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
          .opaque         = opaque,
      };
 -    ctx = bdrv_child_get_parent_aio_context(child);
 -
 -    /* If the AioContexts don't match, first try to move the subtree of
 +    /*
 +     * If the AioContexts don't match, first try to move the subtree of
       * child_bs into the AioContext of the new parent. If this doesn't work,
 -     * try moving the parent into the AioContext of child_bs instead. */
 -    if (bdrv_get_aio_context(child_bs) != ctx) {
 -        ret = bdrv_try_set_aio_context(child_bs, ctx, &local_err);
 +     * try moving the parent into the AioContext of child_bs instead.
 +     */
 +    parent_ctx = bdrv_child_get_parent_aio_context(new_child);
 +    if (child_ctx != parent_ctx) {
 +        Error *local_err = NULL;
 +        int ret = bdrv_try_set_aio_context(child_bs, parent_ctx, &local_err);
 +
          if (ret < 0 && child_class->can_set_aio_ctx) {
 -            GSList *ignore = g_slist_prepend(NULL, child);
 -            ctx = bdrv_get_aio_context(child_bs);
 -            if (child_class->can_set_aio_ctx(child, ctx, &ignore, NULL)) {
 +            GSList *ignore = g_slist_prepend(NULL, new_child);
 +            if (child_class->can_set_aio_ctx(new_child, child_ctx, &ignore,
 +                                             NULL))
 +            {
                  error_free(local_err);
                  ret = 0;
                  g_slist_free(ignore);
 -                ignore = g_slist_prepend(NULL, child);
 -                child_class->set_aio_ctx(child, ctx, &ignore);
 +                ignore = g_slist_prepend(NULL, new_child);
 +                child_class->set_aio_ctx(new_child, child_ctx, &ignore);
              }
              g_slist_free(ignore);
          }
 +
          if (ret < 0) {
              error_propagate(errp, local_err);
 -            g_free(child);
 -            bdrv_abort_perm_update(child_bs);
 -            bdrv_unref(child_bs);
 -            return NULL;
 +            bdrv_remove_empty_child(new_child);
 +            return ret;
          }
      }
 -    /* This performs the matching bdrv_set_perm() for the above check. */
 -    bdrv_replace_child(child, child_bs);
 +    bdrv_ref(child_bs);
 +    bdrv_replace_child_noperm(new_child, child_bs);
 +    *child = new_child;
 +
 +    BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
 +    *s = (BdrvAttachChildCommonState) {
 +        .child = child,
 +        .old_parent_ctx = parent_ctx,
 +        .old_child_ctx = child_ctx,
 +    };
 +    tran_add(tran, &bdrv_attach_child_common_drv, s);
 +
 +    return 0;
 +}
 +
 +static void bdrv_detach_child(BdrvChild *child)
 +{
 +    bdrv_replace_child(child, NULL);
 +    bdrv_remove_empty_child(child);
 +}
 +
 +/*
 + * This function steals the reference to child_bs from the caller.
 + * That reference is later dropped by bdrv_root_unref_child().
 + *
 + * On failure NULL is returned, errp is set and the reference to
 + * child_bs is also dropped.
 + *
 + * The caller must hold the AioContext lock @child_bs, but not that of @ctx
 + * (unless @child_bs is already in @ctx).
 + */
 +BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
 +                                  const char *child_name,
 +                                  const BdrvChildClass *child_class,
 +                                  BdrvChildRole child_role,
 +                                  uint64_t perm, uint64_t shared_perm,
 +                                  void *opaque, Error **errp)
 +{
 +    int ret;
 +    BdrvChild *child = NULL;
 +    Transaction *tran = tran_new();
 +
 +    ret = bdrv_attach_child_common(child_bs, child_name, child_class,
 +                                   child_role, perm, shared_perm, opaque,
 +                                   &child, tran, errp);
 +    if (ret < 0) {
 +        bdrv_unref(child_bs);
 +        return NULL;
 +    }
 +
 +    ret = bdrv_refresh_perms(child_bs, errp);
 +    tran_finalize(tran, ret);
 +
 +    bdrv_unref(child_bs);
      return child;
  }
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
      return child;
  }
 -static void bdrv_detach_child(BdrvChild *child)
 -{
 -    QLIST_SAFE_REMOVE(child, next);
 -
 -    bdrv_replace_child(child, NULL);
 -
 -    g_free(child->name);
 -    g_free(child);
 -}
 -
  /* Callers must ensure that child->frozen is false. */
  void bdrv_root_unref_child(BdrvChild *child)
  {
 diff --git a/tests/qemu-iotests/tests/qsd-jobs.out b/tests/qemu-iotests/tests/qsd-jobs.out
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/tests/qsd-jobs.out
 +++ b/tests/qemu-iotests/tests/qsd-jobs.out
@@ -XXX,XX +XXX,XX @@ QMP_VERSION
  {"return": {}}
  {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
  {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
 -{"error": {"class": "GenericError", "desc": "Conflicts with use by a block device as 'root', which uses 'write' on fmt_base"}}
 +{"error": {"class": "GenericError", "desc": "Conflicts with use by stream job 'job0' as 'intermediate node', which does not allow 'write' on fmt_base"}}
  {"return": {}}
  {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export1"}}
  *** done
 --
 .30.2

-New patch
+[PULL 19/39] block: add bdrv_attach_child_noperm() transaction action
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Split no-perm part of bdrv_attach_child as separate transaction action.
+It will be used in later commits.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-20-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++-----------
+file changed, 58 insertions(+), 13 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
+ static void bdrv_replace_child_noperm(BdrvChild *child,
+                                       BlockDriverState *new_bs);
++static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
++                                    BlockDriverState *child_bs,
++                                    const char *child_name,
++                                    const BdrvChildClass *child_class,
++                                    BdrvChildRole child_role,
++                                    BdrvChild **child,
++                                    Transaction *tran,
++                                    Error **errp);
+ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
+                                *queue, Error **errp);
+@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_common(BlockDriverState *child_bs,
+     return 0;
+ }
++static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
++                                    BlockDriverState *child_bs,
++                                    const char *child_name,
++                                    const BdrvChildClass *child_class,
++                                    BdrvChildRole child_role,
++                                    BdrvChild **child,
++                                    Transaction *tran,
++                                    Error **errp)
++{
++    int ret;
++    uint64_t perm, shared_perm;
++
++    assert(parent_bs->drv);
++
++    bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
++    bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
++                    perm, shared_perm, &perm, &shared_perm);
++
++    ret = bdrv_attach_child_common(child_bs, child_name, child_class,
++                                   child_role, perm, shared_perm, parent_bs,
++                                   child, tran, errp);
++    if (ret < 0) {
++        return ret;
++    }
++
++    QLIST_INSERT_HEAD(&parent_bs->children, *child, next);
++    /*
++     * child is removed in bdrv_attach_child_common_abort(), so don't care to
++     * abort this change separately.
++     */
++
++    return 0;
++}
++
+ static void bdrv_detach_child(BdrvChild *child)
+ {
+     bdrv_replace_child(child, NULL);
+@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
+                              BdrvChildRole child_role,
+                              Error **errp)
+ {
+-    BdrvChild *child;
+-    uint64_t perm, shared_perm;
+-
+-    bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
++    int ret;
++    BdrvChild *child = NULL;
++    Transaction *tran = tran_new();
+-    assert(parent_bs->drv);
+-    bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
+-                    perm, shared_perm, &perm, &shared_perm);
++    ret = bdrv_attach_child_noperm(parent_bs, child_bs, child_name, child_class,
++                                   child_role, &child, tran, errp);
++    if (ret < 0) {
++        goto out;
++    }
+-    child = bdrv_root_attach_child(child_bs, child_name, child_class,
+-                                   child_role, perm, shared_perm, parent_bs,
+-                                   errp);
+-    if (child == NULL) {
+-        return NULL;
++    ret = bdrv_refresh_perms(parent_bs, errp);
++    if (ret < 0) {
++        goto out;
+     }
+-    QLIST_INSERT_HEAD(&parent_bs->children, child, next);
++out:
++    tran_finalize(tran, ret);
++
++    bdrv_unref(child_bs);
++
+     return child;
+ }
+--
+.30.2

-New patch
+[PULL 20/39] block: split out bdrv_replace_node_noperm()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Split part of bdrv_replace_node_common() to be used separately.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-21-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 50 +++++++++++++++++++++++++++++++-------------------
+file changed, 31 insertions(+), 19 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static bool should_update_child(BdrvChild *c, BlockDriverState *to)
+     return ret;
+ }
++static int bdrv_replace_node_noperm(BlockDriverState *from,
++                                    BlockDriverState *to,
++                                    bool auto_skip, Transaction *tran,
++                                    Error **errp)
++{
++    BdrvChild *c, *next;
++
++    QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
++        assert(c->bs == from);
++        if (!should_update_child(c, to)) {
++            if (auto_skip) {
++                continue;
++            }
++            error_setg(errp, "Should not change '%s' link to '%s'",
++                       c->name, from->node_name);
++            return -EINVAL;
++        }
++        if (c->frozen) {
++            error_setg(errp, "Cannot change '%s' link to '%s'",
++                       c->name, from->node_name);
++            return -EPERM;
++        }
++        bdrv_replace_child_safe(c, to, tran);
++    }
++
++    return 0;
++}
++
+ /*
+  * With auto_skip=true bdrv_replace_node_common skips updating from parents
+  * if it creates a parent-child relation loop or if parent is block-job.
+@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
+                                     BlockDriverState *to,
+                                     bool auto_skip, Error **errp)
+ {
+-    BdrvChild *c, *next;
+     Transaction *tran = tran_new();
+     g_autoptr(GHashTable) found = NULL;
+     g_autoptr(GSList) refresh_list = NULL;
+@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
+      * permissions based on new graph. If we fail, we'll roll-back the
+      * replacement.
+      */
+-    QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
+-        assert(c->bs == from);
+-        if (!should_update_child(c, to)) {
+-            if (auto_skip) {
+-                continue;
+-            }
+-            ret = -EINVAL;
+-            error_setg(errp, "Should not change '%s' link to '%s'",
+-                       c->name, from->node_name);
+-            goto out;
+-        }
+-        if (c->frozen) {
+-            ret = -EPERM;
+-            error_setg(errp, "Cannot change '%s' link to '%s'",
+-                       c->name, from->node_name);
+-            goto out;
+-        }
+-        bdrv_replace_child_safe(c, to, tran);
++    ret = bdrv_replace_node_noperm(from, to, auto_skip, tran, errp);
++    if (ret < 0) {
++        goto out;
+     }
+     found = g_hash_table_new(NULL, NULL);
+--
+.30.2

-New patch
+[PULL 21/39] block: adapt bdrv_append() for inserting filters
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+bdrv_append is not very good for inserting filters: it does extra
+permission update as part of bdrv_set_backing_hd(). During this update
+filter may conflict with other parents of top_bs.
+Instead, let's first do all graph modifications and after it update
+permissions.
+append-greedy-filter test-case in test-bdrv-graph-mod is now works, so
+move it out of debug option.
+Note: bdrv_append() is still only works for backing-child based
+filters. It's something to improve later.
+Note2: we use the fact that bdrv_append() is used to append new nodes,
+without backing child, so we don't need frozen check and inherits_from
+logic from bdrv_set_backing_hd().
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-22-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c                          | 27 ++++++++++++++++++++-------
+ tests/unit/test-bdrv-graph-mod.c | 17 ++---------------
+files changed, 22 insertions(+), 22 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
+  * This will modify the BlockDriverState fields, and swap contents
+  * between bs_new and bs_top. Both bs_new and bs_top are modified.
+  *
+- * bs_new must not be attached to a BlockBackend.
++ * bs_new must not be attached to a BlockBackend and must not have backing
++ * child.
+  *
+  * This function does not create any image files.
+  */
+ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
+                 Error **errp)
+ {
+-    int ret = bdrv_set_backing_hd(bs_new, bs_top, errp);
++    int ret;
++    Transaction *tran = tran_new();
++
++    assert(!bs_new->backing);
++
++    ret = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
++                                   &child_of_bds, bdrv_backing_role(bs_new),
++                                   &bs_new->backing, tran, errp);
+     if (ret < 0) {
+-        return ret;
++        goto out;
+     }
+-    ret = bdrv_replace_node(bs_top, bs_new, errp);
++    ret = bdrv_replace_node_noperm(bs_top, bs_new, true, tran, errp);
+     if (ret < 0) {
+-        bdrv_set_backing_hd(bs_new, NULL, &error_abort);
+-        return ret;
++        goto out;
+     }
+-    return 0;
++    ret = bdrv_refresh_perms(bs_new, errp);
++out:
++    tran_finalize(tran, ret);
++
++    bdrv_refresh_limits(bs_top, NULL);
++
++    return ret;
+ }
+ static void bdrv_delete(BlockDriverState *bs)
+diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/unit/test-bdrv-graph-mod.c
++++ b/tests/unit/test-bdrv-graph-mod.c
+@@ -XXX,XX +XXX,XX @@ static void test_append_greedy_filter(void)
+ int main(int argc, char *argv[])
+ {
+-    int i;
+-    bool debug = false;
+-
+-    for (i = 1; i < argc; i++) {
+-        if (!strcmp(argv[i], "-d")) {
+-            debug = true;
+-            break;
+-        }
+-    }
+-
+     bdrv_init();
+     qemu_init_main_loop(&error_abort);
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
+                     test_parallel_perm_update);
+     g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
+                     test_parallel_exclusive_write);
+-
+-    if (debug) {
+-        g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
+-                        test_append_greedy_filter);
+-    }
++    g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
++                    test_append_greedy_filter);
+     return g_test_run();
+ }
+--
+.30.2

-New patch
+[PULL 22/39] block: add bdrv_remove_filter_or_cow transaction action
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-23-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--
+file changed, 82 insertions(+), 2 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
+     }
+ }
++static void bdrv_child_free(void *opaque)
++{
++    BdrvChild *c = opaque;
++
++    g_free(c->name);
++    g_free(c);
++}
++
+ static void bdrv_remove_empty_child(BdrvChild *child)
+ {
+     assert(!child->bs);
+     QLIST_SAFE_REMOVE(child, next);
+-    g_free(child->name);
+-    g_free(child);
++    bdrv_child_free(child);
+ }
+ typedef struct BdrvAttachChildCommonState {
+@@ -XXX,XX +XXX,XX @@ static bool should_update_child(BdrvChild *c, BlockDriverState *to)
+     return ret;
+ }
++typedef struct BdrvRemoveFilterOrCowChild {
++    BdrvChild *child;
++    bool is_backing;
++} BdrvRemoveFilterOrCowChild;
++
++static void bdrv_remove_filter_or_cow_child_abort(void *opaque)
++{
++    BdrvRemoveFilterOrCowChild *s = opaque;
++    BlockDriverState *parent_bs = s->child->opaque;
++
++    QLIST_INSERT_HEAD(&parent_bs->children, s->child, next);
++    if (s->is_backing) {
++        parent_bs->backing = s->child;
++    } else {
++        parent_bs->file = s->child;
++    }
++
++    /*
++     * We don't have to restore child->bs here to undo bdrv_replace_child()
++     * because that function is transactionable and it registered own completion
++     * entries in @tran, so .abort() for bdrv_replace_child_safe() will be
++     * called automatically.
++     */
++}
++
++static void bdrv_remove_filter_or_cow_child_commit(void *opaque)
++{
++    BdrvRemoveFilterOrCowChild *s = opaque;
++
++    bdrv_child_free(s->child);
++}
++
++static TransactionActionDrv bdrv_remove_filter_or_cow_child_drv = {
++    .abort = bdrv_remove_filter_or_cow_child_abort,
++    .commit = bdrv_remove_filter_or_cow_child_commit,
++    .clean = g_free,
++};
++
++/*
++ * A function to remove backing-chain child of @bs if exists: cow child for
++ * format nodes (always .backing) and filter child for filters (may be .file or
++ * .backing)
++ */
++__attribute__((unused))
++static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
++                                            Transaction *tran)
++{
++    BdrvRemoveFilterOrCowChild *s;
++    BdrvChild *child = bdrv_filter_or_cow_child(bs);
++
++    if (!child) {
++        return;
++    }
++
++    if (child->bs) {
++        bdrv_replace_child_safe(child, NULL, tran);
++    }
++
++    s = g_new(BdrvRemoveFilterOrCowChild, 1);
++    *s = (BdrvRemoveFilterOrCowChild) {
++        .child = child,
++        .is_backing = (child == bs->backing),
++    };
++    tran_add(tran, &bdrv_remove_filter_or_cow_child_drv, s);
++
++    QLIST_SAFE_REMOVE(child, next);
++    if (s->is_backing) {
++        bs->backing = NULL;
++    } else {
++        bs->file = NULL;
++    }
++}
++
+ static int bdrv_replace_node_noperm(BlockDriverState *from,
+                                     BlockDriverState *to,
+                                     bool auto_skip, Transaction *tran,
+--
+.30.2

-New patch
+[PULL 23/39] block: introduce bdrv_drop_filter()
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Using bdrv_replace_node() for removing filter is not good enough: it
+keeps child reference of the filter, which may conflict with original
+top node during permission update.
+Instead let's create new interface, which will do all graph
+modifications first and then update permissions.
+Let's modify bdrv_replace_node_common(), allowing it additionally drop
+backing chain child link pointing to new node. This is quite
+appropriate for bdrv_drop_intermediate() and makes possible to add
+new bdrv_drop_filter() as a simple wrapper.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-24-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ include/block/block.h |  1 +
+ block.c               | 43 +++++++++++++++++++++++++++++++++++++++----
+files changed, 40 insertions(+), 4 deletions(-)
+diff --git a/include/block/block.h b/include/block/block.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/block/block.h
++++ b/include/block/block.h
+@@ -XXX,XX +XXX,XX @@ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
+                       Error **errp);
+ BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *node_options,
+                                    int flags, Error **errp);
++int bdrv_drop_filter(BlockDriverState *bs, Error **errp);
+ int bdrv_parse_aio(const char *mode, int *flags);
+ int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough);
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ static TransactionActionDrv bdrv_remove_filter_or_cow_child_drv = {
+  * format nodes (always .backing) and filter child for filters (may be .file or
+  * .backing)
+  */
+-__attribute__((unused))
+ static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
+                                             Transaction *tran)
+ {
+@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_noperm(BlockDriverState *from,
+  *
+  * With auto_skip=false the error is returned if from has a parent which should
+  * not be updated.
++ *
++ * With @detach_subchain=true @to must be in a backing chain of @from. In this
++ * case backing link of the cow-parent of @to is removed.
+  */
+ static int bdrv_replace_node_common(BlockDriverState *from,
+                                     BlockDriverState *to,
+-                                    bool auto_skip, Error **errp)
++                                    bool auto_skip, bool detach_subchain,
++                                    Error **errp)
+ {
+     Transaction *tran = tran_new();
+     g_autoptr(GHashTable) found = NULL;
+     g_autoptr(GSList) refresh_list = NULL;
++    BlockDriverState *to_cow_parent;
+     int ret;
++    if (detach_subchain) {
++        assert(bdrv_chain_contains(from, to));
++        assert(from != to);
++        for (to_cow_parent = from;
++             bdrv_filter_or_cow_bs(to_cow_parent) != to;
++             to_cow_parent = bdrv_filter_or_cow_bs(to_cow_parent))
++        {
++            ;
++        }
++    }
++
+     /* Make sure that @from doesn't go away until we have successfully attached
+      * all of its parents to @to. */
+     bdrv_ref(from);
+@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
+         goto out;
+     }
++    if (detach_subchain) {
++        bdrv_remove_filter_or_cow_child(to_cow_parent, tran);
++    }
++
+     found = g_hash_table_new(NULL, NULL);
+     refresh_list = bdrv_topological_dfs(refresh_list, found, to);
+@@ -XXX,XX +XXX,XX @@ out:
+ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
+                       Error **errp)
+ {
+-    return bdrv_replace_node_common(from, to, true, errp);
++    return bdrv_replace_node_common(from, to, true, false, errp);
++}
++
++int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
++{
++    return bdrv_replace_node_common(bs, bdrv_filter_or_cow_bs(bs), true, true,
++                                    errp);
+ }
+ /*
+@@ -XXX,XX +XXX,XX @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
+         updated_children = g_slist_prepend(updated_children, c);
+     }
+-    bdrv_replace_node_common(top, base, false, &local_err);
++    /*
++     * It seems correct to pass detach_subchain=true here, but it triggers
++     * one more yet not fixed bug, when due to nested aio_poll loop we switch to
++     * another drained section, which modify the graph (for example, removing
++     * the child, which we keep in updated_children list). So, it's a TODO.
++     *
++     * Note, bug triggered if pass detach_subchain=true here and run
++     * test-bdrv-drain. test_drop_intermediate_poll() test-case will crash.
++     * That's a FIXME.
++     */
++    bdrv_replace_node_common(top, base, false, false, &local_err);
+     if (local_err) {
+         error_report_err(local_err);
+         goto exit;
+--
+.30.2

-New patch
+[PULL 24/39] block/backup-top: drop .active
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+We don't need this workaround anymore: bdrv_append is already smart
+enough and we can use new bdrv_drop_filter().
+This commit efficiently reverts also recent 705dde27c6c53b73, which
+checked .active on io path. Still it said that the problem should be
+theoretical. And the logic of filter removement is changed anyway.
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-25-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block/backup-top.c         | 47 +-------------------------------------
+ tests/qemu-iotests/283.out |  2 +-
+files changed, 2 insertions(+), 47 deletions(-)
+diff --git a/block/backup-top.c b/block/backup-top.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block/backup-top.c
++++ b/block/backup-top.c
+@@ -XXX,XX +XXX,XX @@
+ typedef struct BDRVBackupTopState {
+     BlockCopyState *bcs;
+     BdrvChild *target;
+-    bool active;
+     int64_t cluster_size;
+ } BDRVBackupTopState;
+@@ -XXX,XX +XXX,XX @@ static coroutine_fn int backup_top_co_preadv(
+         BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+         QEMUIOVector *qiov, int flags)
+ {
+-    BDRVBackupTopState *s = bs->opaque;
+-
+-    if (!s->active) {
+-        return -EIO;
+-    }
+-
+     return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
+ }
+@@ -XXX,XX +XXX,XX @@ static coroutine_fn int backup_top_cbw(BlockDriverState *bs, uint64_t offset,
+     BDRVBackupTopState *s = bs->opaque;
+     uint64_t off, end;
+-    if (!s->active) {
+-        return -EIO;
+-    }
+-
+     if (flags & BDRV_REQ_WRITE_UNCHANGED) {
+         return 0;
+     }
+@@ -XXX,XX +XXX,XX @@ static void backup_top_child_perm(BlockDriverState *bs, BdrvChild *c,
+                                   uint64_t perm, uint64_t shared,
+                                   uint64_t *nperm, uint64_t *nshared)
+ {
+-    BDRVBackupTopState *s = bs->opaque;
+-
+-    if (!s->active) {
+-        /*
+-         * The filter node may be in process of bdrv_append(), which firstly do
+-         * bdrv_set_backing_hd() and then bdrv_replace_node(). This means that
+-         * we can't unshare BLK_PERM_WRITE during bdrv_append() operation. So,
+-         * let's require nothing during bdrv_append() and refresh permissions
+-         * after it (see bdrv_backup_top_append()).
+-         */
+-        *nperm = 0;
+-        *nshared = BLK_PERM_ALL;
+-        return;
+-    }
+-
+     if (!(role & BDRV_CHILD_FILTERED)) {
+         /*
+          * Target child
+@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+     }
+     appended = true;
+-    /*
+-     * bdrv_append() finished successfully, now we can require permissions
+-     * we want.
+-     */
+-    state->active = true;
+-    ret = bdrv_child_refresh_perms(top, top->backing, errp);
+-    if (ret < 0) {
+-        error_prepend(errp, "Cannot set permissions for backup-top filter: ");
+-        goto fail;
+-    }
+-
+     state->cluster_size = cluster_size;
+     state->bcs = block_copy_state_new(top->backing, state->target,
+                                       cluster_size, perf->use_copy_range,
+@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
+ fail:
+     if (appended) {
+-        state->active = false;
+         bdrv_backup_top_drop(top);
+     } else {
+         bdrv_unref(top);
+@@ -XXX,XX +XXX,XX @@ void bdrv_backup_top_drop(BlockDriverState *bs)
+ {
+     BDRVBackupTopState *s = bs->opaque;
+-    bdrv_drained_begin(bs);
++    bdrv_drop_filter(bs, &error_abort);
+     block_copy_state_free(s->bcs);
+-    s->active = false;
+-    bdrv_child_refresh_perms(bs, bs->backing, &error_abort);
+-    bdrv_replace_node(bs, bs->backing->bs, &error_abort);
+-    bdrv_set_backing_hd(bs, NULL, &error_abort);
+-
+-    bdrv_drained_end(bs);
+-
+     bdrv_unref(bs);
+ }
+diff --git a/tests/qemu-iotests/283.out b/tests/qemu-iotests/283.out
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qemu-iotests/283.out
++++ b/tests/qemu-iotests/283.out
+@@ -XXX,XX +XXX,XX @@
+ {"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": "base", "node-name": "other", "take-child-perms": ["write"]}}
+ {"return": {}}
+ {"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
+-{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by source as 'image', which does not allow 'write' on base"}}
++{"error": {"class": "GenericError", "desc": "Cannot append backup-top filter: Conflicts with use by source as 'image', which does not allow 'write' on base"}}
+ === backup-top should be gone after job-finalize ===
+--
+.30.2

-[PULL 09/17] block/vpc: Make vpc_open() read the full dynamic header
+[PULL 25/39] block: drop ignore_children for permission update functions
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-The dynamic header's size is 1024 bytes.
+This argument is always NULL. Drop it.
-vpc_open() reads only the 512 bytes of the dynamic header into buf[].
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Works, because it doesn't actually access the second half.  However, a
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-colleague told me that GCC 11 warns:
+Message-Id: <20210428151804.439460-26-vsementsov@virtuozzo.com>
     ../block/vpc.c:358:51: error: array subscript 'struct VHDDynDiskHeader[0]' is partly outside array bounds of 'uint8_t[512]' [-Werror=array-bounds]
 Clean up to read the full header.
 Rename buf[] to dyndisk_header_buf[] while there.
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Message-Id: <20201217162003.1102738-2-armbru@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 8 ++++----
+ block.c | 38 +++++++++++---------------------------
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 11 insertions(+), 27 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/block.c
-+++ b/block/vpc.c
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
+@@ -XXX,XX +XXX,XX @@ static int bdrv_fill_options(QDict **options, const char *filename,
-     QemuOpts *opts = NULL;
+ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
-     Error *local_err = NULL;
+                                   uint64_t new_used_perm,
-     bool use_chs;
+                                   uint64_t new_shared_perm,
--    uint8_t buf[HEADER_SIZE];
+-                                  GSList *ignore_children,
-+    uint8_t dyndisk_header_buf[1024];
+                                   Error **errp);
-     uint32_t checksum;
-     uint64_t computed_size;
+ typedef struct BlockReopenQueueEntry {
-     uint64_t pagetable_size;
+@@ -XXX,XX +XXX,XX @@ static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
+     return false;
  }
 -static bool bdrv_parent_perms_conflict(BlockDriverState *bs,
 -                                       GSList *ignore_children,
 -                                       Error **errp)
 +static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
  {
      BdrvChild *a, *b;
@@ -XXX,XX +XXX,XX @@ static bool bdrv_parent_perms_conflict(BlockDriverState *bs,
       * directions.
       */
      QLIST_FOREACH(a, &bs->parents, next_parent) {
 -        if (g_slist_find(ignore_children, a)) {
 -            continue;
 -        }
 -
          QLIST_FOREACH(b, &bs->parents, next_parent) {
 -            if (a == b || g_slist_find(ignore_children, b)) {
 +            if (a == b) {
                  continue;
              }
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
  static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                  uint64_t cumulative_perms,
                                  uint64_t cumulative_shared_perms,
 -                                GSList *ignore_children,
                                  Transaction *tran, Error **errp)
  {
      BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
                                    bool use_cumulative_perms,
                                    uint64_t cumulative_perms,
                                    uint64_t cumulative_shared_perms,
 -                                  GSList *ignore_children,
                                    Transaction *tran, Error **errp)
  {
      int ret;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
          ret = bdrv_node_check_perm(bs, q, cumulative_perms,
                                     cumulative_shared_perms,
 -                                   ignore_children, tran, errp);
 +                                   tran, errp);
          if (ret < 0) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
      for ( ; list; list = list->next) {
          bs = list->data;
 -        if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
 +        if (bdrv_parent_perms_conflict(bs, errp)) {
              return -EINVAL;
          }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
          ret = bdrv_node_check_perm(bs, q, cumulative_perms,
                                     cumulative_shared_perms,
 -                                   ignore_children, tran, errp);
 +                                   tran, errp);
          if (ret < 0) {
              return ret;
          }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
  static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
                             uint64_t cumulative_perms,
 -                           uint64_t cumulative_shared_perms,
 -                           GSList *ignore_children, Error **errp)
 +                           uint64_t cumulative_shared_perms, Error **errp)
  {
      g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
      return bdrv_check_perm_common(list, q, true, cumulative_perms,
 -                                  cumulative_shared_perms, ignore_children,
 -                                  NULL, errp);
 +                                  cumulative_shared_perms, NULL, errp);
  }
  static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
                                     Transaction *tran, Error **errp)
  {
 -    return bdrv_check_perm_common(list, q, false, 0, 0, NULL, tran, errp);
 +    return bdrv_check_perm_common(list, q, false, 0, 0, tran, errp);
  }
  /*
@@ -XXX,XX +XXX,XX @@ char *bdrv_perm_names(uint64_t perm)
  static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                    uint64_t new_used_perm,
                                    uint64_t new_shared_perm,
 -                                  GSList *ignore_children,
                                    Error **errp)
  {
      BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
      assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
      QLIST_FOREACH(c, &bs->parents, next_parent) {
 -        if (g_slist_find(ignore_children, c)) {
 -            continue;
 -        }
 -
          if ((new_used_perm & c->shared_perm) != new_used_perm) {
              char *user = bdrv_child_user_desc(c);
              char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
      }
-     if (disk_type == VHD_DYNAMIC) {
+     return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
--        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
+-                           ignore_children, errp);
--                         HEADER_SIZE);
++                           errp);
-+        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
+ }
-+                         dyndisk_header_buf, 1024);
  static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
      QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
          BDRVReopenState *state = &bs_entry->state;
          ret = bdrv_check_perm(state->bs, bs_queue, state->perm,
 -                              state->shared_perm, NULL, errp);
 +                              state->shared_perm, errp);
          if (ret < 0) {
-             error_setg(errp, "Error reading dynamic VHD header");
+             goto cleanup_perm;
              goto fail;
          }
+@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
--        dyndisk_header = (VHDDynDiskHeader *) buf;
+                             bs_queue, state->perm, state->shared_perm,
-+        dyndisk_header = (VHDDynDiskHeader *)dyndisk_header_buf;
+                             &nperm, &nshared);
+             ret = bdrv_check_update_perm(state->new_backing_bs, NULL,
-         if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
+-                                         nperm, nshared, NULL, errp);
-             error_setg(errp, "Invalid header magic");
++                                         nperm, nshared, errp);
              if (ret < 0) {
                  goto cleanup_perm;
              }
 --
-.29.2
+.30.2

-[PULL 13/17] block/vpc: Pad VHDDynDiskHeader, replace uint8_t[] buffers
+[PULL 26/39] block: make bdrv_unset_inherits_from to be a transaction action
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Pad VHDDynDiskHeader as specified in the "Virtual Hard Disk Image
+To be used in the further commit.
 Format Specification" version 1.0[*].  Change dynamic disk header
 buffers from uint8_t[1024] to VHDDynDiskHeader.  Their size remains
 the same.
-The VHDDynDiskHeader * variables pointing to a VHDDynDiskHeader
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-variable right next to it are now silly.  Eliminate them.
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-27-vsementsov@virtuozzo.com>
 [*] http://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Message-Id: <20201217162003.1102738-6-armbru@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 41 +++++++++++++++++++----------------------
+ block.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
-file changed, 19 insertions(+), 22 deletions(-)
+file changed, 42 insertions(+), 4 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/block.c
-+++ b/block/vpc.c
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ typedef struct vhd_dyndisk_header {
+@@ -XXX,XX +XXX,XX @@ void bdrv_root_unref_child(BdrvChild *child)
-         uint32_t    reserved;
+     bdrv_unref(child_bs);
-         uint64_t    data_offset;
+ }
-     } parent_locator[8];
-+    uint8_t     reserved2[256];
++typedef struct BdrvSetInheritsFrom {
- } QEMU_PACKED VHDDynDiskHeader;
++    BlockDriverState *bs;
++    BlockDriverState *old_inherits_from;
-+QEMU_BUILD_BUG_ON(sizeof(VHDDynDiskHeader) != 1024);
++} BdrvSetInheritsFrom;
 +
- typedef struct BDRVVPCState {
++static void bdrv_set_inherits_from_abort(void *opaque)
-     CoMutex lock;
++{
-     uint8_t footer_buf[HEADER_SIZE];
++    BdrvSetInheritsFrom *s = opaque;
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
++
-     BDRVVPCState *s = bs->opaque;
++    s->bs->inherits_from = s->old_inherits_from;
-     int i;
++}
-     VHDFooter *footer;
++
--    VHDDynDiskHeader *dyndisk_header;
++static TransactionActionDrv bdrv_set_inherits_from_drv = {
-     QemuOpts *opts = NULL;
++    .abort = bdrv_set_inherits_from_abort,
-     Error *local_err = NULL;
++    .clean = g_free,
-     bool use_chs;
++};
--    uint8_t dyndisk_header_buf[1024];
++
-+    VHDDynDiskHeader dyndisk_header;
++/* @tran is allowed to be NULL. In this case no rollback is possible */
-     uint32_t checksum;
++static void bdrv_set_inherits_from(BlockDriverState *bs,
-     uint64_t computed_size;
++                                   BlockDriverState *new_inherits_from,
-     uint64_t pagetable_size;
++                                   Transaction *tran)
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
++{
++    if (tran) {
-     if (disk_type == VHD_DYNAMIC) {
++        BdrvSetInheritsFrom *s = g_new(BdrvSetInheritsFrom, 1);
-         ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
++
--                         dyndisk_header_buf, 1024);
++        *s = (BdrvSetInheritsFrom) {
-+                         &dyndisk_header, 1024);
++            .bs = bs,
-         if (ret < 0) {
++            .old_inherits_from = bs->inherits_from,
-             error_setg(errp, "Error reading dynamic VHD header");
++        };
-             goto fail;
++
 +        tran_add(tran, &bdrv_set_inherits_from_drv, s);
 +    }
 +
 +    bs->inherits_from = new_inherits_from;
 +}
 +
  /**
   * Clear all inherits_from pointers from children and grandchildren of
   * @root that point to @root, where necessary.
 + * @tran is allowed to be NULL. In this case no rollback is possible
   */
 -static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
 +static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child,
 +                                     Transaction *tran)
  {
      BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
              }
          }
+         if (c == NULL) {
--        dyndisk_header = (VHDDynDiskHeader *)dyndisk_header_buf;
+-            child->bs->inherits_from = NULL;
--
++            bdrv_set_inherits_from(child->bs, NULL, tran);
 -        if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
 +        if (strncmp(dyndisk_header.magic, "cxsparse", 8)) {
              error_setg(errp, "Invalid header magic");
              ret = -EINVAL;
              goto fail;
          }
--        s->block_size = be32_to_cpu(dyndisk_header->block_size);
-+        s->block_size = be32_to_cpu(dyndisk_header.block_size);
-         if (!is_power_of_2(s->block_size) || s->block_size < BDRV_SECTOR_SIZE) {
-             error_setg(errp, "Invalid block size %" PRIu32, s->block_size);
-             ret = -EINVAL;
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
-         }
-         s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;
--        s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
-+        s->max_table_entries = be32_to_cpu(dyndisk_header.max_table_entries);
-         if ((bs->total_sectors * 512) / s->block_size > 0xffffffffU) {
-             error_setg(errp, "Too many blocks");
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
-             goto fail;
-         }
--        s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
-+        s->bat_offset = be64_to_cpu(dyndisk_header.table_offset);
-         ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable,
-                          pagetable_size);
-@@ -XXX,XX +XXX,XX @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
- static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
-                                int64_t total_sectors)
- {
--    uint8_t dyndisk_header_buf[1024];
--    VHDDynDiskHeader *dyndisk_header =
--        (VHDDynDiskHeader *)dyndisk_header_buf;
-+    VHDDynDiskHeader dyndisk_header;
-     uint8_t bat_sector[512];
-     size_t block_size, num_bat_entries;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
      }
-     /* Prepare the Dynamic Disk Header */
+     QLIST_FOREACH(c, &child->bs->children, next) {
--    memset(dyndisk_header_buf, 0, 1024);
+-        bdrv_unset_inherits_from(root, c);
-+    memset(&dyndisk_header, 0, 1024);
++        bdrv_unset_inherits_from(root, c, tran);
 -    memcpy(dyndisk_header->magic, "cxsparse", 8);
 +    memcpy(dyndisk_header.magic, "cxsparse", 8);
      /*
       * Note: The spec is actually wrong here for data_offset, it says
       * 0xFFFFFFFF, but MS tools expect all 64 bits to be set.
       */
 -    dyndisk_header->data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
 -    dyndisk_header->table_offset = cpu_to_be64(3 * 512);
 -    dyndisk_header->version = cpu_to_be32(0x00010000);
 -    dyndisk_header->block_size = cpu_to_be32(block_size);
 -    dyndisk_header->max_table_entries = cpu_to_be32(num_bat_entries);
 +    dyndisk_header.data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
 +    dyndisk_header.table_offset = cpu_to_be64(3 * 512);
 +    dyndisk_header.version = cpu_to_be32(0x00010000);
 +    dyndisk_header.block_size = cpu_to_be32(block_size);
 +    dyndisk_header.max_table_entries = cpu_to_be32(num_bat_entries);
 -    dyndisk_header->checksum = cpu_to_be32(vpc_checksum(dyndisk_header_buf,
 -                                                        1024));
 +    dyndisk_header.checksum = cpu_to_be32(vpc_checksum(&dyndisk_header, 1024));
      /* Write the header */
      offset = 512;
 -    ret = blk_pwrite(blk, offset, dyndisk_header_buf, 1024, 0);
 +    ret = blk_pwrite(blk, offset, &dyndisk_header, 1024, 0);
      if (ret < 0) {
          goto fail;
      }
+ }
+@@ -XXX,XX +XXX,XX @@ void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
+         return;
+     }
+-    bdrv_unset_inherits_from(parent, child);
++    bdrv_unset_inherits_from(parent, child, NULL);
+     bdrv_root_unref_child(child);
+ }
 --
-.29.2
+.30.2

-[PULL 17/17] block/vpc: Use sizeof() instead of HEADER_SIZE for footer size
+[PULL 27/39] block: make bdrv_refresh_limits() to be a transaction action
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
+To be used in further commit.
-Message-Id: <20201217162003.1102738-10-armbru@redhat.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-28-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 29 ++++++++++++++---------------
+ include/block/block.h |  3 ++-
-file changed, 14 insertions(+), 15 deletions(-)
+ block.c               |  9 ++++-----
  block/io.c            | 31 +++++++++++++++++++++++++++++--
 files changed, 35 insertions(+), 8 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/include/block/block.h b/include/block/block.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/include/block/block.h
-+++ b/block/vpc.c
++++ b/include/block/block.h
 @@ -XXX,XX +XXX,XX @@
+ #include "block/dirty-bitmap.h"
- /**************************************************************/
+ #include "block/blockjob.h"
+ #include "qemu/hbitmap.h"
--#define HEADER_SIZE 512
++#include "qemu/transactions.h"
--
- //#define CACHE
+ /*
+  * generated_co_wrapper
- enum vhd_type {
+@@ -XXX,XX +XXX,XX @@ int64_t bdrv_get_allocated_file_size(BlockDriverState *bs);
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
+ BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
-         goto fail;
+                                BlockDriverState *in_bs, Error **errp);
-     }
+ void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
+-void bdrv_refresh_limits(BlockDriverState *bs, Error **errp);
--    ret = bdrv_pread(bs->file, 0, &s->footer, HEADER_SIZE);
++void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp);
-+    ret = bdrv_pread(bs->file, 0, &s->footer, sizeof(s->footer));
+ int bdrv_commit(BlockDriverState *bs);
-     if (ret < 0) {
+ int bdrv_make_empty(BdrvChild *c, Error **errp);
-         error_setg(errp, "Unable to read VHD header");
+ int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
-         goto fail;
+diff --git a/block.c b/block.c
-@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
+index XXXXXXX..XXXXXXX 100644
-             ret = offset;
+--- a/block.c
-             error_setg(errp, "Invalid file size");
++++ b/block.c
-             goto fail;
+@@ -XXX,XX +XXX,XX @@
--        } else if (offset < HEADER_SIZE) {
+ #include "qemu/timer.h"
-+        } else if (offset < sizeof(*footer)) {
+ #include "qemu/cutils.h"
-             ret = -EINVAL;
+ #include "qemu/id.h"
-             error_setg(errp, "File too small for a VHD header");
+-#include "qemu/transactions.h"
-             goto fail;
+ #include "block/coroutines.h"
-         }
+ #ifdef CONFIG_BSD
-         /* If a fixed disk, the footer is found only at the end of the file */
+@@ -XXX,XX +XXX,XX @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
 -        ret = bdrv_pread(bs->file, offset - HEADER_SIZE, footer,
 -                         HEADER_SIZE);
 +        ret = bdrv_pread(bs->file, offset - sizeof(*footer),
 +                         footer, sizeof(*footer));
          if (ret < 0) {
              goto fail;
          }
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
      checksum = be32_to_cpu(footer->checksum);
      footer->checksum = 0;
 -    if (vpc_checksum(footer, HEADER_SIZE) != checksum) {
 +    if (vpc_checksum(footer, sizeof(*footer)) != checksum) {
          error_setg(errp, "Incorrect header checksum");
          ret = -EINVAL;
          goto fail;
@@ -XXX,XX +XXX,XX @@ static int rewrite_footer(BlockDriverState *bs)
      BDRVVPCState *s = bs->opaque;
      int64_t offset = s->free_data_block_offset;
 -    ret = bdrv_pwrite_sync(bs->file, offset, &s->footer, HEADER_SIZE);
 +    ret = bdrv_pwrite_sync(bs->file, offset, &s->footer, sizeof(s->footer));
      if (ret < 0)
          return ret;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
      block_size = 0x200000;
      num_bat_entries = DIV_ROUND_UP(total_sectors, block_size / 512);
 -    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
 +    ret = blk_pwrite(blk, offset, footer, sizeof(*footer), 0);
      if (ret < 0) {
          goto fail;
      }
      offset = 1536 + ((num_bat_entries * 4 + 511) & ~511);
 -    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
 +    ret = blk_pwrite(blk, offset, footer, sizeof(*footer), 0);
      if (ret < 0) {
          goto fail;
      }
@@ -XXX,XX +XXX,XX @@ static int create_fixed_disk(BlockBackend *blk, VHDFooter *footer,
      int ret;
      /* Add footer to total size */
 -    total_size += HEADER_SIZE;
 +    total_size += sizeof(*footer);
      ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, 0, errp);
      if (ret < 0) {
          return ret;
      }
--    ret = blk_pwrite(blk, total_size - HEADER_SIZE, footer, HEADER_SIZE, 0);
+-    bdrv_refresh_limits(bs, &local_err);
-+    ret = blk_pwrite(blk, total_size - sizeof(*footer),
++    bdrv_refresh_limits(bs, NULL, &local_err);
-+                     footer, sizeof(*footer), 0);
+     if (local_err) {
-     if (ret < 0) {
+         error_propagate(errp, local_err);
-         error_setg_errno(errp, -ret, "Unable to write VHD header");
+         return -EINVAL;
-         return ret;
+@@ -XXX,XX +XXX,XX @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
      }
-     /* Prepare the Hard Disk Footer */
+ out:
--    memset(&footer, 0, HEADER_SIZE);
+-    bdrv_refresh_limits(bs, NULL);
-+    memset(&footer, 0, sizeof(footer));
++    bdrv_refresh_limits(bs, NULL, NULL);
-     memcpy(footer.creator, "conectix", 8);
+     return ret;
-     if (vpc_opts->force_size) {
+ }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
+@@ -XXX,XX +XXX,XX @@ static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
-     footer.features = cpu_to_be32(0x02);
+         bdrv_set_backing_hd(bs, reopen_state->new_backing_bs, &error_abort);
      footer.version = cpu_to_be32(0x00010000);
      if (disk_type == VHD_DYNAMIC) {
 -        footer.data_offset = cpu_to_be64(HEADER_SIZE);
 +        footer.data_offset = cpu_to_be64(sizeof(footer));
      } else {
          footer.data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
      }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
-     qemu_uuid_generate(&uuid);
+-    bdrv_refresh_limits(bs, NULL);
-     footer.uuid = uuid;
++    bdrv_refresh_limits(bs, NULL, NULL);
+ }
--    footer.checksum = cpu_to_be32(vpc_checksum(&footer, HEADER_SIZE));
-+    footer.checksum = cpu_to_be32(vpc_checksum(&footer, sizeof(footer)));
+ /*
+@@ -XXX,XX +XXX,XX @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
-     if (disk_type == VHD_DYNAMIC) {
+ out:
-         ret = create_dynamic_disk(blk, &footer, total_sectors);
+     tran_finalize(tran, ret);
 -    bdrv_refresh_limits(bs_top, NULL);
 +    bdrv_refresh_limits(bs_top, NULL, NULL);
      return ret;
  }
 diff --git a/block/io.c b/block/io.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/io.c
 +++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
      dst->max_iov = MIN_NON_ZERO(dst->max_iov, src->max_iov);
  }
 -void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)
 +typedef struct BdrvRefreshLimitsState {
 +    BlockDriverState *bs;
 +    BlockLimits old_bl;
 +} BdrvRefreshLimitsState;
 +
 +static void bdrv_refresh_limits_abort(void *opaque)
 +{
 +    BdrvRefreshLimitsState *s = opaque;
 +
 +    s->bs->bl = s->old_bl;
 +}
 +
 +static TransactionActionDrv bdrv_refresh_limits_drv = {
 +    .abort = bdrv_refresh_limits_abort,
 +    .clean = g_free,
 +};
 +
 +/* @tran is allowed to be NULL, in this case no rollback is possible. */
 +void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
  {
      ERRP_GUARD();
      BlockDriver *drv = bs->drv;
      BdrvChild *c;
      bool have_limits;
 +    if (tran) {
 +        BdrvRefreshLimitsState *s = g_new(BdrvRefreshLimitsState, 1);
 +        *s = (BdrvRefreshLimitsState) {
 +            .bs = bs,
 +            .old_bl = bs->bl,
 +        };
 +        tran_add(tran, &bdrv_refresh_limits_drv, s);
 +    }
 +
      memset(&bs->bl, 0, sizeof(bs->bl));
      if (!drv) {
@@ -XXX,XX +XXX,XX @@ void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)
      QLIST_FOREACH(c, &bs->children, next) {
          if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
          {
 -            bdrv_refresh_limits(c->bs, errp);
 +            bdrv_refresh_limits(c->bs, tran, errp);
              if (*errp) {
                  return;
              }
 --
-.29.2
+.30.2

-[PULL 11/17] block/vpc: Don't abuse the footer buffer for dynamic header
+[PULL 28/39] block: add bdrv_set_backing_noperm() transaction action
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-create_dynamic_disk() takes a buffer holding the footer as first
+Split out no-perm part of bdrv_set_backing_hd() as a separate
-argument.  It writes out the footer (512 bytes), then reuses the
+transaction action. Note the in case of existing BdrvChild we reuse it,
-buffer to initialize and write out the dynamic header (1024 bytes).
+not recreate, just to do less actions.
-Works, because the caller passes a buffer that is large enough for
+We don't need to create extra reference to backing_hd as we don't lose
-both purposes.  I hate that.
+it in bdrv_attach_child().
-Use a separate buffer for the dynamic header, and adjust the caller's
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-buffer.
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-29-vsementsov@virtuozzo.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Message-Id: <20201217162003.1102738-4-armbru@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 22 ++++++++++++----------
+ block.c | 54 +++++++++++++++++++++++++++++++++++++-----------------
-file changed, 12 insertions(+), 10 deletions(-)
+file changed, 37 insertions(+), 17 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/block.c
-+++ b/block/vpc.c
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
+@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
- static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+                                     BdrvChild **child,
-                                int64_t total_sectors)
+                                     Transaction *tran,
                                      Error **errp);
 +static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
 +                                            Transaction *tran);
  static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
                                 *queue, Error **errp);
@@ -XXX,XX +XXX,XX @@ static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
   * Sets the bs->backing link of a BDS. A new reference is created; callers
   * which don't need their own reference any more must call bdrv_unref().
   */
 -int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
 -                        Error **errp)
 +static int bdrv_set_backing_noperm(BlockDriverState *bs,
 +                                   BlockDriverState *backing_hd,
 +                                   Transaction *tran, Error **errp)
  {
-+    uint8_t dyndisk_header_buf[1024];
+     int ret = 0;
-     VHDDynDiskHeader *dyndisk_header =
+     bool update_inherits_from = bdrv_chain_contains(bs, backing_hd) &&
--        (VHDDynDiskHeader *) buf;
+@@ -XXX,XX +XXX,XX @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
-+        (VHDDynDiskHeader *)dyndisk_header_buf;
+         return -EPERM;
      uint8_t bat_sector[512];
      size_t block_size, num_bat_entries;
      int i;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
      }
-     /* Prepare the Dynamic Disk Header */
+-    if (backing_hd) {
--    memset(buf, 0, 1024);
+-        bdrv_ref(backing_hd);
-+    memset(dyndisk_header_buf, 0, 1024);
+-    }
+-
-     memcpy(dyndisk_header->magic, "cxsparse", 8);
+     if (bs->backing) {
+         /* Cannot be frozen, we checked that above */
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+-        bdrv_unref_child(bs, bs->backing);
-     dyndisk_header->block_size = cpu_to_be32(block_size);
+-        bs->backing = NULL;
-     dyndisk_header->max_table_entries = cpu_to_be32(num_bat_entries);
++        bdrv_unset_inherits_from(bs, bs->backing, tran);
++        bdrv_remove_filter_or_cow_child(bs, tran);
 -    dyndisk_header->checksum = cpu_to_be32(vpc_checksum(buf, 1024));
 +    dyndisk_header->checksum = cpu_to_be32(vpc_checksum(dyndisk_header_buf,
 +                                                        1024));
      /* Write the header */
      offset = 512;
 -    ret = blk_pwrite(blk, offset, buf, 1024, 0);
 +    ret = blk_pwrite(blk, offset, dyndisk_header_buf, 1024, 0);
      if (ret < 0) {
          goto fail;
      }
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
-     BlockBackend *blk = NULL;
+     if (!backing_hd) {
-     BlockDriverState *bs = NULL;
+         goto out;
 -    uint8_t buf[1024];
 -    VHDFooter *footer = (VHDFooter *) buf;
 +    uint8_t footer_buf[HEADER_SIZE];
 +    VHDFooter *footer = (VHDFooter *)footer_buf;
      uint16_t cyls = 0;
      uint8_t heads = 0;
      uint8_t secs_per_cyl = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
      }
-     /* Prepare the Hard Disk Footer */
+-    bs->backing = bdrv_attach_child(bs, backing_hd, "backing", &child_of_bds,
--    memset(buf, 0, 1024);
+-                                    bdrv_backing_role(bs), errp);
-+    memset(footer_buf, 0, HEADER_SIZE);
+-    if (!bs->backing) {
+-        ret = -EPERM;
-     memcpy(footer->creator, "conectix", 8);
+-        goto out;
-     if (vpc_opts->force_size) {
++    ret = bdrv_attach_child_noperm(bs, backing_hd, "backing",
-@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
++                                   &child_of_bds, bdrv_backing_role(bs),
-     qemu_uuid_generate(&uuid);
++                                   &bs->backing, tran, errp);
-     footer->uuid = uuid;
++    if (ret < 0) {
++        return ret;
 -    footer->checksum = cpu_to_be32(vpc_checksum(buf, HEADER_SIZE));
 +    footer->checksum = cpu_to_be32(vpc_checksum(footer_buf, HEADER_SIZE));
      if (disk_type == VHD_DYNAMIC) {
 -        ret = create_dynamic_disk(blk, buf, total_sectors);
 +        ret = create_dynamic_disk(blk, footer_buf, total_sectors);
          if (ret < 0) {
              error_setg(errp, "Unable to create or write VHD header");
          }
      } else {
 -        ret = create_fixed_disk(blk, buf, total_size, errp);
 +        ret = create_fixed_disk(blk, footer_buf, total_size, errp);
      }
+-    /* If backing_hd was already part of bs's backing chain, and
++
++    /*
++     * If backing_hd was already part of bs's backing chain, and
+      * inherits_from pointed recursively to bs then let's update it to
+-     * point directly to bs (else it will become NULL). */
++     * point directly to bs (else it will become NULL).
++     */
+     if (update_inherits_from) {
+-        backing_hd->inherits_from = bs;
++        bdrv_set_inherits_from(backing_hd, bs, tran);
+     }
  out:
+-    bdrv_refresh_limits(bs, NULL, NULL);
++    bdrv_refresh_limits(bs, tran, NULL);
++
++    return 0;
++}
++
++int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
++                        Error **errp)
++{
++    int ret;
++    Transaction *tran = tran_new();
++
++    ret = bdrv_set_backing_noperm(bs, backing_hd, tran, errp);
++    if (ret < 0) {
++        goto out;
++    }
++
++    ret = bdrv_refresh_perms(bs, errp);
++out:
++    tran_finalize(tran, ret);
+     return ret;
+ }
 --
-.29.2
+.30.2

-New patch
+[PULL 29/39] block: bdrv_reopen_multiple(): move bdrv_flush to separate pre-prepare
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+During reopen we may add backing bs from other aio context, which may
+lead to changing original context of top bs.
+We are going to move graph modification to prepare stage. So, it will
+be possible that bdrv_flush() in bdrv_reopen_prepare called on bs in
+non-original aio context, which we didn't aquire which leads to crash.
+To avoid this problem move bdrv_flush() to be a separate reopen stage
+before bdrv_reopen_prepare().
+This doesn't seem correct to acquire only one aio context and not all
+contexts participating in reopen. But it's not obvious how to do it
+correctly, keeping in mind:
+. rules of bdrv_set_aio_context_ignore() that requires new_context
+    lock not being held
+. possible deadlocks because of holding all (or several?) AioContext
+    locks
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-30-vsementsov@virtuozzo.com>
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
+---
+ block.c | 14 ++++++++------
+file changed, 8 insertions(+), 6 deletions(-)
+diff --git a/block.c b/block.c
+index XXXXXXX..XXXXXXX 100644
+--- a/block.c
++++ b/block.c
+@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
+     assert(bs_queue != NULL);
++    QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
++        ret = bdrv_flush(bs_entry->state.bs);
++        if (ret < 0) {
++            error_setg_errno(errp, -ret, "Error flushing drive");
++            goto cleanup;
++        }
++    }
++
+     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
+         assert(bs_entry->state.bs->quiesce_counter > 0);
+         if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, errp)) {
+@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
+     bdrv_reopen_perm(queue, reopen_state->bs,
+                      &reopen_state->perm, &reopen_state->shared_perm);
+-    ret = bdrv_flush(reopen_state->bs);
+-    if (ret) {
+-        error_setg_errno(errp, -ret, "Error flushing drive");
+-        goto error;
+-    }
+-
+     if (drv->bdrv_reopen_prepare) {
+         /*
+          * If a driver-specific option is missing, it means that we
+--
+.30.2

-[PULL 10/17] block/vpc: Don't abuse the footer buffer as BAT sector buffer
+[PULL 30/39] block: bdrv_reopen_multiple: refresh permissions on updated graph
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-create_dynamic_disk() takes a buffer holding the footer as first
+Move bdrv_reopen_multiple to new paradigm of permission update:
-argument.  It writes out the footer (512 bytes), then reuses the
+first update graph relations, then do refresh the permissions.
 buffer to initialize and write out the dynamic header (1024 bytes),
 then reuses it again to initialize and write out BAT sectors (512).
-Works, because the caller passes a buffer that is large enough for all
+We have to modify reopen process in file-posix driver: with new scheme
-three purposes.  I hate that.
+we don't have prepared permissions in raw_reopen_prepare(), so we
 should reconfigure fd in raw_check_perm(). Still this seems more native
 and simple anyway.
-Use a separate buffer for writing out BAT sectors.  The next commit
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-will do the same for the dynamic header.
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
+Message-Id: <20210428151804.439460-31-vsementsov@virtuozzo.com>
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Message-Id: <20201217162003.1102738-3-armbru@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 5 +++--
+ include/block/block.h |   3 +-
-file changed, 3 insertions(+), 2 deletions(-)
+ block.c               | 187 ++++++++++++------------------------------
  block/file-posix.c    |  91 +++++++-------------
 files changed, 84 insertions(+), 197 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/include/block/block.h b/include/block/block.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/include/block/block.h
-+++ b/block/vpc.c
++++ b/include/block/block.h
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ typedef struct BDRVReopenState {
      BlockdevDetectZeroesOptions detect_zeroes;
      bool backing_missing;
      bool replace_backing_bs;  /* new_backing_bs is ignored if this is false */
 -    BlockDriverState *new_backing_bs; /* If NULL then detach the current bs */
 -    uint64_t perm, shared_perm;
 +    BlockDriverState *old_backing_bs; /* keep pointer for permissions update */
      QDict *options;
      QDict *explicit_options;
      void *opaque;
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
  static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
                                              Transaction *tran);
 -static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
 -                               *queue, Error **errp);
 +static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
 +                               BlockReopenQueue *queue,
 +                               Transaction *set_backings_tran, Error **errp);
  static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
  static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
@@ -XXX,XX +XXX,XX @@ static void bdrv_list_abort_perm_update(GSList *list)
      }
  }
 +__attribute__((unused))
  static void bdrv_abort_perm_update(BlockDriverState *bs)
  {
-     VHDDynDiskHeader *dyndisk_header =
+     g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-         (VHDDynDiskHeader *) buf;
+@@ -XXX,XX +XXX,XX @@ char *bdrv_perm_names(uint64_t perm)
-+    uint8_t bat_sector[512];
+  *
-     size_t block_size, num_bat_entries;
+  * Needs to be followed by a call to either bdrv_set_perm() or
-     int i;
+  * bdrv_abort_perm_update(). */
 +__attribute__((unused))
  static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                    uint64_t new_used_perm,
                                    uint64_t new_shared_perm,
@@ -XXX,XX +XXX,XX @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
      bs_entry->state.explicit_options = explicit_options;
      bs_entry->state.flags = flags;
 -    /* This needs to be overwritten in bdrv_reopen_prepare() */
 -    bs_entry->state.perm = UINT64_MAX;
 -    bs_entry->state.shared_perm = 0;
 -
      /*
       * If keep_old_opts is false then it means that unspecified
       * options must be reset to their original value. We don't allow
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
  {
      int ret = -1;
      BlockReopenQueueEntry *bs_entry, *next;
 +    Transaction *tran = tran_new();
 +    g_autoptr(GHashTable) found = NULL;
 +    g_autoptr(GSList) refresh_list = NULL;
      assert(bs_queue != NULL);
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
      QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
          assert(bs_entry->state.bs->quiesce_counter > 0);
 -        if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, errp)) {
 -            goto cleanup;
 +        ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
 +        if (ret < 0) {
 +            goto abort;
          }
          bs_entry->prepared = true;
      }
 +    found = g_hash_table_new(NULL, NULL);
      QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
          BDRVReopenState *state = &bs_entry->state;
 -        ret = bdrv_check_perm(state->bs, bs_queue, state->perm,
 -                              state->shared_perm, errp);
 -        if (ret < 0) {
 -            goto cleanup_perm;
 -        }
 -        /* Check if new_backing_bs would accept the new permissions */
 -        if (state->replace_backing_bs && state->new_backing_bs) {
 -            uint64_t nperm, nshared;
 -            bdrv_child_perm(state->bs, state->new_backing_bs,
 -                            NULL, bdrv_backing_role(state->bs),
 -                            bs_queue, state->perm, state->shared_perm,
 -                            &nperm, &nshared);
 -            ret = bdrv_check_update_perm(state->new_backing_bs, NULL,
 -                                         nperm, nshared, errp);
 -            if (ret < 0) {
 -                goto cleanup_perm;
 -            }
 +
 +        refresh_list = bdrv_topological_dfs(refresh_list, found, state->bs);
 +        if (state->old_backing_bs) {
 +            refresh_list = bdrv_topological_dfs(refresh_list, found,
 +                                                state->old_backing_bs);
          }
 -        bs_entry->perms_checked = true;
 +    }
 +
 +    /*
 +     * Note that file-posix driver rely on permission update done during reopen
 +     * (even if no permission changed), because it wants "new" permissions for
 +     * reconfiguring the fd and that's why it does it in raw_check_perm(), not
 +     * in raw_reopen_prepare() which is called with "old" permissions.
 +     */
 +    ret = bdrv_list_refresh_perms(refresh_list, bs_queue, tran, errp);
 +    if (ret < 0) {
 +        goto abort;
      }
      /*
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
          bdrv_reopen_commit(&bs_entry->state);
      }
 -    ret = 0;
 -cleanup_perm:
 -    QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
 -        BDRVReopenState *state = &bs_entry->state;
 -
 -        if (!bs_entry->perms_checked) {
 -            continue;
 -        }
 -
 -        if (ret == 0) {
 -            uint64_t perm, shared;
 +    tran_commit(tran);
 -            bdrv_get_cumulative_perm(state->bs, &perm, &shared);
 -            assert(perm == state->perm);
 -            assert(shared == state->shared_perm);
 +    QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
 +        BlockDriverState *bs = bs_entry->state.bs;
 -            bdrv_set_perm(state->bs);
 -        } else {
 -            bdrv_abort_perm_update(state->bs);
 -            if (state->replace_backing_bs && state->new_backing_bs) {
 -                bdrv_abort_perm_update(state->new_backing_bs);
 -            }
 +        if (bs->drv->bdrv_reopen_commit_post) {
 +            bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
          }
      }
 -    if (ret == 0) {
 -        QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
 -            BlockDriverState *bs = bs_entry->state.bs;
 +    ret = 0;
 +    goto cleanup;
 -            if (bs->drv->bdrv_reopen_commit_post)
 -                bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
 +abort:
 +    tran_abort(tran);
 +    QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
 +        if (bs_entry->prepared) {
 +            bdrv_reopen_abort(&bs_entry->state);
          }
 +        qobject_unref(bs_entry->state.explicit_options);
 +        qobject_unref(bs_entry->state.options);
      }
 +
  cleanup:
      QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
 -        if (ret) {
 -            if (bs_entry->prepared) {
 -                bdrv_reopen_abort(&bs_entry->state);
 -            }
 -            qobject_unref(bs_entry->state.explicit_options);
 -            qobject_unref(bs_entry->state.options);
 -        }
 -        if (bs_entry->state.new_backing_bs) {
 -            bdrv_unref(bs_entry->state.new_backing_bs);
 -        }
          g_free(bs_entry);
      }
      g_free(bs_queue);
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
      return ret;
  }
 -static BlockReopenQueueEntry *find_parent_in_reopen_queue(BlockReopenQueue *q,
 -                                                          BdrvChild *c)
 -{
 -    BlockReopenQueueEntry *entry;
 -
 -    QTAILQ_FOREACH(entry, q, entry) {
 -        BlockDriverState *bs = entry->state.bs;
 -        BdrvChild *child;
 -
 -        QLIST_FOREACH(child, &bs->children, next) {
 -            if (child == c) {
 -                return entry;
 -            }
 -        }
 -    }
 -
 -    return NULL;
 -}
 -
 -static void bdrv_reopen_perm(BlockReopenQueue *q, BlockDriverState *bs,
 -                             uint64_t *perm, uint64_t *shared)
 -{
 -    BdrvChild *c;
 -    BlockReopenQueueEntry *parent;
 -    uint64_t cumulative_perms = 0;
 -    uint64_t cumulative_shared_perms = BLK_PERM_ALL;
 -
 -    QLIST_FOREACH(c, &bs->parents, next_parent) {
 -        parent = find_parent_in_reopen_queue(q, c);
 -        if (!parent) {
 -            cumulative_perms |= c->perm;
 -            cumulative_shared_perms &= c->shared_perm;
 -        } else {
 -            uint64_t nperm, nshared;
 -
 -            bdrv_child_perm(parent->state.bs, bs, c, c->role, q,
 -                            parent->state.perm, parent->state.shared_perm,
 -                            &nperm, &nshared);
 -
 -            cumulative_perms |= nperm;
 -            cumulative_shared_perms &= nshared;
 -        }
 -    }
 -    *perm = cumulative_perms;
 -    *shared = cumulative_shared_perms;
 -}
 -
  static bool bdrv_reopen_can_attach(BlockDriverState *parent,
                                     BdrvChild *child,
                                     BlockDriverState *new_child,
@@ -XXX,XX +XXX,XX @@ static bool bdrv_reopen_can_attach(BlockDriverState *parent,
   * Return 0 on success, otherwise return < 0 and set @errp.
   */
  static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
 +                                     Transaction *set_backings_tran,
                                       Error **errp)
  {
      BlockDriverState *bs = reopen_state->bs;
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
      /* If we want to replace the backing file we need some extra checks */
      if (new_backing_bs != bdrv_filter_or_cow_bs(overlay_bs)) {
 +        int ret;
 +
          /* Check for implicit nodes between bs and its backing file */
          if (bs != overlay_bs) {
              error_setg(errp, "Cannot change backing link if '%s' has "
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
              return -EPERM;
          }
          reopen_state->replace_backing_bs = true;
 -        if (new_backing_bs) {
 -            bdrv_ref(new_backing_bs);
 -            reopen_state->new_backing_bs = new_backing_bs;
 +        reopen_state->old_backing_bs = bs->backing ? bs->backing->bs : NULL;
 +        ret = bdrv_set_backing_noperm(bs, new_backing_bs, set_backings_tran,
 +                                      errp);
 +        if (ret < 0) {
 +            return ret;
          }
      }
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
   *
   */
  static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
 -                               BlockReopenQueue *queue, Error **errp)
 +                               BlockReopenQueue *queue,
 +                               Transaction *set_backings_tran, Error **errp)
  {
      int ret = -1;
      int old_flags;
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
          goto error;
      }
 -    /* Calculate required permissions after reopening */
 -    bdrv_reopen_perm(queue, reopen_state->bs,
 -                     &reopen_state->perm, &reopen_state->shared_perm);
 -
      if (drv->bdrv_reopen_prepare) {
          /*
           * If a driver-specific option is missing, it means that we
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
       * either a reference to an existing node (using its node name)
       * or NULL to simply detach the current backing file.
       */
 -    ret = bdrv_reopen_parse_backing(reopen_state, errp);
 +    ret = bdrv_reopen_parse_backing(reopen_state, set_backings_tran, errp);
      if (ret < 0) {
          goto error;
      }
@@ -XXX,XX +XXX,XX @@ static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
          qdict_del(bs->explicit_options, child->name);
          qdict_del(bs->options, child->name);
      }
 -
 -    /*
 -     * Change the backing file if a new one was specified. We do this
 -     * after updating bs->options, so bdrv_refresh_filename() (called
 -     * from bdrv_set_backing_hd()) has the new values.
 -     */
 -    if (reopen_state->replace_backing_bs) {
 -        BlockDriverState *old_backing_bs = child_bs(bs->backing);
 -        assert(!old_backing_bs || !old_backing_bs->implicit);
 -        /* Abort the permission update on the backing bs we're detaching */
 -        if (old_backing_bs) {
 -            bdrv_abort_perm_update(old_backing_bs);
 -        }
 -        bdrv_set_backing_hd(bs, reopen_state->new_backing_bs, &error_abort);
 -    }
 -
      bdrv_refresh_limits(bs, NULL, NULL);
  }
 diff --git a/block/file-posix.c b/block/file-posix.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/file-posix.c
 +++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVRawState {
  } BDRVRawState;
  typedef struct BDRVRawReopenState {
 -    int fd;
      int open_flags;
      bool drop_cache;
      bool check_cache_dropped;
@@ -XXX,XX +XXX,XX @@ static int raw_reopen_prepare(BDRVReopenState *state,
      BDRVRawReopenState *rs;
      QemuOpts *opts;
      int ret;
-@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+-    Error *local_err = NULL;
-     /* Write the initial BAT */
-     offset = 3 * 512;
+     assert(state != NULL);
+     assert(state->bs != NULL);
--    memset(buf, 0xFF, 512);
+@@ -XXX,XX +XXX,XX @@ static int raw_reopen_prepare(BDRVReopenState *state,
-+    memset(bat_sector, 0xFF, 512);
+      * bdrv_reopen_prepare() will detect changes and complain. */
-     for (i = 0; i < DIV_ROUND_UP(num_bat_entries * 4, 512); i++) {
+     qemu_opts_to_qdict(opts, state->options);
--        ret = blk_pwrite(blk, offset, buf, 512, 0);
-+        ret = blk_pwrite(blk, offset, bat_sector, 512, 0);
+-    rs->fd = raw_reconfigure_getfd(state->bs, state->flags, &rs->open_flags,
-         if (ret < 0) {
+-                                   state->perm, true, &local_err);
-             goto fail;
+-    if (local_err) {
-         }
+-        error_propagate(errp, local_err);
 -        ret = -1;
 -        goto out;
 -    }
 -
 -    /* Fail already reopen_prepare() if we can't get a working O_DIRECT
 -     * alignment with the new fd. */
 -    if (rs->fd != -1) {
 -        raw_probe_alignment(state->bs, rs->fd, &local_err);
 -        if (local_err) {
 -            error_propagate(errp, local_err);
 -            ret = -EINVAL;
 -            goto out_fd;
 -        }
 -    }
 +    /*
 +     * As part of reopen prepare we also want to create new fd by
 +     * raw_reconfigure_getfd(). But it wants updated "perm", when in
 +     * bdrv_reopen_multiple() .bdrv_reopen_prepare() callback called prior to
 +     * permission update. Happily, permission update is always a part (a seprate
 +     * stage) of bdrv_reopen_multiple() so we can rely on this fact and
 +     * reconfigure fd in raw_check_perm().
 +     */
      s->reopen_state = state;
      ret = 0;
 -out_fd:
 -    if (ret < 0) {
 -        qemu_close(rs->fd);
 -        rs->fd = -1;
 -    }
 +
  out:
      qemu_opts_del(opts);
      return ret;
@@ -XXX,XX +XXX,XX @@ static void raw_reopen_commit(BDRVReopenState *state)
      s->drop_cache = rs->drop_cache;
      s->check_cache_dropped = rs->check_cache_dropped;
      s->open_flags = rs->open_flags;
 -
 -    qemu_close(s->fd);
 -    s->fd = rs->fd;
 -
      g_free(state->opaque);
      state->opaque = NULL;
@@ -XXX,XX +XXX,XX @@ static void raw_reopen_abort(BDRVReopenState *state)
          return;
      }
 -    if (rs->fd >= 0) {
 -        qemu_close(rs->fd);
 -        rs->fd = -1;
 -    }
      g_free(state->opaque);
      state->opaque = NULL;
@@ -XXX,XX +XXX,XX @@ static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
                            Error **errp)
  {
      BDRVRawState *s = bs->opaque;
 -    BDRVRawReopenState *rs = NULL;
 +    int input_flags = s->reopen_state ? s->reopen_state->flags : bs->open_flags;
      int open_flags;
      int ret;
 -    if (s->perm_change_fd) {
 +    /* We may need a new fd if auto-read-only switches the mode */
 +    ret = raw_reconfigure_getfd(bs, input_flags, &open_flags, perm,
 +                                false, errp);
 +    if (ret < 0) {
 +        return ret;
 +    } else if (ret != s->fd) {
 +        Error *local_err = NULL;
 +
          /*
 -         * In the context of reopen, this function may be called several times
 -         * (directly and recursively while change permissions of the parent).
 -         * This is even true for children that don't inherit from the original
 -         * reopen node, so s->reopen_state is not set.
 -         *
 -         * Ignore all but the first call.
 +         * Fail already check_perm() if we can't get a working O_DIRECT
 +         * alignment with the new fd.
           */
 -        return 0;
 -    }
 -
 -    if (s->reopen_state) {
 -        /* We already have a new file descriptor to set permissions for */
 -        assert(s->reopen_state->perm == perm);
 -        assert(s->reopen_state->shared_perm == shared);
 -        rs = s->reopen_state->opaque;
 -        s->perm_change_fd = rs->fd;
 -        s->perm_change_flags = rs->open_flags;
 -    } else {
 -        /* We may need a new fd if auto-read-only switches the mode */
 -        ret = raw_reconfigure_getfd(bs, bs->open_flags, &open_flags, perm,
 -                                    false, errp);
 -        if (ret < 0) {
 -            return ret;
 -        } else if (ret != s->fd) {
 -            s->perm_change_fd = ret;
 -            s->perm_change_flags = open_flags;
 +        raw_probe_alignment(bs, ret, &local_err);
 +        if (local_err) {
 +            error_propagate(errp, local_err);
 +            return -EINVAL;
          }
 +
 +        s->perm_change_fd = ret;
 +        s->perm_change_flags = open_flags;
      }
      /* Prepare permissions on old fd to avoid conflicts between old and new,
@@ -XXX,XX +XXX,XX @@ static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
      return 0;
  fail:
 -    if (s->perm_change_fd && !s->reopen_state) {
 +    if (s->perm_change_fd) {
          qemu_close(s->perm_change_fd);
      }
      s->perm_change_fd = 0;
@@ -XXX,XX +XXX,XX @@ static void raw_abort_perm_update(BlockDriverState *bs)
      /* For reopen, .bdrv_reopen_abort is called afterwards and will close
       * the file descriptor. */
 -    if (s->perm_change_fd && !s->reopen_state) {
 +    if (s->perm_change_fd) {
          qemu_close(s->perm_change_fd);
      }
      s->perm_change_fd = 0;
 --
-.29.2
+.30.2

-[PULL 05/17] docs: add qemu-storage-daemon(1) man page
+[PULL 31/39] block: drop unused permission update functions
-From: Stefan Hajnoczi <stefanha@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Document the qemu-storage-daemon tool. Most of the command-line options
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-are identical to their QEMU counterparts. Perhaps Sphinx hxtool
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-integration could be extended to extract documentation for individual
+Message-Id: <20210428151804.439460-32-vsementsov@virtuozzo.com>
 command-line options so they can be shared. For now the
 qemu-storage-daemon simply refers to the qemu(1) man page where the
 command-line options are identical.
 Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
 Message-Id: <20201209103802.350848-3-stefanha@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- docs/tools/conf.py                 |   2 +
+ block.c | 103 --------------------------------------------------------
- docs/tools/index.rst               |   1 +
+file changed, 103 deletions(-)
  docs/tools/qemu-storage-daemon.rst | 148 +++++++++++++++++++++++++++++
 files changed, 151 insertions(+)
  create mode 100644 docs/tools/qemu-storage-daemon.rst
-diff --git a/docs/tools/conf.py b/docs/tools/conf.py
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/tools/conf.py
+--- a/block.c
-+++ b/docs/tools/conf.py
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ html_theme_options['description'] = \
+@@ -XXX,XX +XXX,XX @@ static int bdrv_fill_options(QDict **options, const char *filename,
- man_pages = [
+     return 0;
-     ('qemu-img', 'qemu-img', u'QEMU disk image utility',
+ }
-      ['Fabrice Bellard'], 1),
-+    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
+-static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
-+     [], 1),
+-                                  uint64_t new_used_perm,
-     ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
+-                                  uint64_t new_shared_perm,
-      ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
+-                                  Error **errp);
-     ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
+-
-diff --git a/docs/tools/index.rst b/docs/tools/index.rst
+ typedef struct BlockReopenQueueEntry {
-index XXXXXXX..XXXXXXX 100644
+      bool prepared;
---- a/docs/tools/index.rst
+      bool perms_checked;
-+++ b/docs/tools/index.rst
+@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
-@@ -XXX,XX +XXX,XX @@ Contents:
+     return 0;
-    :maxdepth: 2
+ }
-    qemu-img
+-static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-+   qemu-storage-daemon
+-                           uint64_t cumulative_perms,
-    qemu-nbd
+-                           uint64_t cumulative_shared_perms, Error **errp)
-    qemu-pr-helper
+-{
-    qemu-trace-stap
+-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-diff --git a/docs/tools/qemu-storage-daemon.rst b/docs/tools/qemu-storage-daemon.rst
+-    return bdrv_check_perm_common(list, q, true, cumulative_perms,
-new file mode 100644
+-                                  cumulative_shared_perms, NULL, errp);
-index XXXXXXX..XXXXXXX
+-}
---- /dev/null
+-
-+++ b/docs/tools/qemu-storage-daemon.rst
+ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
-@@ -XXX,XX +XXX,XX @@
+                                    Transaction *tran, Error **errp)
-+QEMU Storage Daemon
+ {
-+===================
+     return bdrv_check_perm_common(list, q, false, 0, 0, tran, errp);
-+
+ }
-+Synopsis
-+--------
+-/*
-+
+- * Notifies drivers that after a previous bdrv_check_perm() call, the
-+**qemu-storage-daemon** [options]
+- * permission update is not performed and any preparations made for it (e.g.
-+
+- * taken file locks) need to be undone.
-+Description
+- */
-+-----------
+-static void bdrv_node_abort_perm_update(BlockDriverState *bs)
-+
+-{
-+qemu-storage-daemon provides disk image functionality from QEMU, qemu-img, and
+-    BlockDriver *drv = bs->drv;
-+qemu-nbd in a long-running process controlled via QMP commands without running
+-    BdrvChild *c;
-+a virtual machine. It can export disk images, run block job operations, and
+-
-+perform other disk-related operations. The daemon is controlled via a QMP
+-    if (!drv) {
-+monitor and initial configuration from the command-line.
+-        return;
-+
+-    }
-+The daemon offers the following subset of QEMU features:
+-
-+
+-    bdrv_drv_set_perm_abort(bs);
-+* Block nodes
+-
-+* Block jobs
+-    QLIST_FOREACH(c, &bs->children, next) {
-+* Block exports
+-        bdrv_child_set_perm_abort(c);
-+* Throttle groups
+-    }
-+* Character devices
+-}
-+* Crypto and secrets
+-
-+* QMP
+-static void bdrv_list_abort_perm_update(GSList *list)
-+* IOThreads
+-{
-+
+-    for ( ; list; list = list->next) {
-+Commands can be sent over a QEMU Monitor Protocol (QMP) connection. See the
+-        bdrv_node_abort_perm_update((BlockDriverState *)list->data);
-+:manpage:`qemu-storage-daemon-qmp-ref(7)` manual page for a description of the
+-    }
-+commands.
+-}
-+
+-
-+The daemon runs until it is stopped using the ``quit`` QMP command or
+-__attribute__((unused))
-+SIGINT/SIGHUP/SIGTERM.
+-static void bdrv_abort_perm_update(BlockDriverState *bs)
-+
+-{
-+**Warning:** Never modify images in use by a running virtual machine or any
+-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-+other process; this may destroy the image. Also, be aware that querying an
+-    return bdrv_list_abort_perm_update(list);
-+image that is being modified by another process may encounter inconsistent
+-}
-+state.
+-
-+
+ static void bdrv_node_set_perm(BlockDriverState *bs)
-+Options
+ {
-+-------
+     BlockDriver *drv = bs->drv;
-+
+@@ -XXX,XX +XXX,XX @@ char *bdrv_perm_names(uint64_t perm)
-+.. program:: qemu-storage-daemon
+     return g_string_free(result, FALSE);
-+
+ }
-+Standard options:
-+
+-/*
-+.. option:: -h, --help
+- * Checks whether a new reference to @bs can be added if the new user requires
-+
+- * @new_used_perm/@new_shared_perm as its permissions. If @ignore_children is
-+  Display help and exit
+- * set, the BdrvChild objects in this list are ignored in the calculations;
-+
+- * this allows checking permission updates for an existing reference.
-+.. option:: -V, --version
+- *
-+
+- * Needs to be followed by a call to either bdrv_set_perm() or
-+  Display version information and exit
+- * bdrv_abort_perm_update(). */
-+
+-__attribute__((unused))
-+.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
+-static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
-+
+-                                  uint64_t new_used_perm,
-+  .. include:: ../qemu-option-trace.rst.inc
+-                                  uint64_t new_shared_perm,
-+
+-                                  Error **errp)
-+.. option:: --blockdev BLOCKDEVDEF
+-{
-+
+-    BdrvChild *c;
-+  is a block node definition. See the :manpage:`qemu(1)` manual page for a
+-    uint64_t cumulative_perms = new_used_perm;
-+  description of block node properties and the :manpage:`qemu-block-drivers(7)`
+-    uint64_t cumulative_shared_perms = new_shared_perm;
-+  manual page for a description of driver-specific parameters.
+-
-+
+-
-+.. option:: --chardev CHARDEVDEF
+-    /* There is no reason why anyone couldn't tolerate write_unchanged */
-+
+-    assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
-+  is a character device definition. See the :manpage:`qemu(1)` manual page for
+-
-+  a description of character device properties. A common character device
+-    QLIST_FOREACH(c, &bs->parents, next_parent) {
-+  definition configures a UNIX domain socket::
+-        if ((new_used_perm & c->shared_perm) != new_used_perm) {
-+
+-            char *user = bdrv_child_user_desc(c);
-+  --chardev socket,id=char1,path=/tmp/qmp.sock,server,nowait
+-            char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
-+
+-
-+.. option:: --export [type=]nbd,id=<id>,node-name=<node-name>[,name=<export-name>][,writable=on|off][,bitmap=<name>]
+-            error_setg(errp, "Conflicts with use by %s as '%s', which does not "
-+  --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=unix,addr.path=<socket-path>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
+-                             "allow '%s' on %s",
-+  --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=fd,addr.str=<fd>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
+-                       user, c->name, perm_names, bdrv_get_node_name(c->bs));
-+
+-            g_free(user);
-+  is a block export definition. ``node-name`` is the block node that should be
+-            g_free(perm_names);
-+  exported. ``writable`` determines whether or not the export allows write
+-            return -EPERM;
-+  requests for modifying data (the default is off).
+-        }
-+
+-
-+  The ``nbd`` export type requires ``--nbd-server`` (see below). ``name`` is
+-        if ((c->perm & new_shared_perm) != c->perm) {
-+  the NBD export name. ``bitmap`` is the name of a dirty bitmap reachable from
+-            char *user = bdrv_child_user_desc(c);
-+  the block node, so the NBD client can use NBD_OPT_SET_META_CONTEXT with the
+-            char *perm_names = bdrv_perm_names(c->perm & ~new_shared_perm);
-+  metadata context name "qemu:dirty-bitmap:BITMAP" to inspect the bitmap.
+-
-+
+-            error_setg(errp, "Conflicts with use by %s as '%s', which uses "
-+  The ``vhost-user-blk`` export type takes a vhost-user socket address on which
+-                             "'%s' on %s",
-+  it accept incoming connections. Both
+-                       user, c->name, perm_names, bdrv_get_node_name(c->bs));
-+  ``addr.type=unix,addr.path=<socket-path>`` for UNIX domain sockets and
+-            g_free(user);
-+  ``addr.type=fd,addr.str=<fd>`` for file descriptor passing are supported.
+-            g_free(perm_names);
-+  ``logical-block-size`` sets the logical block size in bytes (the default is
+-            return -EPERM;
-+  512). ``num-queues`` sets the number of virtqueues (the default is 1).
+-        }
-+
+-
-+.. option:: --monitor MONITORDEF
+-        cumulative_perms |= c->perm;
-+
+-        cumulative_shared_perms &= c->shared_perm;
-+  is a QMP monitor definition. See the :manpage:`qemu(1)` manual page for
+-    }
-+  a description of QMP monitor properties. A common QMP monitor definition
+-
-+  configures a monitor on character device ``char1``::
+-    return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
-+
+-                           errp);
-+  --monitor chardev=char1
+-}
-+
-+.. option:: --nbd-server addr.type=inet,addr.host=<host>,addr.port=<port>[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
+ static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
-+  --nbd-server addr.type=unix,addr.path=<path>[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
+ {
 +
 +  is a server for NBD exports. Both TCP and UNIX domain sockets are supported.
 +  TLS encryption can be configured using ``--object`` tls-creds-* and authz-*
 +  secrets (see below).
 +
 +  To configure an NBD server on UNIX domain socket path ``/tmp/nbd.sock``::
 +
 +  --nbd-server addr.type=unix,addr.path=/tmp/nbd.sock
 +
 +.. option:: --object help
 +  --object <type>,help
 +  --object <type>[,<property>=<value>...]
 +
 +  is a QEMU user creatable object definition. List object types with ``help``.
 +  List object properties with ``<type>,help``. See the :manpage:`qemu(1)`
 +  manual page for a description of the object properties.
 +
 +Examples
 +--------
 +Launch the daemon with QMP monitor socket ``qmp.sock`` so clients can execute
 +QMP commands::
 +
 +  $ qemu-storage-daemon \
 +      --chardev socket,path=qmp.sock,server,nowait,id=char1 \
 +      --monitor chardev=char1
 +
 +Export raw image file ``disk.img`` over NBD UNIX domain socket ``nbd.sock``::
 +
 +  $ qemu-storage-daemon \
 +      --blockdev driver=file,node-name=disk,filename=disk.img \
 +      --nbd-server addr.type=unix,addr.path=nbd.sock \
 +      --export type=nbd,id=export,node-name=disk,writable=on
 +
 +Export a qcow2 image file ``disk.qcow2`` as a vhosts-user-blk device over UNIX
 +domain socket ``vhost-user-blk.sock``::
 +
 +  $ qemu-storage-daemon \
 +      --blockdev driver=file,node-name=file,filename=disk.qcow2 \
 +      --blockdev driver=qcow2,node-name=qcow2,file=file \
 +      --export type=vhost-user-blk,id=export,addr.type=unix,addr.path=vhost-user-blk.sock,node-name=qcow2
 +
 +See also
 +--------
 +
 +:manpage:`qemu(1)`, :manpage:`qemu-block-drivers(7)`, :manpage:`qemu-storage-daemon-qmp-ref(7)`
 --
-.29.2
+.30.2

-[PULL 08/17] iotests:172: use _filter_qom_path
+[PULL 32/39] block: inline bdrv_check_perm_common()
 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-device[NUMBER] thing in QOM path is not stable and tracking it during
+bdrv_check_perm_common() has only one caller, so no more sense in
-code modifications is not fun. Let's filter it like it's already done
+"common".
 in iotest 186.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Message-Id: <20201216095205.526235-3-vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-33-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- tests/qemu-iotests/172     |   2 +-
+ block.c | 32 +++-----------------------------
- tests/qemu-iotests/172.out | 152 ++++++++++++++++++-------------------
+file changed, 3 insertions(+), 29 deletions(-)
 files changed, 77 insertions(+), 77 deletions(-)
-diff --git a/tests/qemu-iotests/172 b/tests/qemu-iotests/172
+diff --git a/block.c b/block.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/172
+--- a/block.c
-+++ b/tests/qemu-iotests/172
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ check_floppy_qtree()
+@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-     (QEMU_OPTIONS="" do_run_qemu "$@" |
+     return 0;
      _filter_testdir |_filter_generated_node_ids | _filter_hmp |
          sed -ne '/^          dev: isa-fdc/,/^          dev:/{x;p};/^[a-z][^ ]* (NODE_NAME):* /,/^(qemu)$/{p}') 2>&1 |
 -    _filter_win32 | _filter_qemu
 +    _filter_win32 | _filter_qemu | _filter_qom_path
  }
- check_cache_mode()
+-/*
-diff --git a/tests/qemu-iotests/172.out b/tests/qemu-iotests/172.out
+- * If use_cumulative_perms is true, use cumulative_perms and
-index XXXXXXX..XXXXXXX 100644
+- * cumulative_shared_perms for first element of the list. Otherwise just refresh
---- a/tests/qemu-iotests/172.out
+- * all permissions.
-+++ b/tests/qemu-iotests/172.out
+- */
-@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2
+-static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
-                 share-rw = false
+-                                  bool use_cumulative_perms,
-                 drive-type = "144"
+-                                  uint64_t cumulative_perms,
- floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
+-                                  uint64_t cumulative_shared_perms,
--    Attached to:      /machine/unattached/device[15]
+-                                  Transaction *tran, Error **errp)
-+    Attached to:      /machine/unattached/device[N]
++static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
-     Removable device: not locked, tray closed
++                                   Transaction *tran, Error **errp)
-     Cache mode:       writeback
+ {
+     int ret;
- ide1-cd0: [not inserted]
++    uint64_t cumulative_perms, cumulative_shared_perms;
--    Attached to:      /machine/unattached/device[22]
+     BlockDriverState *bs;
-+    Attached to:      /machine/unattached/device[N]
-     Removable device: not locked, tray closed
+-    if (use_cumulative_perms) {
+-        bs = list->data;
- sd0: [not inserted]
+-
-@@ -XXX,XX +XXX,XX @@ Testing: -fdb TEST_DIR/t.qcow2
+-        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
-                 share-rw = false
+-                                   cumulative_shared_perms,
-                 drive-type = "288"
+-                                   tran, errp);
- floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
+-        if (ret < 0) {
--    Attached to:      /machine/unattached/device[16]
+-            return ret;
-+    Attached to:      /machine/unattached/device[N]
+-        }
-     Removable device: not locked, tray closed
+-
-     Cache mode:       writeback
+-        list = list->next;
+-    }
- ide1-cd0: [not inserted]
+-
--    Attached to:      /machine/unattached/device[23]
+     for ( ; list; list = list->next) {
-+    Attached to:      /machine/unattached/device[N]
+         bs = list->data;
-     Removable device: not locked, tray closed
+@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
- floppy0: [not inserted]
+     return 0;
--    Attached to:      /machine/unattached/device[15]
+ }
-+    Attached to:      /machine/unattached/device[N]
-     Removable device: not locked, tray closed
+-static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
+-                                   Transaction *tran, Error **errp)
- sd0: [not inserted]
+-{
-@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2 -fdb TEST_DIR/t.qcow2.2
+-    return bdrv_check_perm_common(list, q, false, 0, 0, tran, errp);
-                 share-rw = false
+-}
-                 drive-type = "144"
+-
- floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
+ static void bdrv_node_set_perm(BlockDriverState *bs)
--    Attached to:      /machine/unattached/device[15]
+ {
-+    Attached to:      /machine/unattached/device[N]
+     BlockDriver *drv = bs->drv;
      Removable device: not locked, tray closed
      Cache mode:       writeback
  floppy1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/unattached/device[16]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[23]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2,index=1
                  share-rw = false
                  drive-type = "288"
  floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[16]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[23]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  floppy0: [not inserted]
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=floppy,file=TEST_DIR/t
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  floppy1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/unattached/device[16]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[23]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/unattached/device[16]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[23]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,unit=1
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qco
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[1]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[16]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[23]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[16]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[23]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                  share-rw = false
                  drive-type = "144"
  floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                  share-rw = false
                  drive-type = "144"
  floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                  share-rw = false
                  drive-type = "144"
  floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/unattached/device[15]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[22]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -global floppy.drive=none0 -device
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,drive-t
                  share-rw = false
                  drive-type = "120"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,drive-t
                  share-rw = false
                  drive-type = "288"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,logical
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,physica
                  share-rw = false
                  drive-type = "144"
  none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
 -    Attached to:      /machine/peripheral-anon/device[0]
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  ide1-cd0: [not inserted]
 -    Attached to:      /machine/unattached/device[21]
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  sd0: [not inserted]
 --
-.29.2
+.30.2

-[PULL 07/17] iotests: make _filter_qom_path more strict
+[PULL 33/39] block: inline bdrv_replace_child()
 From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-According to original commit, that added this filter (627f607e3dddb2),
+bdrv_replace_child() has only one caller, the second argument is
-the problematic thing in qom path is device[NUMBER], not the whole
+unused. Inline it now. This triggers deletion of some more unused
-path. Seems that tracking the other parts of the path in iotest output
+interfaces.
 is not bad. Let's make _filter_qom_path stricter.
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Message-Id: <20201216095205.526235-2-vsementsov@virtuozzo.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-34-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- tests/qemu-iotests/186.out       | 56 ++++++++++++++++----------------
+ block.c | 101 ++++++++++----------------------------------------------
- tests/qemu-iotests/common.filter |  2 +-
+file changed, 18 insertions(+), 83 deletions(-)
 files changed, 29 insertions(+), 29 deletions(-)
-diff --git a/tests/qemu-iotests/186.out b/tests/qemu-iotests/186.out
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/186.out
+--- a/block.c
-+++ b/tests/qemu-iotests/186.out
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ Testing: -device floppy
+@@ -XXX,XX +XXX,XX @@ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
- QEMU X.Y.Z monitor - type 'help' for more information
+     return 0;
- (qemu) info block
+ }
- /machine/peripheral-anon/device[1]: [not inserted]
--    Attached to:      PATH
+-static void bdrv_node_set_perm(BlockDriverState *bs)
-+    Attached to:      /machine/peripheral-anon/device[N]
+-{
-     Removable device: not locked, tray closed
+-    BlockDriver *drv = bs->drv;
- (qemu) quit
+-    BdrvChild *c;
+-
-@@ -XXX,XX +XXX,XX @@ Testing: -device ide-cd
+-    if (!drv) {
- QEMU X.Y.Z monitor - type 'help' for more information
+-        return;
- (qemu) info block
+-    }
- /machine/peripheral-anon/device[1]: [not inserted]
+-
--    Attached to:      PATH
+-    bdrv_drv_set_perm_commit(bs);
-+    Attached to:      /machine/peripheral-anon/device[N]
+-
-     Removable device: not locked, tray closed
+-    /* Drivers that never have children can omit .bdrv_child_perm() */
- (qemu) quit
+-    if (!drv->bdrv_child_perm) {
+-        assert(QLIST_EMPTY(&bs->children));
-@@ -XXX,XX +XXX,XX @@ Testing: -device scsi-cd
+-        return;
- QEMU X.Y.Z monitor - type 'help' for more information
+-    }
- (qemu) info block
+-
- /machine/peripheral-anon/device[1]: [not inserted]
+-    /* Update all children */
--    Attached to:      PATH
+-    QLIST_FOREACH(c, &bs->children, next) {
-+    Attached to:      /machine/peripheral-anon/device[N]
+-        bdrv_child_set_perm_commit(c);
-     Removable device: not locked, tray closed
+-    }
- (qemu) quit
+-}
+-
-@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device ide-hd,d
+-static void bdrv_list_set_perm(GSList *list)
- QEMU X.Y.Z monitor - type 'help' for more information
+-{
- (qemu) info block
+-    for ( ; list; list = list->next) {
- null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
+-        bdrv_node_set_perm((BlockDriverState *)list->data);
--    Attached to:      PATH
+-    }
-+    Attached to:      /machine/peripheral-anon/device[N]
+-}
-     Cache mode:       writeback
+-
- (qemu) quit
+-static void bdrv_set_perm(BlockDriverState *bs)
+-{
-@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device scsi-hd,
+-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
- QEMU X.Y.Z monitor - type 'help' for more information
+-    return bdrv_list_set_perm(list);
- (qemu) info block
+-}
- null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
+-
--    Attached to:      PATH
+ void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
-+    Attached to:      /machine/peripheral-anon/device[N]
+                               uint64_t *shared_perm)
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device virtio-b
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]/virtio-backend
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device virtio-b
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral/qdev_id/virtio-backend
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device floppy,d
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device ide-cd,d
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device scsi-cd,
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
      Cache mode:       writeback
  null: json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral/qdev_id/virtio-backend
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device ide
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device scs
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device vir
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]/virtio-backend
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device vir
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral/qdev_id/virtio-backend
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device flo
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device ide
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device scs
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none -device floppy,drive=none0
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0: [not inserted]
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none -device ide-cd,drive=none0
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0: [not inserted]
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none -device scsi-cd,drive=none0
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  none0: [not inserted]
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]
      Removable device: not locked, tray closed
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  floppy0: [not inserted]
 -    Attached to:      PATH
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,driver=null-co,read-zeroes=on
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  floppy0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=ide,driver=null-co,read-zeroes=on
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  ide0-hd0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/unattached/device[N]
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=ide,media=cdrom
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  ide0-cd0: [not inserted]
 -    Attached to:      PATH
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=ide,driver=null-co,read-zeroes=on,media=cdrom
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  ide0-cd0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co, read-only)
 -    Attached to:      PATH
 +    Attached to:      /machine/unattached/device[N]
      Removable device: not locked, tray closed
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=virtio,driver=null-co,read-zeroes=on
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  virtio0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/peripheral-anon/device[N]/virtio-backend
      Cache mode:       writeback
  (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=pflash,driver=null-co,read-zeroes=on,size=1M
  QEMU X.Y.Z monitor - type 'help' for more information
  (qemu) info block
  pflash0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co", "size": "1M"} (null-co)
 -    Attached to:      PATH
 +    Attached to:      /machine/system.flash0
      Cache mode:       writeback
  (qemu) quit
 diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qemu-iotests/common.filter
 +++ b/tests/qemu-iotests/common.filter
@@ -XXX,XX +XXX,XX @@ _filter_generated_node_ids()
  _filter_qom_path()
  {
--    $SED -e 's#\(Attached to: *\) /.*#\1 PATH#'
+@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child_noperm(BdrvChild *child,
-+    $SED -e '/Attached to:/s/\device[[0-9]\+\]/device[N]/g'
+     }
  }
- # replace occurrences of the actual TEST_DIR value with TEST_DIR
+-/*
 - * Updates @child to change its reference to point to @new_bs, including
 - * checking and applying the necessary permission updates both to the old node
 - * and to @new_bs.
 - *
 - * NULL is passed as @new_bs for removing the reference before freeing @child.
 - *
 - * If @new_bs is not NULL, bdrv_check_perm() must be called beforehand, as this
 - * function uses bdrv_set_perm() to update the permissions according to the new
 - * reference that @new_bs gets.
 - *
 - * Callers must ensure that child->frozen is false.
 - */
 -static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
 -{
 -    BlockDriverState *old_bs = child->bs;
 -
 -    /* Asserts that child->frozen == false */
 -    bdrv_replace_child_noperm(child, new_bs);
 -
 -    /*
 -     * Start with the new node's permissions.  If @new_bs is a (direct
 -     * or indirect) child of @old_bs, we must complete the permission
 -     * update on @new_bs before we loosen the restrictions on @old_bs.
 -     * Otherwise, bdrv_check_perm() on @old_bs would re-initiate
 -     * updating the permissions of @new_bs, and thus not purely loosen
 -     * restrictions.
 -     */
 -    if (new_bs) {
 -        bdrv_set_perm(new_bs);
 -    }
 -
 -    if (old_bs) {
 -        /*
 -         * Update permissions for old node. We're just taking a parent away, so
 -         * we're loosening restrictions. Errors of permission update are not
 -         * fatal in this case, ignore them.
 -         */
 -        bdrv_refresh_perms(old_bs, NULL);
 -
 -        /* When the parent requiring a non-default AioContext is removed, the
 -         * node moves back to the main AioContext */
 -        bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
 -    }
 -}
 -
  static void bdrv_child_free(void *opaque)
  {
      BdrvChild *c = opaque;
@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
  static void bdrv_detach_child(BdrvChild *child)
  {
 -    bdrv_replace_child(child, NULL);
 +    BlockDriverState *old_bs = child->bs;
 +
 +    bdrv_replace_child_noperm(child, NULL);
      bdrv_remove_empty_child(child);
 +
 +    if (old_bs) {
 +        /*
 +         * Update permissions for old node. We're just taking a parent away, so
 +         * we're loosening restrictions. Errors of permission update are not
 +         * fatal in this case, ignore them.
 +         */
 +        bdrv_refresh_perms(old_bs, NULL);
 +
 +        /*
 +         * When the parent requiring a non-default AioContext is removed, the
 +         * node moves back to the main AioContext
 +         */
 +        bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
 +    }
  }
  /*
 --
-.29.2
+.30.2

-[PULL 12/17] block/vpc: Make vpc_checksum() take void *
+[PULL 34/39] block: refactor bdrv_child_set_perm_safe() transaction action
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Some of the next commits will checksum structs.  Change vpc_checksum()
+Old interfaces dropped, nobody directly calls
-to take void * instead of uint8_t, to save us pointless casts to
+bdrv_child_set_perm_abort() and bdrv_child_set_perm_commit(), so we can
-uint8_t *.
+use personal state structure for the action and stop exploiting
 BdrvChild structure. Also, drop "_safe" suffix which is redundant now.
-Signed-off-by: Markus Armbruster <armbru@redhat.com>
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Message-Id: <20201217162003.1102738-5-armbru@redhat.com>
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-Reviewed-by: Max Reitz <mreitz@redhat.com>
+Message-Id: <20210428151804.439460-35-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 3 ++-
+ include/block/block_int.h |  5 ----
-file changed, 2 insertions(+), 1 deletion(-)
+ block.c                   | 63 ++++++++++++++-------------------------
 files changed, 22 insertions(+), 46 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/include/block/block_int.h b/include/block/block_int.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/include/block/block_int.h
-+++ b/block/vpc.c
++++ b/include/block/block_int.h
-@@ -XXX,XX +XXX,XX @@ static QemuOptsList vpc_runtime_opts = {
+@@ -XXX,XX +XXX,XX @@ struct BdrvChild {
+      */
- static QemuOptsList vpc_create_opts;
+     uint64_t shared_perm;
--static uint32_t vpc_checksum(uint8_t *buf, size_t size)
+-    /* backup of permissions during permission update procedure */
-+static uint32_t vpc_checksum(void *p, size_t size)
+-    bool has_backup_perm;
 -    uint64_t backup_perm;
 -    uint64_t backup_shared_perm;
 -
      /*
       * This link is frozen: the child can neither be replaced nor
       * detached from the parent.
 diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block.c
 +++ b/block.c
@@ -XXX,XX +XXX,XX @@ static GSList *bdrv_topological_dfs(GSList *list, GHashTable *found,
      return g_slist_prepend(list, bs);
  }
 -static void bdrv_child_set_perm_commit(void *opaque)
 -{
 -    BdrvChild *c = opaque;
 -
 -    c->has_backup_perm = false;
 -}
 +typedef struct BdrvChildSetPermState {
 +    BdrvChild *child;
 +    uint64_t old_perm;
 +    uint64_t old_shared_perm;
 +} BdrvChildSetPermState;
  static void bdrv_child_set_perm_abort(void *opaque)
  {
-+    uint8_t *buf = p;
+-    BdrvChild *c = opaque;
-     uint32_t res = 0;
+-    /*
-     int i;
+-     * We may have child->has_backup_perm unset at this point, as in case of
 -     * _check_ stage of permission update failure we may _check_ not the whole
 -     * subtree.  Still, _abort_ is called on the whole subtree anyway.
 -     */
 -    if (c->has_backup_perm) {
 -        c->perm = c->backup_perm;
 -        c->shared_perm = c->backup_shared_perm;
 -        c->has_backup_perm = false;
 -    }
 +    BdrvChildSetPermState *s = opaque;
 +
 +    s->child->perm = s->old_perm;
 +    s->child->shared_perm = s->old_shared_perm;
  }
  static TransactionActionDrv bdrv_child_set_pem_drv = {
      .abort = bdrv_child_set_perm_abort,
 -    .commit = bdrv_child_set_perm_commit,
 +    .clean = g_free,
  };
 -/*
 - * With tran=NULL needs to be followed by direct call to either
 - * bdrv_child_set_perm_commit() or bdrv_child_set_perm_abort().
 - *
 - * With non-NULL tran needs to be followed by tran_abort() or tran_commit()
 - * instead.
 - */
 -static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
 -                                     uint64_t shared, Transaction *tran)
 +static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm,
 +                                uint64_t shared, Transaction *tran)
  {
 -    if (!c->has_backup_perm) {
 -        c->has_backup_perm = true;
 -        c->backup_perm = c->perm;
 -        c->backup_shared_perm = c->shared_perm;
 -    }
 -    /*
 -     * Note: it's OK if c->has_backup_perm was already set, as we can find the
 -     * same c twice during check_perm procedure
 -     */
 +    BdrvChildSetPermState *s = g_new(BdrvChildSetPermState, 1);
 +
 +    *s = (BdrvChildSetPermState) {
 +        .child = c,
 +        .old_perm = c->perm,
 +        .old_shared_perm = c->shared_perm,
 +    };
      c->perm = perm;
      c->shared_perm = shared;
 -    if (tran) {
 -        tran_add(tran, &bdrv_child_set_pem_drv, c);
 -    }
 +    tran_add(tran, &bdrv_child_set_pem_drv, s);
  }
  static void bdrv_drv_set_perm_commit(void *opaque)
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
          bdrv_child_perm(bs, c->bs, c, c->role, q,
                          cumulative_perms, cumulative_shared_perms,
                          &cur_perm, &cur_shared);
 -        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, tran);
 +        bdrv_child_set_perm(c, cur_perm, cur_shared, tran);
      }
      return 0;
@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
      Transaction *tran = tran_new();
      int ret;
 -    bdrv_child_set_perm_safe(c, perm, shared, tran);
 +    bdrv_child_set_perm(c, perm, shared, tran);
      ret = bdrv_refresh_perms(c->bs, &local_err);
 --
-.29.2
+.30.2

-[PULL 15/17] block/vpc: Pad VHDFooter, replace uint8_t[] buffers
+[PULL 35/39] block: rename bdrv_replace_child_safe() to bdrv_replace_child()
-From: Markus Armbruster <armbru@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Pad VHDFooter as specified in the "Virtual Hard Disk Image Format
+We don't have bdrv_replace_child(), so it's time for
-Specification" version 1.0[*].  Change footer buffers from
+bdrv_replace_child_safe() to take its place.
 uint8_t[HEADER_SIZE] to VHDFooter.  Their size remains the same.
-The VHDFooter * variables pointing to a VHDFooter variable right next
+Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-to it are now silly.  Eliminate them, and shorten the remaining
+Reviewed-by: Kevin Wolf <kwolf@redhat.com>
-variables' names.
+Message-Id: <20210428151804.439460-36-vsementsov@virtuozzo.com>
 Most variables pointing to s->footer are now also silly.  Eliminate
 them, too.
 [*] http://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc
 Signed-off-by: Markus Armbruster <armbru@redhat.com>
 Message-Id: <20201217162003.1102738-8-armbru@redhat.com>
 Reviewed-by: Max Reitz <mreitz@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/vpc.c | 77 +++++++++++++++++++++++++----------------------------
+ block.c | 10 +++++-----
-file changed, 37 insertions(+), 40 deletions(-)
+file changed, 5 insertions(+), 5 deletions(-)
-diff --git a/block/vpc.c b/block/vpc.c
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/block/vpc.c
+--- a/block.c
-+++ b/block/vpc.c
++++ b/block.c
-@@ -XXX,XX +XXX,XX @@ typedef struct vhd_footer {
+@@ -XXX,XX +XXX,XX @@ static TransactionActionDrv bdrv_replace_child_drv = {
-     QemuUUID    uuid;
+ };
-     uint8_t     in_saved_state;
+ /*
-+    uint8_t     reserved[427];
+- * bdrv_replace_child_safe
- } QEMU_PACKED VHDFooter;
++ * bdrv_replace_child
+  *
-+QEMU_BUILD_BUG_ON(sizeof(VHDFooter) != 512);
+  * Note: real unref of old_bs is done only on commit.
-+
+  */
- typedef struct vhd_dyndisk_header {
+-static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
-     char        magic[8]; /* "cxsparse" */
+-                                    Transaction *tran)
++static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs,
-@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(VHDDynDiskHeader) != 1024);
++                               Transaction *tran)
+ {
- typedef struct BDRVVPCState {
+     BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
-     CoMutex lock;
+     *s = (BdrvReplaceChildState) {
--    uint8_t footer_buf[HEADER_SIZE];
+@@ -XXX,XX +XXX,XX @@ static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
 +    VHDFooter footer;
      uint64_t free_data_block_offset;
      int max_table_entries;
      uint32_t *pagetable;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
          goto fail;
      }
--    ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
+     if (child->bs) {
-+    ret = bdrv_pread(bs->file, 0, &s->footer, HEADER_SIZE);
+-        bdrv_replace_child_safe(child, NULL, tran);
-     if (ret < 0) {
++        bdrv_replace_child(child, NULL, tran);
          error_setg(errp, "Unable to read VHD header");
          goto fail;
      }
--    footer = (VHDFooter *) s->footer_buf;
+     s = g_new(BdrvRemoveFilterOrCowChild, 1);
-+    footer = &s->footer;
+@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_noperm(BlockDriverState *from,
-     if (strncmp(footer->creator, "conectix", 8)) {
+                        c->name, from->node_name);
-         int64_t offset = bdrv_getlength(bs->file->bs);
+             return -EPERM;
          if (offset < 0) {
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
          }
+-        bdrv_replace_child_safe(c, to, tran);
-         /* If a fixed disk, the footer is found only at the end of the file */
++        bdrv_replace_child(c, to, tran);
 -        ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
 +        ret = bdrv_pread(bs->file, offset - HEADER_SIZE, footer,
                           HEADER_SIZE);
          if (ret < 0) {
              goto fail;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
      checksum = be32_to_cpu(footer->checksum);
      footer->checksum = 0;
 -    if (vpc_checksum(s->footer_buf, HEADER_SIZE) != checksum) {
 +    if (vpc_checksum(footer, HEADER_SIZE) != checksum) {
          error_setg(errp, "Incorrect header checksum");
          ret = -EINVAL;
          goto fail;
@@ -XXX,XX +XXX,XX @@ static int rewrite_footer(BlockDriverState *bs)
      BDRVVPCState *s = bs->opaque;
      int64_t offset = s->free_data_block_offset;
 -    ret = bdrv_pwrite_sync(bs->file, offset, s->footer_buf, HEADER_SIZE);
 +    ret = bdrv_pwrite_sync(bs->file, offset, &s->footer, HEADER_SIZE);
      if (ret < 0)
          return ret;
@@ -XXX,XX +XXX,XX @@ fail:
  static int vpc_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
  {
      BDRVVPCState *s = (BDRVVPCState *)bs->opaque;
 -    VHDFooter *footer = (VHDFooter *) s->footer_buf;
 -    if (be32_to_cpu(footer->type) != VHD_FIXED) {
 +    if (be32_to_cpu(s->footer.type) != VHD_FIXED) {
          bdi->cluster_size = s->block_size;
      }
-@@ -XXX,XX +XXX,XX @@ vpc_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
+     return 0;
      int64_t image_offset;
      int64_t n_bytes;
      int64_t bytes_done = 0;
 -    VHDFooter *footer = (VHDFooter *) s->footer_buf;
      QEMUIOVector local_qiov;
 -    if (be32_to_cpu(footer->type) == VHD_FIXED) {
 +    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
          return bdrv_co_preadv(bs->file, offset, bytes, qiov, 0);
      }
@@ -XXX,XX +XXX,XX @@ vpc_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
      int64_t n_bytes;
      int64_t bytes_done = 0;
      int ret = 0;
 -    VHDFooter *footer =  (VHDFooter *) s->footer_buf;
      QEMUIOVector local_qiov;
 -    if (be32_to_cpu(footer->type) == VHD_FIXED) {
 +    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
          return bdrv_co_pwritev(bs->file, offset, bytes, qiov, 0);
      }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_block_status(BlockDriverState *bs,
                                              BlockDriverState **file)
  {
      BDRVVPCState *s = bs->opaque;
 -    VHDFooter *footer = (VHDFooter*) s->footer_buf;
      int64_t image_offset;
      bool allocated;
      int ret;
      int64_t n;
 -    if (be32_to_cpu(footer->type) == VHD_FIXED) {
 +    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
          *pnum = bytes;
          *map = offset;
          *file = bs->file->bs;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
      BlockBackend *blk = NULL;
      BlockDriverState *bs = NULL;
 -    uint8_t footer_buf[HEADER_SIZE];
 -    VHDFooter *footer = (VHDFooter *)footer_buf;
 +    VHDFooter footer;
      uint16_t cyls = 0;
      uint8_t heads = 0;
      uint8_t secs_per_cyl = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
      }
      /* Prepare the Hard Disk Footer */
 -    memset(footer_buf, 0, HEADER_SIZE);
 +    memset(&footer, 0, HEADER_SIZE);
 -    memcpy(footer->creator, "conectix", 8);
 +    memcpy(footer.creator, "conectix", 8);
      if (vpc_opts->force_size) {
 -        memcpy(footer->creator_app, "qem2", 4);
 +        memcpy(footer.creator_app, "qem2", 4);
      } else {
 -        memcpy(footer->creator_app, "qemu", 4);
 +        memcpy(footer.creator_app, "qemu", 4);
      }
 -    memcpy(footer->creator_os, "Wi2k", 4);
 +    memcpy(footer.creator_os, "Wi2k", 4);
 -    footer->features = cpu_to_be32(0x02);
 -    footer->version = cpu_to_be32(0x00010000);
 +    footer.features = cpu_to_be32(0x02);
 +    footer.version = cpu_to_be32(0x00010000);
      if (disk_type == VHD_DYNAMIC) {
 -        footer->data_offset = cpu_to_be64(HEADER_SIZE);
 +        footer.data_offset = cpu_to_be64(HEADER_SIZE);
      } else {
 -        footer->data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
 +        footer.data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
      }
 -    footer->timestamp = cpu_to_be32(time(NULL) - VHD_TIMESTAMP_BASE);
 +    footer.timestamp = cpu_to_be32(time(NULL) - VHD_TIMESTAMP_BASE);
      /* Version of Virtual PC 2007 */
 -    footer->major = cpu_to_be16(0x0005);
 -    footer->minor = cpu_to_be16(0x0003);
 -    footer->orig_size = cpu_to_be64(total_size);
 -    footer->current_size = cpu_to_be64(total_size);
 -    footer->cyls = cpu_to_be16(cyls);
 -    footer->heads = heads;
 -    footer->secs_per_cyl = secs_per_cyl;
 +    footer.major = cpu_to_be16(0x0005);
 +    footer.minor = cpu_to_be16(0x0003);
 +    footer.orig_size = cpu_to_be64(total_size);
 +    footer.current_size = cpu_to_be64(total_size);
 +    footer.cyls = cpu_to_be16(cyls);
 +    footer.heads = heads;
 +    footer.secs_per_cyl = secs_per_cyl;
 -    footer->type = cpu_to_be32(disk_type);
 +    footer.type = cpu_to_be32(disk_type);
      qemu_uuid_generate(&uuid);
 -    footer->uuid = uuid;
 +    footer.uuid = uuid;
 -    footer->checksum = cpu_to_be32(vpc_checksum(footer_buf, HEADER_SIZE));
 +    footer.checksum = cpu_to_be32(vpc_checksum(&footer, HEADER_SIZE));
      if (disk_type == VHD_DYNAMIC) {
 -        ret = create_dynamic_disk(blk, footer_buf, total_sectors);
 +        ret = create_dynamic_disk(blk, (uint8_t *)&footer, total_sectors);
          if (ret < 0) {
              error_setg(errp, "Unable to create or write VHD header");
          }
      } else {
 -        ret = create_fixed_disk(blk, footer_buf, total_size, errp);
 +        ret = create_fixed_disk(blk, (uint8_t *)&footer, total_size, errp);
      }
  out:
@@ -XXX,XX +XXX,XX @@ fail:
  static int vpc_has_zero_init(BlockDriverState *bs)
  {
      BDRVVPCState *s = bs->opaque;
 -    VHDFooter *footer =  (VHDFooter *) s->footer_buf;
 -    if (be32_to_cpu(footer->type) == VHD_FIXED) {
 +    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
          return bdrv_has_zero_init(bs->file->bs);
      } else {
          return 1;
 --
-.29.2
+.30.2

-[PULL 04/17] docs: generate qemu-storage-daemon-qmp-ref(7) man page
+[PULL 36/39] block: refactor bdrv_node_check_perm()
-From: Stefan Hajnoczi <stefanha@redhat.com>
+From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
-Although individual qemu-storage-daemon QMP commands are identical to
+Now, bdrv_node_check_perm() is called only with fresh cumulative
-QEMU QMP commands, qemu-storage-daemon only supports a subset of QEMU's
+permissions, so its actually "refresh_perm".
 QMP commands. Generate a manual page of just the commands supported by
 qemu-storage-daemon so that users know exactly what is available in
 qemu-storage-daemon.
-Add an h1 heading in storage-daemon/qapi/qapi-schema.json so that
+Move permission calculation to the function. Also, drop unreachable
-block-core.json is at the h2 heading level.
+error message and rewrite the remaining one to be more generic (as now
 we don't know which node is added and which was already here).
-Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
+Add also Virtuozzo copyright, as big work is done at this point.
-Message-Id: <20201209103802.350848-2-stefanha@redhat.com>
 Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Kevin Wolf <kwolf@redhat.com>
 Message-Id: <20210428151804.439460-37-vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- docs/interop/conf.py                         |  2 ++
+ block.c                | 38 +++++++++++---------------------------
- docs/interop/index.rst                       |  1 +
+ tests/qemu-iotests/245 |  2 +-
- docs/interop/qemu-storage-daemon-qmp-ref.rst | 13 +++++++++++++
+files changed, 12 insertions(+), 28 deletions(-)
  docs/meson.build                             |  1 +
  storage-daemon/qapi/qapi-schema.json         |  3 +++
 files changed, 20 insertions(+)
  create mode 100644 docs/interop/qemu-storage-daemon-qmp-ref.rst
-diff --git a/docs/interop/conf.py b/docs/interop/conf.py
+diff --git a/block.c b/block.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/interop/conf.py
+--- a/block.c
-+++ b/docs/interop/conf.py
++++ b/block.c
@@ -XXX,XX +XXX,XX @@ man_pages = [
       [], 7),
      ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
       [], 7),
 +    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
 +     'QEMU Storage Daemon QMP Reference Manual', [], 7),
  ]
 diff --git a/docs/interop/index.rst b/docs/interop/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/interop/index.rst
 +++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
     qemu-ga
     qemu-ga-ref
     qemu-qmp-ref
 +   qemu-storage-daemon-qmp-ref
     vhost-user
     vhost-user-gpu
     vhost-vdpa
 diff --git a/docs/interop/qemu-storage-daemon-qmp-ref.rst b/docs/interop/qemu-storage-daemon-qmp-ref.rst
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/interop/qemu-storage-daemon-qmp-ref.rst
 @@ -XXX,XX +XXX,XX @@
-+QEMU Storage Daemon QMP Reference Manual
+  * QEMU System Emulator block driver
-+========================================
+  *
   * Copyright (c) 2003 Fabrice Bellard
 + * Copyright (c) 2020 Virtuozzo International GmbH.
   *
   * Permission is hereby granted, free of charge, to any person obtaining a copy
   * of this software and associated documentation files (the "Software"), to deal
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs,
  }
  /*
 - * Check whether permissions on this node can be changed in a way that
 - * @cumulative_perms and @cumulative_shared_perms are the new cumulative
 - * permissions of all its parents. This involves checking whether all necessary
 - * permission changes to child nodes can be performed.
 - *
 - * A call to this function must always be followed by a call to bdrv_set_perm()
 - * or bdrv_abort_perm_update().
 + * Refresh permissions in @bs subtree. The function is intended to be called
 + * after some graph modification that was done without permission update.
   */
 -static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
 -                                uint64_t cumulative_perms,
 -                                uint64_t cumulative_shared_perms,
 -                                Transaction *tran, Error **errp)
 +static int bdrv_node_refresh_perm(BlockDriverState *bs, BlockReopenQueue *q,
 +                                  Transaction *tran, Error **errp)
  {
      BlockDriver *drv = bs->drv;
      BdrvChild *c;
      int ret;
 +    uint64_t cumulative_perms, cumulative_shared_perms;
 +
-+..
++    bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
-+   TODO: the old Texinfo manual used to note that this manual
-+   is GPL-v2-or-later. We should make that reader-visible
+     /* Write permissions never work with read-only images */
-+   both here and in our Sphinx manuals more generally.
+     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
-+
+@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-+..
+         if (!bdrv_is_writable_after_reopen(bs, NULL)) {
-+   TODO: display the QEMU version, both here and in our Sphinx manuals
+             error_setg(errp, "Block node is read-only");
-+   more generally.
+         } else {
-+
+-            uint64_t current_perms, current_shared;
-+.. qapi-doc:: storage-daemon/qapi/qapi-schema.json
+-            bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
-diff --git a/docs/meson.build b/docs/meson.build
+-            if (current_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
-index XXXXXXX..XXXXXXX 100644
+-                error_setg(errp, "Cannot make block node read-only, there is "
---- a/docs/meson.build
+-                           "a writer on it");
-+++ b/docs/meson.build
+-            } else {
-@@ -XXX,XX +XXX,XX @@ if build_docs
+-                error_setg(errp, "Cannot make block node read-only and create "
-         'qemu-ga.8': (have_tools ? 'man8' : ''),
+-                           "a writer on it");
-         'qemu-ga-ref.7': 'man7',
+-            }
-         'qemu-qmp-ref.7': 'man7',
++            error_setg(errp, "Read-only block node '%s' cannot support "
-+        'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
++                       "read-write users", bdrv_get_node_name(bs));
-     },
+         }
-     'tools': {
-         'qemu-img.1': (have_tools ? 'man1' : ''),
+         return -EPERM;
-diff --git a/storage-daemon/qapi/qapi-schema.json b/storage-daemon/qapi/qapi-schema.json
+@@ -XXX,XX +XXX,XX @@ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
-index XXXXXXX..XXXXXXX 100644
+                                    Transaction *tran, Error **errp)
---- a/storage-daemon/qapi/qapi-schema.json
+ {
-+++ b/storage-daemon/qapi/qapi-schema.json
+     int ret;
-@@ -XXX,XX +XXX,XX @@
+-    uint64_t cumulative_perms, cumulative_shared_perms;
+     BlockDriverState *bs;
- { 'include': '../../qapi/pragma.json' }
+     for ( ; list; list = list->next) {
-+##
+@@ -XXX,XX +XXX,XX @@ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
-+# = Block devices
+             return -EINVAL;
-+##
+         }
- { 'include': '../../qapi/block-core.json' }
- { 'include': '../../qapi/block-export.json' }
+-        bdrv_get_cumulative_perm(bs, &cumulative_perms,
- { 'include': '../../qapi/char.json' }
+-                                 &cumulative_shared_perms);
 -
 -        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
 -                                   cumulative_shared_perms,
 -                                   tran, errp);
 +        ret = bdrv_node_refresh_perm(bs, q, tran, errp);
          if (ret < 0) {
              return ret;
          }
 diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
 index XXXXXXX..XXXXXXX 100755
 --- a/tests/qemu-iotests/245
 +++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
          # We can't reopen hd1 to read-only, as block-stream requires it to be
          # read-write
          self.reopen(opts['backing'], {'read-only': True},
 -                    "Cannot make block node read-only, there is a writer on it")
 +                    "Read-only block node 'hd1' cannot support read-write users")
          # We can't remove hd2 while the stream job is ongoing
          opts['backing']['backing'] = None
 --
-.29.2
+.30.2

-[PULL 03/17] block/nfs: fix int overflow in nfs_client_open_qdict
+[PULL 37/39] block: Add BDRV_O_NO_SHARE for blk_new_open()
-From: Peter Lieven <pl@kamp.de>
+Normally, blk_new_open() just shares all permissions. This was fine
 originally when permissions only protected against uses in the same
 process because no other part of the code would actually get to access
 the block nodes opened with blk_new_open(). However, since we use it for
 file locking now, unsharing permissions becomes desirable.
-nfs_client_open returns the file size in sectors. This effectively
+Add a new BDRV_O_NO_SHARE flag that is used in blk_new_open() to unshare
-makes it impossible to open files larger than 1TB.
+any permissions that can be unshared.
-Fixes: c22a03454544c2a08f1107c5cc8481a5574533d5
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-Cc: qemu-stable@nongnu.org
+Message-Id: <20210422164344.283389-2-kwolf@redhat.com>
-Signed-off-by: Peter Lieven <pl@kamp.de>
+Reviewed-by: Eric Blake <eblake@redhat.com>
-Message-Id: <20201209121735.16437-1-pl@kamp.de>
+Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- block/nfs.c | 2 +-
+ include/block/block.h |  1 +
-file changed, 1 insertion(+), 1 deletion(-)
+ block/block-backend.c | 19 +++++++++++++------
 files changed, 14 insertions(+), 6 deletions(-)
-diff --git a/block/nfs.c b/block/nfs.c
+diff --git a/include/block/block.h b/include/block/block.h
 index XXXXXXX..XXXXXXX 100644
---- a/block/nfs.c
+--- a/include/block/block.h
-+++ b/block/nfs.c
++++ b/include/block/block.h
-@@ -XXX,XX +XXX,XX @@ static int64_t nfs_client_open_qdict(NFSClient *client, QDict *options,
+@@ -XXX,XX +XXX,XX @@ typedef struct HDGeometry {
-                                      int flags, int open_flags, Error **errp)
+     uint32_t cylinders;
- {
+ } HDGeometry;
-     BlockdevOptionsNfs *opts;
--    int ret;
++#define BDRV_O_NO_SHARE    0x0001 /* don't share permissions */
-+    int64_t ret;
+ #define BDRV_O_RDWR        0x0002
+ #define BDRV_O_RESIZE      0x0004 /* request permission for resizing the node */
-     opts = nfs_options_qdict_to_qapi(options, errp);
+ #define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
-     if (opts == NULL) {
+diff --git a/block/block-backend.c b/block/block-backend.c
 index XXXXXXX..XXXXXXX 100644
 --- a/block/block-backend.c
 +++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
      BlockBackend *blk;
      BlockDriverState *bs;
      uint64_t perm = 0;
 +    uint64_t shared = BLK_PERM_ALL;
 -    /* blk_new_open() is mainly used in .bdrv_create implementations and the
 -     * tools where sharing isn't a concern because the BDS stays private, so we
 -     * just request permission according to the flags.
 +    /*
 +     * blk_new_open() is mainly used in .bdrv_create implementations and the
 +     * tools where sharing isn't a major concern because the BDS stays private
 +     * and the file is generally not supposed to be used by a second process,
 +     * so we just request permission according to the flags.
       *
       * The exceptions are xen_disk and blockdev_init(); in these cases, the
       * caller of blk_new_open() doesn't make use of the permissions, but they
       * shouldn't hurt either. We can still share everything here because the
 -     * guest devices will add their own blockers if they can't share. */
 +     * guest devices will add their own blockers if they can't share.
 +     */
      if ((flags & BDRV_O_NO_IO) == 0) {
          perm |= BLK_PERM_CONSISTENT_READ;
          if (flags & BDRV_O_RDWR) {
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
      if (flags & BDRV_O_RESIZE) {
          perm |= BLK_PERM_RESIZE;
      }
 +    if (flags & BDRV_O_NO_SHARE) {
 +        shared = BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED;
 +    }
 -    blk = blk_new(qemu_get_aio_context(), perm, BLK_PERM_ALL);
 +    blk = blk_new(qemu_get_aio_context(), perm, shared);
      bs = bdrv_open(filename, reference, options, flags, errp);
      if (!bs) {
          blk_unref(blk);
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
      blk->root = bdrv_root_attach_child(bs, "root", &child_root,
                                         BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
 -                                       perm, BLK_PERM_ALL, blk, errp);
 +                                       perm, shared, blk, errp);
      if (!blk->root) {
          blk_unref(blk);
          return NULL;
 --
-.29.2
+.30.2

-[PULL 01/17] iotests/210: Fix reference output
+[PULL 38/39] qemu-img convert: Unshare write permission for source
-From: Max Reitz <mreitz@redhat.com>
+For a successful conversion of an image, we must make sure that its
 content doesn't change during the conversion.
-Commit 8b1170012b1 has added a global maximum disk length for the block
+A special case of this is using the same image file both as the source
-layer, so the error message when creating an overly large disk has
+and as the destination. If both input and output format are raw, the
-changed.
+operation would just be useless work, with other formats it is a sure
 way to destroy the image. This will now fail because the image file
 can't be opened a second time for the output when opening it for the
 input has already acquired file locks to unshare BLK_PERM_WRITE.
-Fixes: 8b1170012b1de6649c66ac1887f4df7e312abf3b
+Nevertheless, if there is some reason in a special case why it is
-       ("block: introduce BDRV_MAX_LENGTH")
+actually okay to allow writes to the image while it is being converted,
-Signed-off-by: Max Reitz <mreitz@redhat.com>
+-U can still be used to force sharing all permissions.
-Message-Id: <20201214175158.299919-1-mreitz@redhat.com>
 Note that for most image formats, BLK_PERM_WRITE would already be
 unshared by the format driver, so this only really makes a difference
 for raw source images (but any output format).
 Reported-by: Xueqiang Wei <xuwei@redhat.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Message-Id: <20210422164344.283389-3-kwolf@redhat.com>
 Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- tests/qemu-iotests/210.out | 2 +-
+ qemu-img.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/tests/qemu-iotests/210.out b/tests/qemu-iotests/210.out
+diff --git a/qemu-img.c b/qemu-img.c
 index XXXXXXX..XXXXXXX 100644
---- a/tests/qemu-iotests/210.out
+--- a/qemu-img.c
-+++ b/tests/qemu-iotests/210.out
++++ b/qemu-img.c
-@@ -XXX,XX +XXX,XX @@ Job failed: The requested file size is too large
+@@ -XXX,XX +XXX,XX @@ static void set_rate_limit(BlockBackend *blk, int64_t rate_limit)
- === Resize image with invalid sizes ===
+ static int img_convert(int argc, char **argv)
- {"execute": "block_resize", "arguments": {"node-name": "node1", "size": 9223372036854775296}}
+ {
--{"error": {"class": "GenericError", "desc": "The requested file size is too large"}}
+-    int c, bs_i, flags, src_flags = 0;
-+{"error": {"class": "GenericError", "desc": "Required too big image size, it must be not greater than 9223372035781033984"}}
++    int c, bs_i, flags, src_flags = BDRV_O_NO_SHARE;
- {"execute": "block_resize", "arguments": {"node-name": "node1", "size": 9223372036854775808}}
+     const char *fmt = NULL, *out_fmt = NULL, *cache = "unsafe",
- {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'size', expected: integer"}}
+                *src_cache = BDRV_DEFAULT_CACHE, *out_baseimg = NULL,
- {"execute": "block_resize", "arguments": {"node-name": "node1", "size": 18446744073709551104}}
+                *out_filename, *out_baseimg_param, *snapshot_name = NULL;
 --
-.29.2
+.30.2

-[PULL 02/17] hw/block/nand: Decommission the NAND museum
+[PULL 39/39] vhost-user-blk: Fail gracefully on too large queue size
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+virtio_add_queue() aborts when queue_size > VIRTQUEUE_MAX_SIZE, so
 vhost_user_blk_device_realize() should check this before calling it.
-This is the QEMU equivalent of this Linux commit (but 7 years later):
+Simple reproducer:
 https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7025a43a9da2
-    The MTD subsystem has its own small museum of ancient NANDs
+qemu-system-x86_64 \
-    in a form of the CONFIG_MTD_NAND_MUSEUM_IDS configuration option.
+    -chardev null,id=foo \
-    The museum contains stone age NANDs with 256 bytes pages, as well
+    -device vhost-user-blk-pci,queue-size=4096,chardev=foo
     as iron age NANDs with 512 bytes per page and up to 8MiB page size.
-    It is with great sorrow that I inform you that the museum is being
+Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935014
-    decommissioned. The MTD subsystem is out of budget for Kconfig
+Signed-off-by: Kevin Wolf <kwolf@redhat.com>
-    options and already has too many of them, and there is a general
+Message-Id: <20210413165654.50810-1-kwolf@redhat.com>
-    kernel trend to simplify the configuration menu.
+Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
+Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
-    We remove the stone age exhibits along with closing the museum,
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-    but some of the iron age ones are transferred to the regular NAND
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
     depot. Namely, only those which have unique device IDs are
     transferred, and the ones which have conflicting device IDs are
     removed.
 The machine using this device are:
 - axis-dev88
 - tosa (via tc6393xb_init)
 - spitz based (akita, borzoi, terrier)
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Message-Id: <20201214002620.342384-1-f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Kevin Wolf <kwolf@redhat.com>
 ---
- hw/block/nand.c | 12 +-----------
+ hw/block/vhost-user-blk.c | 5 +++++
-file changed, 1 insertion(+), 11 deletions(-)
+file changed, 5 insertions(+)
-diff --git a/hw/block/nand.c b/hw/block/nand.c
+diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/block/nand.c
+--- a/hw/block/vhost-user-blk.c
-+++ b/hw/block/nand.c
++++ b/hw/block/vhost-user-blk.c
-@@ -XXX,XX +XXX,XX @@ static void mem_and(uint8_t *dest, const uint8_t *src, size_t n)
+@@ -XXX,XX +XXX,XX @@ static void vhost_user_blk_device_realize(DeviceState *dev, Error **errp)
- # define ADDR_SHIFT        16
+         error_setg(errp, "vhost-user-blk: queue size must be non-zero");
- # include "nand.c"
+         return;
+     }
--/* Information based on Linux drivers/mtd/nand/nand_ids.c */
++    if (s->queue_size > VIRTQUEUE_MAX_SIZE) {
-+/* Information based on Linux drivers/mtd/nand/raw/nand_ids.c */
++        error_setg(errp, "vhost-user-blk: queue size must not exceed %d",
- static const struct {
++                   VIRTQUEUE_MAX_SIZE);
-     int size;
++        return;
-     int width;
++    }
-@@ -XXX,XX +XXX,XX @@ static const struct {
- } nand_flash_ids[0x100] = {
+     if (!vhost_user_init(&s->vhost_user, &s->chardev, errp)) {
-     [0 ... 0xff] = { 0 },
+         return;
 -    [0x6e] = { 1,    8,    8, 4, 0 },
 -    [0x64] = { 2,    8,    8, 4, 0 },
      [0x6b] = { 4,    8,    9, 4, 0 },
 -    [0xe8] = { 1,    8,    8, 4, 0 },
 -    [0xec] = { 1,    8,    8, 4, 0 },
 -    [0xea] = { 2,    8,    8, 4, 0 },
 -    [0xd5] = { 4,    8,    9, 4, 0 },
      [0xe3] = { 4,    8,    9, 4, 0 },
      [0xe5] = { 4,    8,    9, 4, 0 },
      [0xd6] = { 8,    8,    9, 4, 0 },
 -
 -    [0x39] = { 8,    8,    9, 4, 0 },
      [0xe6] = { 8,    8,    9, 4, 0 },
 -    [0x49] = { 8,    16,    9, 4, NAND_BUSWIDTH_16 },
 -    [0x59] = { 8,    16,    9, 4, NAND_BUSWIDTH_16 },
      [0x33] = { 16,    8,    9, 5, 0 },
      [0x73] = { 16,    8,    9, 5, 0 },
 --
-.29.2
+.30.2

The following changes since commit 75ee62ac606bfc9eb59310b9446df3434bf6e8c2:

Merge remote-tracking branch 'remotes/ehabkost-gl/tags/x86-next-pull-request' into staging (2020-12-17 18:53:36 +0000)

are available in the Git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to be7c5ddd0d80e2d6cf8e3ef12c049851d28d9c26:

block/vpc: Use sizeof() instead of HEADER_SIZE for footer size (2020-12-18 12:43:30 +0100)

----------------------------------------------------------------
Block layer patches:

- Add qemu-storage-daemon documentation
- hw/block/nand: Decommission the NAND museum
- vpc: Clean up some buffer abuse
- nfs: fix int overflow in nfs_client_open_qdict
- Several iotests fixes

----------------------------------------------------------------
Markus Armbruster (9):
      block/vpc: Make vpc_open() read the full dynamic header
      block/vpc: Don't abuse the footer buffer as BAT sector buffer
      block/vpc: Don't abuse the footer buffer for dynamic header
      block/vpc: Make vpc_checksum() take void *
      block/vpc: Pad VHDDynDiskHeader, replace uint8_t[] buffers
      block/vpc: Use sizeof() instead of 1024 for dynamic header size
      block/vpc: Pad VHDFooter, replace uint8_t[] buffers
      block/vpc: Pass footer buffers as VHDFooter * instead of uint8_t *
      block/vpc: Use sizeof() instead of HEADER_SIZE for footer size

Max Reitz (1):
      iotests/210: Fix reference output

Peter Lieven (1):
      block/nfs: fix int overflow in nfs_client_open_qdict

Philippe Mathieu-Daudé (1):
      hw/block/nand: Decommission the NAND museum

Stefan Hajnoczi (3):
      docs: generate qemu-storage-daemon-qmp-ref(7) man page
      docs: add qemu-storage-daemon(1) man page
      MAINTAINERS: add Kevin Wolf as storage daemon maintainer

Vladimir Sementsov-Ogievskiy (2):
      iotests: make _filter_qom_path more strict
      iotests:172: use _filter_qom_path

docs/interop/conf.py                         |   2 +
 docs/interop/index.rst                       |   1 +
 docs/interop/qemu-storage-daemon-qmp-ref.rst |  13 +++
 docs/meson.build                             |   1 +
 docs/tools/conf.py                           |   2 +
 docs/tools/index.rst                         |   1 +
 docs/tools/qemu-storage-daemon.rst           | 148 ++++++++++++++++++++++++++
 block/nfs.c                                  |   2 +-
 block/vpc.c                                  | 146 +++++++++++++------------
 hw/block/nand.c                              |  12 +--
 MAINTAINERS                                  |   9 ++
 storage-daemon/qapi/qapi-schema.json         |   3 +
 tests/qemu-iotests/172                       |   2 +-
 tests/qemu-iotests/172.out                   | 152 +++++++++++++--------------
 tests/qemu-iotests/186.out                   |  56 +++++-----
 tests/qemu-iotests/210.out                   |   2 +-
 tests/qemu-iotests/common.filter             |   2 +-
 17 files changed, 361 insertions(+), 193 deletions(-)
 create mode 100644 docs/interop/qemu-storage-daemon-qmp-ref.rst
 create mode 100644 docs/tools/qemu-storage-daemon.rst

From: Max Reitz <mreitz@redhat.com>

Commit 8b1170012b1 has added a global maximum disk length for the block
layer, so the error message when creating an overly large disk has
changed.

Fixes: 8b1170012b1de6649c66ac1887f4df7e312abf3b
       ("block: introduce BDRV_MAX_LENGTH")
Signed-off-by: Max Reitz <mreitz@redhat.com>
Message-Id: <20201214175158.299919-1-mreitz@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/210.out | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/qemu-iotests/210.out b/tests/qemu-iotests/210.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/210.out
+++ b/tests/qemu-iotests/210.out
@@ -XXX,XX +XXX,XX @@ Job failed: The requested file size is too large
 === Resize image with invalid sizes ===
 
 {"execute": "block_resize", "arguments": {"node-name": "node1", "size": 9223372036854775296}}
-{"error": {"class": "GenericError", "desc": "The requested file size is too large"}}
+{"error": {"class": "GenericError", "desc": "Required too big image size, it must be not greater than 9223372035781033984"}}
 {"execute": "block_resize", "arguments": {"node-name": "node1", "size": 9223372036854775808}}
 {"error": {"class": "GenericError", "desc": "Invalid parameter type for 'size', expected: integer"}}
 {"execute": "block_resize", "arguments": {"node-name": "node1", "size": 18446744073709551104}}
-- 
2.29.2

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

This is the QEMU equivalent of this Linux commit (but 7 years later):
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=f7025a43a9da2

The MTD subsystem has its own small museum of ancient NANDs
    in a form of the CONFIG_MTD_NAND_MUSEUM_IDS configuration option.
    The museum contains stone age NANDs with 256 bytes pages, as well
    as iron age NANDs with 512 bytes per page and up to 8MiB page size.

It is with great sorrow that I inform you that the museum is being
    decommissioned. The MTD subsystem is out of budget for Kconfig
    options and already has too many of them, and there is a general
    kernel trend to simplify the configuration menu.

We remove the stone age exhibits along with closing the museum,
    but some of the iron age ones are transferred to the regular NAND
    depot. Namely, only those which have unique device IDs are
    transferred, and the ones which have conflicting device IDs are
    removed.

The machine using this device are:
- axis-dev88
- tosa (via tc6393xb_init)
- spitz based (akita, borzoi, terrier)

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Message-Id: <20201214002620.342384-1-f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/block/nand.c | 12 +-----------
 1 file changed, 1 insertion(+), 11 deletions(-)

diff --git a/hw/block/nand.c b/hw/block/nand.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/nand.c
+++ b/hw/block/nand.c
@@ -XXX,XX +XXX,XX @@ static void mem_and(uint8_t *dest, const uint8_t *src, size_t n)
 # define ADDR_SHIFT		16
 # include "nand.c"
 
-/* Information based on Linux drivers/mtd/nand/nand_ids.c */
+/* Information based on Linux drivers/mtd/nand/raw/nand_ids.c */
 static const struct {
     int size;
     int width;
@@ -XXX,XX +XXX,XX @@ static const struct {
 } nand_flash_ids[0x100] = {
     [0 ... 0xff] = { 0 },
 
-    [0x6e] = { 1,	8,	8, 4, 0 },
-    [0x64] = { 2,	8,	8, 4, 0 },
     [0x6b] = { 4,	8,	9, 4, 0 },
-    [0xe8] = { 1,	8,	8, 4, 0 },
-    [0xec] = { 1,	8,	8, 4, 0 },
-    [0xea] = { 2,	8,	8, 4, 0 },
-    [0xd5] = { 4,	8,	9, 4, 0 },
     [0xe3] = { 4,	8,	9, 4, 0 },
     [0xe5] = { 4,	8,	9, 4, 0 },
     [0xd6] = { 8,	8,	9, 4, 0 },
-
-    [0x39] = { 8,	8,	9, 4, 0 },
     [0xe6] = { 8,	8,	9, 4, 0 },
-    [0x49] = { 8,	16,	9, 4, NAND_BUSWIDTH_16 },
-    [0x59] = { 8,	16,	9, 4, NAND_BUSWIDTH_16 },
 
     [0x33] = { 16,	8,	9, 5, 0 },
     [0x73] = { 16,	8,	9, 5, 0 },
-- 
2.29.2

From: Stefan Hajnoczi <stefanha@redhat.com>

Although individual qemu-storage-daemon QMP commands are identical to
QEMU QMP commands, qemu-storage-daemon only supports a subset of QEMU's
QMP commands. Generate a manual page of just the commands supported by
qemu-storage-daemon so that users know exactly what is available in
qemu-storage-daemon.

Add an h1 heading in storage-daemon/qapi/qapi-schema.json so that
block-core.json is at the h2 heading level.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201209103802.350848-2-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/interop/conf.py                         |  2 ++
 docs/interop/index.rst                       |  1 +
 docs/interop/qemu-storage-daemon-qmp-ref.rst | 13 +++++++++++++
 docs/meson.build                             |  1 +
 storage-daemon/qapi/qapi-schema.json         |  3 +++
 5 files changed, 20 insertions(+)
 create mode 100644 docs/interop/qemu-storage-daemon-qmp-ref.rst

diff --git a/docs/interop/conf.py b/docs/interop/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/conf.py
+++ b/docs/interop/conf.py
@@ -XXX,XX +XXX,XX @@ man_pages = [
      [], 7),
     ('qemu-qmp-ref', 'qemu-qmp-ref', 'QEMU QMP Reference Manual',
      [], 7),
+    ('qemu-storage-daemon-qmp-ref', 'qemu-storage-daemon-qmp-ref',
+     'QEMU Storage Daemon QMP Reference Manual', [], 7),
 ]
diff --git a/docs/interop/index.rst b/docs/interop/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/interop/index.rst
+++ b/docs/interop/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    qemu-ga
    qemu-ga-ref
    qemu-qmp-ref
+   qemu-storage-daemon-qmp-ref
    vhost-user
    vhost-user-gpu
    vhost-vdpa
diff --git a/docs/interop/qemu-storage-daemon-qmp-ref.rst b/docs/interop/qemu-storage-daemon-qmp-ref.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/interop/qemu-storage-daemon-qmp-ref.rst
@@ -XXX,XX +XXX,XX @@
+QEMU Storage Daemon QMP Reference Manual
+========================================
+
+..
+   TODO: the old Texinfo manual used to note that this manual
+   is GPL-v2-or-later. We should make that reader-visible
+   both here and in our Sphinx manuals more generally.
+
+..
+   TODO: display the QEMU version, both here and in our Sphinx manuals
+   more generally.
+
+.. qapi-doc:: storage-daemon/qapi/qapi-schema.json
diff --git a/docs/meson.build b/docs/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/docs/meson.build
+++ b/docs/meson.build
@@ -XXX,XX +XXX,XX @@ if build_docs
         'qemu-ga.8': (have_tools ? 'man8' : ''),
         'qemu-ga-ref.7': 'man7',
         'qemu-qmp-ref.7': 'man7',
+        'qemu-storage-daemon-qmp-ref.7': (have_tools ? 'man7' : ''),
     },
     'tools': {
         'qemu-img.1': (have_tools ? 'man1' : ''),
diff --git a/storage-daemon/qapi/qapi-schema.json b/storage-daemon/qapi/qapi-schema.json
index XXXXXXX..XXXXXXX 100644
--- a/storage-daemon/qapi/qapi-schema.json
+++ b/storage-daemon/qapi/qapi-schema.json
@@ -XXX,XX +XXX,XX @@
 
 { 'include': '../../qapi/pragma.json' }
 
+##
+# = Block devices
+##
 { 'include': '../../qapi/block-core.json' }
 { 'include': '../../qapi/block-export.json' }
 { 'include': '../../qapi/char.json' }
-- 
2.29.2

From: Stefan Hajnoczi <stefanha@redhat.com>

Document the qemu-storage-daemon tool. Most of the command-line options
are identical to their QEMU counterparts. Perhaps Sphinx hxtool
integration could be extended to extract documentation for individual
command-line options so they can be shared. For now the
qemu-storage-daemon simply refers to the qemu(1) man page where the
command-line options are identical.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201209103802.350848-3-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 docs/tools/conf.py                 |   2 +
 docs/tools/index.rst               |   1 +
 docs/tools/qemu-storage-daemon.rst | 148 +++++++++++++++++++++++++++++
 3 files changed, 151 insertions(+)
 create mode 100644 docs/tools/qemu-storage-daemon.rst

diff --git a/docs/tools/conf.py b/docs/tools/conf.py
index XXXXXXX..XXXXXXX 100644
--- a/docs/tools/conf.py
+++ b/docs/tools/conf.py
@@ -XXX,XX +XXX,XX @@ html_theme_options['description'] = \
 man_pages = [
     ('qemu-img', 'qemu-img', u'QEMU disk image utility',
      ['Fabrice Bellard'], 1),
+    ('qemu-storage-daemon', 'qemu-storage-daemon', u'QEMU storage daemon',
+     [], 1),
     ('qemu-nbd', 'qemu-nbd', u'QEMU Disk Network Block Device Server',
      ['Anthony Liguori <anthony@codemonkey.ws>'], 8),
     ('qemu-pr-helper', 'qemu-pr-helper', 'QEMU persistent reservation helper',
diff --git a/docs/tools/index.rst b/docs/tools/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/tools/index.rst
+++ b/docs/tools/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    :maxdepth: 2
 
    qemu-img
+   qemu-storage-daemon
    qemu-nbd
    qemu-pr-helper
    qemu-trace-stap
diff --git a/docs/tools/qemu-storage-daemon.rst b/docs/tools/qemu-storage-daemon.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/tools/qemu-storage-daemon.rst
@@ -XXX,XX +XXX,XX @@
+QEMU Storage Daemon
+===================
+
+Synopsis
+--------
+
+**qemu-storage-daemon** [options]
+
+Description
+-----------
+
+qemu-storage-daemon provides disk image functionality from QEMU, qemu-img, and
+qemu-nbd in a long-running process controlled via QMP commands without running
+a virtual machine. It can export disk images, run block job operations, and
+perform other disk-related operations. The daemon is controlled via a QMP
+monitor and initial configuration from the command-line.
+
+The daemon offers the following subset of QEMU features:
+
+* Block nodes
+* Block jobs
+* Block exports
+* Throttle groups
+* Character devices
+* Crypto and secrets
+* QMP
+* IOThreads
+
+Commands can be sent over a QEMU Monitor Protocol (QMP) connection. See the
+:manpage:`qemu-storage-daemon-qmp-ref(7)` manual page for a description of the
+commands.
+
+The daemon runs until it is stopped using the ``quit`` QMP command or
+SIGINT/SIGHUP/SIGTERM.
+
+**Warning:** Never modify images in use by a running virtual machine or any
+other process; this may destroy the image. Also, be aware that querying an
+image that is being modified by another process may encounter inconsistent
+state.
+
+Options
+-------
+
+.. program:: qemu-storage-daemon
+
+Standard options:
+
+.. option:: -h, --help
+
+  Display help and exit
+
+.. option:: -V, --version
+
+  Display version information and exit
+
+.. option:: -T, --trace [[enable=]PATTERN][,events=FILE][,file=FILE]
+
+  .. include:: ../qemu-option-trace.rst.inc
+
+.. option:: --blockdev BLOCKDEVDEF
+
+  is a block node definition. See the :manpage:`qemu(1)` manual page for a
+  description of block node properties and the :manpage:`qemu-block-drivers(7)`
+  manual page for a description of driver-specific parameters.
+
+.. option:: --chardev CHARDEVDEF
+
+  is a character device definition. See the :manpage:`qemu(1)` manual page for
+  a description of character device properties. A common character device
+  definition configures a UNIX domain socket::
+
+  --chardev socket,id=char1,path=/tmp/qmp.sock,server,nowait
+
+.. option:: --export [type=]nbd,id=<id>,node-name=<node-name>[,name=<export-name>][,writable=on|off][,bitmap=<name>]
+  --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=unix,addr.path=<socket-path>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
+  --export [type=]vhost-user-blk,id=<id>,node-name=<node-name>,addr.type=fd,addr.str=<fd>[,writable=on|off][,logical-block-size=<block-size>][,num-queues=<num-queues>]
+
+  is a block export definition. ``node-name`` is the block node that should be
+  exported. ``writable`` determines whether or not the export allows write
+  requests for modifying data (the default is off).
+
+  The ``nbd`` export type requires ``--nbd-server`` (see below). ``name`` is
+  the NBD export name. ``bitmap`` is the name of a dirty bitmap reachable from
+  the block node, so the NBD client can use NBD_OPT_SET_META_CONTEXT with the
+  metadata context name "qemu:dirty-bitmap:BITMAP" to inspect the bitmap.
+
+  The ``vhost-user-blk`` export type takes a vhost-user socket address on which
+  it accept incoming connections. Both
+  ``addr.type=unix,addr.path=<socket-path>`` for UNIX domain sockets and
+  ``addr.type=fd,addr.str=<fd>`` for file descriptor passing are supported.
+  ``logical-block-size`` sets the logical block size in bytes (the default is
+  512). ``num-queues`` sets the number of virtqueues (the default is 1).
+
+.. option:: --monitor MONITORDEF
+
+  is a QMP monitor definition. See the :manpage:`qemu(1)` manual page for
+  a description of QMP monitor properties. A common QMP monitor definition
+  configures a monitor on character device ``char1``::
+
+  --monitor chardev=char1
+
+.. option:: --nbd-server addr.type=inet,addr.host=<host>,addr.port=<port>[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
+  --nbd-server addr.type=unix,addr.path=<path>[,tls-creds=<id>][,tls-authz=<id>][,max-connections=<n>]
+
+  is a server for NBD exports. Both TCP and UNIX domain sockets are supported.
+  TLS encryption can be configured using ``--object`` tls-creds-* and authz-*
+  secrets (see below).
+
+  To configure an NBD server on UNIX domain socket path ``/tmp/nbd.sock``::
+
+  --nbd-server addr.type=unix,addr.path=/tmp/nbd.sock
+
+.. option:: --object help
+  --object <type>,help
+  --object <type>[,<property>=<value>...]
+
+  is a QEMU user creatable object definition. List object types with ``help``.
+  List object properties with ``<type>,help``. See the :manpage:`qemu(1)`
+  manual page for a description of the object properties.
+
+Examples
+--------
+Launch the daemon with QMP monitor socket ``qmp.sock`` so clients can execute
+QMP commands::
+
+  $ qemu-storage-daemon \
+      --chardev socket,path=qmp.sock,server,nowait,id=char1 \
+      --monitor chardev=char1
+
+Export raw image file ``disk.img`` over NBD UNIX domain socket ``nbd.sock``::
+
+  $ qemu-storage-daemon \
+      --blockdev driver=file,node-name=disk,filename=disk.img \
+      --nbd-server addr.type=unix,addr.path=nbd.sock \
+      --export type=nbd,id=export,node-name=disk,writable=on
+
+Export a qcow2 image file ``disk.qcow2`` as a vhosts-user-blk device over UNIX
+domain socket ``vhost-user-blk.sock``::
+
+  $ qemu-storage-daemon \
+      --blockdev driver=file,node-name=file,filename=disk.qcow2 \
+      --blockdev driver=qcow2,node-name=qcow2,file=file \
+      --export type=vhost-user-blk,id=export,addr.type=unix,addr.path=vhost-user-blk.sock,node-name=qcow2
+
+See also
+--------
+
+:manpage:`qemu(1)`, :manpage:`qemu-block-drivers(7)`, :manpage:`qemu-storage-daemon-qmp-ref(7)`
-- 
2.29.2

From: Stefan Hajnoczi <stefanha@redhat.com>

The MAINTAINERS file was not updated when the storage daemon was merged.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Message-Id: <20201209103802.350848-4-stefanha@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 MAINTAINERS | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: qobject/block-qdict.c
 F: tests/check-block-qdict.c
 T: git https://repo.or.cz/qemu/kevin.git block
 
+Storage daemon
+M: Kevin Wolf <kwolf@redhat.com>
+L: qemu-block@nongnu.org
+S: Supported
+F: storage-daemon/
+F: docs/interop/qemu-storage-daemon-qmp-ref.rst
+F: docs/tools/qemu-storage-daemon.rst
+T: git https://repo.or.cz/qemu/kevin.git block
+
 Block I/O path
 M: Stefan Hajnoczi <stefanha@redhat.com>
 M: Fam Zheng <fam@euphon.net>
-- 
2.29.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

According to original commit, that added this filter (627f607e3dddb2),
the problematic thing in qom path is device[NUMBER], not the whole
path. Seems that tracking the other parts of the path in iotest output
is not bad. Let's make _filter_qom_path stricter.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201216095205.526235-2-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/186.out       | 56 ++++++++++++++++----------------
 tests/qemu-iotests/common.filter |  2 +-
 2 files changed, 29 insertions(+), 29 deletions(-)

diff --git a/tests/qemu-iotests/186.out b/tests/qemu-iotests/186.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/186.out
+++ b/tests/qemu-iotests/186.out
@@ -XXX,XX +XXX,XX @@ Testing: -device floppy
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 /machine/peripheral-anon/device[1]: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -device ide-cd
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 /machine/peripheral-anon/device[1]: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -device scsi-cd
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 /machine/peripheral-anon/device[1]: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device ide-hd,d
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device scsi-hd,
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device virtio-b
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]/virtio-backend
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device virtio-b
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral/qdev_id/virtio-backend
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device floppy,d
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device ide-cd,d
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -blockdev driver=null-co,read-zeroes=on,node-name=null -device scsi-cd,
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 null: json:{"read-zeroes": true, "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
     Cache mode:       writeback
 
 null: json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral/qdev_id/virtio-backend
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device ide
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device scs
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device vir
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]/virtio-backend
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device vir
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral/qdev_id/virtio-backend
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device flo
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device ide
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,driver=null-co,read-zeroes=on,node-name=null -device scs
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0 (null): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none -device floppy,drive=none0
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none -device ide-cd,drive=none0
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none -device scsi-cd,drive=none0
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 none0: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 floppy0: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,driver=null-co,read-zeroes=on
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 floppy0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=ide,driver=null-co,read-zeroes=on
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 ide0-hd0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/unattached/device[N]
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=ide,media=cdrom
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 ide0-cd0: [not inserted]
-    Attached to:      PATH
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=ide,driver=null-co,read-zeroes=on,media=cdrom
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 ide0-cd0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co, read-only)
-    Attached to:      PATH
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 (qemu) quit
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=virtio,driver=null-co,read-zeroes=on
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 virtio0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/peripheral-anon/device[N]/virtio-backend
     Cache mode:       writeback
 (qemu) quit
 
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=pflash,driver=null-co,read-zeroes=on,size=1M
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) info block
 pflash0 (NODE_NAME): json:{"read-zeroes": "on", "driver": "null-co", "size": "1M"} (null-co)
-    Attached to:      PATH
+    Attached to:      /machine/system.flash0
     Cache mode:       writeback
 (qemu) quit
 
diff --git a/tests/qemu-iotests/common.filter b/tests/qemu-iotests/common.filter
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/common.filter
+++ b/tests/qemu-iotests/common.filter
@@ -XXX,XX +XXX,XX @@ _filter_generated_node_ids()
 
 _filter_qom_path()
 {
-    $SED -e 's#$Attached to: *$ /.*#\1 PATH#'
+    $SED -e '/Attached to:/s/\device[[0-9]\+\]/device[N]/g'
 }
 
 # replace occurrences of the actual TEST_DIR value with TEST_DIR
-- 
2.29.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

device[NUMBER] thing in QOM path is not stable and tracking it during
code modifications is not fun. Let's filter it like it's already done
in iotest 186.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20201216095205.526235-3-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/qemu-iotests/172     |   2 +-
 tests/qemu-iotests/172.out | 152 ++++++++++++++++++-------------------
 2 files changed, 77 insertions(+), 77 deletions(-)

diff --git a/tests/qemu-iotests/172 b/tests/qemu-iotests/172
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/172
+++ b/tests/qemu-iotests/172
@@ -XXX,XX +XXX,XX @@ check_floppy_qtree()
     (QEMU_OPTIONS="" do_run_qemu "$@" |
 	_filter_testdir |_filter_generated_node_ids | _filter_hmp |
         sed -ne '/^          dev: isa-fdc/,/^          dev:/{x;p};/^[a-z][^ ]* (NODE_NAME):* /,/^(qemu)$/{p}') 2>&1 |
-    _filter_win32 | _filter_qemu
+    _filter_win32 | _filter_qemu | _filter_qom_path
 }
 
 check_cache_mode()
diff --git a/tests/qemu-iotests/172.out b/tests/qemu-iotests/172.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/172.out
+++ b/tests/qemu-iotests/172.out
@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fdb TEST_DIR/t.qcow2
                 share-rw = false
                 drive-type = "288"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 floppy0: [not inserted]
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2 -fdb TEST_DIR/t.qcow2.2
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2,index=1
                 share-rw = false
                 drive-type = "288"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 floppy0: [not inserted]
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=floppy,file=TEST_DIR/t
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,unit=1
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qco
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[1]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[16]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[23]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fda TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 drive-type = "144"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -fdb TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.qcow2.2 -device fl
                 share-rw = false
                 drive-type = "144"
 floppy1 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=floppy,file=TEST_DIR/t.qcow2 -drive if=none,file=TEST_DIR/t.q
                 share-rw = false
                 drive-type = "144"
 floppy0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none0 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=0,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Use -device floppy,unit=1,drive=... instead.
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/unattached/device[15]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 none1 (NODE_NAME): TEST_DIR/t.qcow2.2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[22]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -global floppy.drive=none0 -device
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,drive-t
                 share-rw = false
                 drive-type = "120"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,drive-t
                 share-rw = false
                 drive-type = "288"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,logical
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
@@ -XXX,XX +XXX,XX @@ Testing: -drive if=none,file=TEST_DIR/t.qcow2 -device floppy,drive=none0,physica
                 share-rw = false
                 drive-type = "144"
 none0 (NODE_NAME): TEST_DIR/t.qcow2 (qcow2)
-    Attached to:      /machine/peripheral-anon/device[0]
+    Attached to:      /machine/peripheral-anon/device[N]
     Removable device: not locked, tray closed
     Cache mode:       writeback
 
 ide1-cd0: [not inserted]
-    Attached to:      /machine/unattached/device[21]
+    Attached to:      /machine/unattached/device[N]
     Removable device: not locked, tray closed
 
 sd0: [not inserted]
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

The dynamic header's size is 1024 bytes.

vpc_open() reads only the 512 bytes of the dynamic header into buf[].
Works, because it doesn't actually access the second half.  However, a
colleague told me that GCC 11 warns:

../block/vpc.c:358:51: error: array subscript 'struct VHDDynDiskHeader[0]' is partly outside array bounds of 'uint8_t[512]' [-Werror=array-bounds]

Clean up to read the full header.

Rename buf[] to dyndisk_header_buf[] while there.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-2-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     QemuOpts *opts = NULL;
     Error *local_err = NULL;
     bool use_chs;
-    uint8_t buf[HEADER_SIZE];
+    uint8_t dyndisk_header_buf[1024];
     uint32_t checksum;
     uint64_t computed_size;
     uint64_t pagetable_size;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     }
 
     if (disk_type == VHD_DYNAMIC) {
-        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset), buf,
-                         HEADER_SIZE);
+        ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
+                         dyndisk_header_buf, 1024);
         if (ret < 0) {
             error_setg(errp, "Error reading dynamic VHD header");
             goto fail;
         }
 
-        dyndisk_header = (VHDDynDiskHeader *) buf;
+        dyndisk_header = (VHDDynDiskHeader *)dyndisk_header_buf;
 
         if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
             error_setg(errp, "Invalid header magic");
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

create_dynamic_disk() takes a buffer holding the footer as first
argument.  It writes out the footer (512 bytes), then reuses the
buffer to initialize and write out the dynamic header (1024 bytes),
then reuses it again to initialize and write out BAT sectors (512).

Works, because the caller passes a buffer that is large enough for all
three purposes.  I hate that.

Use a separate buffer for writing out BAT sectors.  The next commit
will do the same for the dynamic header.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-3-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 5 +++--
 1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
 {
     VHDDynDiskHeader *dyndisk_header =
         (VHDDynDiskHeader *) buf;
+    uint8_t bat_sector[512];
     size_t block_size, num_bat_entries;
     int i;
     int ret;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     /* Write the initial BAT */
     offset = 3 * 512;
 
-    memset(buf, 0xFF, 512);
+    memset(bat_sector, 0xFF, 512);
     for (i = 0; i < DIV_ROUND_UP(num_bat_entries * 4, 512); i++) {
-        ret = blk_pwrite(blk, offset, buf, 512, 0);
+        ret = blk_pwrite(blk, offset, bat_sector, 512, 0);
         if (ret < 0) {
             goto fail;
         }
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

create_dynamic_disk() takes a buffer holding the footer as first
argument.  It writes out the footer (512 bytes), then reuses the
buffer to initialize and write out the dynamic header (1024 bytes).

Works, because the caller passes a buffer that is large enough for
both purposes.  I hate that.

Use a separate buffer for the dynamic header, and adjust the caller's
buffer.

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-4-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 22 ++++++++++++----------
 1 file changed, 12 insertions(+), 10 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
 static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
                                int64_t total_sectors)
 {
+    uint8_t dyndisk_header_buf[1024];
     VHDDynDiskHeader *dyndisk_header =
-        (VHDDynDiskHeader *) buf;
+        (VHDDynDiskHeader *)dyndisk_header_buf;
     uint8_t bat_sector[512];
     size_t block_size, num_bat_entries;
     int i;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     }
 
     /* Prepare the Dynamic Disk Header */
-    memset(buf, 0, 1024);
+    memset(dyndisk_header_buf, 0, 1024);
 
     memcpy(dyndisk_header->magic, "cxsparse", 8);
 
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     dyndisk_header->block_size = cpu_to_be32(block_size);
     dyndisk_header->max_table_entries = cpu_to_be32(num_bat_entries);
 
-    dyndisk_header->checksum = cpu_to_be32(vpc_checksum(buf, 1024));
+    dyndisk_header->checksum = cpu_to_be32(vpc_checksum(dyndisk_header_buf,
+                                                        1024));
 
     /* Write the header */
     offset = 512;
 
-    ret = blk_pwrite(blk, offset, buf, 1024, 0);
+    ret = blk_pwrite(blk, offset, dyndisk_header_buf, 1024, 0);
     if (ret < 0) {
         goto fail;
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     BlockBackend *blk = NULL;
     BlockDriverState *bs = NULL;
 
-    uint8_t buf[1024];
-    VHDFooter *footer = (VHDFooter *) buf;
+    uint8_t footer_buf[HEADER_SIZE];
+    VHDFooter *footer = (VHDFooter *)footer_buf;
     uint16_t cyls = 0;
     uint8_t heads = 0;
     uint8_t secs_per_cyl = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     }
 
     /* Prepare the Hard Disk Footer */
-    memset(buf, 0, 1024);
+    memset(footer_buf, 0, HEADER_SIZE);
 
     memcpy(footer->creator, "conectix", 8);
     if (vpc_opts->force_size) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     qemu_uuid_generate(&uuid);
     footer->uuid = uuid;
 
-    footer->checksum = cpu_to_be32(vpc_checksum(buf, HEADER_SIZE));
+    footer->checksum = cpu_to_be32(vpc_checksum(footer_buf, HEADER_SIZE));
 
     if (disk_type == VHD_DYNAMIC) {
-        ret = create_dynamic_disk(blk, buf, total_sectors);
+        ret = create_dynamic_disk(blk, footer_buf, total_sectors);
         if (ret < 0) {
             error_setg(errp, "Unable to create or write VHD header");
         }
     } else {
-        ret = create_fixed_disk(blk, buf, total_size, errp);
+        ret = create_fixed_disk(blk, footer_buf, total_size, errp);
     }
 
 out:
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

Pad VHDDynDiskHeader as specified in the "Virtual Hard Disk Image
Format Specification" version 1.0[*].  Change dynamic disk header
buffers from uint8_t[1024] to VHDDynDiskHeader.  Their size remains
the same.

The VHDDynDiskHeader * variables pointing to a VHDDynDiskHeader
variable right next to it are now silly.  Eliminate them.

[*] http://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-6-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 41 +++++++++++++++++++----------------------
 1 file changed, 19 insertions(+), 22 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ typedef struct vhd_dyndisk_header {
         uint32_t    reserved;
         uint64_t    data_offset;
     } parent_locator[8];
+    uint8_t     reserved2[256];
 } QEMU_PACKED VHDDynDiskHeader;
 
+QEMU_BUILD_BUG_ON(sizeof(VHDDynDiskHeader) != 1024);
+
 typedef struct BDRVVPCState {
     CoMutex lock;
     uint8_t footer_buf[HEADER_SIZE];
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
     BDRVVPCState *s = bs->opaque;
     int i;
     VHDFooter *footer;
-    VHDDynDiskHeader *dyndisk_header;
     QemuOpts *opts = NULL;
     Error *local_err = NULL;
     bool use_chs;
-    uint8_t dyndisk_header_buf[1024];
+    VHDDynDiskHeader dyndisk_header;
     uint32_t checksum;
     uint64_t computed_size;
     uint64_t pagetable_size;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
 
     if (disk_type == VHD_DYNAMIC) {
         ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
-                         dyndisk_header_buf, 1024);
+                         &dyndisk_header, 1024);
         if (ret < 0) {
             error_setg(errp, "Error reading dynamic VHD header");
             goto fail;
         }
 
-        dyndisk_header = (VHDDynDiskHeader *)dyndisk_header_buf;
-
-        if (strncmp(dyndisk_header->magic, "cxsparse", 8)) {
+        if (strncmp(dyndisk_header.magic, "cxsparse", 8)) {
             error_setg(errp, "Invalid header magic");
             ret = -EINVAL;
             goto fail;
         }
 
-        s->block_size = be32_to_cpu(dyndisk_header->block_size);
+        s->block_size = be32_to_cpu(dyndisk_header.block_size);
         if (!is_power_of_2(s->block_size) || s->block_size < BDRV_SECTOR_SIZE) {
             error_setg(errp, "Invalid block size %" PRIu32, s->block_size);
             ret = -EINVAL;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
         }
         s->bitmap_size = ((s->block_size / (8 * 512)) + 511) & ~511;
 
-        s->max_table_entries = be32_to_cpu(dyndisk_header->max_table_entries);
+        s->max_table_entries = be32_to_cpu(dyndisk_header.max_table_entries);
 
         if ((bs->total_sectors * 512) / s->block_size > 0xffffffffU) {
             error_setg(errp, "Too many blocks");
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
             goto fail;
         }
 
-        s->bat_offset = be64_to_cpu(dyndisk_header->table_offset);
+        s->bat_offset = be64_to_cpu(dyndisk_header.table_offset);
 
         ret = bdrv_pread(bs->file, s->bat_offset, s->pagetable,
                          pagetable_size);
@@ -XXX,XX +XXX,XX @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
 static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
                                int64_t total_sectors)
 {
-    uint8_t dyndisk_header_buf[1024];
-    VHDDynDiskHeader *dyndisk_header =
-        (VHDDynDiskHeader *)dyndisk_header_buf;
+    VHDDynDiskHeader dyndisk_header;
     uint8_t bat_sector[512];
     size_t block_size, num_bat_entries;
     int i;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     }
 
     /* Prepare the Dynamic Disk Header */
-    memset(dyndisk_header_buf, 0, 1024);
+    memset(&dyndisk_header, 0, 1024);
 
-    memcpy(dyndisk_header->magic, "cxsparse", 8);
+    memcpy(dyndisk_header.magic, "cxsparse", 8);
 
     /*
      * Note: The spec is actually wrong here for data_offset, it says
      * 0xFFFFFFFF, but MS tools expect all 64 bits to be set.
      */
-    dyndisk_header->data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
-    dyndisk_header->table_offset = cpu_to_be64(3 * 512);
-    dyndisk_header->version = cpu_to_be32(0x00010000);
-    dyndisk_header->block_size = cpu_to_be32(block_size);
-    dyndisk_header->max_table_entries = cpu_to_be32(num_bat_entries);
+    dyndisk_header.data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
+    dyndisk_header.table_offset = cpu_to_be64(3 * 512);
+    dyndisk_header.version = cpu_to_be32(0x00010000);
+    dyndisk_header.block_size = cpu_to_be32(block_size);
+    dyndisk_header.max_table_entries = cpu_to_be32(num_bat_entries);
 
-    dyndisk_header->checksum = cpu_to_be32(vpc_checksum(dyndisk_header_buf,
-                                                        1024));
+    dyndisk_header.checksum = cpu_to_be32(vpc_checksum(&dyndisk_header, 1024));
 
     /* Write the header */
     offset = 512;
 
-    ret = blk_pwrite(blk, offset, dyndisk_header_buf, 1024, 0);
+    ret = blk_pwrite(blk, offset, &dyndisk_header, 1024, 0);
     if (ret < 0) {
         goto fail;
     }
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-7-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 9 +++++----
 1 file changed, 5 insertions(+), 4 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
 
     if (disk_type == VHD_DYNAMIC) {
         ret = bdrv_pread(bs->file, be64_to_cpu(footer->data_offset),
-                         &dyndisk_header, 1024);
+                         &dyndisk_header, sizeof(dyndisk_header));
         if (ret < 0) {
             error_setg(errp, "Error reading dynamic VHD header");
             goto fail;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     }
 
     /* Prepare the Dynamic Disk Header */
-    memset(&dyndisk_header, 0, 1024);
+    memset(&dyndisk_header, 0, sizeof(dyndisk_header));
 
     memcpy(dyndisk_header.magic, "cxsparse", 8);
 
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     dyndisk_header.block_size = cpu_to_be32(block_size);
     dyndisk_header.max_table_entries = cpu_to_be32(num_bat_entries);
 
-    dyndisk_header.checksum = cpu_to_be32(vpc_checksum(&dyndisk_header, 1024));
+    dyndisk_header.checksum = cpu_to_be32(
+        vpc_checksum(&dyndisk_header, sizeof(dyndisk_header)));
 
     /* Write the header */
     offset = 512;
 
-    ret = blk_pwrite(blk, offset, &dyndisk_header, 1024, 0);
+    ret = blk_pwrite(blk, offset, &dyndisk_header, sizeof(dyndisk_header), 0);
     if (ret < 0) {
         goto fail;
     }
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

Pad VHDFooter as specified in the "Virtual Hard Disk Image Format
Specification" version 1.0[*].  Change footer buffers from
uint8_t[HEADER_SIZE] to VHDFooter.  Their size remains the same.

The VHDFooter * variables pointing to a VHDFooter variable right next
to it are now silly.  Eliminate them, and shorten the remaining
variables' names.

Most variables pointing to s->footer are now also silly.  Eliminate
them, too.

[*] http://download.microsoft.com/download/f/f/e/ffef50a5-07dd-4cf8-aaa3-442c0673a029/Virtual%20Hard%20Disk%20Format%20Spec_10_18_06.doc

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-8-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 77 +++++++++++++++++++++++++----------------------------
 1 file changed, 37 insertions(+), 40 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ typedef struct vhd_footer {
     QemuUUID    uuid;
 
     uint8_t     in_saved_state;
+    uint8_t     reserved[427];
 } QEMU_PACKED VHDFooter;
 
+QEMU_BUILD_BUG_ON(sizeof(VHDFooter) != 512);
+
 typedef struct vhd_dyndisk_header {
     char        magic[8]; /* "cxsparse" */
 
@@ -XXX,XX +XXX,XX @@ QEMU_BUILD_BUG_ON(sizeof(VHDDynDiskHeader) != 1024);
 
 typedef struct BDRVVPCState {
     CoMutex lock;
-    uint8_t footer_buf[HEADER_SIZE];
+    VHDFooter footer;
     uint64_t free_data_block_offset;
     int max_table_entries;
     uint32_t *pagetable;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 
-    ret = bdrv_pread(bs->file, 0, s->footer_buf, HEADER_SIZE);
+    ret = bdrv_pread(bs->file, 0, &s->footer, HEADER_SIZE);
     if (ret < 0) {
         error_setg(errp, "Unable to read VHD header");
         goto fail;
     }
 
-    footer = (VHDFooter *) s->footer_buf;
+    footer = &s->footer;
     if (strncmp(footer->creator, "conectix", 8)) {
         int64_t offset = bdrv_getlength(bs->file->bs);
         if (offset < 0) {
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
         }
 
         /* If a fixed disk, the footer is found only at the end of the file */
-        ret = bdrv_pread(bs->file, offset-HEADER_SIZE, s->footer_buf,
+        ret = bdrv_pread(bs->file, offset - HEADER_SIZE, footer,
                          HEADER_SIZE);
         if (ret < 0) {
             goto fail;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
 
     checksum = be32_to_cpu(footer->checksum);
     footer->checksum = 0;
-    if (vpc_checksum(s->footer_buf, HEADER_SIZE) != checksum) {
+    if (vpc_checksum(footer, HEADER_SIZE) != checksum) {
         error_setg(errp, "Incorrect header checksum");
         ret = -EINVAL;
         goto fail;
@@ -XXX,XX +XXX,XX @@ static int rewrite_footer(BlockDriverState *bs)
     BDRVVPCState *s = bs->opaque;
     int64_t offset = s->free_data_block_offset;
 
-    ret = bdrv_pwrite_sync(bs->file, offset, s->footer_buf, HEADER_SIZE);
+    ret = bdrv_pwrite_sync(bs->file, offset, &s->footer, HEADER_SIZE);
     if (ret < 0)
         return ret;
 
@@ -XXX,XX +XXX,XX @@ fail:
 static int vpc_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
 {
     BDRVVPCState *s = (BDRVVPCState *)bs->opaque;
-    VHDFooter *footer = (VHDFooter *) s->footer_buf;
 
-    if (be32_to_cpu(footer->type) != VHD_FIXED) {
+    if (be32_to_cpu(s->footer.type) != VHD_FIXED) {
         bdi->cluster_size = s->block_size;
     }
 
@@ -XXX,XX +XXX,XX @@ vpc_co_preadv(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     int64_t image_offset;
     int64_t n_bytes;
     int64_t bytes_done = 0;
-    VHDFooter *footer = (VHDFooter *) s->footer_buf;
     QEMUIOVector local_qiov;
 
-    if (be32_to_cpu(footer->type) == VHD_FIXED) {
+    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
         return bdrv_co_preadv(bs->file, offset, bytes, qiov, 0);
     }
 
@@ -XXX,XX +XXX,XX @@ vpc_co_pwritev(BlockDriverState *bs, uint64_t offset, uint64_t bytes,
     int64_t n_bytes;
     int64_t bytes_done = 0;
     int ret = 0;
-    VHDFooter *footer =  (VHDFooter *) s->footer_buf;
     QEMUIOVector local_qiov;
 
-    if (be32_to_cpu(footer->type) == VHD_FIXED) {
+    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
         return bdrv_co_pwritev(bs->file, offset, bytes, qiov, 0);
     }
 
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_block_status(BlockDriverState *bs,
                                             BlockDriverState **file)
 {
     BDRVVPCState *s = bs->opaque;
-    VHDFooter *footer = (VHDFooter*) s->footer_buf;
     int64_t image_offset;
     bool allocated;
     int ret;
     int64_t n;
 
-    if (be32_to_cpu(footer->type) == VHD_FIXED) {
+    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
         *pnum = bytes;
         *map = offset;
         *file = bs->file->bs;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     BlockBackend *blk = NULL;
     BlockDriverState *bs = NULL;
 
-    uint8_t footer_buf[HEADER_SIZE];
-    VHDFooter *footer = (VHDFooter *)footer_buf;
+    VHDFooter footer;
     uint16_t cyls = 0;
     uint8_t heads = 0;
     uint8_t secs_per_cyl = 0;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     }
 
     /* Prepare the Hard Disk Footer */
-    memset(footer_buf, 0, HEADER_SIZE);
+    memset(&footer, 0, HEADER_SIZE);
 
-    memcpy(footer->creator, "conectix", 8);
+    memcpy(footer.creator, "conectix", 8);
     if (vpc_opts->force_size) {
-        memcpy(footer->creator_app, "qem2", 4);
+        memcpy(footer.creator_app, "qem2", 4);
     } else {
-        memcpy(footer->creator_app, "qemu", 4);
+        memcpy(footer.creator_app, "qemu", 4);
     }
-    memcpy(footer->creator_os, "Wi2k", 4);
+    memcpy(footer.creator_os, "Wi2k", 4);
 
-    footer->features = cpu_to_be32(0x02);
-    footer->version = cpu_to_be32(0x00010000);
+    footer.features = cpu_to_be32(0x02);
+    footer.version = cpu_to_be32(0x00010000);
     if (disk_type == VHD_DYNAMIC) {
-        footer->data_offset = cpu_to_be64(HEADER_SIZE);
+        footer.data_offset = cpu_to_be64(HEADER_SIZE);
     } else {
-        footer->data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
+        footer.data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
     }
-    footer->timestamp = cpu_to_be32(time(NULL) - VHD_TIMESTAMP_BASE);
+    footer.timestamp = cpu_to_be32(time(NULL) - VHD_TIMESTAMP_BASE);
 
     /* Version of Virtual PC 2007 */
-    footer->major = cpu_to_be16(0x0005);
-    footer->minor = cpu_to_be16(0x0003);
-    footer->orig_size = cpu_to_be64(total_size);
-    footer->current_size = cpu_to_be64(total_size);
-    footer->cyls = cpu_to_be16(cyls);
-    footer->heads = heads;
-    footer->secs_per_cyl = secs_per_cyl;
+    footer.major = cpu_to_be16(0x0005);
+    footer.minor = cpu_to_be16(0x0003);
+    footer.orig_size = cpu_to_be64(total_size);
+    footer.current_size = cpu_to_be64(total_size);
+    footer.cyls = cpu_to_be16(cyls);
+    footer.heads = heads;
+    footer.secs_per_cyl = secs_per_cyl;
 
-    footer->type = cpu_to_be32(disk_type);
+    footer.type = cpu_to_be32(disk_type);
 
     qemu_uuid_generate(&uuid);
-    footer->uuid = uuid;
+    footer.uuid = uuid;
 
-    footer->checksum = cpu_to_be32(vpc_checksum(footer_buf, HEADER_SIZE));
+    footer.checksum = cpu_to_be32(vpc_checksum(&footer, HEADER_SIZE));
 
     if (disk_type == VHD_DYNAMIC) {
-        ret = create_dynamic_disk(blk, footer_buf, total_sectors);
+        ret = create_dynamic_disk(blk, (uint8_t *)&footer, total_sectors);
         if (ret < 0) {
             error_setg(errp, "Unable to create or write VHD header");
         }
     } else {
-        ret = create_fixed_disk(blk, footer_buf, total_size, errp);
+        ret = create_fixed_disk(blk, (uint8_t *)&footer, total_size, errp);
     }
 
 out:
@@ -XXX,XX +XXX,XX @@ fail:
 static int vpc_has_zero_init(BlockDriverState *bs)
 {
     BDRVVPCState *s = bs->opaque;
-    VHDFooter *footer =  (VHDFooter *) s->footer_buf;
 
-    if (be32_to_cpu(footer->type) == VHD_FIXED) {
+    if (be32_to_cpu(s->footer.type) == VHD_FIXED) {
         return bdrv_has_zero_init(bs->file->bs);
     } else {
         return 1;
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-9-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@ static int calculate_geometry(int64_t total_sectors, uint16_t *cyls,
     return 0;
 }
 
-static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
+static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
                                int64_t total_sectors)
 {
     VHDDynDiskHeader dyndisk_header;
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     block_size = 0x200000;
     num_bat_entries = DIV_ROUND_UP(total_sectors, block_size / 512);
 
-    ret = blk_pwrite(blk, offset, buf, HEADER_SIZE, 0);
+    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
     if (ret < 0) {
         goto fail;
     }
 
     offset = 1536 + ((num_bat_entries * 4 + 511) & ~511);
-    ret = blk_pwrite(blk, offset, buf, HEADER_SIZE, 0);
+    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
     if (ret < 0) {
         goto fail;
     }
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, uint8_t *buf,
     return ret;
 }
 
-static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
+static int create_fixed_disk(BlockBackend *blk, VHDFooter *footer,
                              int64_t total_size, Error **errp)
 {
     int ret;
@@ -XXX,XX +XXX,XX @@ static int create_fixed_disk(BlockBackend *blk, uint8_t *buf,
         return ret;
     }
 
-    ret = blk_pwrite(blk, total_size - HEADER_SIZE, buf, HEADER_SIZE, 0);
+    ret = blk_pwrite(blk, total_size - HEADER_SIZE, footer, HEADER_SIZE, 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Unable to write VHD header");
         return ret;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     footer.checksum = cpu_to_be32(vpc_checksum(&footer, HEADER_SIZE));
 
     if (disk_type == VHD_DYNAMIC) {
-        ret = create_dynamic_disk(blk, (uint8_t *)&footer, total_sectors);
+        ret = create_dynamic_disk(blk, &footer, total_sectors);
         if (ret < 0) {
             error_setg(errp, "Unable to create or write VHD header");
         }
     } else {
-        ret = create_fixed_disk(blk, (uint8_t *)&footer, total_size, errp);
+        ret = create_fixed_disk(blk, &footer, total_size, errp);
     }
 
 out:
-- 
2.29.2

From: Markus Armbruster <armbru@redhat.com>

Signed-off-by: Markus Armbruster <armbru@redhat.com>
Message-Id: <20201217162003.1102738-10-armbru@redhat.com>
Reviewed-by: Max Reitz <mreitz@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/vpc.c | 29 ++++++++++++++---------------
 1 file changed, 14 insertions(+), 15 deletions(-)

diff --git a/block/vpc.c b/block/vpc.c
index XXXXXXX..XXXXXXX 100644
--- a/block/vpc.c
+++ b/block/vpc.c
@@ -XXX,XX +XXX,XX @@
 
 /**************************************************************/
 
-#define HEADER_SIZE 512
-
 //#define CACHE
 
 enum vhd_type {
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
         goto fail;
     }
 
-    ret = bdrv_pread(bs->file, 0, &s->footer, HEADER_SIZE);
+    ret = bdrv_pread(bs->file, 0, &s->footer, sizeof(s->footer));
     if (ret < 0) {
         error_setg(errp, "Unable to read VHD header");
         goto fail;
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
             ret = offset;
             error_setg(errp, "Invalid file size");
             goto fail;
-        } else if (offset < HEADER_SIZE) {
+        } else if (offset < sizeof(*footer)) {
             ret = -EINVAL;
             error_setg(errp, "File too small for a VHD header");
             goto fail;
         }
 
         /* If a fixed disk, the footer is found only at the end of the file */
-        ret = bdrv_pread(bs->file, offset - HEADER_SIZE, footer,
-                         HEADER_SIZE);
+        ret = bdrv_pread(bs->file, offset - sizeof(*footer),
+                         footer, sizeof(*footer));
         if (ret < 0) {
             goto fail;
         }
@@ -XXX,XX +XXX,XX @@ static int vpc_open(BlockDriverState *bs, QDict *options, int flags,
 
     checksum = be32_to_cpu(footer->checksum);
     footer->checksum = 0;
-    if (vpc_checksum(footer, HEADER_SIZE) != checksum) {
+    if (vpc_checksum(footer, sizeof(*footer)) != checksum) {
         error_setg(errp, "Incorrect header checksum");
         ret = -EINVAL;
         goto fail;
@@ -XXX,XX +XXX,XX @@ static int rewrite_footer(BlockDriverState *bs)
     BDRVVPCState *s = bs->opaque;
     int64_t offset = s->free_data_block_offset;
 
-    ret = bdrv_pwrite_sync(bs->file, offset, &s->footer, HEADER_SIZE);
+    ret = bdrv_pwrite_sync(bs->file, offset, &s->footer, sizeof(s->footer));
     if (ret < 0)
         return ret;
 
@@ -XXX,XX +XXX,XX @@ static int create_dynamic_disk(BlockBackend *blk, VHDFooter *footer,
     block_size = 0x200000;
     num_bat_entries = DIV_ROUND_UP(total_sectors, block_size / 512);
 
-    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
+    ret = blk_pwrite(blk, offset, footer, sizeof(*footer), 0);
     if (ret < 0) {
         goto fail;
     }
 
     offset = 1536 + ((num_bat_entries * 4 + 511) & ~511);
-    ret = blk_pwrite(blk, offset, footer, HEADER_SIZE, 0);
+    ret = blk_pwrite(blk, offset, footer, sizeof(*footer), 0);
     if (ret < 0) {
         goto fail;
     }
@@ -XXX,XX +XXX,XX @@ static int create_fixed_disk(BlockBackend *blk, VHDFooter *footer,
     int ret;
 
     /* Add footer to total size */
-    total_size += HEADER_SIZE;
+    total_size += sizeof(*footer);
 
     ret = blk_truncate(blk, total_size, false, PREALLOC_MODE_OFF, 0, errp);
     if (ret < 0) {
         return ret;
     }
 
-    ret = blk_pwrite(blk, total_size - HEADER_SIZE, footer, HEADER_SIZE, 0);
+    ret = blk_pwrite(blk, total_size - sizeof(*footer),
+                     footer, sizeof(*footer), 0);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Unable to write VHD header");
         return ret;
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     }
 
     /* Prepare the Hard Disk Footer */
-    memset(&footer, 0, HEADER_SIZE);
+    memset(&footer, 0, sizeof(footer));
 
     memcpy(footer.creator, "conectix", 8);
     if (vpc_opts->force_size) {
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     footer.features = cpu_to_be32(0x02);
     footer.version = cpu_to_be32(0x00010000);
     if (disk_type == VHD_DYNAMIC) {
-        footer.data_offset = cpu_to_be64(HEADER_SIZE);
+        footer.data_offset = cpu_to_be64(sizeof(footer));
     } else {
         footer.data_offset = cpu_to_be64(0xFFFFFFFFFFFFFFFFULL);
     }
@@ -XXX,XX +XXX,XX @@ static int coroutine_fn vpc_co_create(BlockdevCreateOptions *opts,
     qemu_uuid_generate(&uuid);
     footer.uuid = uuid;
 
-    footer.checksum = cpu_to_be32(vpc_checksum(&footer, HEADER_SIZE));
+    footer.checksum = cpu_to_be32(vpc_checksum(&footer, sizeof(footer)));
 
     if (disk_type == VHD_DYNAMIC) {
         ret = create_dynamic_disk(blk, &footer, total_sectors);
-- 
2.29.2

The following changes since commit ccdf06c1db192152ac70a1dd974c624f566cb7d4:

Open 6.1 development tree (2021-04-30 11:15:40 +0100)

are available in the Git repository at:

git://repo.or.cz/qemu/kevin.git tags/for-upstream

for you to fetch changes up to 68bf7336533faa6aa90fdd4558edddbf5d8ef814:

vhost-user-blk: Fail gracefully on too large queue size (2021-04-30 12:27:48 +0200)

----------------------------------------------------------------
Block layer patches

- Fix permission update order problems with block graph changes
- qemu-img convert: Unshare write permission for source
- vhost-user-blk: Fail gracefully on too large queue size

----------------------------------------------------------------
Kevin Wolf (3):
      block: Add BDRV_O_NO_SHARE for blk_new_open()
      qemu-img convert: Unshare write permission for source
      vhost-user-blk: Fail gracefully on too large queue size

Vladimir Sementsov-Ogievskiy (36):
      tests/test-bdrv-graph-mod: add test_parallel_exclusive_write
      tests/test-bdrv-graph-mod: add test_parallel_perm_update
      tests/test-bdrv-graph-mod: add test_append_greedy_filter
      block: bdrv_append(): don't consume reference
      block: BdrvChildClass: add .get_parent_aio_context handler
      block: drop ctx argument from bdrv_root_attach_child
      block: make bdrv_reopen_{prepare,commit,abort} private
      util: add transactions.c
      block: bdrv_refresh_perms: check for parents permissions conflict
      block: refactor bdrv_child* permission functions
      block: rewrite bdrv_child_try_set_perm() using bdrv_refresh_perms()
      block: inline bdrv_child_*() permission functions calls
      block: use topological sort for permission update
      block: add bdrv_drv_set_perm transaction action
      block: add bdrv_list_* permission update functions
      block: add bdrv_replace_child_safe() transaction action
      block: fix bdrv_replace_node_common
      block: add bdrv_attach_child_common() transaction action
      block: add bdrv_attach_child_noperm() transaction action
      block: split out bdrv_replace_node_noperm()
      block: adapt bdrv_append() for inserting filters
      block: add bdrv_remove_filter_or_cow transaction action
      block: introduce bdrv_drop_filter()
      block/backup-top: drop .active
      block: drop ignore_children for permission update functions
      block: make bdrv_unset_inherits_from to be a transaction action
      block: make bdrv_refresh_limits() to be a transaction action
      block: add bdrv_set_backing_noperm() transaction action
      block: bdrv_reopen_multiple(): move bdrv_flush to separate pre-prepare
      block: bdrv_reopen_multiple: refresh permissions on updated graph
      block: drop unused permission update functions
      block: inline bdrv_check_perm_common()
      block: inline bdrv_replace_child()
      block: refactor bdrv_child_set_perm_safe() transaction action
      block: rename bdrv_replace_child_safe() to bdrv_replace_child()
      block: refactor bdrv_node_check_perm()

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add the test that shows that concept of ignore_children is incomplete.
Actually, when we want to update something, ignoring permission of some
existing BdrvChild, we should ignore also the propagated effect of this
child to the other children. But that's not done. Better approach
(update permissions on already updated graph) will be implemented
later.

Now the test fails, so it's added with -d argument to not break make
check.

Test fails with

"Conflicts with use by fl1 as 'backing', which does not allow 'write' on base"

because when updating permissions we can ignore original top->fl1
BdrvChild. But we don't ignore exclusive write permission in fl1->base
BdrvChild, which is propagated. Correct thing to do is make graph
change first and then do permission update from the top node.

To run test do

./test-bdrv-graph-mod -d -p /bdrv-graph-mod/parallel-exclusive-write

from <build-directory>/tests.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-2-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/unit/test-bdrv-graph-mod.c | 70 +++++++++++++++++++++++++++++++-
 1 file changed, 69 insertions(+), 1 deletion(-)

diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@
 /*
  * Block node graph modifications tests
  *
- * Copyright (c) 2019 Virtuozzo International GmbH. All rights reserved.
+ * Copyright (c) 2019-2021 Virtuozzo International GmbH. All rights reserved.
  *
  * This program is free software; you can redistribute it and/or modify
  * it under the terms of the GNU General Public License as published by
@@ -XXX,XX +XXX,XX @@ static BlockDriver bdrv_no_perm = {
     .bdrv_child_perm = no_perm_default_perms,
 };
 
+static void exclusive_write_perms(BlockDriverState *bs, BdrvChild *c,
+                                  BdrvChildRole role,
+                                  BlockReopenQueue *reopen_queue,
+                                  uint64_t perm, uint64_t shared,
+                                  uint64_t *nperm, uint64_t *nshared)
+{
+    *nperm = BLK_PERM_WRITE;
+    *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
+}
+
+static BlockDriver bdrv_exclusive_writer = {
+    .format_name = "exclusive-writer",
+    .bdrv_child_perm = exclusive_write_perms,
+};
+
 static BlockDriverState *no_perm_node(const char *name)
 {
     return bdrv_new_open_driver(&bdrv_no_perm, name, BDRV_O_RDWR, &error_abort);
@@ -XXX,XX +XXX,XX @@ static BlockDriverState *pass_through_node(const char *name)
                                 BDRV_O_RDWR, &error_abort);
 }
 
+static BlockDriverState *exclusive_writer_node(const char *name)
+{
+    return bdrv_new_open_driver(&bdrv_exclusive_writer, name,
+                                BDRV_O_RDWR, &error_abort);
+}
+
 /*
  * test_update_perm_tree
  *
@@ -XXX,XX +XXX,XX @@ static void test_should_update_child(void)
     blk_unref(root);
 }
 
+/*
+ * test_parallel_exclusive_write
+ *
+ * Check that when we replace node, old permissions of the node being removed
+ * doesn't break the replacement.
+ */
+static void test_parallel_exclusive_write(void)
+{
+    BlockDriverState *top = exclusive_writer_node("top");
+    BlockDriverState *base = no_perm_node("base");
+    BlockDriverState *fl1 = pass_through_node("fl1");
+    BlockDriverState *fl2 = pass_through_node("fl2");
+
+    /*
+     * bdrv_attach_child() eats child bs reference, so we need two @base
+     * references for two filters:
+     */
+    bdrv_ref(base);
+
+    bdrv_attach_child(top, fl1, "backing", &child_of_bds, BDRV_CHILD_DATA,
+                      &error_abort);
+    bdrv_attach_child(fl1, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
+                      &error_abort);
+    bdrv_attach_child(fl2, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
+                      &error_abort);
+
+    bdrv_replace_node(fl1, fl2, &error_abort);
+
+    bdrv_unref(fl2);
+    bdrv_unref(top);
+}
+
 int main(int argc, char *argv[])
 {
+    int i;
+    bool debug = false;
+
+    for (i = 1; i < argc; i++) {
+        if (!strcmp(argv[i], "-d")) {
+            debug = true;
+            break;
+        }
+    }
+
     bdrv_init();
     qemu_init_main_loop(&error_abort);
 
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     g_test_add_func("/bdrv-graph-mod/should-update-child",
                     test_should_update_child);
 
+    if (debug) {
+        g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
+                        test_parallel_exclusive_write);
+    }
+
     return g_test_run();
 }
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add test to show that simple DFS recursion order is not correct for
permission update. Correct order is topological-sort order, which will
be introduced later.

Consider the block driver which has two filter children: one active
with exclusive write access and one inactive with no specific
permissions.

And, these two children has a common base child, like this:

┌─────┐     ┌──────┐
│ fl2 │ ◀── │ top  │
└─────┘     └──────┘
  │           │
  │           │ w
  │           ▼
  │         ┌──────┐
  │         │ fl1  │
  │         └──────┘
  │           │
  │           │ w
  │           ▼
  │         ┌──────┐
  └───────▶ │ base │
            └──────┘

So, exclusive write is propagated.

Assume, we want to make fl2 active instead of fl1.
So, we set some option for top driver and do permission update.

If permission update (remember, it's DFS) goes first through
top->fl1->base branch it will succeed: it firstly drop exclusive write
permissions and than apply them for another BdrvChildren.
But if permission update goes first through top->fl2->base branch it
will fail, as when we try to update fl2->base child, old not yet
updated fl1->base child will be in conflict.

Now test fails, so it runs only with -d flag. To run do

./test-bdrv-graph-mod -d -p /bdrv-graph-mod/parallel-perm-update

from <build-directory>/tests.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-3-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/unit/test-bdrv-graph-mod.c | 116 +++++++++++++++++++++++++++++++
 1 file changed, 116 insertions(+)

diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ static void test_parallel_exclusive_write(void)
     bdrv_unref(top);
 }
 
+static void write_to_file_perms(BlockDriverState *bs, BdrvChild *c,
+                                     BdrvChildRole role,
+                                     BlockReopenQueue *reopen_queue,
+                                     uint64_t perm, uint64_t shared,
+                                     uint64_t *nperm, uint64_t *nshared)
+{
+    if (bs->file && c == bs->file) {
+        *nperm = BLK_PERM_WRITE;
+        *nshared = BLK_PERM_ALL & ~BLK_PERM_WRITE;
+    } else {
+        *nperm = 0;
+        *nshared = BLK_PERM_ALL;
+    }
+}
+
+static BlockDriver bdrv_write_to_file = {
+    .format_name = "tricky-perm",
+    .bdrv_child_perm = write_to_file_perms,
+};
+
+
+/*
+ * The following test shows that topological-sort order is required for
+ * permission update, simple DFS is not enough.
+ *
+ * Consider the block driver which has two filter children: one active
+ * with exclusive write access and one inactive with no specific
+ * permissions.
+ *
+ * And, these two children has a common base child, like this:
+ *
+ * ┌─────┐     ┌──────┐
+ * │ fl2 │ ◀── │ top  │
+ * └─────┘     └──────┘
+ *   │           │
+ *   │           │ w
+ *   │           ▼
+ *   │         ┌──────┐
+ *   │         │ fl1  │
+ *   │         └──────┘
+ *   │           │
+ *   │           │ w
+ *   │           ▼
+ *   │         ┌──────┐
+ *   └───────▶ │ base │
+ *             └──────┘
+ *
+ * So, exclusive write is propagated.
+ *
+ * Assume, we want to make fl2 active instead of fl1.
+ * So, we set some option for top driver and do permission update.
+ *
+ * With simple DFS, if permission update goes first through
+ * top->fl1->base branch it will succeed: it firstly drop exclusive write
+ * permissions and than apply them for another BdrvChildren.
+ * But if permission update goes first through top->fl2->base branch it
+ * will fail, as when we try to update fl2->base child, old not yet
+ * updated fl1->base child will be in conflict.
+ *
+ * With topological-sort order we always update parents before children, so fl1
+ * and fl2 are both updated when we update base and there is no conflict.
+ */
+static void test_parallel_perm_update(void)
+{
+    BlockDriverState *top = no_perm_node("top");
+    BlockDriverState *tricky =
+            bdrv_new_open_driver(&bdrv_write_to_file, "tricky", BDRV_O_RDWR,
+                                 &error_abort);
+    BlockDriverState *base = no_perm_node("base");
+    BlockDriverState *fl1 = pass_through_node("fl1");
+    BlockDriverState *fl2 = pass_through_node("fl2");
+    BdrvChild *c_fl1, *c_fl2;
+
+    /*
+     * bdrv_attach_child() eats child bs reference, so we need two @base
+     * references for two filters:
+     */
+    bdrv_ref(base);
+
+    bdrv_attach_child(top, tricky, "file", &child_of_bds, BDRV_CHILD_DATA,
+                      &error_abort);
+    c_fl1 = bdrv_attach_child(tricky, fl1, "first", &child_of_bds,
+                              BDRV_CHILD_FILTERED, &error_abort);
+    c_fl2 = bdrv_attach_child(tricky, fl2, "second", &child_of_bds,
+                              BDRV_CHILD_FILTERED, &error_abort);
+    bdrv_attach_child(fl1, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
+                      &error_abort);
+    bdrv_attach_child(fl2, base, "backing", &child_of_bds, BDRV_CHILD_FILTERED,
+                      &error_abort);
+
+    /* Select fl1 as first child to be active */
+    tricky->file = c_fl1;
+    bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
+
+    assert(c_fl1->perm & BLK_PERM_WRITE);
+    assert(!(c_fl2->perm & BLK_PERM_WRITE));
+
+    /* Now, try to switch active child and update permissions */
+    tricky->file = c_fl2;
+    bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
+
+    assert(c_fl2->perm & BLK_PERM_WRITE);
+    assert(!(c_fl1->perm & BLK_PERM_WRITE));
+
+    /* Switch once more, to not care about real child order in the list */
+    tricky->file = c_fl1;
+    bdrv_child_refresh_perms(top, top->children.lh_first, &error_abort);
+
+    assert(c_fl1->perm & BLK_PERM_WRITE);
+    assert(!(c_fl2->perm & BLK_PERM_WRITE));
+
+    bdrv_unref(top);
+}
+
 int main(int argc, char *argv[])
 {
     int i;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     if (debug) {
         g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
                         test_parallel_exclusive_write);
+        g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
+                        test_parallel_perm_update);
     }
 
     return g_test_run();
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

bdrv_append() is not quite good for inserting filters: it does extra
permission update in intermediate state, where filter get it filtered
child but is not yet replace it in a backing chain.

Some filters (for example backup-top) may want permissions even when
have no parents. And described intermediate state becomes invalid.

That's (half a) reason, why we need "inactive" state for backup-top
filter.

bdrv_append() will be improved later, now let's add a unit test.

Now test fails, so it runs only with -d flag. To run do

./test-bdrv-graph-mod -d -p /bdrv-graph-mod/append-greedy-filter

from <build-directory>/tests.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-4-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 tests/unit/test-bdrv-graph-mod.c | 33 ++++++++++++++++++++++++++++++++
 1 file changed, 33 insertions(+)

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We have too much comments for this feature. It seems better just don't
do it. Most of real users (tests don't count) have to create additional
reference.

Drop also comment in external_snapshot_prepare:
 - bdrv_append doesn't "remove" old bs in common sense, it sounds
   strange
 - the fact that bdrv_append can fail is obvious from the context
 - the fact that we must rollback all changes in transaction abort is
   known (it's the direct role of abort)

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-5-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 25 +++----------------------
 block/backup-top.c               |  1 -
 block/commit.c                   |  1 +
 block/mirror.c                   |  3 ---
 blockdev.c                       |  4 ----
 tests/unit/test-bdrv-drain.c     |  2 +-
 tests/unit/test-bdrv-graph-mod.c |  3 +++
 7 files changed, 8 insertions(+), 31 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_append_temp_snapshot(BlockDriverState *bs,
         goto out;
     }
 
-    /* bdrv_append() consumes a strong reference to bs_snapshot
-     * (i.e. it will call bdrv_unref() on it) even on error, so in
-     * order to be able to return one, we have to increase
-     * bs_snapshot's refcount here */
-    bdrv_ref(bs_snapshot);
     ret = bdrv_append(bs_snapshot, bs, errp);
     if (ret < 0) {
         bs_snapshot = NULL;
@@ -XXX,XX +XXX,XX @@ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
  * bs_new must not be attached to a BlockBackend.
  *
  * This function does not create any image files.
- *
- * bdrv_append() takes ownership of a bs_new reference and unrefs it because
- * that's what the callers commonly need. bs_new will be referenced by the old
- * parents of bs_top after bdrv_append() returns. If the caller needs to keep a
- * reference of its own, it must call bdrv_ref().
  */
 int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
                 Error **errp)
 {
     int ret = bdrv_set_backing_hd(bs_new, bs_top, errp);
     if (ret < 0) {
-        goto out;
+        return ret;
     }
 
     ret = bdrv_replace_node(bs_top, bs_new, errp);
     if (ret < 0) {
         bdrv_set_backing_hd(bs_new, NULL, &error_abort);
-        goto out;
+        return ret;
     }
 
-    ret = 0;
-
-out:
-    /*
-     * bs_new is now referenced by its new parents, we don't need the
-     * additional reference any more.
-     */
-    bdrv_unref(bs_new);
-
-    return ret;
+    return 0;
 }
 
 static void bdrv_delete(BlockDriverState *bs)
diff --git a/block/backup-top.c b/block/backup-top.c
index XXXXXXX..XXXXXXX 100644
--- a/block/backup-top.c
+++ b/block/backup-top.c
@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
 
     bdrv_drained_begin(source);
 
-    bdrv_ref(top);
     ret = bdrv_append(top, source, errp);
     if (ret < 0) {
         error_prepend(errp, "Cannot append backup-top filter: ");
diff --git a/block/commit.c b/block/commit.c
index XXXXXXX..XXXXXXX 100644
--- a/block/commit.c
+++ b/block/commit.c
@@ -XXX,XX +XXX,XX @@ void commit_start(const char *job_id, BlockDriverState *bs,
     commit_top_bs->total_sectors = top->total_sectors;
 
     ret = bdrv_append(commit_top_bs, top, errp);
+    bdrv_unref(commit_top_bs); /* referenced by new parents or failed */
     if (ret < 0) {
         commit_top_bs = NULL;
         goto fail;
diff --git a/block/mirror.c b/block/mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/block/mirror.c
+++ b/block/mirror.c
@@ -XXX,XX +XXX,XX @@ static BlockJob *mirror_start_job(
 
     bs_opaque->is_commit = target_is_backing;
 
-    /* bdrv_append takes ownership of the mirror_top_bs reference, need to keep
-     * it alive until block_job_create() succeeds even if bs has no parent. */
-    bdrv_ref(mirror_top_bs);
     bdrv_drained_begin(bs);
     ret = bdrv_append(mirror_top_bs, bs, errp);
     bdrv_drained_end(bs);
diff --git a/blockdev.c b/blockdev.c
index XXXXXXX..XXXXXXX 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -XXX,XX +XXX,XX @@ static void external_snapshot_prepare(BlkActionState *common,
         goto out;
     }
 
-    /* This removes our old bs and adds the new bs. This is an operation that
-     * can fail, so we need to do it in .prepare; undoing it for abort is
-     * always possible. */
-    bdrv_ref(state->new_bs);
     ret = bdrv_append(state->new_bs, state->old_bs, errp);
     if (ret < 0) {
         goto out;
diff --git a/tests/unit/test-bdrv-drain.c b/tests/unit/test-bdrv-drain.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-drain.c
+++ b/tests/unit/test-bdrv-drain.c
@@ -XXX,XX +XXX,XX @@ static void test_append_to_drained(void)
     g_assert_cmpint(base_s->drain_count, ==, 1);
     g_assert_cmpint(base->in_flight, ==, 0);
 
-    /* Takes ownership of overlay, so we don't have to unref it later */
     bdrv_append(overlay, base, &error_abort);
     g_assert_cmpint(base->in_flight, ==, 0);
     g_assert_cmpint(overlay->in_flight, ==, 0);
@@ -XXX,XX +XXX,XX @@ static void test_append_to_drained(void)
     g_assert_cmpint(overlay->quiesce_counter, ==, 0);
     g_assert_cmpint(overlay_s->drain_count, ==, 0);
 
+    bdrv_unref(overlay);
     bdrv_unref(base);
     blk_unref(blk);
 }
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ static void test_update_perm_tree(void)
     ret = bdrv_append(filter, bs, NULL);
     g_assert_cmpint(ret, <, 0);
 
+    bdrv_unref(filter);
     blk_unref(root);
 }
 
@@ -XXX,XX +XXX,XX @@ static void test_should_update_child(void)
     bdrv_append(filter, bs, &error_abort);
     g_assert(target->backing->bs == bs);
 
+    bdrv_unref(filter);
     bdrv_unref(bs);
     blk_unref(root);
 }
@@ -XXX,XX +XXX,XX @@ static void test_append_greedy_filter(void)
                       &error_abort);
 
     bdrv_append(fl, base, &error_abort);
+    bdrv_unref(fl);
     bdrv_unref(top);
 }
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add new handler to get aio context and implement it in all child
classes. Add corresponding public interface to be used soon.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-6-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h     |  2 ++
 include/block/block_int.h |  2 ++
 block.c                   | 13 +++++++++++++
 block/block-backend.c     |  9 +++++++++
 blockjob.c                |  8 ++++++++
 5 files changed, 34 insertions(+)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ bool bdrv_child_can_set_aio_context(BdrvChild *c, AioContext *ctx,
                                     GSList **ignore, Error **errp);
 bool bdrv_can_set_aio_context(BlockDriverState *bs, AioContext *ctx,
                               GSList **ignore, Error **errp);
+AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c);
+
 int bdrv_probe_blocksizes(BlockDriverState *bs, BlockSizes *bsz);
 int bdrv_probe_geometry(BlockDriverState *bs, HDGeometry *geo);
 
diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BdrvChildClass {
     bool (*can_set_aio_ctx)(BdrvChild *child, AioContext *ctx,
                             GSList **ignore, Error **errp);
     void (*set_aio_ctx)(BdrvChild *child, AioContext *ctx, GSList **ignore);
+
+    AioContext *(*get_parent_aio_context)(BdrvChild *child);
 };
 
 extern const BdrvChildClass child_of_bds;
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_child_cb_update_filename(BdrvChild *c, BlockDriverState *base,
     return 0;
 }
 
+static AioContext *bdrv_child_cb_get_parent_aio_context(BdrvChild *c)
+{
+    BlockDriverState *bs = c->opaque;
+
+    return bdrv_get_aio_context(bs);
+}
+
 const BdrvChildClass child_of_bds = {
     .parent_is_bds   = true,
     .get_parent_desc = bdrv_child_get_parent_desc,
@@ -XXX,XX +XXX,XX @@ const BdrvChildClass child_of_bds = {
     .can_set_aio_ctx = bdrv_child_cb_can_set_aio_ctx,
     .set_aio_ctx     = bdrv_child_cb_set_aio_ctx,
     .update_filename = bdrv_child_cb_update_filename,
+    .get_parent_aio_context = bdrv_child_cb_get_parent_aio_context,
 };
 
+AioContext *bdrv_child_get_parent_aio_context(BdrvChild *c)
+{
+    return c->klass->get_parent_aio_context(c);
+}
+
 static int bdrv_open_flags(BlockDriverState *bs, int flags)
 {
     int open_flags = flags;
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ static void blk_root_detach(BdrvChild *child)
     }
 }
 
+static AioContext *blk_root_get_parent_aio_context(BdrvChild *c)
+{
+    BlockBackend *blk = c->opaque;
+
+    return blk_get_aio_context(blk);
+}
+
 static const BdrvChildClass child_root = {
     .inherit_options    = blk_root_inherit_options,
 
@@ -XXX,XX +XXX,XX @@ static const BdrvChildClass child_root = {
 
     .can_set_aio_ctx    = blk_root_can_set_aio_ctx,
     .set_aio_ctx        = blk_root_set_aio_ctx,
+
+    .get_parent_aio_context = blk_root_get_parent_aio_context,
 };
 
 /*
diff --git a/blockjob.c b/blockjob.c
index XXXXXXX..XXXXXXX 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -XXX,XX +XXX,XX @@ static void child_job_set_aio_ctx(BdrvChild *c, AioContext *ctx,
     job->job.aio_context = ctx;
 }
 
+static AioContext *child_job_get_parent_aio_context(BdrvChild *c)
+{
+    BlockJob *job = c->opaque;
+
+    return job->job.aio_context;
+}
+
 static const BdrvChildClass child_job = {
     .get_parent_desc    = child_job_get_parent_desc,
     .drained_begin      = child_job_drained_begin,
@@ -XXX,XX +XXX,XX @@ static const BdrvChildClass child_job = {
     .can_set_aio_ctx    = child_job_can_set_aio_ctx,
     .set_aio_ctx        = child_job_set_aio_ctx,
     .stay_at_node       = true,
+    .get_parent_aio_context = child_job_get_parent_aio_context,
 };
 
 void block_job_remove_all_bdrv(BlockJob *job)
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Passing parent aio context is redundant, as child_class and parent
opaque pointer are enough to retrieve it. Drop the argument and use new
bdrv_child_get_parent_aio_context() interface.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-7-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block_int.h | 1 -
 block.c                   | 8 +++++---
 block/block-backend.c     | 4 ++--
 blockjob.c                | 3 +--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
                                   const char *child_name,
                                   const BdrvChildClass *child_class,
                                   BdrvChildRole child_role,
-                                  AioContext *ctx,
                                   uint64_t perm, uint64_t shared_perm,
                                   void *opaque, Error **errp);
 void bdrv_root_unref_child(BdrvChild *child);
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
                                   const char *child_name,
                                   const BdrvChildClass *child_class,
                                   BdrvChildRole child_role,
-                                  AioContext *ctx,
                                   uint64_t perm, uint64_t shared_perm,
                                   void *opaque, Error **errp)
 {
     BdrvChild *child;
     Error *local_err = NULL;
     int ret;
+    AioContext *ctx;
 
     ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, errp);
     if (ret < 0) {
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
         .opaque         = opaque,
     };
 
+    ctx = bdrv_child_get_parent_aio_context(child);
+
     /* If the AioContexts don't match, first try to move the subtree of
      * child_bs into the AioContext of the new parent. If this doesn't work,
      * try moving the parent into the AioContext of child_bs instead. */
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
                     perm, shared_perm, &perm, &shared_perm);
 
     child = bdrv_root_attach_child(child_bs, child_name, child_class,
-                                   child_role, bdrv_get_aio_context(parent_bs),
-                                   perm, shared_perm, parent_bs, errp);
+                                   child_role, perm, shared_perm, parent_bs,
+                                   errp);
     if (child == NULL) {
         return NULL;
     }
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
 
     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                                       blk->ctx, perm, BLK_PERM_ALL, blk, errp);
+                                       perm, BLK_PERM_ALL, blk, errp);
     if (!blk->root) {
         blk_unref(blk);
         return NULL;
@@ -XXX,XX +XXX,XX @@ int blk_insert_bs(BlockBackend *blk, BlockDriverState *bs, Error **errp)
     bdrv_ref(bs);
     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                                       blk->ctx, blk->perm, blk->shared_perm,
+                                       blk->perm, blk->shared_perm,
                                        blk, errp);
     if (blk->root == NULL) {
         return -EPERM;
diff --git a/blockjob.c b/blockjob.c
index XXXXXXX..XXXXXXX 100644
--- a/blockjob.c
+++ b/blockjob.c
@@ -XXX,XX +XXX,XX @@ int block_job_add_bdrv(BlockJob *job, const char *name, BlockDriverState *bs,
     if (need_context_ops && job->job.aio_context != qemu_get_aio_context()) {
         aio_context_release(job->job.aio_context);
     }
-    c = bdrv_root_attach_child(bs, name, &child_job, 0,
-                               job->job.aio_context, perm, shared_perm, job,
+    c = bdrv_root_attach_child(bs, name, &child_job, 0, perm, shared_perm, job,
                                errp);
     if (need_context_ops && job->job.aio_context != qemu_get_aio_context()) {
         aio_context_acquire(job->job.aio_context);
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

These functions are called only from bdrv_reopen_multiple() in block.c.
No reason to publish them.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-8-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h |  4 ----
 block.c               | 13 +++++++++----
 2 files changed, 9 insertions(+), 8 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ BlockReopenQueue *bdrv_reopen_queue(BlockReopenQueue *bs_queue,
 int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp);
 int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
                               Error **errp);
-int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
-                        BlockReopenQueue *queue, Error **errp);
-void bdrv_reopen_commit(BDRVReopenState *reopen_state);
-void bdrv_reopen_abort(BDRVReopenState *reopen_state);
 int bdrv_pwrite_zeroes(BdrvChild *child, int64_t offset,
                        int64_t bytes, BdrvRequestFlags flags);
 int bdrv_make_zero(BdrvChild *child, BdrvRequestFlags flags);
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                            BdrvChildRole child_role,
                                            Error **errp);
 
+static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
+                               *queue, Error **errp);
+static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
+static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
+
 /* If non-zero, use only whitelisted block drivers */
 static int use_bdrv_whitelist;
 
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
  * commit() for any other BDS that have been left in a prepare() state
  *
  */
-int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue *queue,
-                        Error **errp)
+static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
+                               BlockReopenQueue *queue, Error **errp)
 {
     int ret = -1;
     int old_flags;
@@ -XXX,XX +XXX,XX @@ error:
  * makes them final by swapping the staging BlockDriverState contents into
  * the active BlockDriverState contents.
  */
-void bdrv_reopen_commit(BDRVReopenState *reopen_state)
+static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
 {
     BlockDriver *drv;
     BlockDriverState *bs;
@@ -XXX,XX +XXX,XX @@ void bdrv_reopen_commit(BDRVReopenState *reopen_state)
  * Abort the reopen, and delete and free the staged changes in
  * reopen_state
  */
-void bdrv_reopen_abort(BDRVReopenState *reopen_state)
+static void bdrv_reopen_abort(BDRVReopenState *reopen_state)
 {
     BlockDriver *drv;
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add simple transaction API to use in further update of block graph
operations.

Supposed usage is:

- "prepare" is main function of the action and it should make the main
  effect of the action to be visible for the following actions, keeping
  possibility of roll-back, saving necessary things in action state,
  which is prepended to the action list (to do that, prepare func
  should call tran_add()). So, driver struct doesn't include "prepare"
  field, as it is supposed to be called directly.

- commit/rollback is supposed to be called for the list of action
  states, to commit/rollback all the actions in reverse order

- When possible "commit" should not make visible effect for other
  actions, which make possible transparent logical interaction between
  actions.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-9-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/qemu/transactions.h | 63 ++++++++++++++++++++++++
 util/transactions.c         | 96 +++++++++++++++++++++++++++++++++++++
 MAINTAINERS                 |  6 +++
 util/meson.build            |  1 +
 4 files changed, 166 insertions(+)
 create mode 100644 include/qemu/transactions.h
 create mode 100644 util/transactions.c

diff --git a/include/qemu/transactions.h b/include/qemu/transactions.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/qemu/transactions.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Simple transactions API
+ *
+ * Copyright (c) 2021 Virtuozzo International GmbH.
+ *
+ * Author:
+ *  Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ *
+ *
+ * = Generic transaction API =
+ *
+ * The intended usage is the following: you create "prepare" functions, which
+ * represents the actions. They will usually have Transaction* argument, and
+ * call tran_add() to register finalization callbacks. For finalization
+ * callbacks, prepare corresponding TransactionActionDrv structures.
+ *
+ * Then, when you need to make a transaction, create an empty Transaction by
+ * tran_create(), call your "prepare" functions on it, and finally call
+ * tran_abort() or tran_commit() to finalize the transaction by corresponding
+ * finalization actions in reverse order.
+ */
+
+#ifndef QEMU_TRANSACTIONS_H
+#define QEMU_TRANSACTIONS_H
+
+#include <gmodule.h>
+
+typedef struct TransactionActionDrv {
+    void (*abort)(void *opaque);
+    void (*commit)(void *opaque);
+    void (*clean)(void *opaque);
+} TransactionActionDrv;
+
+typedef struct Transaction Transaction;
+
+Transaction *tran_new(void);
+void tran_add(Transaction *tran, TransactionActionDrv *drv, void *opaque);
+void tran_abort(Transaction *tran);
+void tran_commit(Transaction *tran);
+
+static inline void tran_finalize(Transaction *tran, int ret)
+{
+    if (ret < 0) {
+        tran_abort(tran);
+    } else {
+        tran_commit(tran);
+    }
+}
+
+#endif /* QEMU_TRANSACTIONS_H */
diff --git a/util/transactions.c b/util/transactions.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/util/transactions.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Simple transactions API
+ *
+ * Copyright (c) 2021 Virtuozzo International GmbH.
+ *
+ * Author:
+ *  Sementsov-Ogievskiy Vladimir <vsementsov@virtuozzo.com>
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program. If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "qemu/osdep.h"
+
+#include "qemu/transactions.h"
+#include "qemu/queue.h"
+
+typedef struct TransactionAction {
+    TransactionActionDrv *drv;
+    void *opaque;
+    QSLIST_ENTRY(TransactionAction) entry;
+} TransactionAction;
+
+struct Transaction {
+    QSLIST_HEAD(, TransactionAction) actions;
+};
+
+Transaction *tran_new(void)
+{
+    Transaction *tran = g_new(Transaction, 1);
+
+    QSLIST_INIT(&tran->actions);
+
+    return tran;
+}
+
+void tran_add(Transaction *tran, TransactionActionDrv *drv, void *opaque)
+{
+    TransactionAction *act;
+
+    act = g_new(TransactionAction, 1);
+    *act = (TransactionAction) {
+        .drv = drv,
+        .opaque = opaque
+    };
+
+    QSLIST_INSERT_HEAD(&tran->actions, act, entry);
+}
+
+void tran_abort(Transaction *tran)
+{
+    TransactionAction *act, *next;
+
+    QSLIST_FOREACH_SAFE(act, &tran->actions, entry, next) {
+        if (act->drv->abort) {
+            act->drv->abort(act->opaque);
+        }
+
+        if (act->drv->clean) {
+            act->drv->clean(act->opaque);
+        }
+
+        g_free(act);
+    }
+
+    g_free(tran);
+}
+
+void tran_commit(Transaction *tran)
+{
+    TransactionAction *act, *next;
+
+    QSLIST_FOREACH_SAFE(act, &tran->actions, entry, next) {
+        if (act->drv->commit) {
+            act->drv->commit(act->opaque);
+        }
+
+        if (act->drv->clean) {
+            act->drv->clean(act->opaque);
+        }
+
+        g_free(act);
+    }
+
+    g_free(tran);
+}
diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
 S: Maintained
 F: scripts/simplebench/
 
+Transactions helper
+M: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
+S: Maintained
+F: include/qemu/transactions.h
+F: util/transactions.c
+
 QAPI
 M: Markus Armbruster <armbru@redhat.com>
 M: Michael Roth <michael.roth@amd.com>
diff --git a/util/meson.build b/util/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/util/meson.build
+++ b/util/meson.build
@@ -XXX,XX +XXX,XX @@ util_ss.add(files('qsp.c'))
 util_ss.add(files('range.c'))
 util_ss.add(files('stats64.c'))
 util_ss.add(files('systemd.c'))
+util_ss.add(files('transactions.c'))
 util_ss.add(when: 'CONFIG_POSIX', if_true: files('drm.c'))
 util_ss.add(files('guest-random.c'))
 util_ss.add(files('yank.c'))
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add additional check that node parents do not interfere with each
other. This should not hurt existing callers and allows in further
patch use bdrv_refresh_perms() to update a subtree of changed
BdrvChild (check that change is correct).

New check will substitute bdrv_check_update_perm() in following
permissions refactoring, so keep error messages the same to avoid
unit test result changes.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-10-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 63 ++++++++++++++++++++++++++++++++++++++++++++++++---------
 1 file changed, 54 insertions(+), 9 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ bool bdrv_is_writable(BlockDriverState *bs)
     return bdrv_is_writable_after_reopen(bs, NULL);
 }
 
+static char *bdrv_child_user_desc(BdrvChild *c)
+{
+    if (c->klass->get_parent_desc) {
+        return c->klass->get_parent_desc(c);
+    }
+
+    return g_strdup("another user");
+}
+
+static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
+{
+    g_autofree char *user = NULL;
+    g_autofree char *perm_names = NULL;
+
+    if ((b->perm & a->shared_perm) == b->perm) {
+        return true;
+    }
+
+    perm_names = bdrv_perm_names(b->perm & ~a->shared_perm);
+    user = bdrv_child_user_desc(a);
+    error_setg(errp, "Conflicts with use by %s as '%s', which does not "
+               "allow '%s' on %s",
+               user, a->name, perm_names, bdrv_get_node_name(b->bs));
+
+    return false;
+}
+
+static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
+{
+    BdrvChild *a, *b;
+
+    /*
+     * During the loop we'll look at each pair twice. That's correct because
+     * bdrv_a_allow_b() is asymmetric and we should check each pair in both
+     * directions.
+     */
+    QLIST_FOREACH(a, &bs->parents, next_parent) {
+        QLIST_FOREACH(b, &bs->parents, next_parent) {
+            if (a == b) {
+                continue;
+            }
+
+            if (!bdrv_a_allow_b(a, b, errp)) {
+                return true;
+            }
+        }
+    }
+
+    return false;
+}
+
 static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
                             BdrvChild *c, BdrvChildRole role,
                             BlockReopenQueue *reopen_queue,
@@ -XXX,XX +XXX,XX @@ void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
     *shared_perm = cumulative_shared_perms;
 }
 
-static char *bdrv_child_user_desc(BdrvChild *c)
-{
-    if (c->klass->get_parent_desc) {
-        return c->klass->get_parent_desc(c);
-    }
-
-    return g_strdup("another user");
-}
-
 char *bdrv_perm_names(uint64_t perm)
 {
     struct perm_name {
@@ -XXX,XX +XXX,XX @@ static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
     int ret;
     uint64_t perm, shared_perm;
 
+    if (bdrv_parent_perms_conflict(bs, errp)) {
+        return -EPERM;
+    }
     bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
     ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, errp);
     if (ret < 0) {
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split out non-recursive parts, and refactor as block graph transaction
action.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-11-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 79 ++++++++++++++++++++++++++++++++++++++++++---------------
 1 file changed, 59 insertions(+), 20 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/cutils.h"
 #include "qemu/id.h"
+#include "qemu/transactions.h"
 #include "block/coroutines.h"
 
 #ifdef CONFIG_BSD
@@ -XXX,XX +XXX,XX @@ static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
     }
 }
 
+static void bdrv_child_set_perm_commit(void *opaque)
+{
+    BdrvChild *c = opaque;
+
+    c->has_backup_perm = false;
+}
+
+static void bdrv_child_set_perm_abort(void *opaque)
+{
+    BdrvChild *c = opaque;
+    /*
+     * We may have child->has_backup_perm unset at this point, as in case of
+     * _check_ stage of permission update failure we may _check_ not the whole
+     * subtree.  Still, _abort_ is called on the whole subtree anyway.
+     */
+    if (c->has_backup_perm) {
+        c->perm = c->backup_perm;
+        c->shared_perm = c->backup_shared_perm;
+        c->has_backup_perm = false;
+    }
+}
+
+static TransactionActionDrv bdrv_child_set_pem_drv = {
+    .abort = bdrv_child_set_perm_abort,
+    .commit = bdrv_child_set_perm_commit,
+};
+
+/*
+ * With tran=NULL needs to be followed by direct call to either
+ * bdrv_child_set_perm_commit() or bdrv_child_set_perm_abort().
+ *
+ * With non-NULL tran needs to be followed by tran_abort() or tran_commit()
+ * instead.
+ */
+static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
+                                     uint64_t shared, Transaction *tran)
+{
+    if (!c->has_backup_perm) {
+        c->has_backup_perm = true;
+        c->backup_perm = c->perm;
+        c->backup_shared_perm = c->shared_perm;
+    }
+    /*
+     * Note: it's OK if c->has_backup_perm was already set, as we can find the
+     * same c twice during check_perm procedure
+     */
+
+    c->perm = perm;
+    c->shared_perm = shared;
+
+    if (tran) {
+        tran_add(tran, &bdrv_child_set_pem_drv, c);
+    }
+}
+
 /*
  * Check whether permissions on this node can be changed in a way that
  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
@@ -XXX,XX +XXX,XX @@ static int bdrv_child_check_perm(BdrvChild *c, BlockReopenQueue *q,
         return ret;
     }
 
-    if (!c->has_backup_perm) {
-        c->has_backup_perm = true;
-        c->backup_perm = c->perm;
-        c->backup_shared_perm = c->shared_perm;
-    }
-    /*
-     * Note: it's OK if c->has_backup_perm was already set, as we can find the
-     * same child twice during check_perm procedure
-     */
-
-    c->perm = perm;
-    c->shared_perm = shared;
+    bdrv_child_set_perm_safe(c, perm, shared, NULL);
 
     return 0;
 }
 
 static void bdrv_child_set_perm(BdrvChild *c)
 {
-    c->has_backup_perm = false;
-
+    bdrv_child_set_perm_commit(c);
     bdrv_set_perm(c->bs);
 }
 
 static void bdrv_child_abort_perm_update(BdrvChild *c)
 {
-    if (c->has_backup_perm) {
-        c->perm = c->backup_perm;
-        c->shared_perm = c->backup_shared_perm;
-        c->has_backup_perm = false;
-    }
-
+    bdrv_child_set_perm_abort(c);
     bdrv_abort_perm_update(c->bs);
 }
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We are going to drop recursive bdrv_child_* functions, so stop use them
in bdrv_child_try_set_perm() as a first step.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-12-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
                             Error **errp)
 {
     Error *local_err = NULL;
+    Transaction *tran = tran_new();
     int ret;
 
-    ret = bdrv_child_check_perm(c, NULL, perm, shared, NULL, &local_err);
+    bdrv_child_set_perm_safe(c, perm, shared, tran);
+
+    ret = bdrv_refresh_perms(c->bs, &local_err);
+
+    tran_finalize(tran, ret);
+
     if (ret < 0) {
-        bdrv_child_abort_perm_update(c);
         if ((perm & ~c->perm) || (c->shared_perm & ~shared)) {
             /* tighten permissions */
             error_propagate(errp, local_err);
@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
             error_free(local_err);
             ret = 0;
         }
-        return ret;
     }
 
-    bdrv_child_set_perm(c);
-
-    return 0;
+    return ret;
 }
 
 int bdrv_child_refresh_perms(BlockDriverState *bs, BdrvChild *c, Error **errp)
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Each of them has only one caller. Open-coding simplifies further
pemission-update system changes.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Alberto Garcia <berto@igalia.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-13-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 59 +++++++++++++++++----------------------------------------
 1 file changed, 17 insertions(+), 42 deletions(-)

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Rewrite bdrv_check_perm(), bdrv_abort_perm_update() and bdrv_set_perm()
to update nodes in topological sort order instead of simple DFS. With
topologically sorted nodes, we update a node only when all its parents
already updated. With DFS it's not so.

Consider the following example:

A -+
    |  |
    |  v
    |  B
    |  |
    v  |
    C<-+

A is parent for B and C, B is parent for C.

Obviously, to update permissions, we should go in order A B C, so, when
we update C, all parent permissions already updated. But with current
approach (simple recursion) we can update in sequence A C B C (C is
updated twice). On first update of C, we consider old B permissions, so
doing wrong thing. If it succeed, all is OK, on second C update we will
finish with correct graph. But if the wrong thing failed, we break the
whole process for no reason (it's possible that updated B permission
will be less strict, but we will never check it).

Also new approach gives a way to simultaneously and correctly update
several nodes, we just need to run bdrv_topological_dfs() several times
to add all nodes and their subtrees into one topologically sorted list
(next patch will update bdrv_replace_node() in this manner).

Test test_parallel_perm_update() is now passing, so move it out of
debugging "if".

We also need to support ignore_children in
bdrv_parent_perms_conflict()

For test 283 order of conflicting parents check is changed.

Note also that in bdrv_check_perm() we don't check for parents conflict
at root bs, as we may be in the middle of permission update in
bdrv_reopen_multiple(). bdrv_reopen_multiple() will be updated soon.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-14-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 116 +++++++++++++++++++++++++------
 tests/unit/test-bdrv-graph-mod.c |   4 +-
 tests/qemu-iotests/283.out       |   2 +-
 3 files changed, 99 insertions(+), 23 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
     return false;
 }
 
-static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
+static bool bdrv_parent_perms_conflict(BlockDriverState *bs,
+                                       GSList *ignore_children,
+                                       Error **errp)
 {
     BdrvChild *a, *b;
 
@@ -XXX,XX +XXX,XX @@ static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
      * directions.
      */
     QLIST_FOREACH(a, &bs->parents, next_parent) {
+        if (g_slist_find(ignore_children, a)) {
+            continue;
+        }
+
         QLIST_FOREACH(b, &bs->parents, next_parent) {
-            if (a == b) {
+            if (a == b || g_slist_find(ignore_children, b)) {
                 continue;
             }
 
@@ -XXX,XX +XXX,XX @@ static void bdrv_child_perm(BlockDriverState *bs, BlockDriverState *child_bs,
     }
 }
 
+/*
+ * Adds the whole subtree of @bs (including @bs itself) to the @list (except for
+ * nodes that are already in the @list, of course) so that final list is
+ * topologically sorted. Return the result (GSList @list object is updated, so
+ * don't use old reference after function call).
+ *
+ * On function start @list must be already topologically sorted and for any node
+ * in the @list the whole subtree of the node must be in the @list as well. The
+ * simplest way to satisfy this criteria: use only result of
+ * bdrv_topological_dfs() or NULL as @list parameter.
+ */
+static GSList *bdrv_topological_dfs(GSList *list, GHashTable *found,
+                                    BlockDriverState *bs)
+{
+    BdrvChild *child;
+    g_autoptr(GHashTable) local_found = NULL;
+
+    if (!found) {
+        assert(!list);
+        found = local_found = g_hash_table_new(NULL, NULL);
+    }
+
+    if (g_hash_table_contains(found, bs)) {
+        return list;
+    }
+    g_hash_table_add(found, bs);
+
+    QLIST_FOREACH(child, &bs->children, next) {
+        list = bdrv_topological_dfs(list, found, child->bs);
+    }
+
+    return g_slist_prepend(list, bs);
+}
+
 static void bdrv_child_set_perm_commit(void *opaque)
 {
     BdrvChild *c = opaque;
@@ -XXX,XX +XXX,XX @@ static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
  * A call to this function must always be followed by a call to bdrv_set_perm()
  * or bdrv_abort_perm_update().
  */
-static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-                           uint64_t cumulative_perms,
-                           uint64_t cumulative_shared_perms,
-                           GSList *ignore_children, Error **errp)
+static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
+                                uint64_t cumulative_perms,
+                                uint64_t cumulative_shared_perms,
+                                GSList *ignore_children, Error **errp)
 {
     BlockDriver *drv = bs->drv;
     BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
     /* Check all children */
     QLIST_FOREACH(c, &bs->children, next) {
         uint64_t cur_perm, cur_shared;
-        GSList *cur_ignore_children;
 
         bdrv_child_perm(bs, c->bs, c, c->role, q,
                         cumulative_perms, cumulative_shared_perms,
                         &cur_perm, &cur_shared);
+        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
+    }
+
+    return 0;
+}
+
+static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
+                           uint64_t cumulative_perms,
+                           uint64_t cumulative_shared_perms,
+                           GSList *ignore_children, Error **errp)
+{
+    int ret;
+    BlockDriverState *root = bs;
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, root);
 
-        cur_ignore_children = g_slist_prepend(g_slist_copy(ignore_children), c);
-        ret = bdrv_check_update_perm(c->bs, q, cur_perm, cur_shared,
-                                     cur_ignore_children, errp);
-        g_slist_free(cur_ignore_children);
+    for ( ; list; list = list->next) {
+        bs = list->data;
+
+        if (bs != root) {
+            if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
+                return -EINVAL;
+            }
+
+            bdrv_get_cumulative_perm(bs, &cumulative_perms,
+                                     &cumulative_shared_perms);
+        }
+
+        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
+                                   cumulative_shared_perms,
+                                   ignore_children, errp);
         if (ret < 0) {
             return ret;
         }
-
-        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
     }
 
     return 0;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
  * Notifies drivers that after a previous bdrv_check_perm() call, the
  * permission update is not performed and any preparations made for it (e.g.
  * taken file locks) need to be undone.
- *
- * This function recursively notifies all child nodes.
  */
-static void bdrv_abort_perm_update(BlockDriverState *bs)
+static void bdrv_node_abort_perm_update(BlockDriverState *bs)
 {
     BlockDriver *drv = bs->drv;
     BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static void bdrv_abort_perm_update(BlockDriverState *bs)
 
     QLIST_FOREACH(c, &bs->children, next) {
         bdrv_child_set_perm_abort(c);
-        bdrv_abort_perm_update(c->bs);
     }
 }
 
-static void bdrv_set_perm(BlockDriverState *bs)
+static void bdrv_abort_perm_update(BlockDriverState *bs)
+{
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
+
+    for ( ; list; list = list->next) {
+        bdrv_node_abort_perm_update((BlockDriverState *)list->data);
+    }
+}
+
+static void bdrv_node_set_perm(BlockDriverState *bs)
 {
     uint64_t cumulative_perms, cumulative_shared_perms;
     BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ static void bdrv_set_perm(BlockDriverState *bs)
     /* Update all children */
     QLIST_FOREACH(c, &bs->children, next) {
         bdrv_child_set_perm_commit(c);
-        bdrv_set_perm(c->bs);
+    }
+}
+
+static void bdrv_set_perm(BlockDriverState *bs)
+{
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
+
+    for ( ; list; list = list->next) {
+        bdrv_node_set_perm((BlockDriverState *)list->data);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
     int ret;
     uint64_t perm, shared_perm;
 
-    if (bdrv_parent_perms_conflict(bs, errp)) {
+    if (bdrv_parent_perms_conflict(bs, NULL, errp)) {
         return -EPERM;
     }
     bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
     g_test_add_func("/bdrv-graph-mod/update-perm-tree", test_update_perm_tree);
     g_test_add_func("/bdrv-graph-mod/should-update-child",
                     test_should_update_child);
+    g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
+                    test_parallel_perm_update);
 
     if (debug) {
         g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
                         test_parallel_exclusive_write);
-        g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
-                        test_parallel_perm_update);
         g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
                         test_append_greedy_filter);
     }
diff --git a/tests/qemu-iotests/283.out b/tests/qemu-iotests/283.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/283.out
+++ b/tests/qemu-iotests/283.out
@@ -XXX,XX +XXX,XX @@
 {"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": "base", "node-name": "other", "take-child-perms": ["write"]}}
 {"return": {}}
 {"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
-{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by other as 'image', which uses 'write' on base"}}
+{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by source as 'image', which does not allow 'write' on base"}}
 
 === backup-top should be gone after job-finalize ===
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Refactor calling driver callbacks to a separate transaction action to
be used later.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-15-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 70 ++++++++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 54 insertions(+), 16 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
     }
 }
 
+static void bdrv_drv_set_perm_commit(void *opaque)
+{
+    BlockDriverState *bs = opaque;
+    uint64_t cumulative_perms, cumulative_shared_perms;
+
+    if (bs->drv->bdrv_set_perm) {
+        bdrv_get_cumulative_perm(bs, &cumulative_perms,
+                                 &cumulative_shared_perms);
+        bs->drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
+    }
+}
+
+static void bdrv_drv_set_perm_abort(void *opaque)
+{
+    BlockDriverState *bs = opaque;
+
+    if (bs->drv->bdrv_abort_perm_update) {
+        bs->drv->bdrv_abort_perm_update(bs);
+    }
+}
+
+TransactionActionDrv bdrv_drv_set_perm_drv = {
+    .abort = bdrv_drv_set_perm_abort,
+    .commit = bdrv_drv_set_perm_commit,
+};
+
+static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
+                             uint64_t shared_perm, Transaction *tran,
+                             Error **errp)
+{
+    if (!bs->drv) {
+        return 0;
+    }
+
+    if (bs->drv->bdrv_check_perm) {
+        int ret = bs->drv->bdrv_check_perm(bs, perm, shared_perm, errp);
+        if (ret < 0) {
+            return ret;
+        }
+    }
+
+    if (tran) {
+        tran_add(tran, &bdrv_drv_set_perm_drv, bs);
+    }
+
+    return 0;
+}
+
 /*
  * Check whether permissions on this node can be changed in a way that
  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
         return 0;
     }
 
-    if (drv->bdrv_check_perm) {
-        ret = drv->bdrv_check_perm(bs, cumulative_perms,
-                                   cumulative_shared_perms, errp);
-        if (ret < 0) {
-            return ret;
-        }
+    ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, NULL,
+                            errp);
+    if (ret < 0) {
+        return ret;
     }
 
     /* Drivers that never have children can omit .bdrv_child_perm() */
@@ -XXX,XX +XXX,XX @@ static void bdrv_node_abort_perm_update(BlockDriverState *bs)
         return;
     }
 
-    if (drv->bdrv_abort_perm_update) {
-        drv->bdrv_abort_perm_update(bs);
-    }
+    bdrv_drv_set_perm_abort(bs);
 
     QLIST_FOREACH(c, &bs->children, next) {
         bdrv_child_set_perm_abort(c);
@@ -XXX,XX +XXX,XX @@ static void bdrv_abort_perm_update(BlockDriverState *bs)
 
 static void bdrv_node_set_perm(BlockDriverState *bs)
 {
-    uint64_t cumulative_perms, cumulative_shared_perms;
     BlockDriver *drv = bs->drv;
     BdrvChild *c;
 
@@ -XXX,XX +XXX,XX @@ static void bdrv_node_set_perm(BlockDriverState *bs)
         return;
     }
 
-    bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
-
-    /* Update this node */
-    if (drv->bdrv_set_perm) {
-        drv->bdrv_set_perm(bs, cumulative_perms, cumulative_shared_perms);
-    }
+    bdrv_drv_set_perm_commit(bs);
 
     /* Drivers that never have children can omit .bdrv_child_perm() */
     if (!drv->bdrv_child_perm) {
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Add new interface, allowing use of existing node list. It will be used
to fix bdrv_replace_node() in the further commit.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-16-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 106 +++++++++++++++++++++++++++++++++++++-------------------
 1 file changed, 71 insertions(+), 35 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
 static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                 uint64_t cumulative_perms,
                                 uint64_t cumulative_shared_perms,
-                                GSList *ignore_children, Error **errp)
+                                GSList *ignore_children,
+                                Transaction *tran, Error **errp)
 {
     BlockDriver *drv = bs->drv;
     BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
         return 0;
     }
 
-    ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, NULL,
+    ret = bdrv_drv_set_perm(bs, cumulative_perms, cumulative_shared_perms, tran,
                             errp);
     if (ret < 0) {
         return ret;
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
         bdrv_child_perm(bs, c->bs, c, c->role, q,
                         cumulative_perms, cumulative_shared_perms,
                         &cur_perm, &cur_shared);
-        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, NULL);
+        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, tran);
     }
 
     return 0;
 }
 
-static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-                           uint64_t cumulative_perms,
-                           uint64_t cumulative_shared_perms,
-                           GSList *ignore_children, Error **errp)
+/*
+ * If use_cumulative_perms is true, use cumulative_perms and
+ * cumulative_shared_perms for first element of the list. Otherwise just refresh
+ * all permissions.
+ */
+static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
+                                  bool use_cumulative_perms,
+                                  uint64_t cumulative_perms,
+                                  uint64_t cumulative_shared_perms,
+                                  GSList *ignore_children,
+                                  Transaction *tran, Error **errp)
 {
     int ret;
-    BlockDriverState *root = bs;
-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, root);
+    BlockDriverState *bs;
 
-    for ( ; list; list = list->next) {
+    if (use_cumulative_perms) {
         bs = list->data;
 
-        if (bs != root) {
-            if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
-                return -EINVAL;
-            }
+        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
+                                   cumulative_shared_perms,
+                                   ignore_children, tran, errp);
+        if (ret < 0) {
+            return ret;
+        }
 
-            bdrv_get_cumulative_perm(bs, &cumulative_perms,
-                                     &cumulative_shared_perms);
+        list = list->next;
+    }
+
+    for ( ; list; list = list->next) {
+        bs = list->data;
+
+        if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
+            return -EINVAL;
         }
 
+        bdrv_get_cumulative_perm(bs, &cumulative_perms,
+                                 &cumulative_shared_perms);
+
         ret = bdrv_node_check_perm(bs, q, cumulative_perms,
                                    cumulative_shared_perms,
-                                   ignore_children, errp);
+                                   ignore_children, tran, errp);
         if (ret < 0) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
     return 0;
 }
 
+static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
+                           uint64_t cumulative_perms,
+                           uint64_t cumulative_shared_perms,
+                           GSList *ignore_children, Error **errp)
+{
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
+    return bdrv_check_perm_common(list, q, true, cumulative_perms,
+                                  cumulative_shared_perms, ignore_children,
+                                  NULL, errp);
+}
+
+static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
+                                   Transaction *tran, Error **errp)
+{
+    return bdrv_check_perm_common(list, q, false, 0, 0, NULL, tran, errp);
+}
+
 /*
  * Notifies drivers that after a previous bdrv_check_perm() call, the
  * permission update is not performed and any preparations made for it (e.g.
@@ -XXX,XX +XXX,XX @@ static void bdrv_node_abort_perm_update(BlockDriverState *bs)
     }
 }
 
-static void bdrv_abort_perm_update(BlockDriverState *bs)
+static void bdrv_list_abort_perm_update(GSList *list)
 {
-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-
     for ( ; list; list = list->next) {
         bdrv_node_abort_perm_update((BlockDriverState *)list->data);
     }
 }
 
+static void bdrv_abort_perm_update(BlockDriverState *bs)
+{
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
+    return bdrv_list_abort_perm_update(list);
+}
+
 static void bdrv_node_set_perm(BlockDriverState *bs)
 {
     BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ static void bdrv_node_set_perm(BlockDriverState *bs)
     }
 }
 
-static void bdrv_set_perm(BlockDriverState *bs)
+static void bdrv_list_set_perm(GSList *list)
 {
-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-
     for ( ; list; list = list->next) {
         bdrv_node_set_perm((BlockDriverState *)list->data);
     }
 }
 
+static void bdrv_set_perm(BlockDriverState *bs)
+{
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
+    return bdrv_list_set_perm(list);
+}
+
 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
                               uint64_t *shared_perm)
 {
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
 static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
 {
     int ret;
-    uint64_t perm, shared_perm;
+    Transaction *tran = tran_new();
+    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
 
-    if (bdrv_parent_perms_conflict(bs, NULL, errp)) {
-        return -EPERM;
-    }
-    bdrv_get_cumulative_perm(bs, &perm, &shared_perm);
-    ret = bdrv_check_perm(bs, NULL, perm, shared_perm, NULL, errp);
-    if (ret < 0) {
-        bdrv_abort_perm_update(bs);
-        return ret;
-    }
-    bdrv_set_perm(bs);
+    ret = bdrv_list_refresh_perms(list, NULL, tran, errp);
+    tran_finalize(tran, ret);
 
-    return 0;
+    return ret;
 }
 
 int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

To be used in the following commit.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-17-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 54 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 54 insertions(+)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
                                            BdrvChildRole child_role,
                                            Error **errp);
 
+static void bdrv_replace_child_noperm(BdrvChild *child,
+                                      BlockDriverState *new_bs);
+
 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
                                *queue, Error **errp);
 static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
@@ -XXX,XX +XXX,XX @@ static int bdrv_drv_set_perm(BlockDriverState *bs, uint64_t perm,
     return 0;
 }
 
+typedef struct BdrvReplaceChildState {
+    BdrvChild *child;
+    BlockDriverState *old_bs;
+} BdrvReplaceChildState;
+
+static void bdrv_replace_child_commit(void *opaque)
+{
+    BdrvReplaceChildState *s = opaque;
+
+    bdrv_unref(s->old_bs);
+}
+
+static void bdrv_replace_child_abort(void *opaque)
+{
+    BdrvReplaceChildState *s = opaque;
+    BlockDriverState *new_bs = s->child->bs;
+
+    /* old_bs reference is transparently moved from @s to @s->child */
+    bdrv_replace_child_noperm(s->child, s->old_bs);
+    bdrv_unref(new_bs);
+}
+
+static TransactionActionDrv bdrv_replace_child_drv = {
+    .commit = bdrv_replace_child_commit,
+    .abort = bdrv_replace_child_abort,
+    .clean = g_free,
+};
+
+/*
+ * bdrv_replace_child_safe
+ *
+ * Note: real unref of old_bs is done only on commit.
+ */
+__attribute__((unused))
+static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
+                                    Transaction *tran)
+{
+    BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
+    *s = (BdrvReplaceChildState) {
+        .child = child,
+        .old_bs = child->bs,
+    };
+    tran_add(tran, &bdrv_replace_child_drv, s);
+
+    if (new_bs) {
+        bdrv_ref(new_bs);
+    }
+    bdrv_replace_child_noperm(child, new_bs);
+    /* old_bs reference is transparently moved from @child to @s */
+}
+
 /*
  * Check whether permissions on this node can be changed in a way that
  * @cumulative_perms and @cumulative_shared_perms are the new cumulative
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

inore_children thing doesn't help to track all propagated permissions
of children we want to ignore. The simplest way to correctly update
permissions is update graph first and then do permission update. In
this case we just referesh permissions for the whole subgraph (in
topological-sort defined order) and everything is correctly calculated
automatically without any ignore_children.

So, refactor bdrv_replace_node_common to first do graph update and then
refresh the permissions.

Test test_parallel_exclusive_write() now pass, so move it out of
debugging "if".

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-18-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 43 +++++++++++++-------------------
 tests/unit/test-bdrv-graph-mod.c |  4 +--
 2 files changed, 20 insertions(+), 27 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static TransactionActionDrv bdrv_replace_child_drv = {
  *
  * Note: real unref of old_bs is done only on commit.
  */
-__attribute__((unused))
 static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
                                     Transaction *tran)
 {
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
                                     bool auto_skip, Error **errp)
 {
     BdrvChild *c, *next;
-    GSList *list = NULL, *p;
-    uint64_t perm = 0, shared = BLK_PERM_ALL;
+    Transaction *tran = tran_new();
+    g_autoptr(GHashTable) found = NULL;
+    g_autoptr(GSList) refresh_list = NULL;
     int ret;
 
     /* Make sure that @from doesn't go away until we have successfully attached
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
     assert(bdrv_get_aio_context(from) == bdrv_get_aio_context(to));
     bdrv_drained_begin(from);
 
-    /* Put all parents into @list and calculate their cumulative permissions */
+    /*
+     * Do the replacement without permission update.
+     * Replacement may influence the permissions, we should calculate new
+     * permissions based on new graph. If we fail, we'll roll-back the
+     * replacement.
+     */
     QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
         assert(c->bs == from);
         if (!should_update_child(c, to)) {
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
                        c->name, from->node_name);
             goto out;
         }
-        list = g_slist_prepend(list, c);
-        perm |= c->perm;
-        shared &= c->shared_perm;
+        bdrv_replace_child_safe(c, to, tran);
     }
 
-    /* Check whether the required permissions can be granted on @to, ignoring
-     * all BdrvChild in @list so that they can't block themselves. */
-    ret = bdrv_check_update_perm(to, NULL, perm, shared, list, errp);
-    if (ret < 0) {
-        bdrv_abort_perm_update(to);
-        goto out;
-    }
+    found = g_hash_table_new(NULL, NULL);
 
-    /* Now actually perform the change. We performed the permission check for
-     * all elements of @list at once, so set the permissions all at once at the
-     * very end. */
-    for (p = list; p != NULL; p = p->next) {
-        c = p->data;
+    refresh_list = bdrv_topological_dfs(refresh_list, found, to);
+    refresh_list = bdrv_topological_dfs(refresh_list, found, from);
 
-        bdrv_ref(to);
-        bdrv_replace_child_noperm(c, to);
-        bdrv_unref(from);
+    ret = bdrv_list_refresh_perms(refresh_list, NULL, tran, errp);
+    if (ret < 0) {
+        goto out;
     }
 
-    bdrv_set_perm(to);
-
     ret = 0;
 
 out:
-    g_slist_free(list);
+    tran_finalize(tran, ret);
+
     bdrv_drained_end(from);
     bdrv_unref(from);
 
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
                     test_should_update_child);
     g_test_add_func("/bdrv-graph-mod/parallel-perm-update",
                     test_parallel_perm_update);
+    g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
+                    test_parallel_exclusive_write);
 
     if (debug) {
-        g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
-                        test_parallel_exclusive_write);
         g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
                         test_append_greedy_filter);
     }
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split out no-perm part of bdrv_root_attach_child() into separate
transaction action. bdrv_root_attach_child() now moves to new
permission update paradigm: first update graph relations then update
permissions.

qsd-jobs test output updated. Seems now permission update goes in
another order. Still, the test comment say that we only want to check
that command doesn't crash, and it's still so.

Error message is a bit misleading as it looks like job was added first.
But actually in new paradigm of graph update we can't distinguish such
things. We should update the error message, but let's not do it now.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Message-Id: <20210428151804.439460-19-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                               | 190 ++++++++++++++++++--------
 tests/qemu-iotests/tests/qsd-jobs.out |   2 +-
 2 files changed, 137 insertions(+), 55 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
     }
 }
 
-/*
- * This function steals the reference to child_bs from the caller.
- * That reference is later dropped by bdrv_root_unref_child().
- *
- * On failure NULL is returned, errp is set and the reference to
- * child_bs is also dropped.
- *
- * The caller must hold the AioContext lock @child_bs, but not that of @ctx
- * (unless @child_bs is already in @ctx).
- */
-BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
-                                  const char *child_name,
-                                  const BdrvChildClass *child_class,
-                                  BdrvChildRole child_role,
-                                  uint64_t perm, uint64_t shared_perm,
-                                  void *opaque, Error **errp)
+static void bdrv_remove_empty_child(BdrvChild *child)
 {
-    BdrvChild *child;
-    Error *local_err = NULL;
-    int ret;
-    AioContext *ctx;
+    assert(!child->bs);
+    QLIST_SAFE_REMOVE(child, next);
+    g_free(child->name);
+    g_free(child);
+}
 
-    ret = bdrv_check_update_perm(child_bs, NULL, perm, shared_perm, NULL, errp);
-    if (ret < 0) {
-        bdrv_abort_perm_update(child_bs);
-        bdrv_unref(child_bs);
-        return NULL;
+typedef struct BdrvAttachChildCommonState {
+    BdrvChild **child;
+    AioContext *old_parent_ctx;
+    AioContext *old_child_ctx;
+} BdrvAttachChildCommonState;
+
+static void bdrv_attach_child_common_abort(void *opaque)
+{
+    BdrvAttachChildCommonState *s = opaque;
+    BdrvChild *child = *s->child;
+    BlockDriverState *bs = child->bs;
+
+    bdrv_replace_child_noperm(child, NULL);
+
+    if (bdrv_get_aio_context(bs) != s->old_child_ctx) {
+        bdrv_try_set_aio_context(bs, s->old_child_ctx, &error_abort);
     }
 
-    child = g_new(BdrvChild, 1);
-    *child = (BdrvChild) {
+    if (bdrv_child_get_parent_aio_context(child) != s->old_parent_ctx) {
+        GSList *ignore = g_slist_prepend(NULL, child);
+
+        child->klass->can_set_aio_ctx(child, s->old_parent_ctx, &ignore,
+                                      &error_abort);
+        g_slist_free(ignore);
+        ignore = g_slist_prepend(NULL, child);
+        child->klass->set_aio_ctx(child, s->old_parent_ctx, &ignore);
+
+        g_slist_free(ignore);
+    }
+
+    bdrv_unref(bs);
+    bdrv_remove_empty_child(child);
+    *s->child = NULL;
+}
+
+static TransactionActionDrv bdrv_attach_child_common_drv = {
+    .abort = bdrv_attach_child_common_abort,
+    .clean = g_free,
+};
+
+/*
+ * Common part of attaching bdrv child to bs or to blk or to job
+ */
+static int bdrv_attach_child_common(BlockDriverState *child_bs,
+                                    const char *child_name,
+                                    const BdrvChildClass *child_class,
+                                    BdrvChildRole child_role,
+                                    uint64_t perm, uint64_t shared_perm,
+                                    void *opaque, BdrvChild **child,
+                                    Transaction *tran, Error **errp)
+{
+    BdrvChild *new_child;
+    AioContext *parent_ctx;
+    AioContext *child_ctx = bdrv_get_aio_context(child_bs);
+
+    assert(child);
+    assert(*child == NULL);
+
+    new_child = g_new(BdrvChild, 1);
+    *new_child = (BdrvChild) {
         .bs             = NULL,
         .name           = g_strdup(child_name),
         .klass          = child_class,
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
         .opaque         = opaque,
     };
 
-    ctx = bdrv_child_get_parent_aio_context(child);
-
-    /* If the AioContexts don't match, first try to move the subtree of
+    /*
+     * If the AioContexts don't match, first try to move the subtree of
      * child_bs into the AioContext of the new parent. If this doesn't work,
-     * try moving the parent into the AioContext of child_bs instead. */
-    if (bdrv_get_aio_context(child_bs) != ctx) {
-        ret = bdrv_try_set_aio_context(child_bs, ctx, &local_err);
+     * try moving the parent into the AioContext of child_bs instead.
+     */
+    parent_ctx = bdrv_child_get_parent_aio_context(new_child);
+    if (child_ctx != parent_ctx) {
+        Error *local_err = NULL;
+        int ret = bdrv_try_set_aio_context(child_bs, parent_ctx, &local_err);
+
         if (ret < 0 && child_class->can_set_aio_ctx) {
-            GSList *ignore = g_slist_prepend(NULL, child);
-            ctx = bdrv_get_aio_context(child_bs);
-            if (child_class->can_set_aio_ctx(child, ctx, &ignore, NULL)) {
+            GSList *ignore = g_slist_prepend(NULL, new_child);
+            if (child_class->can_set_aio_ctx(new_child, child_ctx, &ignore,
+                                             NULL))
+            {
                 error_free(local_err);
                 ret = 0;
                 g_slist_free(ignore);
-                ignore = g_slist_prepend(NULL, child);
-                child_class->set_aio_ctx(child, ctx, &ignore);
+                ignore = g_slist_prepend(NULL, new_child);
+                child_class->set_aio_ctx(new_child, child_ctx, &ignore);
             }
             g_slist_free(ignore);
         }
+
         if (ret < 0) {
             error_propagate(errp, local_err);
-            g_free(child);
-            bdrv_abort_perm_update(child_bs);
-            bdrv_unref(child_bs);
-            return NULL;
+            bdrv_remove_empty_child(new_child);
+            return ret;
         }
     }
 
-    /* This performs the matching bdrv_set_perm() for the above check. */
-    bdrv_replace_child(child, child_bs);
+    bdrv_ref(child_bs);
+    bdrv_replace_child_noperm(new_child, child_bs);
 
+    *child = new_child;
+
+    BdrvAttachChildCommonState *s = g_new(BdrvAttachChildCommonState, 1);
+    *s = (BdrvAttachChildCommonState) {
+        .child = child,
+        .old_parent_ctx = parent_ctx,
+        .old_child_ctx = child_ctx,
+    };
+    tran_add(tran, &bdrv_attach_child_common_drv, s);
+
+    return 0;
+}
+
+static void bdrv_detach_child(BdrvChild *child)
+{
+    bdrv_replace_child(child, NULL);
+    bdrv_remove_empty_child(child);
+}
+
+/*
+ * This function steals the reference to child_bs from the caller.
+ * That reference is later dropped by bdrv_root_unref_child().
+ *
+ * On failure NULL is returned, errp is set and the reference to
+ * child_bs is also dropped.
+ *
+ * The caller must hold the AioContext lock @child_bs, but not that of @ctx
+ * (unless @child_bs is already in @ctx).
+ */
+BdrvChild *bdrv_root_attach_child(BlockDriverState *child_bs,
+                                  const char *child_name,
+                                  const BdrvChildClass *child_class,
+                                  BdrvChildRole child_role,
+                                  uint64_t perm, uint64_t shared_perm,
+                                  void *opaque, Error **errp)
+{
+    int ret;
+    BdrvChild *child = NULL;
+    Transaction *tran = tran_new();
+
+    ret = bdrv_attach_child_common(child_bs, child_name, child_class,
+                                   child_role, perm, shared_perm, opaque,
+                                   &child, tran, errp);
+    if (ret < 0) {
+        bdrv_unref(child_bs);
+        return NULL;
+    }
+
+    ret = bdrv_refresh_perms(child_bs, errp);
+    tran_finalize(tran, ret);
+
+    bdrv_unref(child_bs);
     return child;
 }
 
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
     return child;
 }
 
-static void bdrv_detach_child(BdrvChild *child)
-{
-    QLIST_SAFE_REMOVE(child, next);
-
-    bdrv_replace_child(child, NULL);
-
-    g_free(child->name);
-    g_free(child);
-}
-
 /* Callers must ensure that child->frozen is false. */
 void bdrv_root_unref_child(BdrvChild *child)
 {
diff --git a/tests/qemu-iotests/tests/qsd-jobs.out b/tests/qemu-iotests/tests/qsd-jobs.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/tests/qsd-jobs.out
+++ b/tests/qemu-iotests/tests/qsd-jobs.out
@@ -XXX,XX +XXX,XX @@ QMP_VERSION
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "job0"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "null", "id": "job0"}}
-{"error": {"class": "GenericError", "desc": "Conflicts with use by a block device as 'root', which uses 'write' on fmt_base"}}
+{"error": {"class": "GenericError", "desc": "Conflicts with use by stream job 'job0' as 'intermediate node', which does not allow 'write' on fmt_base"}}
 {"return": {}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "BLOCK_EXPORT_DELETED", "data": {"id": "export1"}}
 *** done
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split no-perm part of bdrv_attach_child as separate transaction action.
It will be used in later commits.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-20-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 71 ++++++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 58 insertions(+), 13 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static BlockDriverState *bdrv_open_inherit(const char *filename,
 
 static void bdrv_replace_child_noperm(BdrvChild *child,
                                       BlockDriverState *new_bs);
+static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
+                                    BlockDriverState *child_bs,
+                                    const char *child_name,
+                                    const BdrvChildClass *child_class,
+                                    BdrvChildRole child_role,
+                                    BdrvChild **child,
+                                    Transaction *tran,
+                                    Error **errp);
 
 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
                                *queue, Error **errp);
@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_common(BlockDriverState *child_bs,
     return 0;
 }
 
+static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
+                                    BlockDriverState *child_bs,
+                                    const char *child_name,
+                                    const BdrvChildClass *child_class,
+                                    BdrvChildRole child_role,
+                                    BdrvChild **child,
+                                    Transaction *tran,
+                                    Error **errp)
+{
+    int ret;
+    uint64_t perm, shared_perm;
+
+    assert(parent_bs->drv);
+
+    bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
+    bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
+                    perm, shared_perm, &perm, &shared_perm);
+
+    ret = bdrv_attach_child_common(child_bs, child_name, child_class,
+                                   child_role, perm, shared_perm, parent_bs,
+                                   child, tran, errp);
+    if (ret < 0) {
+        return ret;
+    }
+
+    QLIST_INSERT_HEAD(&parent_bs->children, *child, next);
+    /*
+     * child is removed in bdrv_attach_child_common_abort(), so don't care to
+     * abort this change separately.
+     */
+
+    return 0;
+}
+
 static void bdrv_detach_child(BdrvChild *child)
 {
     bdrv_replace_child(child, NULL);
@@ -XXX,XX +XXX,XX @@ BdrvChild *bdrv_attach_child(BlockDriverState *parent_bs,
                              BdrvChildRole child_role,
                              Error **errp)
 {
-    BdrvChild *child;
-    uint64_t perm, shared_perm;
-
-    bdrv_get_cumulative_perm(parent_bs, &perm, &shared_perm);
+    int ret;
+    BdrvChild *child = NULL;
+    Transaction *tran = tran_new();
 
-    assert(parent_bs->drv);
-    bdrv_child_perm(parent_bs, child_bs, NULL, child_role, NULL,
-                    perm, shared_perm, &perm, &shared_perm);
+    ret = bdrv_attach_child_noperm(parent_bs, child_bs, child_name, child_class,
+                                   child_role, &child, tran, errp);
+    if (ret < 0) {
+        goto out;
+    }
 
-    child = bdrv_root_attach_child(child_bs, child_name, child_class,
-                                   child_role, perm, shared_perm, parent_bs,
-                                   errp);
-    if (child == NULL) {
-        return NULL;
+    ret = bdrv_refresh_perms(parent_bs, errp);
+    if (ret < 0) {
+        goto out;
     }
 
-    QLIST_INSERT_HEAD(&parent_bs->children, child, next);
+out:
+    tran_finalize(tran, ret);
+
+    bdrv_unref(child_bs);
+
     return child;
 }
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split part of bdrv_replace_node_common() to be used separately.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-21-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 50 +++++++++++++++++++++++++++++++-------------------
 1 file changed, 31 insertions(+), 19 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static bool should_update_child(BdrvChild *c, BlockDriverState *to)
     return ret;
 }
 
+static int bdrv_replace_node_noperm(BlockDriverState *from,
+                                    BlockDriverState *to,
+                                    bool auto_skip, Transaction *tran,
+                                    Error **errp)
+{
+    BdrvChild *c, *next;
+
+    QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
+        assert(c->bs == from);
+        if (!should_update_child(c, to)) {
+            if (auto_skip) {
+                continue;
+            }
+            error_setg(errp, "Should not change '%s' link to '%s'",
+                       c->name, from->node_name);
+            return -EINVAL;
+        }
+        if (c->frozen) {
+            error_setg(errp, "Cannot change '%s' link to '%s'",
+                       c->name, from->node_name);
+            return -EPERM;
+        }
+        bdrv_replace_child_safe(c, to, tran);
+    }
+
+    return 0;
+}
+
 /*
  * With auto_skip=true bdrv_replace_node_common skips updating from parents
  * if it creates a parent-child relation loop or if parent is block-job.
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
                                     BlockDriverState *to,
                                     bool auto_skip, Error **errp)
 {
-    BdrvChild *c, *next;
     Transaction *tran = tran_new();
     g_autoptr(GHashTable) found = NULL;
     g_autoptr(GSList) refresh_list = NULL;
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
      * permissions based on new graph. If we fail, we'll roll-back the
      * replacement.
      */
-    QLIST_FOREACH_SAFE(c, &from->parents, next_parent, next) {
-        assert(c->bs == from);
-        if (!should_update_child(c, to)) {
-            if (auto_skip) {
-                continue;
-            }
-            ret = -EINVAL;
-            error_setg(errp, "Should not change '%s' link to '%s'",
-                       c->name, from->node_name);
-            goto out;
-        }
-        if (c->frozen) {
-            ret = -EPERM;
-            error_setg(errp, "Cannot change '%s' link to '%s'",
-                       c->name, from->node_name);
-            goto out;
-        }
-        bdrv_replace_child_safe(c, to, tran);
+    ret = bdrv_replace_node_noperm(from, to, auto_skip, tran, errp);
+    if (ret < 0) {
+        goto out;
     }
 
     found = g_hash_table_new(NULL, NULL);
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

bdrv_append is not very good for inserting filters: it does extra
permission update as part of bdrv_set_backing_hd(). During this update
filter may conflict with other parents of top_bs.

Instead, let's first do all graph modifications and after it update
permissions.

append-greedy-filter test-case in test-bdrv-graph-mod is now works, so
move it out of debug option.

Note: bdrv_append() is still only works for backing-child based
filters. It's something to improve later.

Note2: we use the fact that bdrv_append() is used to append new nodes,
without backing child, so we don't need frozen check and inherits_from
logic from bdrv_set_backing_hd().

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-22-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                          | 27 ++++++++++++++++++++-------
 tests/unit/test-bdrv-graph-mod.c | 17 ++---------------
 2 files changed, 22 insertions(+), 22 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
  * This will modify the BlockDriverState fields, and swap contents
  * between bs_new and bs_top. Both bs_new and bs_top are modified.
  *
- * bs_new must not be attached to a BlockBackend.
+ * bs_new must not be attached to a BlockBackend and must not have backing
+ * child.
  *
  * This function does not create any image files.
  */
 int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
                 Error **errp)
 {
-    int ret = bdrv_set_backing_hd(bs_new, bs_top, errp);
+    int ret;
+    Transaction *tran = tran_new();
+
+    assert(!bs_new->backing);
+
+    ret = bdrv_attach_child_noperm(bs_new, bs_top, "backing",
+                                   &child_of_bds, bdrv_backing_role(bs_new),
+                                   &bs_new->backing, tran, errp);
     if (ret < 0) {
-        return ret;
+        goto out;
     }
 
-    ret = bdrv_replace_node(bs_top, bs_new, errp);
+    ret = bdrv_replace_node_noperm(bs_top, bs_new, true, tran, errp);
     if (ret < 0) {
-        bdrv_set_backing_hd(bs_new, NULL, &error_abort);
-        return ret;
+        goto out;
     }
 
-    return 0;
+    ret = bdrv_refresh_perms(bs_new, errp);
+out:
+    tran_finalize(tran, ret);
+
+    bdrv_refresh_limits(bs_top, NULL);
+
+    return ret;
 }
 
 static void bdrv_delete(BlockDriverState *bs)
diff --git a/tests/unit/test-bdrv-graph-mod.c b/tests/unit/test-bdrv-graph-mod.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/unit/test-bdrv-graph-mod.c
+++ b/tests/unit/test-bdrv-graph-mod.c
@@ -XXX,XX +XXX,XX @@ static void test_append_greedy_filter(void)
 
 int main(int argc, char *argv[])
 {
-    int i;
-    bool debug = false;
-
-    for (i = 1; i < argc; i++) {
-        if (!strcmp(argv[i], "-d")) {
-            debug = true;
-            break;
-        }
-    }
-
     bdrv_init();
     qemu_init_main_loop(&error_abort);
 
@@ -XXX,XX +XXX,XX @@ int main(int argc, char *argv[])
                     test_parallel_perm_update);
     g_test_add_func("/bdrv-graph-mod/parallel-exclusive-write",
                     test_parallel_exclusive_write);
-
-    if (debug) {
-        g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
-                        test_append_greedy_filter);
-    }
+    g_test_add_func("/bdrv-graph-mod/append-greedy-filter",
+                    test_append_greedy_filter);
 
     return g_test_run();
 }
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-23-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 84 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--
 1 file changed, 82 insertions(+), 2 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
     }
 }
 
+static void bdrv_child_free(void *opaque)
+{
+    BdrvChild *c = opaque;
+
+    g_free(c->name);
+    g_free(c);
+}
+
 static void bdrv_remove_empty_child(BdrvChild *child)
 {
     assert(!child->bs);
     QLIST_SAFE_REMOVE(child, next);
-    g_free(child->name);
-    g_free(child);
+    bdrv_child_free(child);
 }
 
 typedef struct BdrvAttachChildCommonState {
@@ -XXX,XX +XXX,XX @@ static bool should_update_child(BdrvChild *c, BlockDriverState *to)
     return ret;
 }
 
+typedef struct BdrvRemoveFilterOrCowChild {
+    BdrvChild *child;
+    bool is_backing;
+} BdrvRemoveFilterOrCowChild;
+
+static void bdrv_remove_filter_or_cow_child_abort(void *opaque)
+{
+    BdrvRemoveFilterOrCowChild *s = opaque;
+    BlockDriverState *parent_bs = s->child->opaque;
+
+    QLIST_INSERT_HEAD(&parent_bs->children, s->child, next);
+    if (s->is_backing) {
+        parent_bs->backing = s->child;
+    } else {
+        parent_bs->file = s->child;
+    }
+
+    /*
+     * We don't have to restore child->bs here to undo bdrv_replace_child()
+     * because that function is transactionable and it registered own completion
+     * entries in @tran, so .abort() for bdrv_replace_child_safe() will be
+     * called automatically.
+     */
+}
+
+static void bdrv_remove_filter_or_cow_child_commit(void *opaque)
+{
+    BdrvRemoveFilterOrCowChild *s = opaque;
+
+    bdrv_child_free(s->child);
+}
+
+static TransactionActionDrv bdrv_remove_filter_or_cow_child_drv = {
+    .abort = bdrv_remove_filter_or_cow_child_abort,
+    .commit = bdrv_remove_filter_or_cow_child_commit,
+    .clean = g_free,
+};
+
+/*
+ * A function to remove backing-chain child of @bs if exists: cow child for
+ * format nodes (always .backing) and filter child for filters (may be .file or
+ * .backing)
+ */
+__attribute__((unused))
+static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
+                                            Transaction *tran)
+{
+    BdrvRemoveFilterOrCowChild *s;
+    BdrvChild *child = bdrv_filter_or_cow_child(bs);
+
+    if (!child) {
+        return;
+    }
+
+    if (child->bs) {
+        bdrv_replace_child_safe(child, NULL, tran);
+    }
+
+    s = g_new(BdrvRemoveFilterOrCowChild, 1);
+    *s = (BdrvRemoveFilterOrCowChild) {
+        .child = child,
+        .is_backing = (child == bs->backing),
+    };
+    tran_add(tran, &bdrv_remove_filter_or_cow_child_drv, s);
+
+    QLIST_SAFE_REMOVE(child, next);
+    if (s->is_backing) {
+        bs->backing = NULL;
+    } else {
+        bs->file = NULL;
+    }
+}
+
 static int bdrv_replace_node_noperm(BlockDriverState *from,
                                     BlockDriverState *to,
                                     bool auto_skip, Transaction *tran,
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Using bdrv_replace_node() for removing filter is not good enough: it
keeps child reference of the filter, which may conflict with original
top node during permission update.

Instead let's create new interface, which will do all graph
modifications first and then update permissions.

Let's modify bdrv_replace_node_common(), allowing it additionally drop
backing chain child link pointing to new node. This is quite
appropriate for bdrv_drop_intermediate() and makes possible to add
new bdrv_drop_filter() as a simple wrapper.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-24-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h |  1 +
 block.c               | 43 +++++++++++++++++++++++++++++++++++++++----
 2 files changed, 40 insertions(+), 4 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
                       Error **errp);
 BlockDriverState *bdrv_insert_node(BlockDriverState *bs, QDict *node_options,
                                    int flags, Error **errp);
+int bdrv_drop_filter(BlockDriverState *bs, Error **errp);
 
 int bdrv_parse_aio(const char *mode, int *flags);
 int bdrv_parse_cache_mode(const char *mode, int *flags, bool *writethrough);
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static TransactionActionDrv bdrv_remove_filter_or_cow_child_drv = {
  * format nodes (always .backing) and filter child for filters (may be .file or
  * .backing)
  */
-__attribute__((unused))
 static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
                                             Transaction *tran)
 {
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_noperm(BlockDriverState *from,
  *
  * With auto_skip=false the error is returned if from has a parent which should
  * not be updated.
+ *
+ * With @detach_subchain=true @to must be in a backing chain of @from. In this
+ * case backing link of the cow-parent of @to is removed.
  */
 static int bdrv_replace_node_common(BlockDriverState *from,
                                     BlockDriverState *to,
-                                    bool auto_skip, Error **errp)
+                                    bool auto_skip, bool detach_subchain,
+                                    Error **errp)
 {
     Transaction *tran = tran_new();
     g_autoptr(GHashTable) found = NULL;
     g_autoptr(GSList) refresh_list = NULL;
+    BlockDriverState *to_cow_parent;
     int ret;
 
+    if (detach_subchain) {
+        assert(bdrv_chain_contains(from, to));
+        assert(from != to);
+        for (to_cow_parent = from;
+             bdrv_filter_or_cow_bs(to_cow_parent) != to;
+             to_cow_parent = bdrv_filter_or_cow_bs(to_cow_parent))
+        {
+            ;
+        }
+    }
+
     /* Make sure that @from doesn't go away until we have successfully attached
      * all of its parents to @to. */
     bdrv_ref(from);
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_common(BlockDriverState *from,
         goto out;
     }
 
+    if (detach_subchain) {
+        bdrv_remove_filter_or_cow_child(to_cow_parent, tran);
+    }
+
     found = g_hash_table_new(NULL, NULL);
 
     refresh_list = bdrv_topological_dfs(refresh_list, found, to);
@@ -XXX,XX +XXX,XX @@ out:
 int bdrv_replace_node(BlockDriverState *from, BlockDriverState *to,
                       Error **errp)
 {
-    return bdrv_replace_node_common(from, to, true, errp);
+    return bdrv_replace_node_common(from, to, true, false, errp);
+}
+
+int bdrv_drop_filter(BlockDriverState *bs, Error **errp)
+{
+    return bdrv_replace_node_common(bs, bdrv_filter_or_cow_bs(bs), true, true,
+                                    errp);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
         updated_children = g_slist_prepend(updated_children, c);
     }
 
-    bdrv_replace_node_common(top, base, false, &local_err);
+    /*
+     * It seems correct to pass detach_subchain=true here, but it triggers
+     * one more yet not fixed bug, when due to nested aio_poll loop we switch to
+     * another drained section, which modify the graph (for example, removing
+     * the child, which we keep in updated_children list). So, it's a TODO.
+     *
+     * Note, bug triggered if pass detach_subchain=true here and run
+     * test-bdrv-drain. test_drop_intermediate_poll() test-case will crash.
+     * That's a FIXME.
+     */
+    bdrv_replace_node_common(top, base, false, false, &local_err);
     if (local_err) {
         error_report_err(local_err);
         goto exit;
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We don't need this workaround anymore: bdrv_append is already smart
enough and we can use new bdrv_drop_filter().

This commit efficiently reverts also recent 705dde27c6c53b73, which
checked .active on io path. Still it said that the problem should be
theoretical. And the logic of filter removement is changed anyway.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-25-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block/backup-top.c         | 47 +-------------------------------------
 tests/qemu-iotests/283.out |  2 +-
 2 files changed, 2 insertions(+), 47 deletions(-)

diff --git a/block/backup-top.c b/block/backup-top.c
index XXXXXXX..XXXXXXX 100644
--- a/block/backup-top.c
+++ b/block/backup-top.c
@@ -XXX,XX +XXX,XX @@
 typedef struct BDRVBackupTopState {
     BlockCopyState *bcs;
     BdrvChild *target;
-    bool active;
     int64_t cluster_size;
 } BDRVBackupTopState;
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int backup_top_co_preadv(
         BlockDriverState *bs, uint64_t offset, uint64_t bytes,
         QEMUIOVector *qiov, int flags)
 {
-    BDRVBackupTopState *s = bs->opaque;
-
-    if (!s->active) {
-        return -EIO;
-    }
-
     return bdrv_co_preadv(bs->backing, offset, bytes, qiov, flags);
 }
 
@@ -XXX,XX +XXX,XX @@ static coroutine_fn int backup_top_cbw(BlockDriverState *bs, uint64_t offset,
     BDRVBackupTopState *s = bs->opaque;
     uint64_t off, end;
 
-    if (!s->active) {
-        return -EIO;
-    }
-
     if (flags & BDRV_REQ_WRITE_UNCHANGED) {
         return 0;
     }
@@ -XXX,XX +XXX,XX @@ static void backup_top_child_perm(BlockDriverState *bs, BdrvChild *c,
                                   uint64_t perm, uint64_t shared,
                                   uint64_t *nperm, uint64_t *nshared)
 {
-    BDRVBackupTopState *s = bs->opaque;
-
-    if (!s->active) {
-        /*
-         * The filter node may be in process of bdrv_append(), which firstly do
-         * bdrv_set_backing_hd() and then bdrv_replace_node(). This means that
-         * we can't unshare BLK_PERM_WRITE during bdrv_append() operation. So,
-         * let's require nothing during bdrv_append() and refresh permissions
-         * after it (see bdrv_backup_top_append()).
-         */
-        *nperm = 0;
-        *nshared = BLK_PERM_ALL;
-        return;
-    }
-
     if (!(role & BDRV_CHILD_FILTERED)) {
         /*
          * Target child
@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
     }
     appended = true;
 
-    /*
-     * bdrv_append() finished successfully, now we can require permissions
-     * we want.
-     */
-    state->active = true;
-    ret = bdrv_child_refresh_perms(top, top->backing, errp);
-    if (ret < 0) {
-        error_prepend(errp, "Cannot set permissions for backup-top filter: ");
-        goto fail;
-    }
-
     state->cluster_size = cluster_size;
     state->bcs = block_copy_state_new(top->backing, state->target,
                                       cluster_size, perf->use_copy_range,
@@ -XXX,XX +XXX,XX @@ BlockDriverState *bdrv_backup_top_append(BlockDriverState *source,
 
 fail:
     if (appended) {
-        state->active = false;
         bdrv_backup_top_drop(top);
     } else {
         bdrv_unref(top);
@@ -XXX,XX +XXX,XX @@ void bdrv_backup_top_drop(BlockDriverState *bs)
 {
     BDRVBackupTopState *s = bs->opaque;
 
-    bdrv_drained_begin(bs);
+    bdrv_drop_filter(bs, &error_abort);
 
     block_copy_state_free(s->bcs);
 
-    s->active = false;
-    bdrv_child_refresh_perms(bs, bs->backing, &error_abort);
-    bdrv_replace_node(bs, bs->backing->bs, &error_abort);
-    bdrv_set_backing_hd(bs, NULL, &error_abort);
-
-    bdrv_drained_end(bs);
-
     bdrv_unref(bs);
 }
diff --git a/tests/qemu-iotests/283.out b/tests/qemu-iotests/283.out
index XXXXXXX..XXXXXXX 100644
--- a/tests/qemu-iotests/283.out
+++ b/tests/qemu-iotests/283.out
@@ -XXX,XX +XXX,XX @@
 {"execute": "blockdev-add", "arguments": {"driver": "blkdebug", "image": "base", "node-name": "other", "take-child-perms": ["write"]}}
 {"return": {}}
 {"execute": "blockdev-backup", "arguments": {"device": "source", "sync": "full", "target": "target"}}
-{"error": {"class": "GenericError", "desc": "Cannot set permissions for backup-top filter: Conflicts with use by source as 'image', which does not allow 'write' on base"}}
+{"error": {"class": "GenericError", "desc": "Cannot append backup-top filter: Conflicts with use by source as 'image', which does not allow 'write' on base"}}
 
 === backup-top should be gone after job-finalize ===
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

This argument is always NULL. Drop it.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-26-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 38 +++++++++++---------------------------
 1 file changed, 11 insertions(+), 27 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_fill_options(QDict **options, const char *filename,
 static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                   uint64_t new_used_perm,
                                   uint64_t new_shared_perm,
-                                  GSList *ignore_children,
                                   Error **errp);
 
 typedef struct BlockReopenQueueEntry {
@@ -XXX,XX +XXX,XX @@ static bool bdrv_a_allow_b(BdrvChild *a, BdrvChild *b, Error **errp)
     return false;
 }
 
-static bool bdrv_parent_perms_conflict(BlockDriverState *bs,
-                                       GSList *ignore_children,
-                                       Error **errp)
+static bool bdrv_parent_perms_conflict(BlockDriverState *bs, Error **errp)
 {
     BdrvChild *a, *b;
 
@@ -XXX,XX +XXX,XX @@ static bool bdrv_parent_perms_conflict(BlockDriverState *bs,
      * directions.
      */
     QLIST_FOREACH(a, &bs->parents, next_parent) {
-        if (g_slist_find(ignore_children, a)) {
-            continue;
-        }
-
         QLIST_FOREACH(b, &bs->parents, next_parent) {
-            if (a == b || g_slist_find(ignore_children, b)) {
+            if (a == b) {
                 continue;
             }
 
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
 static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                 uint64_t cumulative_perms,
                                 uint64_t cumulative_shared_perms,
-                                GSList *ignore_children,
                                 Transaction *tran, Error **errp)
 {
     BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
                                   bool use_cumulative_perms,
                                   uint64_t cumulative_perms,
                                   uint64_t cumulative_shared_perms,
-                                  GSList *ignore_children,
                                   Transaction *tran, Error **errp)
 {
     int ret;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
 
         ret = bdrv_node_check_perm(bs, q, cumulative_perms,
                                    cumulative_shared_perms,
-                                   ignore_children, tran, errp);
+                                   tran, errp);
         if (ret < 0) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
     for ( ; list; list = list->next) {
         bs = list->data;
 
-        if (bdrv_parent_perms_conflict(bs, ignore_children, errp)) {
+        if (bdrv_parent_perms_conflict(bs, errp)) {
             return -EINVAL;
         }
 
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
 
         ret = bdrv_node_check_perm(bs, q, cumulative_perms,
                                    cumulative_shared_perms,
-                                   ignore_children, tran, errp);
+                                   tran, errp);
         if (ret < 0) {
             return ret;
         }
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
 
 static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
                            uint64_t cumulative_perms,
-                           uint64_t cumulative_shared_perms,
-                           GSList *ignore_children, Error **errp)
+                           uint64_t cumulative_shared_perms, Error **errp)
 {
     g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
     return bdrv_check_perm_common(list, q, true, cumulative_perms,
-                                  cumulative_shared_perms, ignore_children,
-                                  NULL, errp);
+                                  cumulative_shared_perms, NULL, errp);
 }
 
 static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
                                    Transaction *tran, Error **errp)
 {
-    return bdrv_check_perm_common(list, q, false, 0, 0, NULL, tran, errp);
+    return bdrv_check_perm_common(list, q, false, 0, 0, tran, errp);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ char *bdrv_perm_names(uint64_t perm)
 static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                   uint64_t new_used_perm,
                                   uint64_t new_shared_perm,
-                                  GSList *ignore_children,
                                   Error **errp)
 {
     BdrvChild *c;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
     assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
 
     QLIST_FOREACH(c, &bs->parents, next_parent) {
-        if (g_slist_find(ignore_children, c)) {
-            continue;
-        }
-
         if ((new_used_perm & c->shared_perm) != new_used_perm) {
             char *user = bdrv_child_user_desc(c);
             char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
     }
 
     return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
-                           ignore_children, errp);
+                           errp);
 }
 
 static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
         BDRVReopenState *state = &bs_entry->state;
         ret = bdrv_check_perm(state->bs, bs_queue, state->perm,
-                              state->shared_perm, NULL, errp);
+                              state->shared_perm, errp);
         if (ret < 0) {
             goto cleanup_perm;
         }
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
                             bs_queue, state->perm, state->shared_perm,
                             &nperm, &nshared);
             ret = bdrv_check_update_perm(state->new_backing_bs, NULL,
-                                         nperm, nshared, NULL, errp);
+                                         nperm, nshared, errp);
             if (ret < 0) {
                 goto cleanup_perm;
             }
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

To be used in the further commit.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-27-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 46 ++++++++++++++++++++++++++++++++++++++++++----
 1 file changed, 42 insertions(+), 4 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ void bdrv_root_unref_child(BdrvChild *child)
     bdrv_unref(child_bs);
 }
 
+typedef struct BdrvSetInheritsFrom {
+    BlockDriverState *bs;
+    BlockDriverState *old_inherits_from;
+} BdrvSetInheritsFrom;
+
+static void bdrv_set_inherits_from_abort(void *opaque)
+{
+    BdrvSetInheritsFrom *s = opaque;
+
+    s->bs->inherits_from = s->old_inherits_from;
+}
+
+static TransactionActionDrv bdrv_set_inherits_from_drv = {
+    .abort = bdrv_set_inherits_from_abort,
+    .clean = g_free,
+};
+
+/* @tran is allowed to be NULL. In this case no rollback is possible */
+static void bdrv_set_inherits_from(BlockDriverState *bs,
+                                   BlockDriverState *new_inherits_from,
+                                   Transaction *tran)
+{
+    if (tran) {
+        BdrvSetInheritsFrom *s = g_new(BdrvSetInheritsFrom, 1);
+
+        *s = (BdrvSetInheritsFrom) {
+            .bs = bs,
+            .old_inherits_from = bs->inherits_from,
+        };
+
+        tran_add(tran, &bdrv_set_inherits_from_drv, s);
+    }
+
+    bs->inherits_from = new_inherits_from;
+}
+
 /**
  * Clear all inherits_from pointers from children and grandchildren of
  * @root that point to @root, where necessary.
+ * @tran is allowed to be NULL. In this case no rollback is possible
  */
-static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
+static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child,
+                                     Transaction *tran)
 {
     BdrvChild *c;
 
@@ -XXX,XX +XXX,XX @@ static void bdrv_unset_inherits_from(BlockDriverState *root, BdrvChild *child)
             }
         }
         if (c == NULL) {
-            child->bs->inherits_from = NULL;
+            bdrv_set_inherits_from(child->bs, NULL, tran);
         }
     }
 
     QLIST_FOREACH(c, &child->bs->children, next) {
-        bdrv_unset_inherits_from(root, c);
+        bdrv_unset_inherits_from(root, c, tran);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ void bdrv_unref_child(BlockDriverState *parent, BdrvChild *child)
         return;
     }
 
-    bdrv_unset_inherits_from(parent, child);
+    bdrv_unset_inherits_from(parent, child, NULL);
     bdrv_root_unref_child(child);
 }
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

To be used in further commit.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-28-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h |  3 ++-
 block.c               |  9 ++++-----
 block/io.c            | 31 +++++++++++++++++++++++++++++--
 3 files changed, 35 insertions(+), 8 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@
 #include "block/dirty-bitmap.h"
 #include "block/blockjob.h"
 #include "qemu/hbitmap.h"
+#include "qemu/transactions.h"
 
 /*
  * generated_co_wrapper
@@ -XXX,XX +XXX,XX @@ int64_t bdrv_get_allocated_file_size(BlockDriverState *bs);
 BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
                                BlockDriverState *in_bs, Error **errp);
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
-void bdrv_refresh_limits(BlockDriverState *bs, Error **errp);
+void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp);
 int bdrv_commit(BlockDriverState *bs);
 int bdrv_make_empty(BdrvChild *c, Error **errp);
 int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/timer.h"
 #include "qemu/cutils.h"
 #include "qemu/id.h"
-#include "qemu/transactions.h"
 #include "block/coroutines.h"
 
 #ifdef CONFIG_BSD
@@ -XXX,XX +XXX,XX @@ static int bdrv_open_driver(BlockDriverState *bs, BlockDriver *drv,
         return ret;
     }
 
-    bdrv_refresh_limits(bs, &local_err);
+    bdrv_refresh_limits(bs, NULL, &local_err);
     if (local_err) {
         error_propagate(errp, local_err);
         return -EINVAL;
@@ -XXX,XX +XXX,XX @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
     }
 
 out:
-    bdrv_refresh_limits(bs, NULL);
+    bdrv_refresh_limits(bs, NULL, NULL);
 
     return ret;
 }
@@ -XXX,XX +XXX,XX @@ static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
         bdrv_set_backing_hd(bs, reopen_state->new_backing_bs, &error_abort);
     }
 
-    bdrv_refresh_limits(bs, NULL);
+    bdrv_refresh_limits(bs, NULL, NULL);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ int bdrv_append(BlockDriverState *bs_new, BlockDriverState *bs_top,
 out:
     tran_finalize(tran, ret);
 
-    bdrv_refresh_limits(bs_top, NULL);
+    bdrv_refresh_limits(bs_top, NULL, NULL);
 
     return ret;
 }
diff --git a/block/io.c b/block/io.c
index XXXXXXX..XXXXXXX 100644
--- a/block/io.c
+++ b/block/io.c
@@ -XXX,XX +XXX,XX @@ static void bdrv_merge_limits(BlockLimits *dst, const BlockLimits *src)
     dst->max_iov = MIN_NON_ZERO(dst->max_iov, src->max_iov);
 }
 
-void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)
+typedef struct BdrvRefreshLimitsState {
+    BlockDriverState *bs;
+    BlockLimits old_bl;
+} BdrvRefreshLimitsState;
+
+static void bdrv_refresh_limits_abort(void *opaque)
+{
+    BdrvRefreshLimitsState *s = opaque;
+
+    s->bs->bl = s->old_bl;
+}
+
+static TransactionActionDrv bdrv_refresh_limits_drv = {
+    .abort = bdrv_refresh_limits_abort,
+    .clean = g_free,
+};
+
+/* @tran is allowed to be NULL, in this case no rollback is possible. */
+void bdrv_refresh_limits(BlockDriverState *bs, Transaction *tran, Error **errp)
 {
     ERRP_GUARD();
     BlockDriver *drv = bs->drv;
     BdrvChild *c;
     bool have_limits;
 
+    if (tran) {
+        BdrvRefreshLimitsState *s = g_new(BdrvRefreshLimitsState, 1);
+        *s = (BdrvRefreshLimitsState) {
+            .bs = bs,
+            .old_bl = bs->bl,
+        };
+        tran_add(tran, &bdrv_refresh_limits_drv, s);
+    }
+
     memset(&bs->bl, 0, sizeof(bs->bl));
 
     if (!drv) {
@@ -XXX,XX +XXX,XX @@ void bdrv_refresh_limits(BlockDriverState *bs, Error **errp)
     QLIST_FOREACH(c, &bs->children, next) {
         if (c->role & (BDRV_CHILD_DATA | BDRV_CHILD_FILTERED | BDRV_CHILD_COW))
         {
-            bdrv_refresh_limits(c->bs, errp);
+            bdrv_refresh_limits(c->bs, tran, errp);
             if (*errp) {
                 return;
             }
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Split out no-perm part of bdrv_set_backing_hd() as a separate
transaction action. Note the in case of existing BdrvChild we reuse it,
not recreate, just to do less actions.

We don't need to create extra reference to backing_hd as we don't lose
it in bdrv_attach_child().

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-29-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 54 +++++++++++++++++++++++++++++++++++++-----------------
 1 file changed, 37 insertions(+), 17 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
                                     BdrvChild **child,
                                     Transaction *tran,
                                     Error **errp);
+static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
+                                            Transaction *tran);
 
 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
                                *queue, Error **errp);
@@ -XXX,XX +XXX,XX @@ static BdrvChildRole bdrv_backing_role(BlockDriverState *bs)
  * Sets the bs->backing link of a BDS. A new reference is created; callers
  * which don't need their own reference any more must call bdrv_unref().
  */
-int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
-                        Error **errp)
+static int bdrv_set_backing_noperm(BlockDriverState *bs,
+                                   BlockDriverState *backing_hd,
+                                   Transaction *tran, Error **errp)
 {
     int ret = 0;
     bool update_inherits_from = bdrv_chain_contains(bs, backing_hd) &&
@@ -XXX,XX +XXX,XX @@ int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
         return -EPERM;
     }
 
-    if (backing_hd) {
-        bdrv_ref(backing_hd);
-    }
-
     if (bs->backing) {
         /* Cannot be frozen, we checked that above */
-        bdrv_unref_child(bs, bs->backing);
-        bs->backing = NULL;
+        bdrv_unset_inherits_from(bs, bs->backing, tran);
+        bdrv_remove_filter_or_cow_child(bs, tran);
     }
 
     if (!backing_hd) {
         goto out;
     }
 
-    bs->backing = bdrv_attach_child(bs, backing_hd, "backing", &child_of_bds,
-                                    bdrv_backing_role(bs), errp);
-    if (!bs->backing) {
-        ret = -EPERM;
-        goto out;
+    ret = bdrv_attach_child_noperm(bs, backing_hd, "backing",
+                                   &child_of_bds, bdrv_backing_role(bs),
+                                   &bs->backing, tran, errp);
+    if (ret < 0) {
+        return ret;
     }
 
-    /* If backing_hd was already part of bs's backing chain, and
+
+    /*
+     * If backing_hd was already part of bs's backing chain, and
      * inherits_from pointed recursively to bs then let's update it to
-     * point directly to bs (else it will become NULL). */
+     * point directly to bs (else it will become NULL).
+     */
     if (update_inherits_from) {
-        backing_hd->inherits_from = bs;
+        bdrv_set_inherits_from(backing_hd, bs, tran);
     }
 
 out:
-    bdrv_refresh_limits(bs, NULL, NULL);
+    bdrv_refresh_limits(bs, tran, NULL);
+
+    return 0;
+}
+
+int bdrv_set_backing_hd(BlockDriverState *bs, BlockDriverState *backing_hd,
+                        Error **errp)
+{
+    int ret;
+    Transaction *tran = tran_new();
+
+    ret = bdrv_set_backing_noperm(bs, backing_hd, tran, errp);
+    if (ret < 0) {
+        goto out;
+    }
+
+    ret = bdrv_refresh_perms(bs, errp);
+out:
+    tran_finalize(tran, ret);
 
     return ret;
 }
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

During reopen we may add backing bs from other aio context, which may
lead to changing original context of top bs.

We are going to move graph modification to prepare stage. So, it will
be possible that bdrv_flush() in bdrv_reopen_prepare called on bs in
non-original aio context, which we didn't aquire which leads to crash.

To avoid this problem move bdrv_flush() to be a separate reopen stage
before bdrv_reopen_prepare().

This doesn't seem correct to acquire only one aio context and not all
contexts participating in reopen. But it's not obvious how to do it
correctly, keeping in mind:

1. rules of bdrv_set_aio_context_ignore() that requires new_context
    lock not being held

2. possible deadlocks because of holding all (or several?) AioContext
    locks

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-30-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
 
     assert(bs_queue != NULL);
 
+    QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
+        ret = bdrv_flush(bs_entry->state.bs);
+        if (ret < 0) {
+            error_setg_errno(errp, -ret, "Error flushing drive");
+            goto cleanup;
+        }
+    }
+
     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
         assert(bs_entry->state.bs->quiesce_counter > 0);
         if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, errp)) {
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
     bdrv_reopen_perm(queue, reopen_state->bs,
                      &reopen_state->perm, &reopen_state->shared_perm);
 
-    ret = bdrv_flush(reopen_state->bs);
-    if (ret) {
-        error_setg_errno(errp, -ret, "Error flushing drive");
-        goto error;
-    }
-
     if (drv->bdrv_reopen_prepare) {
         /*
          * If a driver-specific option is missing, it means that we
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Move bdrv_reopen_multiple to new paradigm of permission update:
first update graph relations, then do refresh the permissions.

We have to modify reopen process in file-posix driver: with new scheme
we don't have prepared permissions in raw_reopen_prepare(), so we
should reconfigure fd in raw_check_perm(). Still this seems more native
and simple anyway.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-31-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h |   3 +-
 block.c               | 187 ++++++++++++------------------------------
 block/file-posix.c    |  91 +++++++-------------
 3 files changed, 84 insertions(+), 197 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVReopenState {
     BlockdevDetectZeroesOptions detect_zeroes;
     bool backing_missing;
     bool replace_backing_bs;  /* new_backing_bs is ignored if this is false */
-    BlockDriverState *new_backing_bs; /* If NULL then detach the current bs */
-    uint64_t perm, shared_perm;
+    BlockDriverState *old_backing_bs; /* keep pointer for permissions update */
     QDict *options;
     QDict *explicit_options;
     void *opaque;
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
 static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
                                             Transaction *tran);
 
-static int bdrv_reopen_prepare(BDRVReopenState *reopen_state, BlockReopenQueue
-                               *queue, Error **errp);
+static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
+                               BlockReopenQueue *queue,
+                               Transaction *set_backings_tran, Error **errp);
 static void bdrv_reopen_commit(BDRVReopenState *reopen_state);
 static void bdrv_reopen_abort(BDRVReopenState *reopen_state);
 
@@ -XXX,XX +XXX,XX @@ static void bdrv_list_abort_perm_update(GSList *list)
     }
 }
 
+__attribute__((unused))
 static void bdrv_abort_perm_update(BlockDriverState *bs)
 {
     g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
@@ -XXX,XX +XXX,XX @@ char *bdrv_perm_names(uint64_t perm)
  *
  * Needs to be followed by a call to either bdrv_set_perm() or
  * bdrv_abort_perm_update(). */
+__attribute__((unused))
 static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
                                   uint64_t new_used_perm,
                                   uint64_t new_shared_perm,
@@ -XXX,XX +XXX,XX @@ static BlockReopenQueue *bdrv_reopen_queue_child(BlockReopenQueue *bs_queue,
     bs_entry->state.explicit_options = explicit_options;
     bs_entry->state.flags = flags;
 
-    /* This needs to be overwritten in bdrv_reopen_prepare() */
-    bs_entry->state.perm = UINT64_MAX;
-    bs_entry->state.shared_perm = 0;
-
     /*
      * If keep_old_opts is false then it means that unspecified
      * options must be reset to their original value. We don't allow
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
 {
     int ret = -1;
     BlockReopenQueueEntry *bs_entry, *next;
+    Transaction *tran = tran_new();
+    g_autoptr(GHashTable) found = NULL;
+    g_autoptr(GSList) refresh_list = NULL;
 
     assert(bs_queue != NULL);
 
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
 
     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
         assert(bs_entry->state.bs->quiesce_counter > 0);
-        if (bdrv_reopen_prepare(&bs_entry->state, bs_queue, errp)) {
-            goto cleanup;
+        ret = bdrv_reopen_prepare(&bs_entry->state, bs_queue, tran, errp);
+        if (ret < 0) {
+            goto abort;
         }
         bs_entry->prepared = true;
     }
 
+    found = g_hash_table_new(NULL, NULL);
     QTAILQ_FOREACH(bs_entry, bs_queue, entry) {
         BDRVReopenState *state = &bs_entry->state;
-        ret = bdrv_check_perm(state->bs, bs_queue, state->perm,
-                              state->shared_perm, errp);
-        if (ret < 0) {
-            goto cleanup_perm;
-        }
-        /* Check if new_backing_bs would accept the new permissions */
-        if (state->replace_backing_bs && state->new_backing_bs) {
-            uint64_t nperm, nshared;
-            bdrv_child_perm(state->bs, state->new_backing_bs,
-                            NULL, bdrv_backing_role(state->bs),
-                            bs_queue, state->perm, state->shared_perm,
-                            &nperm, &nshared);
-            ret = bdrv_check_update_perm(state->new_backing_bs, NULL,
-                                         nperm, nshared, errp);
-            if (ret < 0) {
-                goto cleanup_perm;
-            }
+
+        refresh_list = bdrv_topological_dfs(refresh_list, found, state->bs);
+        if (state->old_backing_bs) {
+            refresh_list = bdrv_topological_dfs(refresh_list, found,
+                                                state->old_backing_bs);
         }
-        bs_entry->perms_checked = true;
+    }
+
+    /*
+     * Note that file-posix driver rely on permission update done during reopen
+     * (even if no permission changed), because it wants "new" permissions for
+     * reconfiguring the fd and that's why it does it in raw_check_perm(), not
+     * in raw_reopen_prepare() which is called with "old" permissions.
+     */
+    ret = bdrv_list_refresh_perms(refresh_list, bs_queue, tran, errp);
+    if (ret < 0) {
+        goto abort;
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_multiple(BlockReopenQueue *bs_queue, Error **errp)
         bdrv_reopen_commit(&bs_entry->state);
     }
 
-    ret = 0;
-cleanup_perm:
-    QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-        BDRVReopenState *state = &bs_entry->state;
-
-        if (!bs_entry->perms_checked) {
-            continue;
-        }
-
-        if (ret == 0) {
-            uint64_t perm, shared;
+    tran_commit(tran);
 
-            bdrv_get_cumulative_perm(state->bs, &perm, &shared);
-            assert(perm == state->perm);
-            assert(shared == state->shared_perm);
+    QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
+        BlockDriverState *bs = bs_entry->state.bs;
 
-            bdrv_set_perm(state->bs);
-        } else {
-            bdrv_abort_perm_update(state->bs);
-            if (state->replace_backing_bs && state->new_backing_bs) {
-                bdrv_abort_perm_update(state->new_backing_bs);
-            }
+        if (bs->drv->bdrv_reopen_commit_post) {
+            bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
         }
     }
 
-    if (ret == 0) {
-        QTAILQ_FOREACH_REVERSE(bs_entry, bs_queue, entry) {
-            BlockDriverState *bs = bs_entry->state.bs;
+    ret = 0;
+    goto cleanup;
 
-            if (bs->drv->bdrv_reopen_commit_post)
-                bs->drv->bdrv_reopen_commit_post(&bs_entry->state);
+abort:
+    tran_abort(tran);
+    QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
+        if (bs_entry->prepared) {
+            bdrv_reopen_abort(&bs_entry->state);
         }
+        qobject_unref(bs_entry->state.explicit_options);
+        qobject_unref(bs_entry->state.options);
     }
+
 cleanup:
     QTAILQ_FOREACH_SAFE(bs_entry, bs_queue, entry, next) {
-        if (ret) {
-            if (bs_entry->prepared) {
-                bdrv_reopen_abort(&bs_entry->state);
-            }
-            qobject_unref(bs_entry->state.explicit_options);
-            qobject_unref(bs_entry->state.options);
-        }
-        if (bs_entry->state.new_backing_bs) {
-            bdrv_unref(bs_entry->state.new_backing_bs);
-        }
         g_free(bs_entry);
     }
     g_free(bs_queue);
@@ -XXX,XX +XXX,XX @@ int bdrv_reopen_set_read_only(BlockDriverState *bs, bool read_only,
     return ret;
 }
 
-static BlockReopenQueueEntry *find_parent_in_reopen_queue(BlockReopenQueue *q,
-                                                          BdrvChild *c)
-{
-    BlockReopenQueueEntry *entry;
-
-    QTAILQ_FOREACH(entry, q, entry) {
-        BlockDriverState *bs = entry->state.bs;
-        BdrvChild *child;
-
-        QLIST_FOREACH(child, &bs->children, next) {
-            if (child == c) {
-                return entry;
-            }
-        }
-    }
-
-    return NULL;
-}
-
-static void bdrv_reopen_perm(BlockReopenQueue *q, BlockDriverState *bs,
-                             uint64_t *perm, uint64_t *shared)
-{
-    BdrvChild *c;
-    BlockReopenQueueEntry *parent;
-    uint64_t cumulative_perms = 0;
-    uint64_t cumulative_shared_perms = BLK_PERM_ALL;
-
-    QLIST_FOREACH(c, &bs->parents, next_parent) {
-        parent = find_parent_in_reopen_queue(q, c);
-        if (!parent) {
-            cumulative_perms |= c->perm;
-            cumulative_shared_perms &= c->shared_perm;
-        } else {
-            uint64_t nperm, nshared;
-
-            bdrv_child_perm(parent->state.bs, bs, c, c->role, q,
-                            parent->state.perm, parent->state.shared_perm,
-                            &nperm, &nshared);
-
-            cumulative_perms |= nperm;
-            cumulative_shared_perms &= nshared;
-        }
-    }
-    *perm = cumulative_perms;
-    *shared = cumulative_shared_perms;
-}
-
 static bool bdrv_reopen_can_attach(BlockDriverState *parent,
                                    BdrvChild *child,
                                    BlockDriverState *new_child,
@@ -XXX,XX +XXX,XX @@ static bool bdrv_reopen_can_attach(BlockDriverState *parent,
  * Return 0 on success, otherwise return < 0 and set @errp.
  */
 static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
+                                     Transaction *set_backings_tran,
                                      Error **errp)
 {
     BlockDriverState *bs = reopen_state->bs;
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
 
     /* If we want to replace the backing file we need some extra checks */
     if (new_backing_bs != bdrv_filter_or_cow_bs(overlay_bs)) {
+        int ret;
+
         /* Check for implicit nodes between bs and its backing file */
         if (bs != overlay_bs) {
             error_setg(errp, "Cannot change backing link if '%s' has "
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
             return -EPERM;
         }
         reopen_state->replace_backing_bs = true;
-        if (new_backing_bs) {
-            bdrv_ref(new_backing_bs);
-            reopen_state->new_backing_bs = new_backing_bs;
+        reopen_state->old_backing_bs = bs->backing ? bs->backing->bs : NULL;
+        ret = bdrv_set_backing_noperm(bs, new_backing_bs, set_backings_tran,
+                                      errp);
+        if (ret < 0) {
+            return ret;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_parse_backing(BDRVReopenState *reopen_state,
  *
  */
 static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
-                               BlockReopenQueue *queue, Error **errp)
+                               BlockReopenQueue *queue,
+                               Transaction *set_backings_tran, Error **errp)
 {
     int ret = -1;
     int old_flags;
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
         goto error;
     }
 
-    /* Calculate required permissions after reopening */
-    bdrv_reopen_perm(queue, reopen_state->bs,
-                     &reopen_state->perm, &reopen_state->shared_perm);
-
     if (drv->bdrv_reopen_prepare) {
         /*
          * If a driver-specific option is missing, it means that we
@@ -XXX,XX +XXX,XX @@ static int bdrv_reopen_prepare(BDRVReopenState *reopen_state,
      * either a reference to an existing node (using its node name)
      * or NULL to simply detach the current backing file.
      */
-    ret = bdrv_reopen_parse_backing(reopen_state, errp);
+    ret = bdrv_reopen_parse_backing(reopen_state, set_backings_tran, errp);
     if (ret < 0) {
         goto error;
     }
@@ -XXX,XX +XXX,XX @@ static void bdrv_reopen_commit(BDRVReopenState *reopen_state)
         qdict_del(bs->explicit_options, child->name);
         qdict_del(bs->options, child->name);
     }
-
-    /*
-     * Change the backing file if a new one was specified. We do this
-     * after updating bs->options, so bdrv_refresh_filename() (called
-     * from bdrv_set_backing_hd()) has the new values.
-     */
-    if (reopen_state->replace_backing_bs) {
-        BlockDriverState *old_backing_bs = child_bs(bs->backing);
-        assert(!old_backing_bs || !old_backing_bs->implicit);
-        /* Abort the permission update on the backing bs we're detaching */
-        if (old_backing_bs) {
-            bdrv_abort_perm_update(old_backing_bs);
-        }
-        bdrv_set_backing_hd(bs, reopen_state->new_backing_bs, &error_abort);
-    }
-
     bdrv_refresh_limits(bs, NULL, NULL);
 }
 
diff --git a/block/file-posix.c b/block/file-posix.c
index XXXXXXX..XXXXXXX 100644
--- a/block/file-posix.c
+++ b/block/file-posix.c
@@ -XXX,XX +XXX,XX @@ typedef struct BDRVRawState {
 } BDRVRawState;
 
 typedef struct BDRVRawReopenState {
-    int fd;
     int open_flags;
     bool drop_cache;
     bool check_cache_dropped;
@@ -XXX,XX +XXX,XX @@ static int raw_reopen_prepare(BDRVReopenState *state,
     BDRVRawReopenState *rs;
     QemuOpts *opts;
     int ret;
-    Error *local_err = NULL;
 
     assert(state != NULL);
     assert(state->bs != NULL);
@@ -XXX,XX +XXX,XX @@ static int raw_reopen_prepare(BDRVReopenState *state,
      * bdrv_reopen_prepare() will detect changes and complain. */
     qemu_opts_to_qdict(opts, state->options);
 
-    rs->fd = raw_reconfigure_getfd(state->bs, state->flags, &rs->open_flags,
-                                   state->perm, true, &local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        ret = -1;
-        goto out;
-    }
-
-    /* Fail already reopen_prepare() if we can't get a working O_DIRECT
-     * alignment with the new fd. */
-    if (rs->fd != -1) {
-        raw_probe_alignment(state->bs, rs->fd, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            ret = -EINVAL;
-            goto out_fd;
-        }
-    }
+    /*
+     * As part of reopen prepare we also want to create new fd by
+     * raw_reconfigure_getfd(). But it wants updated "perm", when in
+     * bdrv_reopen_multiple() .bdrv_reopen_prepare() callback called prior to
+     * permission update. Happily, permission update is always a part (a seprate
+     * stage) of bdrv_reopen_multiple() so we can rely on this fact and
+     * reconfigure fd in raw_check_perm().
+     */
 
     s->reopen_state = state;
     ret = 0;
-out_fd:
-    if (ret < 0) {
-        qemu_close(rs->fd);
-        rs->fd = -1;
-    }
+
 out:
     qemu_opts_del(opts);
     return ret;
@@ -XXX,XX +XXX,XX @@ static void raw_reopen_commit(BDRVReopenState *state)
     s->drop_cache = rs->drop_cache;
     s->check_cache_dropped = rs->check_cache_dropped;
     s->open_flags = rs->open_flags;
-
-    qemu_close(s->fd);
-    s->fd = rs->fd;
-
     g_free(state->opaque);
     state->opaque = NULL;
 
@@ -XXX,XX +XXX,XX @@ static void raw_reopen_abort(BDRVReopenState *state)
         return;
     }
 
-    if (rs->fd >= 0) {
-        qemu_close(rs->fd);
-        rs->fd = -1;
-    }
     g_free(state->opaque);
     state->opaque = NULL;
 
@@ -XXX,XX +XXX,XX @@ static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
                           Error **errp)
 {
     BDRVRawState *s = bs->opaque;
-    BDRVRawReopenState *rs = NULL;
+    int input_flags = s->reopen_state ? s->reopen_state->flags : bs->open_flags;
     int open_flags;
     int ret;
 
-    if (s->perm_change_fd) {
+    /* We may need a new fd if auto-read-only switches the mode */
+    ret = raw_reconfigure_getfd(bs, input_flags, &open_flags, perm,
+                                false, errp);
+    if (ret < 0) {
+        return ret;
+    } else if (ret != s->fd) {
+        Error *local_err = NULL;
+
         /*
-         * In the context of reopen, this function may be called several times
-         * (directly and recursively while change permissions of the parent).
-         * This is even true for children that don't inherit from the original
-         * reopen node, so s->reopen_state is not set.
-         *
-         * Ignore all but the first call.
+         * Fail already check_perm() if we can't get a working O_DIRECT
+         * alignment with the new fd.
          */
-        return 0;
-    }
-
-    if (s->reopen_state) {
-        /* We already have a new file descriptor to set permissions for */
-        assert(s->reopen_state->perm == perm);
-        assert(s->reopen_state->shared_perm == shared);
-        rs = s->reopen_state->opaque;
-        s->perm_change_fd = rs->fd;
-        s->perm_change_flags = rs->open_flags;
-    } else {
-        /* We may need a new fd if auto-read-only switches the mode */
-        ret = raw_reconfigure_getfd(bs, bs->open_flags, &open_flags, perm,
-                                    false, errp);
-        if (ret < 0) {
-            return ret;
-        } else if (ret != s->fd) {
-            s->perm_change_fd = ret;
-            s->perm_change_flags = open_flags;
+        raw_probe_alignment(bs, ret, &local_err);
+        if (local_err) {
+            error_propagate(errp, local_err);
+            return -EINVAL;
         }
+
+        s->perm_change_fd = ret;
+        s->perm_change_flags = open_flags;
     }
 
     /* Prepare permissions on old fd to avoid conflicts between old and new,
@@ -XXX,XX +XXX,XX @@ static int raw_check_perm(BlockDriverState *bs, uint64_t perm, uint64_t shared,
     return 0;
 
 fail:
-    if (s->perm_change_fd && !s->reopen_state) {
+    if (s->perm_change_fd) {
         qemu_close(s->perm_change_fd);
     }
     s->perm_change_fd = 0;
@@ -XXX,XX +XXX,XX @@ static void raw_abort_perm_update(BlockDriverState *bs)
 
     /* For reopen, .bdrv_reopen_abort is called afterwards and will close
      * the file descriptor. */
-    if (s->perm_change_fd && !s->reopen_state) {
+    if (s->perm_change_fd) {
         qemu_close(s->perm_change_fd);
     }
     s->perm_change_fd = 0;
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-32-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 103 --------------------------------------------------------
 1 file changed, 103 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_fill_options(QDict **options, const char *filename,
     return 0;
 }
 
-static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
-                                  uint64_t new_used_perm,
-                                  uint64_t new_shared_perm,
-                                  Error **errp);
-
 typedef struct BlockReopenQueueEntry {
      bool prepared;
      bool perms_checked;
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
     return 0;
 }
 
-static int bdrv_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-                           uint64_t cumulative_perms,
-                           uint64_t cumulative_shared_perms, Error **errp)
-{
-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-    return bdrv_check_perm_common(list, q, true, cumulative_perms,
-                                  cumulative_shared_perms, NULL, errp);
-}
-
 static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
                                    Transaction *tran, Error **errp)
 {
     return bdrv_check_perm_common(list, q, false, 0, 0, tran, errp);
 }
 
-/*
- * Notifies drivers that after a previous bdrv_check_perm() call, the
- * permission update is not performed and any preparations made for it (e.g.
- * taken file locks) need to be undone.
- */
-static void bdrv_node_abort_perm_update(BlockDriverState *bs)
-{
-    BlockDriver *drv = bs->drv;
-    BdrvChild *c;
-
-    if (!drv) {
-        return;
-    }
-
-    bdrv_drv_set_perm_abort(bs);
-
-    QLIST_FOREACH(c, &bs->children, next) {
-        bdrv_child_set_perm_abort(c);
-    }
-}
-
-static void bdrv_list_abort_perm_update(GSList *list)
-{
-    for ( ; list; list = list->next) {
-        bdrv_node_abort_perm_update((BlockDriverState *)list->data);
-    }
-}
-
-__attribute__((unused))
-static void bdrv_abort_perm_update(BlockDriverState *bs)
-{
-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-    return bdrv_list_abort_perm_update(list);
-}
-
 static void bdrv_node_set_perm(BlockDriverState *bs)
 {
     BlockDriver *drv = bs->drv;
@@ -XXX,XX +XXX,XX @@ char *bdrv_perm_names(uint64_t perm)
     return g_string_free(result, FALSE);
 }
 
-/*
- * Checks whether a new reference to @bs can be added if the new user requires
- * @new_used_perm/@new_shared_perm as its permissions. If @ignore_children is
- * set, the BdrvChild objects in this list are ignored in the calculations;
- * this allows checking permission updates for an existing reference.
- *
- * Needs to be followed by a call to either bdrv_set_perm() or
- * bdrv_abort_perm_update(). */
-__attribute__((unused))
-static int bdrv_check_update_perm(BlockDriverState *bs, BlockReopenQueue *q,
-                                  uint64_t new_used_perm,
-                                  uint64_t new_shared_perm,
-                                  Error **errp)
-{
-    BdrvChild *c;
-    uint64_t cumulative_perms = new_used_perm;
-    uint64_t cumulative_shared_perms = new_shared_perm;
-
-
-    /* There is no reason why anyone couldn't tolerate write_unchanged */
-    assert(new_shared_perm & BLK_PERM_WRITE_UNCHANGED);
-
-    QLIST_FOREACH(c, &bs->parents, next_parent) {
-        if ((new_used_perm & c->shared_perm) != new_used_perm) {
-            char *user = bdrv_child_user_desc(c);
-            char *perm_names = bdrv_perm_names(new_used_perm & ~c->shared_perm);
-
-            error_setg(errp, "Conflicts with use by %s as '%s', which does not "
-                             "allow '%s' on %s",
-                       user, c->name, perm_names, bdrv_get_node_name(c->bs));
-            g_free(user);
-            g_free(perm_names);
-            return -EPERM;
-        }
-
-        if ((c->perm & new_shared_perm) != c->perm) {
-            char *user = bdrv_child_user_desc(c);
-            char *perm_names = bdrv_perm_names(c->perm & ~new_shared_perm);
-
-            error_setg(errp, "Conflicts with use by %s as '%s', which uses "
-                             "'%s' on %s",
-                       user, c->name, perm_names, bdrv_get_node_name(c->bs));
-            g_free(user);
-            g_free(perm_names);
-            return -EPERM;
-        }
-
-        cumulative_perms |= c->perm;
-        cumulative_shared_perms &= c->shared_perm;
-    }
-
-    return bdrv_check_perm(bs, q, cumulative_perms, cumulative_shared_perms,
-                           errp);
-}
 
 static int bdrv_refresh_perms(BlockDriverState *bs, Error **errp)
 {
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

bdrv_check_perm_common() has only one caller, so no more sense in
"common".

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-33-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 32 +++-----------------------------
 1 file changed, 3 insertions(+), 29 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
     return 0;
 }
 
-/*
- * If use_cumulative_perms is true, use cumulative_perms and
- * cumulative_shared_perms for first element of the list. Otherwise just refresh
- * all permissions.
- */
-static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
-                                  bool use_cumulative_perms,
-                                  uint64_t cumulative_perms,
-                                  uint64_t cumulative_shared_perms,
-                                  Transaction *tran, Error **errp)
+static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
+                                   Transaction *tran, Error **errp)
 {
     int ret;
+    uint64_t cumulative_perms, cumulative_shared_perms;
     BlockDriverState *bs;
 
-    if (use_cumulative_perms) {
-        bs = list->data;
-
-        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
-                                   cumulative_shared_perms,
-                                   tran, errp);
-        if (ret < 0) {
-            return ret;
-        }
-
-        list = list->next;
-    }
-
     for ( ; list; list = list->next) {
         bs = list->data;
 
@@ -XXX,XX +XXX,XX @@ static int bdrv_check_perm_common(GSList *list, BlockReopenQueue *q,
     return 0;
 }
 
-static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
-                                   Transaction *tran, Error **errp)
-{
-    return bdrv_check_perm_common(list, q, false, 0, 0, tran, errp);
-}
-
 static void bdrv_node_set_perm(BlockDriverState *bs)
 {
     BlockDriver *drv = bs->drv;
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

bdrv_replace_child() has only one caller, the second argument is
unused. Inline it now. This triggers deletion of some more unused
interfaces.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-34-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 101 ++++++++++----------------------------------------------
 1 file changed, 18 insertions(+), 83 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
     return 0;
 }
 
-static void bdrv_node_set_perm(BlockDriverState *bs)
-{
-    BlockDriver *drv = bs->drv;
-    BdrvChild *c;
-
-    if (!drv) {
-        return;
-    }
-
-    bdrv_drv_set_perm_commit(bs);
-
-    /* Drivers that never have children can omit .bdrv_child_perm() */
-    if (!drv->bdrv_child_perm) {
-        assert(QLIST_EMPTY(&bs->children));
-        return;
-    }
-
-    /* Update all children */
-    QLIST_FOREACH(c, &bs->children, next) {
-        bdrv_child_set_perm_commit(c);
-    }
-}
-
-static void bdrv_list_set_perm(GSList *list)
-{
-    for ( ; list; list = list->next) {
-        bdrv_node_set_perm((BlockDriverState *)list->data);
-    }
-}
-
-static void bdrv_set_perm(BlockDriverState *bs)
-{
-    g_autoptr(GSList) list = bdrv_topological_dfs(NULL, NULL, bs);
-    return bdrv_list_set_perm(list);
-}
-
 void bdrv_get_cumulative_perm(BlockDriverState *bs, uint64_t *perm,
                               uint64_t *shared_perm)
 {
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child_noperm(BdrvChild *child,
     }
 }
 
-/*
- * Updates @child to change its reference to point to @new_bs, including
- * checking and applying the necessary permission updates both to the old node
- * and to @new_bs.
- *
- * NULL is passed as @new_bs for removing the reference before freeing @child.
- *
- * If @new_bs is not NULL, bdrv_check_perm() must be called beforehand, as this
- * function uses bdrv_set_perm() to update the permissions according to the new
- * reference that @new_bs gets.
- *
- * Callers must ensure that child->frozen is false.
- */
-static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs)
-{
-    BlockDriverState *old_bs = child->bs;
-
-    /* Asserts that child->frozen == false */
-    bdrv_replace_child_noperm(child, new_bs);
-
-    /*
-     * Start with the new node's permissions.  If @new_bs is a (direct
-     * or indirect) child of @old_bs, we must complete the permission
-     * update on @new_bs before we loosen the restrictions on @old_bs.
-     * Otherwise, bdrv_check_perm() on @old_bs would re-initiate
-     * updating the permissions of @new_bs, and thus not purely loosen
-     * restrictions.
-     */
-    if (new_bs) {
-        bdrv_set_perm(new_bs);
-    }
-
-    if (old_bs) {
-        /*
-         * Update permissions for old node. We're just taking a parent away, so
-         * we're loosening restrictions. Errors of permission update are not
-         * fatal in this case, ignore them.
-         */
-        bdrv_refresh_perms(old_bs, NULL);
-
-        /* When the parent requiring a non-default AioContext is removed, the
-         * node moves back to the main AioContext */
-        bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
-    }
-}
-
 static void bdrv_child_free(void *opaque)
 {
     BdrvChild *c = opaque;
@@ -XXX,XX +XXX,XX @@ static int bdrv_attach_child_noperm(BlockDriverState *parent_bs,
 
 static void bdrv_detach_child(BdrvChild *child)
 {
-    bdrv_replace_child(child, NULL);
+    BlockDriverState *old_bs = child->bs;
+
+    bdrv_replace_child_noperm(child, NULL);
     bdrv_remove_empty_child(child);
+
+    if (old_bs) {
+        /*
+         * Update permissions for old node. We're just taking a parent away, so
+         * we're loosening restrictions. Errors of permission update are not
+         * fatal in this case, ignore them.
+         */
+        bdrv_refresh_perms(old_bs, NULL);
+
+        /*
+         * When the parent requiring a non-default AioContext is removed, the
+         * node moves back to the main AioContext
+         */
+        bdrv_try_set_aio_context(old_bs, qemu_get_aio_context(), NULL);
+    }
 }
 
 /*
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Old interfaces dropped, nobody directly calls
bdrv_child_set_perm_abort() and bdrv_child_set_perm_commit(), so we can
use personal state structure for the action and stop exploiting
BdrvChild structure. Also, drop "_safe" suffix which is redundant now.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-35-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block_int.h |  5 ----
 block.c                   | 63 ++++++++++++++-------------------------
 2 files changed, 22 insertions(+), 46 deletions(-)

diff --git a/include/block/block_int.h b/include/block/block_int.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -XXX,XX +XXX,XX @@ struct BdrvChild {
      */
     uint64_t shared_perm;
 
-    /* backup of permissions during permission update procedure */
-    bool has_backup_perm;
-    uint64_t backup_perm;
-    uint64_t backup_shared_perm;
-
     /*
      * This link is frozen: the child can neither be replaced nor
      * detached from the parent.
diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static GSList *bdrv_topological_dfs(GSList *list, GHashTable *found,
     return g_slist_prepend(list, bs);
 }
 
-static void bdrv_child_set_perm_commit(void *opaque)
-{
-    BdrvChild *c = opaque;
-
-    c->has_backup_perm = false;
-}
+typedef struct BdrvChildSetPermState {
+    BdrvChild *child;
+    uint64_t old_perm;
+    uint64_t old_shared_perm;
+} BdrvChildSetPermState;
 
 static void bdrv_child_set_perm_abort(void *opaque)
 {
-    BdrvChild *c = opaque;
-    /*
-     * We may have child->has_backup_perm unset at this point, as in case of
-     * _check_ stage of permission update failure we may _check_ not the whole
-     * subtree.  Still, _abort_ is called on the whole subtree anyway.
-     */
-    if (c->has_backup_perm) {
-        c->perm = c->backup_perm;
-        c->shared_perm = c->backup_shared_perm;
-        c->has_backup_perm = false;
-    }
+    BdrvChildSetPermState *s = opaque;
+
+    s->child->perm = s->old_perm;
+    s->child->shared_perm = s->old_shared_perm;
 }
 
 static TransactionActionDrv bdrv_child_set_pem_drv = {
     .abort = bdrv_child_set_perm_abort,
-    .commit = bdrv_child_set_perm_commit,
+    .clean = g_free,
 };
 
-/*
- * With tran=NULL needs to be followed by direct call to either
- * bdrv_child_set_perm_commit() or bdrv_child_set_perm_abort().
- *
- * With non-NULL tran needs to be followed by tran_abort() or tran_commit()
- * instead.
- */
-static void bdrv_child_set_perm_safe(BdrvChild *c, uint64_t perm,
-                                     uint64_t shared, Transaction *tran)
+static void bdrv_child_set_perm(BdrvChild *c, uint64_t perm,
+                                uint64_t shared, Transaction *tran)
 {
-    if (!c->has_backup_perm) {
-        c->has_backup_perm = true;
-        c->backup_perm = c->perm;
-        c->backup_shared_perm = c->shared_perm;
-    }
-    /*
-     * Note: it's OK if c->has_backup_perm was already set, as we can find the
-     * same c twice during check_perm procedure
-     */
+    BdrvChildSetPermState *s = g_new(BdrvChildSetPermState, 1);
+
+    *s = (BdrvChildSetPermState) {
+        .child = c,
+        .old_perm = c->perm,
+        .old_shared_perm = c->shared_perm,
+    };
 
     c->perm = perm;
     c->shared_perm = shared;
 
-    if (tran) {
-        tran_add(tran, &bdrv_child_set_pem_drv, c);
-    }
+    tran_add(tran, &bdrv_child_set_pem_drv, s);
 }
 
 static void bdrv_drv_set_perm_commit(void *opaque)
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
         bdrv_child_perm(bs, c->bs, c, c->role, q,
                         cumulative_perms, cumulative_shared_perms,
                         &cur_perm, &cur_shared);
-        bdrv_child_set_perm_safe(c, cur_perm, cur_shared, tran);
+        bdrv_child_set_perm(c, cur_perm, cur_shared, tran);
     }
 
     return 0;
@@ -XXX,XX +XXX,XX @@ int bdrv_child_try_set_perm(BdrvChild *c, uint64_t perm, uint64_t shared,
     Transaction *tran = tran_new();
     int ret;
 
-    bdrv_child_set_perm_safe(c, perm, shared, tran);
+    bdrv_child_set_perm(c, perm, shared, tran);
 
     ret = bdrv_refresh_perms(c->bs, &local_err);
 
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

We don't have bdrv_replace_child(), so it's time for
bdrv_replace_child_safe() to take its place.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-36-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@ static TransactionActionDrv bdrv_replace_child_drv = {
 };
 
 /*
- * bdrv_replace_child_safe
+ * bdrv_replace_child
  *
  * Note: real unref of old_bs is done only on commit.
  */
-static void bdrv_replace_child_safe(BdrvChild *child, BlockDriverState *new_bs,
-                                    Transaction *tran)
+static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs,
+                               Transaction *tran)
 {
     BdrvReplaceChildState *s = g_new(BdrvReplaceChildState, 1);
     *s = (BdrvReplaceChildState) {
@@ -XXX,XX +XXX,XX @@ static void bdrv_remove_filter_or_cow_child(BlockDriverState *bs,
     }
 
     if (child->bs) {
-        bdrv_replace_child_safe(child, NULL, tran);
+        bdrv_replace_child(child, NULL, tran);
     }
 
     s = g_new(BdrvRemoveFilterOrCowChild, 1);
@@ -XXX,XX +XXX,XX @@ static int bdrv_replace_node_noperm(BlockDriverState *from,
                        c->name, from->node_name);
             return -EPERM;
         }
-        bdrv_replace_child_safe(c, to, tran);
+        bdrv_replace_child(c, to, tran);
     }
 
     return 0;
-- 
2.30.2

From: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>

Now, bdrv_node_check_perm() is called only with fresh cumulative
permissions, so its actually "refresh_perm".

Move permission calculation to the function. Also, drop unreachable
error message and rewrite the remaining one to be more generic (as now
we don't know which node is added and which was already here).

Add also Virtuozzo copyright, as big work is done at this point.

Signed-off-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Reviewed-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210428151804.439460-37-vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 block.c                | 38 +++++++++++---------------------------
 tests/qemu-iotests/245 |  2 +-
 2 files changed, 12 insertions(+), 28 deletions(-)

diff --git a/block.c b/block.c
index XXXXXXX..XXXXXXX 100644
--- a/block.c
+++ b/block.c
@@ -XXX,XX +XXX,XX @@
  * QEMU System Emulator block driver
  *
  * Copyright (c) 2003 Fabrice Bellard
+ * Copyright (c) 2020 Virtuozzo International GmbH.
  *
  * Permission is hereby granted, free of charge, to any person obtaining a copy
  * of this software and associated documentation files (the "Software"), to deal
@@ -XXX,XX +XXX,XX @@ static void bdrv_replace_child(BdrvChild *child, BlockDriverState *new_bs,
 }
 
 /*
- * Check whether permissions on this node can be changed in a way that
- * @cumulative_perms and @cumulative_shared_perms are the new cumulative
- * permissions of all its parents. This involves checking whether all necessary
- * permission changes to child nodes can be performed.
- *
- * A call to this function must always be followed by a call to bdrv_set_perm()
- * or bdrv_abort_perm_update().
+ * Refresh permissions in @bs subtree. The function is intended to be called
+ * after some graph modification that was done without permission update.
  */
-static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
-                                uint64_t cumulative_perms,
-                                uint64_t cumulative_shared_perms,
-                                Transaction *tran, Error **errp)
+static int bdrv_node_refresh_perm(BlockDriverState *bs, BlockReopenQueue *q,
+                                  Transaction *tran, Error **errp)
 {
     BlockDriver *drv = bs->drv;
     BdrvChild *c;
     int ret;
+    uint64_t cumulative_perms, cumulative_shared_perms;
+
+    bdrv_get_cumulative_perm(bs, &cumulative_perms, &cumulative_shared_perms);
 
     /* Write permissions never work with read-only images */
     if ((cumulative_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) &&
@@ -XXX,XX +XXX,XX @@ static int bdrv_node_check_perm(BlockDriverState *bs, BlockReopenQueue *q,
         if (!bdrv_is_writable_after_reopen(bs, NULL)) {
             error_setg(errp, "Block node is read-only");
         } else {
-            uint64_t current_perms, current_shared;
-            bdrv_get_cumulative_perm(bs, &current_perms, &current_shared);
-            if (current_perms & (BLK_PERM_WRITE | BLK_PERM_WRITE_UNCHANGED)) {
-                error_setg(errp, "Cannot make block node read-only, there is "
-                           "a writer on it");
-            } else {
-                error_setg(errp, "Cannot make block node read-only and create "
-                           "a writer on it");
-            }
+            error_setg(errp, "Read-only block node '%s' cannot support "
+                       "read-write users", bdrv_get_node_name(bs));
         }
 
         return -EPERM;
@@ -XXX,XX +XXX,XX @@ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
                                    Transaction *tran, Error **errp)
 {
     int ret;
-    uint64_t cumulative_perms, cumulative_shared_perms;
     BlockDriverState *bs;
 
     for ( ; list; list = list->next) {
@@ -XXX,XX +XXX,XX @@ static int bdrv_list_refresh_perms(GSList *list, BlockReopenQueue *q,
             return -EINVAL;
         }
 
-        bdrv_get_cumulative_perm(bs, &cumulative_perms,
-                                 &cumulative_shared_perms);
-
-        ret = bdrv_node_check_perm(bs, q, cumulative_perms,
-                                   cumulative_shared_perms,
-                                   tran, errp);
+        ret = bdrv_node_refresh_perm(bs, q, tran, errp);
         if (ret < 0) {
             return ret;
         }
diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
index XXXXXXX..XXXXXXX 100755
--- a/tests/qemu-iotests/245
+++ b/tests/qemu-iotests/245
@@ -XXX,XX +XXX,XX @@ class TestBlockdevReopen(iotests.QMPTestCase):
         # We can't reopen hd1 to read-only, as block-stream requires it to be
         # read-write
         self.reopen(opts['backing'], {'read-only': True},
-                    "Cannot make block node read-only, there is a writer on it")
+                    "Read-only block node 'hd1' cannot support read-write users")
 
         # We can't remove hd2 while the stream job is ongoing
         opts['backing']['backing'] = None
-- 
2.30.2

Normally, blk_new_open() just shares all permissions. This was fine
originally when permissions only protected against uses in the same
process because no other part of the code would actually get to access
the block nodes opened with blk_new_open(). However, since we use it for
file locking now, unsharing permissions becomes desirable.

Add a new BDRV_O_NO_SHARE flag that is used in blk_new_open() to unshare
any permissions that can be unshared.

Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210422164344.283389-2-kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 include/block/block.h |  1 +
 block/block-backend.c | 19 +++++++++++++------
 2 files changed, 14 insertions(+), 6 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index XXXXXXX..XXXXXXX 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -XXX,XX +XXX,XX @@ typedef struct HDGeometry {
     uint32_t cylinders;
 } HDGeometry;
 
+#define BDRV_O_NO_SHARE    0x0001 /* don't share permissions */
 #define BDRV_O_RDWR        0x0002
 #define BDRV_O_RESIZE      0x0004 /* request permission for resizing the node */
 #define BDRV_O_SNAPSHOT    0x0008 /* open the file read only and save writes in a snapshot */
diff --git a/block/block-backend.c b/block/block-backend.c
index XXXXXXX..XXXXXXX 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
     BlockBackend *blk;
     BlockDriverState *bs;
     uint64_t perm = 0;
+    uint64_t shared = BLK_PERM_ALL;
 
-    /* blk_new_open() is mainly used in .bdrv_create implementations and the
-     * tools where sharing isn't a concern because the BDS stays private, so we
-     * just request permission according to the flags.
+    /*
+     * blk_new_open() is mainly used in .bdrv_create implementations and the
+     * tools where sharing isn't a major concern because the BDS stays private
+     * and the file is generally not supposed to be used by a second process,
+     * so we just request permission according to the flags.
      *
      * The exceptions are xen_disk and blockdev_init(); in these cases, the
      * caller of blk_new_open() doesn't make use of the permissions, but they
      * shouldn't hurt either. We can still share everything here because the
-     * guest devices will add their own blockers if they can't share. */
+     * guest devices will add their own blockers if they can't share.
+     */
     if ((flags & BDRV_O_NO_IO) == 0) {
         perm |= BLK_PERM_CONSISTENT_READ;
         if (flags & BDRV_O_RDWR) {
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
     if (flags & BDRV_O_RESIZE) {
         perm |= BLK_PERM_RESIZE;
     }
+    if (flags & BDRV_O_NO_SHARE) {
+        shared = BLK_PERM_CONSISTENT_READ | BLK_PERM_WRITE_UNCHANGED;
+    }
 
-    blk = blk_new(qemu_get_aio_context(), perm, BLK_PERM_ALL);
+    blk = blk_new(qemu_get_aio_context(), perm, shared);
     bs = bdrv_open(filename, reference, options, flags, errp);
     if (!bs) {
         blk_unref(blk);
@@ -XXX,XX +XXX,XX @@ BlockBackend *blk_new_open(const char *filename, const char *reference,
 
     blk->root = bdrv_root_attach_child(bs, "root", &child_root,
                                        BDRV_CHILD_FILTERED | BDRV_CHILD_PRIMARY,
-                                       perm, BLK_PERM_ALL, blk, errp);
+                                       perm, shared, blk, errp);
     if (!blk->root) {
         blk_unref(blk);
         return NULL;
-- 
2.30.2

For a successful conversion of an image, we must make sure that its
content doesn't change during the conversion.

A special case of this is using the same image file both as the source
and as the destination. If both input and output format are raw, the
operation would just be useless work, with other formats it is a sure
way to destroy the image. This will now fail because the image file
can't be opened a second time for the output when opening it for the
input has already acquired file locks to unshare BLK_PERM_WRITE.

Nevertheless, if there is some reason in a special case why it is
actually okay to allow writes to the image while it is being converted,
-U can still be used to force sharing all permissions.

Note that for most image formats, BLK_PERM_WRITE would already be
unshared by the format driver, so this only really makes a difference
for raw source images (but any output format).

Reported-by: Xueqiang Wei <xuwei@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Message-Id: <20210422164344.283389-3-kwolf@redhat.com>
Reviewed-by: Vladimir Sementsov-Ogievskiy <vsementsov@virtuozzo.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 qemu-img.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/qemu-img.c b/qemu-img.c
index XXXXXXX..XXXXXXX 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -XXX,XX +XXX,XX @@ static void set_rate_limit(BlockBackend *blk, int64_t rate_limit)
 
 static int img_convert(int argc, char **argv)
 {
-    int c, bs_i, flags, src_flags = 0;
+    int c, bs_i, flags, src_flags = BDRV_O_NO_SHARE;
     const char *fmt = NULL, *out_fmt = NULL, *cache = "unsafe",
                *src_cache = BDRV_DEFAULT_CACHE, *out_baseimg = NULL,
                *out_filename, *out_baseimg_param, *snapshot_name = NULL;
-- 
2.30.2

virtio_add_queue() aborts when queue_size > VIRTQUEUE_MAX_SIZE, so
vhost_user_blk_device_realize() should check this before calling it.

Simple reproducer:

qemu-system-x86_64 \
    -chardev null,id=foo \
    -device vhost-user-blk-pci,queue-size=4096,chardev=foo

Fixes: https://bugzilla.redhat.com/show_bug.cgi?id=1935014
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
Message-Id: <20210413165654.50810-1-kwolf@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Raphael Norwitz <raphael.norwitz@nutanix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Kevin Wolf <kwolf@redhat.com>
---
 hw/block/vhost-user-blk.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/hw/block/vhost-user-blk.c b/hw/block/vhost-user-blk.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/block/vhost-user-blk.c
+++ b/hw/block/vhost-user-blk.c
@@ -XXX,XX +XXX,XX @@ static void vhost_user_blk_device_realize(DeviceState *dev, Error **errp)
         error_setg(errp, "vhost-user-blk: queue size must be non-zero");
         return;
     }
+    if (s->queue_size > VIRTQUEUE_MAX_SIZE) {
+        error_setg(errp, "vhost-user-blk: queue size must not exceed %d",
+                   VIRTQUEUE_MAX_SIZE);
+        return;
+    }
 
     if (!vhost_user_init(&s->vhost_user, &s->chardev, errp)) {
         return;
-- 
2.30.2