[PATCH v3 0/4] Tighten qemu-img rules on missing backing format

[PATCH v3 0/4] Tighten qemu-img rules on missing backing format

[Eric Blake]

In v3:
- patch 1 is new [Jan]
- patch 2:
  - add test 225 for vmdk [Jan]
  - add a few more tests where raw backing files are used [Peter]
- patch 3 add R-b
- patch 4:
  - more tweaks on which messages are emitted [Peter]
  - more test coverage in 114 of new messages
  - rebase to .rst conversion

Eric Blake (4):
  block: Add trivial backing_fmt support to qcow, sheepdog, vmdk
  iotests: Specify explicit backing format where sensible
  block: Add support to warn on backing file change without format
  qemu-img: Deprecate use of -b without -F

 docs/system/deprecated.rst    | 19 ++++++++++++++
 include/block/block.h         |  4 +--
 block.c                       | 34 ++++++++++++++++++++++---
 block/qcow.c                  |  6 +++++
 block/qcow2.c                 |  2 +-
 block/sheepdog.c              |  6 +++++
 block/stream.c                |  2 +-
 block/vmdk.c                  |  5 ++++
 blockdev.c                    |  3 ++-
 qemu-img.c                    |  4 +--
 tests/qemu-iotests/017        |  2 +-
 tests/qemu-iotests/017.out    |  2 +-
 tests/qemu-iotests/018        |  2 +-
 tests/qemu-iotests/018.out    |  2 +-
 tests/qemu-iotests/019        |  5 ++--
 tests/qemu-iotests/019.out    |  2 +-
 tests/qemu-iotests/020        |  4 +--
 tests/qemu-iotests/020.out    |  4 +--
 tests/qemu-iotests/024        |  8 +++---
 tests/qemu-iotests/024.out    |  5 ++--
 tests/qemu-iotests/028        |  4 +--
 tests/qemu-iotests/028.out    |  2 +-
 tests/qemu-iotests/030        | 26 +++++++++++++------
 tests/qemu-iotests/034        |  2 +-
 tests/qemu-iotests/034.out    |  2 +-
 tests/qemu-iotests/037        |  2 +-
 tests/qemu-iotests/037.out    |  2 +-
 tests/qemu-iotests/038        |  2 +-
 tests/qemu-iotests/038.out    |  2 +-
 tests/qemu-iotests/039        |  3 ++-
 tests/qemu-iotests/039.out    |  2 +-
 tests/qemu-iotests/040        | 47 +++++++++++++++++++++++++----------
 tests/qemu-iotests/041        | 37 ++++++++++++++++++---------
 tests/qemu-iotests/042        |  4 +--
 tests/qemu-iotests/043        | 18 +++++++-------
 tests/qemu-iotests/043.out    | 16 +++++++-----
 tests/qemu-iotests/046        |  2 +-
 tests/qemu-iotests/046.out    |  2 +-
 tests/qemu-iotests/050        |  4 +--
 tests/qemu-iotests/050.out    |  2 +-
 tests/qemu-iotests/051        |  2 +-
 tests/qemu-iotests/051.out    |  2 +-
 tests/qemu-iotests/051.pc.out |  2 +-
 tests/qemu-iotests/056        |  3 ++-
 tests/qemu-iotests/060        |  2 +-
 tests/qemu-iotests/060.out    |  2 +-
 tests/qemu-iotests/061        | 10 ++++----
 tests/qemu-iotests/061.out    | 10 ++++----
 tests/qemu-iotests/069        |  2 +-
 tests/qemu-iotests/069.out    |  2 +-
 tests/qemu-iotests/073        |  2 +-
 tests/qemu-iotests/073.out    |  2 +-
 tests/qemu-iotests/082        | 16 +++++++-----
 tests/qemu-iotests/082.out    | 16 ++++++------
 tests/qemu-iotests/085        |  4 +--
 tests/qemu-iotests/085.out    |  6 ++---
 tests/qemu-iotests/089        |  2 +-
 tests/qemu-iotests/089.out    |  2 +-
 tests/qemu-iotests/095        |  4 +--
 tests/qemu-iotests/095.out    |  4 +--
 tests/qemu-iotests/097        |  4 +--
 tests/qemu-iotests/097.out    | 16 ++++++------
 tests/qemu-iotests/098        |  2 +-
 tests/qemu-iotests/098.out    |  8 +++---
 tests/qemu-iotests/110        |  4 +--
 tests/qemu-iotests/110.out    |  4 +--
 tests/qemu-iotests/114        | 11 ++++++++
 tests/qemu-iotests/114.out    |  8 ++++++
 tests/qemu-iotests/122        | 27 ++++++++++++--------
 tests/qemu-iotests/122.out    |  8 +++---
 tests/qemu-iotests/126        |  4 +--
 tests/qemu-iotests/126.out    |  4 +--
 tests/qemu-iotests/127        |  4 +--
 tests/qemu-iotests/127.out    |  4 +--
 tests/qemu-iotests/129        |  3 ++-
 tests/qemu-iotests/133        |  2 +-
 tests/qemu-iotests/133.out    |  2 +-
 tests/qemu-iotests/139        |  2 +-
 tests/qemu-iotests/141        |  4 +--
 tests/qemu-iotests/141.out    |  4 +--
 tests/qemu-iotests/142        |  2 +-
 tests/qemu-iotests/142.out    |  2 +-
 tests/qemu-iotests/153        | 14 +++++------
 tests/qemu-iotests/153.out    | 35 ++++++++++++++------------
 tests/qemu-iotests/154        | 42 +++++++++++++++----------------
 tests/qemu-iotests/154.out    | 42 +++++++++++++++----------------
 tests/qemu-iotests/155        | 12 ++++++---
 tests/qemu-iotests/156        |  9 ++++---
 tests/qemu-iotests/156.out    |  6 ++---
 tests/qemu-iotests/158        |  2 +-
 tests/qemu-iotests/158.out    |  2 +-
 tests/qemu-iotests/161        |  8 +++---
 tests/qemu-iotests/161.out    |  8 +++---
 tests/qemu-iotests/176        |  4 +--
 tests/qemu-iotests/176.out    | 32 ++++++++++++------------
 tests/qemu-iotests/177        |  2 +-
 tests/qemu-iotests/177.out    |  2 +-
 tests/qemu-iotests/179        |  2 +-
 tests/qemu-iotests/179.out    |  2 +-
 tests/qemu-iotests/189        |  2 +-
 tests/qemu-iotests/189.out    |  2 +-
 tests/qemu-iotests/191        | 12 ++++-----
 tests/qemu-iotests/191.out    | 12 ++++-----
 tests/qemu-iotests/195        |  6 ++---
 tests/qemu-iotests/195.out    |  6 ++---
 tests/qemu-iotests/198        |  2 +-
 tests/qemu-iotests/198.out    |  3 ++-
 tests/qemu-iotests/204        |  2 +-
 tests/qemu-iotests/204.out    |  2 +-
 tests/qemu-iotests/216        |  2 +-
 tests/qemu-iotests/224        |  4 +--
 tests/qemu-iotests/225        |  2 +-
 tests/qemu-iotests/225.out    |  2 +-
 tests/qemu-iotests/228        |  5 ++--
 tests/qemu-iotests/245        |  3 ++-
 tests/qemu-iotests/249        |  4 +--
 tests/qemu-iotests/249.out    |  4 +--
 tests/qemu-iotests/252        |  2 +-
 tests/qemu-iotests/257        |  3 ++-
 tests/qemu-iotests/267        |  4 +--
 tests/qemu-iotests/267.out    |  6 ++---
 tests/qemu-iotests/270        |  2 +-
 tests/qemu-iotests/270.out    |  2 +-
 tests/qemu-iotests/273        |  4 +--
 tests/qemu-iotests/273.out    |  4 +--
 tests/qemu-iotests/279        |  4 +--
 tests/qemu-iotests/279.out    |  4 +--
 127 files changed, 509 insertions(+), 351 deletions(-)

-- 
2.25.1

[PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Eric Blake]

For qcow2 and qed, we want to encourage the use of -F always, as these
formats can suffer from data corruption or security holes if backing
format is probed.  But for other formats, the backing format cannot be
recorded.  Making the user decide on a per-format basis whether to
supply a backing format string is awkward, better is to just blindly
accept a backing format argument even if it is ignored by the
contraints of the format at hand.

Signed-off-by: Eric Blake <eblake@redhat.com>
---
 block/qcow.c     | 6 ++++++
 block/sheepdog.c | 6 ++++++
 block/vmdk.c     | 5 +++++
 3 files changed, 17 insertions(+)

diff --git a/block/qcow.c b/block/qcow.c
index fce89898681f..d05c3d526170 100644
--- a/block/qcow.c
+++ b/block/qcow.c
@@ -947,6 +947,7 @@ static int coroutine_fn qcow_co_create_opts(const char *filename,

     static const QDictRenames opt_renames[] = {
         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
+        { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
         { NULL, NULL },
     };
@@ -1151,6 +1152,11 @@ static QemuOptsList qcow_create_opts = {
             .type = QEMU_OPT_STRING,
             .help = "File name of a base image"
         },
+        {
+            .name = BLOCK_OPT_BACKING_FMT,
+            .type = QEMU_OPT_STRING,
+            .help = "Ignored (use raw backing files with caution)",
+        },
         {
             .name = BLOCK_OPT_ENCRYPT,
             .type = QEMU_OPT_BOOL,
diff --git a/block/sheepdog.c b/block/sheepdog.c
index cfa84338a2d6..248dcf4dfa01 100644
--- a/block/sheepdog.c
+++ b/block/sheepdog.c
@@ -2187,6 +2187,7 @@ static int coroutine_fn sd_co_create_opts(const char *filename, QemuOpts *opts,
     /* Change legacy command line options into QMP ones */
     static const QDictRenames opt_renames[] = {
         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
+        { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
         { BLOCK_OPT_OBJECT_SIZE,        "object-size" },
         { NULL, NULL },
     };
@@ -3189,6 +3190,11 @@ static QemuOptsList sd_create_opts = {
             .type = QEMU_OPT_STRING,
             .help = "File name of a base image"
         },
+        {
+            .name = BLOCK_OPT_BACKING_FMT,
+            .type = QEMU_OPT_STRING,
+            .help = "Ignored (use raw backing files with caution)",
+        },
         {
             .name = BLOCK_OPT_PREALLOC,
             .type = QEMU_OPT_STRING,
diff --git a/block/vmdk.c b/block/vmdk.c
index 20e909d99794..53f3d864f3fe 100644
--- a/block/vmdk.c
+++ b/block/vmdk.c
@@ -3005,6 +3005,11 @@ static QemuOptsList vmdk_create_opts = {
             .type = QEMU_OPT_STRING,
             .help = "File name of a base image"
         },
+        {
+            .name = BLOCK_OPT_BACKING_FMT,
+            .type = QEMU_OPT_STRING,
+            .help = "Ignored (base image must be vmdk format)",
+        },
         {
             .name = BLOCK_OPT_COMPAT6,
             .type = QEMU_OPT_BOOL,
-- 
2.25.1

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Kevin Wolf]

Am 06.03.2020 um 23:51 hat Eric Blake geschrieben:
> For qcow2 and qed, we want to encourage the use of -F always, as these
> formats can suffer from data corruption or security holes if backing
> format is probed.  But for other formats, the backing format cannot be
> recorded.  Making the user decide on a per-format basis whether to
> supply a backing format string is awkward, better is to just blindly
> accept a backing format argument even if it is ignored by the
> contraints of the format at hand.
> 
> Signed-off-by: Eric Blake <eblake@redhat.com>

I'm not sure if I agree with this reasoning. Accepting and silently
ignoring -F could give users a false sense of security. If I specify a
-F raw and QEMU later probes qcow2, that would be very surprising.

Kevin

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Eric Blake]

On 3/9/20 10:21 AM, Kevin Wolf wrote:
> Am 06.03.2020 um 23:51 hat Eric Blake geschrieben:
>> For qcow2 and qed, we want to encourage the use of -F always, as these
>> formats can suffer from data corruption or security holes if backing
>> format is probed.  But for other formats, the backing format cannot be
>> recorded.  Making the user decide on a per-format basis whether to
>> supply a backing format string is awkward, better is to just blindly
>> accept a backing format argument even if it is ignored by the
>> contraints of the format at hand.
>>
>> Signed-off-by: Eric Blake <eblake@redhat.com>
> 
> I'm not sure if I agree with this reasoning. Accepting and silently
> ignoring -F could give users a false sense of security. If I specify a
> -F raw and QEMU later probes qcow2, that would be very surprising.

Do we know what formats qcow, sheepdog, and vmdk expect to probe?  I'm 
wondering if we can compromise by checking that the requested backing 
image has the specified format, and error if it is not, rather than 
completely ignoring it - but at the same time, the image formats have no 
where to record a backing format.

I'm guessing that qcow works with either raw or qcow as backing format 
(and anything else is odd - a qcow2 backing to a qcow is unusual, and 
would be better to reject).  I'm not sure if sheepdog can be backed by 
anything but another sheepdog, similarly, I'm not sure if a vmdk can be 
backed by anything but another vmdk.  If so, it should be simple enough 
to do a v4 of this patch which requires -F to be a known-acceptable 
probe type for these images.

Still, the point of this patch is that I want to add -F into all the 
iotests, and without something along the lines of this patch, all of 
those iotests are broken for these image formats.  Patch 2 is a lot 
harder to write if we have to make our use of -F conditional on the 
image format in question.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Daniel P. Berrangé]

On Mon, Mar 09, 2020 at 10:32:52AM -0500, Eric Blake wrote:
> On 3/9/20 10:21 AM, Kevin Wolf wrote:
> > Am 06.03.2020 um 23:51 hat Eric Blake geschrieben:
> > > For qcow2 and qed, we want to encourage the use of -F always, as these
> > > formats can suffer from data corruption or security holes if backing
> > > format is probed.  But for other formats, the backing format cannot be
> > > recorded.  Making the user decide on a per-format basis whether to
> > > supply a backing format string is awkward, better is to just blindly
> > > accept a backing format argument even if it is ignored by the
> > > contraints of the format at hand.
> > > 
> > > Signed-off-by: Eric Blake <eblake@redhat.com>
> > 
> > I'm not sure if I agree with this reasoning. Accepting and silently
> > ignoring -F could give users a false sense of security. If I specify a
> > -F raw and QEMU later probes qcow2, that would be very surprising.
> 
> Do we know what formats qcow, sheepdog, and vmdk expect to probe?  I'm
> wondering if we can compromise by checking that the requested backing image
> has the specified format, and error if it is not, rather than completely
> ignoring it - but at the same time, the image formats have no where to
> record a backing format.

Consider the user creates an image with "-F raw". We can validate the backing
image is raw, and so our check succeeds.  Later the malicious <something> can
write a qcow header into this raw file and QEMU will thereafter probe the
image as qcow, not raw.

IOW, in the case of "-F raw", even if we immediately check the format, we're
still not offering the protection promised by the "-F" flag, because that
promise refers to the runtime behaviour of the QEMU emulator, not the
immediate qemu-img cmd.

We could support "-F ..." and validate any non-raw formats, while raising a
runtime error in the case of "-F raw", as only the "raw" backing format has
the probing security risk.

Users who need  to use qcow, with a backing file, without a format can
just not pass "-F" and in doing so will be insecure.

We could take this opportunity to deprecate 'qcow' perhaps, declare it
a read-only format, restricted to qemu-img/qemu-io for purpose of data
liberation ?

For sheepdog, if it is something we genuinely still care about, then
adding a backing file format record seems neccessary, unless we either
forbid use of raw backing files, or forbid use of non-raw backing files,
either way would be safe.

> I'm guessing that qcow works with either raw or qcow as backing format (and
> anything else is odd - a qcow2 backing to a qcow is unusual, and would be
> better to reject).  I'm not sure if sheepdog can be backed by anything but
> another sheepdog, similarly, I'm not sure if a vmdk can be backed by
> anything but another vmdk.  If so, it should be simple enough to do a v4 of
> this patch which requires -F to be a known-acceptable probe type for these
> images.
> 
> Still, the point of this patch is that I want to add -F into all the
> iotests, and without something along the lines of this patch, all of those
> iotests are broken for these image formats.  Patch 2 is a lot harder to
> write if we have to make our use of -F conditional on the image format in
> question.
> 
> -- 
> Eric Blake, Principal Software Engineer
> Red Hat, Inc.           +1-919-301-3226
> Virtualization:  qemu.org | libvirt.org
> 

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Eric Blake]

On 3/9/20 10:44 AM, Daniel P. Berrangé wrote:

> Consider the user creates an image with "-F raw". We can validate the backing
> image is raw, and so our check succeeds.  Later the malicious <something> can
> write a qcow header into this raw file and QEMU will thereafter probe the
> image as qcow, not raw.
> 
> IOW, in the case of "-F raw", even if we immediately check the format, we're
> still not offering the protection promised by the "-F" flag, because that
> promise refers to the runtime behaviour of the QEMU emulator, not the
> immediate qemu-img cmd.
> 
> We could support "-F ..." and validate any non-raw formats, while raising a
> runtime error in the case of "-F raw", as only the "raw" backing format has
> the probing security risk.
> 
> Users who need  to use qcow, with a backing file, without a format can
> just not pass "-F" and in doing so will be insecure.

And the warning will remind them of that.

> 
> We could take this opportunity to deprecate 'qcow' perhaps, declare it
> a read-only format, restricted to qemu-img/qemu-io for purpose of data
> liberation ?

I'm fine with that, although it makes for a bigger task.

> 
> For sheepdog, if it is something we genuinely still care about, then
> adding a backing file format record seems neccessary, unless we either
> forbid use of raw backing files, or forbid use of non-raw backing files,
> either way would be safe.

I concur - as long as you either have ONLY non-raw (in which case 
probing is safe), or ONLY raw (in which case no probing is necessary), 
then not recording the backing format is safe.  It is only for formats 
that allow both raw and non-raw backing, but which do not have space in 
the image to document which of the two backing formats is expected, 
where we have problems.

> 
>> I'm guessing that qcow works with either raw or qcow as backing format (and
>> anything else is odd - a qcow2 backing to a qcow is unusual, and would be
>> better to reject).  I'm not sure if sheepdog can be backed by anything but
>> another sheepdog, similarly, I'm not sure if a vmdk can be backed by
>> anything but another vmdk.  If so, it should be simple enough to do a v4 of
>> this patch which requires -F to be a known-acceptable probe type for these
>> images.
>>
>> Still, the point of this patch is that I want to add -F into all the
>> iotests, and without something along the lines of this patch, all of those
>> iotests are broken for these image formats.  Patch 2 is a lot harder to
>> write if we have to make our use of -F conditional on the image format in
>> question.
>>
>> -- 
>> Eric Blake, Principal Software Engineer
>> Red Hat, Inc.           +1-919-301-3226
>> Virtualization:  qemu.org | libvirt.org
>>
> 
> Regards,
> Daniel
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Kevin Wolf]

Am 09.03.2020 um 16:44 hat Daniel P. Berrangé geschrieben:
> We could support "-F ..." and validate any non-raw formats, while raising a
> runtime error in the case of "-F raw", as only the "raw" backing format has
> the probing security risk.
> 
> Users who need  to use qcow, with a backing file, without a format can
> just not pass "-F" and in doing so will be insecure.

Hm, this is actually an interesting option. We wouldn't lose features
compared to today without -F, but we would allow -F when we can verify
that the operation is safe (the image is already non-raw).

> We could take this opportunity to deprecate 'qcow' perhaps, declare it
> a read-only format, restricted to qemu-img/qemu-io for purpose of data
> liberation ?

I'm against making any format read-only because that immediately means
that it becomes untestable.

> For sheepdog, if it is something we genuinely still care about, then
> adding a backing file format record seems neccessary, unless we either
> forbid use of raw backing files, or forbid use of non-raw backing files,
> either way would be safe.

In case of doubt, we can use the same logic as you suggested for qcow
(accept only non-raw with -F, but no restrictions without -F).

Kevin

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Kevin Wolf]

Am 09.03.2020 um 16:32 hat Eric Blake geschrieben:
> On 3/9/20 10:21 AM, Kevin Wolf wrote:
> > Am 06.03.2020 um 23:51 hat Eric Blake geschrieben:
> > > For qcow2 and qed, we want to encourage the use of -F always, as these
> > > formats can suffer from data corruption or security holes if backing
> > > format is probed.  But for other formats, the backing format cannot be
> > > recorded.  Making the user decide on a per-format basis whether to
> > > supply a backing format string is awkward, better is to just blindly
> > > accept a backing format argument even if it is ignored by the
> > > contraints of the format at hand.
> > > 
> > > Signed-off-by: Eric Blake <eblake@redhat.com>
> > 
> > I'm not sure if I agree with this reasoning. Accepting and silently
> > ignoring -F could give users a false sense of security. If I specify a
> > -F raw and QEMU later probes qcow2, that would be very surprising.
> 
> Do we know what formats qcow, sheepdog, and vmdk expect to probe?  I'm
> wondering if we can compromise by checking that the requested backing image
> has the specified format, and error if it is not, rather than completely
> ignoring it - but at the same time, the image formats have no where to
> record a backing format.

The important distinction (and in fact the only one that qed makes) is
raw and non-raw. Problems only arise if a guest can write an image
header to a raw file and get it probed as non-raw when opening the
image the next time. If you start with a non-raw format, at least the
first 512 bytes (which are used for probing) are used for metadata and
not accessible for the guest.

> I'm guessing that qcow works with either raw or qcow as backing format (and
> anything else is odd - a qcow2 backing to a qcow is unusual, and would be
> better to reject).  I'm not sure if sheepdog can be backed by anything but
> another sheepdog, similarly, I'm not sure if a vmdk can be backed by
> anything but another vmdk.

I think vmdk only expects vmdk as backing files, even though QEMU
supports everything else, too. However, this is a format for
compatibility with another hypervisor and you're unlikely to find
QEMU-only VMDK images, so requiring non-raw unconditionally might make
sense.

I have no idea about how backing files in Sheepdog are used in practice.
However, QEMU is a primary target for Sheepdog. It wouldn't surprise me
if it's used for both raw and non-raw.

qcow is definitely used for both, as you already said. Allowing only raw
and qcow and forbidding other formats doesn't improve the situation
because the problem is with supporting raw and non-raw at the same time
and you would still have this.
>
> If so, it should be simple enough to do a v4 of
> this patch which requires -F to be a known-acceptable probe type for these
> images.
> 
> Still, the point of this patch is that I want to add -F into all the
> iotests, and without something along the lines of this patch, all of those
> iotests are broken for these image formats.  Patch 2 is a lot harder to
> write if we have to make our use of -F conditional on the image format in
> question.

Hm... Maybe _make_test_img can insert/filter out -F depending on $IMGFMT?

Kevin

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Eric Blake]

On 3/9/20 10:48 AM, Kevin Wolf wrote:

>> Still, the point of this patch is that I want to add -F into all the
>> iotests, and without something along the lines of this patch, all of those
>> iotests are broken for these image formats.  Patch 2 is a lot harder to
>> write if we have to make our use of -F conditional on the image format in
>> question.
> 
> Hm... Maybe _make_test_img can insert/filter out -F depending on $IMGFMT?

I was hoping to avoid that, but yes, if that's what we have to do... :(

The complication is that even if I filter out -F from the command line 
based on $IMGFMT, then I have conditional output (whether backing_fmt= 
or the warning message is output), which means doubling the number of 
expected output cases, or else adding a multi-line filter which is also 
smart enough based on $IMGFMT to translate a warning on one line into an 
addition of a faked backing_fmt= on the next line.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Daniel P. Berrangé]

On Mon, Mar 09, 2020 at 04:21:12PM +0100, Kevin Wolf wrote:
> Am 06.03.2020 um 23:51 hat Eric Blake geschrieben:
> > For qcow2 and qed, we want to encourage the use of -F always, as these
> > formats can suffer from data corruption or security holes if backing
> > format is probed.  But for other formats, the backing format cannot be
> > recorded.  Making the user decide on a per-format basis whether to
> > supply a backing format string is awkward, better is to just blindly
> > accept a backing format argument even if it is ignored by the
> > contraints of the format at hand.
> > 
> > Signed-off-by: Eric Blake <eblake@redhat.com>
> 
> I'm not sure if I agree with this reasoning. Accepting and silently
> ignoring -F could give users a false sense of security. If I specify a
> -F raw and QEMU later probes qcow2, that would be very surprising.

And if the user specifies "-F raw" and we probe qcow2, and the user
does not realize this, they can become silently reliant on always
probing qcow2. If we then honour the "-F raw" option in a later
QEMU release, we'll break the behaviour they've relied on.

IMHO, we must not accept "-F fmt" unless we're in a position to
honour it.

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

Re: [PATCH v3 1/4] block: Add trivial backing_fmt support to qcow, sheepdog, vmdk

[Eric Blake]

On 3/9/20 10:36 AM, Daniel P. Berrangé wrote:
> On Mon, Mar 09, 2020 at 04:21:12PM +0100, Kevin Wolf wrote:
>> Am 06.03.2020 um 23:51 hat Eric Blake geschrieben:
>>> For qcow2 and qed, we want to encourage the use of -F always, as these
>>> formats can suffer from data corruption or security holes if backing
>>> format is probed.  But for other formats, the backing format cannot be
>>> recorded.  Making the user decide on a per-format basis whether to
>>> supply a backing format string is awkward, better is to just blindly
>>> accept a backing format argument even if it is ignored by the
>>> contraints of the format at hand.
>>>
>>> Signed-off-by: Eric Blake <eblake@redhat.com>
>>
>> I'm not sure if I agree with this reasoning. Accepting and silently
>> ignoring -F could give users a false sense of security. If I specify a
>> -F raw and QEMU later probes qcow2, that would be very surprising.
> 
> And if the user specifies "-F raw" and we probe qcow2, and the user
> does not realize this, they can become silently reliant on always
> probing qcow2. If we then honour the "-F raw" option in a later
> QEMU release, we'll break the behaviour they've relied on.
> 
> IMHO, we must not accept "-F fmt" unless we're in a position to
> honour it.

So I'm thinking:

qemu-img create -f qcow -b backing.qcow -F qcow img.qcow   => okay

qemu-img create -f qcow -b backing.raw -F raw img.qcow   => okay, 
slightly risky (if backing.raw is ever changed to be non-raw), but then 
again, backing files tend to be read-only (do we even support commit on 
qcow images, or do we limit that to qcow2?)

qemu-img create -f qcow -b backing.qcow -F raw img.qcow   => fails, due 
to mismatch

qemu-img create -u -f qcow -b anything -F anything img.qcow $size  => 
fails: we can't write -F into the image, nor can we open anything to 
probe its type to check that -F was correct

qemu-img create -f qcow -b backing.qcow img.qcow   => warns, but okay 
(we did not get -F, but the probe works out)

qemu-img create -f qcow -b backing.raw img.qcow    => likewise warns

qemu-img create -f qcow -b backing.qcow2 img.qcow   => error; new qcow 
images (which you should avoid where possible anyways) must be backed by 
only raw or qcow, going forward

Other scenarios?  Do the above ideas look reasonable?

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

[PATCH v3 2/4] iotests: Specify explicit backing format where sensible

[Eric Blake]

There are many existing qcow2 images that specify a backing file but
no format.  This has been the source of CVEs in the past, but has
become more prominent of a problem now that libvirt has switched to
-blockdev.  With older -drive, at least the probing was always done by
qemu (so the only risk of a changed format between successive boots of
a guest was if qemu was upgraded and probed differently).  But with
newer -blockdev, libvirt must specify a format; if libvirt guesses raw
where the image was formatted, this results in data corruption visible
to the guest; conversely, if libvirt guesses qcow2 where qemu was
using raw, this can result in potential security holes, so modern
libvirt instead refuses to use images without explicit backing format.

The change in libvirt to reject images without explicit backing format
has pointed out that a number of tools have been far too reliant on
probing in the past.  It's time to set a better example in our own
iotests of properly setting this parameter.

iotest calls to create, rebase, convert, and amend are all impacted to
some degree.  It's a bit annoying that we are inconsistent on command
line - while all of those accept -o backing_file=...,backing_fmt=...,
the shortcuts are different: create and rebase have -b and -F, convert
has -B but no -F, and amend has no shortcuts.

Signed-off-by: Eric Blake <eblake@redhat.com>
---
 tests/qemu-iotests/017        |  2 +-
 tests/qemu-iotests/017.out    |  2 +-
 tests/qemu-iotests/018        |  2 +-
 tests/qemu-iotests/018.out    |  2 +-
 tests/qemu-iotests/019        |  5 ++--
 tests/qemu-iotests/019.out    |  2 +-
 tests/qemu-iotests/020        |  4 +--
 tests/qemu-iotests/020.out    |  4 +--
 tests/qemu-iotests/024        |  8 +++---
 tests/qemu-iotests/024.out    |  5 ++--
 tests/qemu-iotests/028        |  4 +--
 tests/qemu-iotests/028.out    |  2 +-
 tests/qemu-iotests/030        | 26 +++++++++++++------
 tests/qemu-iotests/034        |  2 +-
 tests/qemu-iotests/034.out    |  2 +-
 tests/qemu-iotests/037        |  2 +-
 tests/qemu-iotests/037.out    |  2 +-
 tests/qemu-iotests/038        |  2 +-
 tests/qemu-iotests/038.out    |  2 +-
 tests/qemu-iotests/039        |  3 ++-
 tests/qemu-iotests/039.out    |  2 +-
 tests/qemu-iotests/040        | 47 +++++++++++++++++++++++++----------
 tests/qemu-iotests/041        | 37 ++++++++++++++++++---------
 tests/qemu-iotests/042        |  4 +--
 tests/qemu-iotests/043        | 18 +++++++-------
 tests/qemu-iotests/043.out    | 16 +++++++-----
 tests/qemu-iotests/046        |  2 +-
 tests/qemu-iotests/046.out    |  2 +-
 tests/qemu-iotests/050        |  4 +--
 tests/qemu-iotests/050.out    |  2 +-
 tests/qemu-iotests/051        |  2 +-
 tests/qemu-iotests/051.out    |  2 +-
 tests/qemu-iotests/051.pc.out |  2 +-
 tests/qemu-iotests/056        |  3 ++-
 tests/qemu-iotests/060        |  2 +-
 tests/qemu-iotests/060.out    |  2 +-
 tests/qemu-iotests/061        | 10 ++++----
 tests/qemu-iotests/061.out    | 10 ++++----
 tests/qemu-iotests/069        |  2 +-
 tests/qemu-iotests/069.out    |  2 +-
 tests/qemu-iotests/073        |  2 +-
 tests/qemu-iotests/073.out    |  2 +-
 tests/qemu-iotests/082        | 16 +++++++-----
 tests/qemu-iotests/082.out    | 16 ++++++------
 tests/qemu-iotests/085        |  4 +--
 tests/qemu-iotests/085.out    |  6 ++---
 tests/qemu-iotests/089        |  2 +-
 tests/qemu-iotests/089.out    |  2 +-
 tests/qemu-iotests/095        |  4 +--
 tests/qemu-iotests/095.out    |  4 +--
 tests/qemu-iotests/097        |  4 +--
 tests/qemu-iotests/097.out    | 16 ++++++------
 tests/qemu-iotests/098        |  2 +-
 tests/qemu-iotests/098.out    |  8 +++---
 tests/qemu-iotests/110        |  4 +--
 tests/qemu-iotests/110.out    |  4 +--
 tests/qemu-iotests/122        | 27 ++++++++++++--------
 tests/qemu-iotests/122.out    |  8 +++---
 tests/qemu-iotests/126        |  4 +--
 tests/qemu-iotests/126.out    |  4 +--
 tests/qemu-iotests/127        |  4 +--
 tests/qemu-iotests/127.out    |  4 +--
 tests/qemu-iotests/129        |  3 ++-
 tests/qemu-iotests/133        |  2 +-
 tests/qemu-iotests/133.out    |  2 +-
 tests/qemu-iotests/139        |  2 +-
 tests/qemu-iotests/141        |  4 +--
 tests/qemu-iotests/141.out    |  4 +--
 tests/qemu-iotests/142        |  2 +-
 tests/qemu-iotests/142.out    |  2 +-
 tests/qemu-iotests/153        | 14 +++++------
 tests/qemu-iotests/153.out    | 35 ++++++++++++++------------
 tests/qemu-iotests/154        | 42 +++++++++++++++----------------
 tests/qemu-iotests/154.out    | 42 +++++++++++++++----------------
 tests/qemu-iotests/155        | 12 ++++++---
 tests/qemu-iotests/156        |  9 ++++---
 tests/qemu-iotests/156.out    |  6 ++---
 tests/qemu-iotests/158        |  2 +-
 tests/qemu-iotests/158.out    |  2 +-
 tests/qemu-iotests/161        |  8 +++---
 tests/qemu-iotests/161.out    |  8 +++---
 tests/qemu-iotests/176        |  4 +--
 tests/qemu-iotests/176.out    | 32 ++++++++++++------------
 tests/qemu-iotests/177        |  2 +-
 tests/qemu-iotests/177.out    |  2 +-
 tests/qemu-iotests/179        |  2 +-
 tests/qemu-iotests/179.out    |  2 +-
 tests/qemu-iotests/189        |  2 +-
 tests/qemu-iotests/189.out    |  2 +-
 tests/qemu-iotests/191        | 12 ++++-----
 tests/qemu-iotests/191.out    | 12 ++++-----
 tests/qemu-iotests/195        |  6 ++---
 tests/qemu-iotests/195.out    |  6 ++---
 tests/qemu-iotests/198        |  2 +-
 tests/qemu-iotests/198.out    |  3 ++-
 tests/qemu-iotests/204        |  2 +-
 tests/qemu-iotests/204.out    |  2 +-
 tests/qemu-iotests/216        |  2 +-
 tests/qemu-iotests/224        |  4 +--
 tests/qemu-iotests/225        |  2 +-
 tests/qemu-iotests/225.out    |  2 +-
 tests/qemu-iotests/228        |  5 ++--
 tests/qemu-iotests/245        |  3 ++-
 tests/qemu-iotests/249        |  4 +--
 tests/qemu-iotests/249.out    |  4 +--
 tests/qemu-iotests/252        |  2 +-
 tests/qemu-iotests/257        |  3 ++-
 tests/qemu-iotests/267        |  4 +--
 tests/qemu-iotests/267.out    |  6 ++---
 tests/qemu-iotests/270        |  2 +-
 tests/qemu-iotests/270.out    |  2 +-
 tests/qemu-iotests/273        |  4 +--
 tests/qemu-iotests/273.out    |  4 +--
 tests/qemu-iotests/279        |  4 +--
 tests/qemu-iotests/279.out    |  4 +--
 115 files changed, 416 insertions(+), 340 deletions(-)

diff --git a/tests/qemu-iotests/017 b/tests/qemu-iotests/017
index 0a4b854e6520..585512bb296b 100755
--- a/tests/qemu-iotests/017
+++ b/tests/qemu-iotests/017
@@ -66,7 +66,7 @@ echo "Creating test image with backing file"
 echo

 TEST_IMG=$TEST_IMG_SAVE
-_make_test_img -b "$TEST_IMG.base" 6G
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 6G

 echo "Filling test image"
 echo
diff --git a/tests/qemu-iotests/017.out b/tests/qemu-iotests/017.out
index 8fc9241942e8..f439d3ece3a7 100644
--- a/tests/qemu-iotests/017.out
+++ b/tests/qemu-iotests/017.out
@@ -269,7 +269,7 @@ wrote 65536/65536 bytes at offset 4295032832
 No errors were found on the image.
 Creating test image with backing file

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Filling test image

 === IO: pattern 1
diff --git a/tests/qemu-iotests/018 b/tests/qemu-iotests/018
index c69ce0920920..191b461a4d29 100755
--- a/tests/qemu-iotests/018
+++ b/tests/qemu-iotests/018
@@ -66,7 +66,7 @@ echo "Creating test image with backing file"
 echo

 TEST_IMG="$TEST_IMG_SAVE.orig"
-_make_test_img -b "$TEST_IMG_SAVE.base" 6G
+_make_test_img -b "$TEST_IMG_SAVE.base" -F $IMGFMT 6G

 echo "Filling test image"
 echo
diff --git a/tests/qemu-iotests/018.out b/tests/qemu-iotests/018.out
index 5df966727f98..0ab664ca4b4c 100644
--- a/tests/qemu-iotests/018.out
+++ b/tests/qemu-iotests/018.out
@@ -269,7 +269,7 @@ wrote 65536/65536 bytes at offset 4295032832
 No errors were found on the image.
 Creating test image with backing file

-Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Filling test image

 === IO: pattern 1
diff --git a/tests/qemu-iotests/019 b/tests/qemu-iotests/019
index 813a84acac47..d3c11256dc0f 100755
--- a/tests/qemu-iotests/019
+++ b/tests/qemu-iotests/019
@@ -74,7 +74,7 @@ echo "Creating test image with backing file"
 echo

 TEST_IMG="$TEST_IMG_SAVE.orig"
-_make_test_img -b "$TEST_IMG_SAVE.base" 6G
+_make_test_img -b "$TEST_IMG_SAVE.base" -F $IMGFMT 6G

 echo "Filling test image"
 echo
@@ -98,7 +98,8 @@ for backing_option in "-B " "-o backing_file="; do
     echo
     echo Testing conversion with $backing_option"$TEST_IMG.base" | _filter_testdir | _filter_imgfmt
     echo
-    $QEMU_IMG convert -f $IMGFMT -O $IMGFMT $backing_option"$TEST_IMG.base" "$TEST_IMG.orig" "$TEST_IMG"
+    $QEMU_IMG convert -f $IMGFMT -O $IMGFMT $backing_option"$TEST_IMG.base" \
+        -o backing_fmt=$IMGFMT "$TEST_IMG.orig" "$TEST_IMG"

     echo "Checking if backing clusters are allocated when they shouldn't"
     echo
diff --git a/tests/qemu-iotests/019.out b/tests/qemu-iotests/019.out
index 17a7c036b989..0fa73bd69ab8 100644
--- a/tests/qemu-iotests/019.out
+++ b/tests/qemu-iotests/019.out
@@ -269,7 +269,7 @@ wrote 65536/65536 bytes at offset 4296015872
 No errors were found on the image.
 Creating test image with backing file

-Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT.orig', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Filling test image

 === IO: pattern 43
diff --git a/tests/qemu-iotests/020 b/tests/qemu-iotests/020
index 20f8f185d071..f90f133f1262 100755
--- a/tests/qemu-iotests/020
+++ b/tests/qemu-iotests/020
@@ -70,7 +70,7 @@ echo "Creating test image with backing file"
 echo

 TEST_IMG="$TEST_IMG_SAVE"
-_make_test_img -b "$TEST_IMG.base" 6G
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 6G

 echo "Filling test image"
 echo
@@ -126,7 +126,7 @@ _make_test_img -b "json:{'driver': '$IMGFMT',
                              'image': {
                                  'driver': 'file',
                                  'filename': '$TEST_IMG.base'
-                             }}}"
+                             }}}" -F $IMGFMT

 # Just write anything so committing will not be a no-op
 $QEMU_IO -c 'writev 0 64k' "$TEST_IMG" | _filter_qemu_io
diff --git a/tests/qemu-iotests/020.out b/tests/qemu-iotests/020.out
index 4b722b2dd022..8c0bf238b297 100644
--- a/tests/qemu-iotests/020.out
+++ b/tests/qemu-iotests/020.out
@@ -269,7 +269,7 @@ wrote 65536/65536 bytes at offset 4295032832
 No errors were found on the image.
 Creating test image with backing file

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Filling test image

 === IO: pattern 1
@@ -1090,7 +1090,7 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=json:{'driv
                              'image': {
                                  'driver': 'file',,
                                  'filename': 'TEST_DIR/t.IMGFMT.base'
-                             }}}
+                             }}} backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qemu-img: Block job failed: No space left on device
diff --git a/tests/qemu-iotests/024 b/tests/qemu-iotests/024
index e2e766241e1a..3c5d57310e94 100755
--- a/tests/qemu-iotests/024
+++ b/tests/qemu-iotests/024
@@ -83,7 +83,7 @@ TEST_IMG="$TEST_IMG_SAVE"
 echo "Creating COW image"
 echo

-_make_test_img -b "$TEST_IMG.base_old" 1G
+_make_test_img -b "$TEST_IMG.base_old" -F $IMGFMT 1G
 io_pattern writev 0 $((4 * CLUSTER_SIZE)) 0 1 0x33
 io_pattern writev $((8 * CLUSTER_SIZE)) $((4 * CLUSTER_SIZE)) 0 1 0x33

@@ -109,7 +109,7 @@ io_pattern readv $((15 * CLUSTER_SIZE)) $CLUSTER_SIZE 0 1 0x00
 echo
 echo Rebase and test again
 echo
-$QEMU_IMG rebase -b "$TEST_IMG.base_new" "$TEST_IMG"
+$QEMU_IMG rebase -b "$TEST_IMG.base_new" -F $IMGFMT "$TEST_IMG"
 io_pattern readv $((0 * CLUSTER_SIZE)) $CLUSTER_SIZE 0 1 0x33
 io_pattern readv $((1 * CLUSTER_SIZE)) $CLUSTER_SIZE 0 1 0x33
 io_pattern readv $((2 * CLUSTER_SIZE)) $CLUSTER_SIZE 0 1 0x33
@@ -159,7 +159,7 @@ OVERLAY="$TEST_DIR/$OVERLAY_WREL"

 TEST_IMG=$BASE_OLD _make_test_img 1M
 TEST_IMG=$BASE_NEW _make_test_img 1M
-TEST_IMG=$OVERLAY _make_test_img -b "$BASE_OLD_OREL" 1M
+TEST_IMG=$OVERLAY _make_test_img -b "$BASE_OLD_OREL" -F $IMGFMT 1M

 echo

@@ -176,7 +176,7 @@ $QEMU_IO "$BASE_NEW" \
 echo

 pushd "$TEST_DIR" >/dev/null
-$QEMU_IMG rebase -f "$IMGFMT" -b "$BASE_NEW_OREL" "$OVERLAY_WREL"
+$QEMU_IMG rebase -f "$IMGFMT" -b "$BASE_NEW_OREL" -F $IMGFMT "$OVERLAY_WREL"
 popd >/dev/null

 # Verify the backing path is correct
diff --git a/tests/qemu-iotests/024.out b/tests/qemu-iotests/024.out
index 024dc786b3c4..f4fd77fd5b4d 100644
--- a/tests/qemu-iotests/024.out
+++ b/tests/qemu-iotests/024.out
@@ -33,7 +33,7 @@ wrote 131072/131072 bytes at offset 786432
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 Creating COW image

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 backing_file=TEST_DIR/t.IMGFMT.base_old
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 backing_file=TEST_DIR/t.IMGFMT.base_old backing_fmt=IMGFMT
 === IO: pattern 0x33
 wrote 262144/262144 bytes at offset 0
 256 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
@@ -146,7 +146,7 @@ read 65536/65536 bytes at offset 983040

 Formatting 'TEST_DIR/subdir/t.IMGFMT.base_old', fmt=IMGFMT size=1048576
 Formatting 'TEST_DIR/subdir/t.IMGFMT.base_new', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/subdir/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=t.IMGFMT.base_old
+Formatting 'TEST_DIR/subdir/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=t.IMGFMT.base_old backing_fmt=IMGFMT

 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
@@ -158,6 +158,7 @@ wrote 65536/65536 bytes at offset 196608
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

 backing file: t.IMGFMT.base_new (actual path: TEST_DIR/subdir/t.IMGFMT.base_new)
+backing file format: IMGFMT

 read 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
diff --git a/tests/qemu-iotests/028 b/tests/qemu-iotests/028
index 797dae535042..5d043cef9289 100755
--- a/tests/qemu-iotests/028
+++ b/tests/qemu-iotests/028
@@ -76,7 +76,7 @@ echo "Creating test image with backing file"
 echo

 TEST_IMG="$TEST_IMG_SAVE"
-_make_test_img -b "$TEST_IMG.base" $image_size
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $image_size

 echo "Filling test image"
 echo
@@ -101,7 +101,7 @@ io_zero readv $(( offset + 32 * 1024 )) 512 1024 32
 _check_test_img

 # Rebase it on top of its base image
-$QEMU_IMG rebase -b "$TEST_IMG.base" "$TEST_IMG"
+$QEMU_IMG rebase -b "$TEST_IMG.base" -F $IMGFMT "$TEST_IMG"

 echo
 echo block-backup
diff --git a/tests/qemu-iotests/028.out b/tests/qemu-iotests/028.out
index 37aed8443628..12f82c6a6c39 100644
--- a/tests/qemu-iotests/028.out
+++ b/tests/qemu-iotests/028.out
@@ -70,7 +70,7 @@ wrote 512/512 bytes at offset 3221225984
 No errors were found on the image.
 Creating test image with backing file

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294968832 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294968832 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Filling test image

 === IO: pattern 196
diff --git a/tests/qemu-iotests/030 b/tests/qemu-iotests/030
index aa911d266a13..322e31e2cd93 100755
--- a/tests/qemu-iotests/030
+++ b/tests/qemu-iotests/030
@@ -32,8 +32,12 @@ class TestSingleDrive(iotests.QMPTestCase):

     def setUp(self):
         iotests.create_image(backing_img, TestSingleDrive.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, mid_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % mid_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img,
+                 '-F', 'raw', mid_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % mid_img,
+                 '-F', iotests.imgfmt, test_img)
         qemu_io('-f', 'raw', '-c', 'write -P 0x1 0 512', backing_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0x1 524288 512', mid_img)
         self.vm = iotests.VM().add_drive("blkdebug::" + test_img,
@@ -199,7 +203,8 @@ class TestParallelOps(iotests.QMPTestCase):
         iotests.create_image(self.imgs[0], self.image_len)
         for i in range(1, self.num_imgs):
             qemu_img('create', '-f', iotests.imgfmt,
-                     '-o', 'backing_file=%s' % self.imgs[i-1], self.imgs[i])
+                     '-o', 'backing_file=%s' % self.imgs[i-1],
+                     '-F', 'raw' if i == 1 else iotests.imgfmt, self.imgs[i])

         # Put data into the images we are copying data from
         odd_img_indexes = [x for x in reversed(range(self.num_imgs)) if x % 2 == 1]
@@ -544,7 +549,8 @@ class TestQuorum(iotests.QMPTestCase):
             qemu_io('-f', iotests.imgfmt,
                     '-c', 'write -P 0x55 0 1024', backing_img)
             qemu_img('create', '-f', iotests.imgfmt,
-                     '-o', 'backing_file=%s' % backing_img, child_img)
+                     '-o', 'backing_file=%s' % backing_img,
+                     '-F', iotests.imgfmt, child_img)
             opts.append("children.%d.file.filename=%s" % (i, child_img))
             opts.append("children.%d.node-name=node%d" % (i, i))

@@ -585,7 +591,9 @@ class TestSmallerBackingFile(iotests.QMPTestCase):

     def setUp(self):
         iotests.create_image(backing_img, self.backing_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img, str(self.image_len))
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img,
+                 '-F', 'raw', test_img, str(self.image_len))
         self.vm = iotests.VM().add_drive(test_img)
         self.vm.launch()

@@ -848,7 +856,9 @@ class TestStreamStop(iotests.QMPTestCase):
     def setUp(self):
         qemu_img('create', backing_img, str(TestStreamStop.image_len))
         qemu_io('-f', 'raw', '-c', 'write -P 0x1 0 32M', backing_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img,
+                 '-F', 'raw', test_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0x1 32M 32M', test_img)
         self.vm = iotests.VM().add_drive("blkdebug::" + test_img)
         self.vm.launch()
@@ -879,7 +889,9 @@ class TestSetSpeed(iotests.QMPTestCase):
     def setUp(self):
         qemu_img('create', backing_img, str(TestSetSpeed.image_len))
         qemu_io('-f', 'raw', '-c', 'write -P 0x1 0 32M', backing_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img,
+                 '-F', 'raw', test_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0x1 32M 32M', test_img)
         self.vm = iotests.VM().add_drive('blkdebug::' + test_img)
         self.vm.launch()
diff --git a/tests/qemu-iotests/034 b/tests/qemu-iotests/034
index da4cea1571e4..ac2d687c71da 100755
--- a/tests/qemu-iotests/034
+++ b/tests/qemu-iotests/034
@@ -58,7 +58,7 @@ $QEMU_IO -c "write -P 0x55 0 1M" "$TEST_IMG" | _filter_qemu_io

 TEST_IMG="$TEST_IMG_SAVE"

-_make_test_img -b "$TEST_IMG.base" 6G
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 6G

 echo
 echo "== zero write with backing file =="
diff --git a/tests/qemu-iotests/034.out b/tests/qemu-iotests/034.out
index 0764ead8b95d..478205ad2542 100644
--- a/tests/qemu-iotests/034.out
+++ b/tests/qemu-iotests/034.out
@@ -4,7 +4,7 @@ QA output created by 034
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
 wrote 1048576/1048576 bytes at offset 0
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == zero write with backing file ==
 wrote 196608/196608 bytes at offset 65536
diff --git a/tests/qemu-iotests/037 b/tests/qemu-iotests/037
index e6517acbd4cd..e1187ac24a0b 100755
--- a/tests/qemu-iotests/037
+++ b/tests/qemu-iotests/037
@@ -74,7 +74,7 @@ backing_io 0 256 write | $QEMU_IO "$TEST_IMG" | _filter_qemu_io

 TEST_IMG="$TEST_IMG_SAVE"

-_make_test_img -b "$TEST_IMG.base" 6G
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 6G

 echo
 echo "== COW in a single cluster =="
diff --git a/tests/qemu-iotests/037.out b/tests/qemu-iotests/037.out
index cd6710c90160..30ef989b64d6 100644
--- a/tests/qemu-iotests/037.out
+++ b/tests/qemu-iotests/037.out
@@ -514,7 +514,7 @@ wrote 512/512 bytes at offset 130048
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 512/512 bytes at offset 130560
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == COW in a single cluster ==
 wrote 2048/2048 bytes at offset 0
diff --git a/tests/qemu-iotests/038 b/tests/qemu-iotests/038
index 707e2d72e92d..a253231f5baf 100755
--- a/tests/qemu-iotests/038
+++ b/tests/qemu-iotests/038
@@ -71,7 +71,7 @@ backing_io 0 256 write | $QEMU_IO "$TEST_IMG" | _filter_qemu_io

 TEST_IMG="$TEST_IMG_SAVE"

-_make_test_img -b "$TEST_IMG.base" 6G
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 6G

 echo
 echo "== Some concurrent requests touching the same cluster =="
diff --git a/tests/qemu-iotests/038.out b/tests/qemu-iotests/038.out
index 0bdfb19faa63..fe2108593ae6 100644
--- a/tests/qemu-iotests/038.out
+++ b/tests/qemu-iotests/038.out
@@ -514,7 +514,7 @@ wrote 65536/65536 bytes at offset 16646144
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 16711680
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == Some concurrent requests touching the same cluster ==
 wrote 65536/65536 bytes at offset XXX
diff --git a/tests/qemu-iotests/039 b/tests/qemu-iotests/039
index ddce48ab4752..42f65031383a 100755
--- a/tests/qemu-iotests/039
+++ b/tests/qemu-iotests/039
@@ -133,7 +133,8 @@ echo "== Committing to a backing file with lazy_refcounts=on =="

 TEST_IMG="$TEST_IMG".base _make_test_img -o "compat=1.1,lazy_refcounts=on" $size

-_make_test_img -o "compat=1.1,lazy_refcounts=on,backing_file=$TEST_IMG.base" $size
+_make_test_img -o "compat=1.1,lazy_refcounts=on,backing_file=$TEST_IMG.base" \
+    -F $IMGFMT $size

 $QEMU_IO -c "write 0 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG commit "$TEST_IMG"
diff --git a/tests/qemu-iotests/039.out b/tests/qemu-iotests/039.out
index bdafa3ace360..e52484d4be1b 100644
--- a/tests/qemu-iotests/039.out
+++ b/tests/qemu-iotests/039.out
@@ -66,7 +66,7 @@ No errors were found on the image.

 == Committing to a backing file with lazy_refcounts=on ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 Image committed.
diff --git a/tests/qemu-iotests/040 b/tests/qemu-iotests/040
index 32c82b4ec68a..f58f50d023e6 100755
--- a/tests/qemu-iotests/040
+++ b/tests/qemu-iotests/040
@@ -80,8 +80,11 @@ class TestSingleDrive(ImageCommitTestCase):

     def setUp(self):
         iotests.create_image(backing_img, self.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, mid_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % mid_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', mid_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % mid_img,
+                 '-F', iotests.imgfmt, test_img)
         qemu_io('-f', 'raw', '-c', 'write -P 0xab 0 524288', backing_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xef 524288 524288', mid_img)
         self.vm = iotests.VM().add_drive(test_img, "node-name=top,backing.node-name=mid,backing.backing.node-name=base", interface="none")
@@ -305,10 +308,16 @@ class TestRelativePaths(ImageCommitTestCase):
             if exception.errno != errno.EEXIST:
                 raise
         iotests.create_image(self.backing_img_abs, TestRelativePaths.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % self.backing_img_abs, self.mid_img_abs)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % self.mid_img_abs, self.test_img)
-        qemu_img('rebase', '-u', '-b', self.backing_img, self.mid_img_abs)
-        qemu_img('rebase', '-u', '-b', self.mid_img, self.test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % self.backing_img_abs,
+                 '-F', 'raw', self.mid_img_abs)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % self.mid_img_abs,
+                 '-F', iotests.imgfmt, self.test_img)
+        qemu_img('rebase', '-u', '-b', self.backing_img,
+                 '-F', 'raw', self.mid_img_abs)
+        qemu_img('rebase', '-u', '-b', self.mid_img,
+                 '-F', iotests.imgfmt, self.test_img)
         qemu_io('-f', 'raw', '-c', 'write -P 0xab 0 524288', self.backing_img_abs)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xef 524288 524288', self.mid_img_abs)
         self.vm = iotests.VM().add_drive(self.test_img)
@@ -371,8 +380,11 @@ class TestSetSpeed(ImageCommitTestCase):

     def setUp(self):
         qemu_img('create', backing_img, str(TestSetSpeed.image_len))
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, mid_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % mid_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', mid_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % mid_img,
+                 '-F', iotests.imgfmt, test_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0x1 0 512', test_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xef 524288 524288', mid_img)
         self.vm = iotests.VM().add_drive('blkdebug::' + test_img)
@@ -410,9 +422,14 @@ class TestReopenOverlay(ImageCommitTestCase):

     def setUp(self):
         iotests.create_image(self.img0, self.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % self.img0, self.img1)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % self.img1, self.img2)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % self.img2, self.img3)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % self.img0, '-F', 'raw', self.img1)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % self.img1,
+                 '-F', iotests.imgfmt, self.img2)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % self.img2,
+                 '-F', iotests.imgfmt, self.img3)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xab 0 128K', self.img1)
         self.vm = iotests.VM().add_drive(self.img3)
         self.vm.launch()
@@ -435,8 +452,12 @@ class TestErrorHandling(iotests.QMPTestCase):

     def setUp(self):
         iotests.create_image(backing_img, self.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, mid_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % mid_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img,
+                 '-F', 'raw', mid_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % mid_img,
+                 '-F', iotests.imgfmt, test_img)

         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0x11 0 512k', mid_img)
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0x22 0 512k', test_img)
diff --git a/tests/qemu-iotests/041 b/tests/qemu-iotests/041
index 5d67bf14bfe8..547d75cc491a 100755
--- a/tests/qemu-iotests/041
+++ b/tests/qemu-iotests/041
@@ -44,7 +44,8 @@ class TestSingleDrive(iotests.QMPTestCase):

     def setUp(self):
         iotests.create_image(backing_img, self.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', test_img)
         self.vm = iotests.VM().add_drive(test_img, "node-name=top,backing.node-name=base")
         if iotests.qemu_default_machine == 'pc':
             self.vm.add_drive(None, 'media=cdrom', 'ide')
@@ -157,7 +158,8 @@ class TestSingleDrive(iotests.QMPTestCase):
         self.assert_no_active_block_jobs()

         qemu_img('create', '-f', iotests.imgfmt, '-o', 'cluster_size=%d,backing_file=%s'
-                        % (self.image_len, backing_img), target_img)
+                        % (self.image_len, backing_img),
+                 '-F', 'raw', target_img)
         result = self.vm.qmp(self.qmp_cmd, device='drive0', sync='full',
                              mode='existing', target=self.qmp_target)
         self.assert_qmp(result, 'return', {})
@@ -227,7 +229,8 @@ class TestSingleBlockdev(TestSingleDrive):

     def setUp(self):
         TestSingleDrive.setUp(self)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, target_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', target_img)
         args = {'driver': iotests.imgfmt,
                 'node-name': self.qmp_target,
                 'file': { 'filename': target_img, 'driver': 'file' } }
@@ -265,7 +268,8 @@ class TestMirrorNoBacking(iotests.QMPTestCase):

     def setUp(self):
         iotests.create_image(backing_img, TestMirrorNoBacking.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', test_img)
         self.vm = iotests.VM().add_drive(test_img)
         self.vm.launch()

@@ -282,7 +286,8 @@ class TestMirrorNoBacking(iotests.QMPTestCase):
     def test_complete(self):
         self.assert_no_active_block_jobs()

-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, target_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', target_img)
         result = self.vm.qmp('drive-mirror', device='drive0', sync='full',
                              mode='existing', target=target_img)
         self.assert_qmp(result, 'return', {})
@@ -297,7 +302,8 @@ class TestMirrorNoBacking(iotests.QMPTestCase):
     def test_cancel(self):
         self.assert_no_active_block_jobs()

-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, target_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', target_img)
         result = self.vm.qmp('drive-mirror', device='drive0', sync='full',
                              mode='existing', target=target_img)
         self.assert_qmp(result, 'return', {})
@@ -316,7 +322,8 @@ class TestMirrorNoBacking(iotests.QMPTestCase):
         qemu_img('create', '-f', iotests.imgfmt, '-o', 'size=%d'
                         %(TestMirrorNoBacking.image_len), target_backing_img)
         qemu_img('create', '-f', iotests.imgfmt, '-o', 'cluster_size=%d,backing_file=%s'
-                        % (TestMirrorNoBacking.image_len, target_backing_img), target_img)
+                        % (TestMirrorNoBacking.image_len, target_backing_img),
+                 '-F', iotests.imgfmt, target_img)

         result = self.vm.qmp('drive-mirror', device='drive0', sync='full',
                              mode='existing', target=target_img)
@@ -335,7 +342,8 @@ class TestMirrorResized(iotests.QMPTestCase):

     def setUp(self):
         iotests.create_image(backing_img, TestMirrorResized.backing_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', test_img)
         qemu_img('resize', test_img, '2M')
         self.vm = iotests.VM().add_drive(test_img)
         self.vm.launch()
@@ -481,7 +489,9 @@ new_state = "1"
         # Test COW into the target image.  The first half of the
         # cluster at MIRROR_GRANULARITY has to be copied from
         # backing_img, even though sync='top'.
-        qemu_img('create', '-f', iotests.imgfmt, '-ocluster_size=131072,backing_file=%s' %(backing_img), target_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-ocluster_size=131072,backing_file=%s' %(backing_img),
+                 '-F', 'raw', target_img)
         result = self.vm.qmp('drive-mirror', device='drive0', sync='top',
                              on_source_error='ignore',
                              mode='existing', target=target_img)
@@ -501,7 +511,8 @@ new_state = "1"
         self.vm.shutdown()

         # Detach blkdebug to compare images successfully
-        qemu_img('rebase', '-f', iotests.imgfmt, '-u', '-b', backing_img, test_img)
+        qemu_img('rebase', '-f', iotests.imgfmt, '-u', '-b', backing_img,
+                 '-F', 'raw', test_img)
         self.assertTrue(iotests.compare_images(test_img, target_img),
                         'target image does not match source after mirroring')

@@ -573,7 +584,8 @@ new_state = "1"
         self.blkdebug_file = target_img + ".blkdebug"
         iotests.create_image(backing_img, TestWriteErrors.image_len)
         self.create_blkdebug_file(self.blkdebug_file, "write_aio", 5)
-        qemu_img('create', '-f', iotests.imgfmt, '-obacking_file=%s' %(backing_img), test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-obacking_file=%s' %(backing_img), '-F', 'raw', test_img)
         self.vm = iotests.VM().add_drive(test_img)
         self.target_img = 'blkdebug:%s:%s' % (self.blkdebug_file, target_img)
         qemu_img('create', '-f', iotests.imgfmt, '-osize=%d' %(TestWriteErrors.image_len), target_img)
@@ -668,7 +680,8 @@ class TestSetSpeed(iotests.QMPTestCase):

     def setUp(self):
         qemu_img('create', backing_img, str(TestSetSpeed.image_len))
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', test_img)
         self.vm = iotests.VM().add_drive(test_img)
         self.vm.launch()

diff --git a/tests/qemu-iotests/042 b/tests/qemu-iotests/042
index 0e85b356b76a..e8f23a174ce7 100755
--- a/tests/qemu-iotests/042
+++ b/tests/qemu-iotests/042
@@ -64,8 +64,8 @@ _check_test_img
 echo
 echo "== Rebasing the image =="

-$QEMU_IMG rebase -u -b "$TEST_IMG.orig" "$TEST_IMG"
-$QEMU_IMG rebase -b "$TEST_IMG.orig" "$TEST_IMG"
+$QEMU_IMG rebase -u -b "$TEST_IMG.orig" -F $IMGFMT "$TEST_IMG"
+$QEMU_IMG rebase -b "$TEST_IMG.orig" -F $IMGFMT "$TEST_IMG"
 _check_test_img

 # success, all done
diff --git a/tests/qemu-iotests/043 b/tests/qemu-iotests/043
index b102e49208b8..e4022b7044de 100755
--- a/tests/qemu-iotests/043
+++ b/tests/qemu-iotests/043
@@ -46,7 +46,7 @@ _supported_proto file

 size=128M
 _make_test_img $size
-$QEMU_IMG rebase -u -b "$TEST_IMG" "$TEST_IMG"
+$QEMU_IMG rebase -u -b "$TEST_IMG" -F $IMGFMT "$TEST_IMG"

 echo
 echo "== backing file references self =="
@@ -54,8 +54,8 @@ _img_info --backing-chain

 _make_test_img $size
 mv "$TEST_IMG" "$TEST_IMG.base"
-_make_test_img -b "$TEST_IMG.base" $size
-$QEMU_IMG rebase -u -b "$TEST_IMG" "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
+$QEMU_IMG rebase -u -b "$TEST_IMG" -F $IMGFMT "$TEST_IMG.base"

 echo
 echo "== parent references self =="
@@ -63,12 +63,12 @@ _img_info --backing-chain

 _make_test_img $size
 mv "$TEST_IMG" "$TEST_IMG.1.base"
-_make_test_img -b "$TEST_IMG.1.base" $size
+_make_test_img -b "$TEST_IMG.1.base" -F $IMGFMT $size
 mv "$TEST_IMG" "$TEST_IMG.2.base"
-_make_test_img -b "$TEST_IMG.2.base" $size
+_make_test_img -b "$TEST_IMG.2.base" -F $IMGFMT $size
 mv "$TEST_IMG" "$TEST_IMG.3.base"
-_make_test_img -b "$TEST_IMG.3.base" $size
-$QEMU_IMG rebase -u -b "$TEST_IMG.2.base" "$TEST_IMG.1.base"
+_make_test_img -b "$TEST_IMG.3.base" -F $IMGFMT $size
+$QEMU_IMG rebase -u -b "$TEST_IMG.2.base" -F $IMGFMT "$TEST_IMG.1.base"

 echo
 echo "== ancestor references another ancestor =="
@@ -76,9 +76,9 @@ _img_info --backing-chain

 _make_test_img $size
 mv "$TEST_IMG" "$TEST_IMG.1.base"
-_make_test_img -b "$TEST_IMG.1.base" $size
+_make_test_img -b "$TEST_IMG.1.base" -F $IMGFMT $size
 mv "$TEST_IMG" "$TEST_IMG.2.base"
-_make_test_img -b "$TEST_IMG.2.base" $size
+_make_test_img -b "$TEST_IMG.2.base" -F $IMGFMT $size

 echo
 echo "== finite chain of length 3 (human) =="
diff --git a/tests/qemu-iotests/043.out b/tests/qemu-iotests/043.out
index 0280f999ce12..7251e26d4ff9 100644
--- a/tests/qemu-iotests/043.out
+++ b/tests/qemu-iotests/043.out
@@ -4,20 +4,20 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
 == backing file references self ==
 qemu-img: Backing file 'TEST_DIR/t.IMGFMT' creates an infinite loop.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == parent references self ==
 qemu-img: Backing file 'TEST_DIR/t.IMGFMT' creates an infinite loop.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.1.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.2.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.3.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.1.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.2.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.3.base backing_fmt=IMGFMT

 == ancestor references another ancestor ==
 qemu-img: Backing file 'TEST_DIR/t.IMGFMT.2.base' creates an infinite loop.
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.1.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.2.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.1.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.2.base backing_fmt=IMGFMT

 == finite chain of length 3 (human) ==
 image: TEST_DIR/t.IMGFMT
@@ -25,12 +25,14 @@ file format: IMGFMT
 virtual size: 128 MiB (134217728 bytes)
 cluster_size: 65536
 backing file: TEST_DIR/t.IMGFMT.2.base
+backing file format: IMGFMT

 image: TEST_DIR/t.IMGFMT.2.base
 file format: IMGFMT
 virtual size: 128 MiB (134217728 bytes)
 cluster_size: 65536
 backing file: TEST_DIR/t.IMGFMT.1.base
+backing file format: IMGFMT

 image: TEST_DIR/t.IMGFMT.1.base
 file format: IMGFMT
@@ -40,6 +42,7 @@ cluster_size: 65536
 == finite chain of length 3 (json) ==
 [
     {
+        "backing-filename-format": "IMGFMT",
         "virtual-size": 134217728,
         "filename": "TEST_DIR/t.IMGFMT",
         "cluster-size": 65536,
@@ -49,6 +52,7 @@ cluster_size: 65536
         "dirty-flag": false
     },
     {
+        "backing-filename-format": "IMGFMT",
         "virtual-size": 134217728,
         "filename": "TEST_DIR/t.IMGFMT.2.base",
         "cluster-size": 65536,
diff --git a/tests/qemu-iotests/046 b/tests/qemu-iotests/046
index a066eec60598..7384136dc016 100755
--- a/tests/qemu-iotests/046
+++ b/tests/qemu-iotests/046
@@ -69,7 +69,7 @@ backing_io 0 32 write | $QEMU_IO "$TEST_IMG" | _filter_qemu_io

 mv "$TEST_IMG" "$TEST_IMG.base"

-_make_test_img -b "$TEST_IMG.base" 6G
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 6G

 echo
 echo "== Some concurrent requests touching the same cluster =="
diff --git a/tests/qemu-iotests/046.out b/tests/qemu-iotests/046.out
index ca2c7404a914..1a9dfe200f6f 100644
--- a/tests/qemu-iotests/046.out
+++ b/tests/qemu-iotests/046.out
@@ -66,7 +66,7 @@ wrote 65536/65536 bytes at offset 1966080
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 2031616
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=6442450944 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == Some concurrent requests touching the same cluster ==
 blkdebug: Suspended request 'A'
diff --git a/tests/qemu-iotests/050 b/tests/qemu-iotests/050
index cdc53565410d..4b0a390c437c 100755
--- a/tests/qemu-iotests/050
+++ b/tests/qemu-iotests/050
@@ -58,13 +58,13 @@ $QEMU_IO -c "write -P 0x5a 0 1048576" "$TEST_IMG" | _filter_qemu_io

 TEST_IMG="$TEST_IMG_SAVE"

-_make_test_img -b "$TEST_IMG.old" $size
+_make_test_img -b "$TEST_IMG.old" -F $IMGFMT $size
 $QEMU_IO -c "write -z 0 1048576" "$TEST_IMG" | _filter_qemu_io

 echo
 echo "== Rebasing the image =="

-$QEMU_IMG rebase -b "$TEST_IMG.new" "$TEST_IMG"
+$QEMU_IMG rebase -b "$TEST_IMG.new" -F $IMGFMT "$TEST_IMG"
 $QEMU_IO -c "read -P 0x00 0 1048576" "$TEST_IMG" | _filter_qemu_io

 # success, all done
diff --git a/tests/qemu-iotests/050.out b/tests/qemu-iotests/050.out
index 3602d580dc05..ab3daeddca3e 100644
--- a/tests/qemu-iotests/050.out
+++ b/tests/qemu-iotests/050.out
@@ -7,7 +7,7 @@ wrote 1048576/1048576 bytes at offset 0
 Formatting 'TEST_DIR/t.IMGFMT.new', fmt=IMGFMT size=10485760
 wrote 1048576/1048576 bytes at offset 0
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=10485760 backing_file=TEST_DIR/t.IMGFMT.old
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=10485760 backing_file=TEST_DIR/t.IMGFMT.old backing_fmt=IMGFMT
 wrote 1048576/1048576 bytes at offset 0
 1 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

diff --git a/tests/qemu-iotests/051 b/tests/qemu-iotests/051
index 034d3a325077..bee26075b207 100755
--- a/tests/qemu-iotests/051
+++ b/tests/qemu-iotests/051
@@ -70,7 +70,7 @@ device_id="drive0"
 _make_test_img $size
 cp "$TEST_IMG" "$TEST_IMG.orig"
 mv "$TEST_IMG" "$TEST_IMG.base"
-_make_test_img -b "$TEST_IMG.base" $size
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size

 echo
 echo === Unknown option ===
diff --git a/tests/qemu-iotests/051.out b/tests/qemu-iotests/051.out
index 554c5ca90a02..de4771bcb36d 100644
--- a/tests/qemu-iotests/051.out
+++ b/tests/qemu-iotests/051.out
@@ -1,6 +1,6 @@
 QA output created by 051
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 === Unknown option ===

diff --git a/tests/qemu-iotests/051.pc.out b/tests/qemu-iotests/051.pc.out
index 0ea80d35f0e2..0a261753faac 100644
--- a/tests/qemu-iotests/051.pc.out
+++ b/tests/qemu-iotests/051.pc.out
@@ -1,6 +1,6 @@
 QA output created by 051
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 === Unknown option ===

diff --git a/tests/qemu-iotests/056 b/tests/qemu-iotests/056
index f73fc74457df..052456aa003f 100755
--- a/tests/qemu-iotests/056
+++ b/tests/qemu-iotests/056
@@ -54,7 +54,8 @@ class TestSyncModesNoneAndTop(iotests.QMPTestCase):

     def setUp(self):
         create_image(backing_img, TestSyncModesNoneAndTop.image_len)
-        qemu_img('create', '-f', iotests.imgfmt, '-o', 'backing_file=%s' % backing_img, test_img)
+        qemu_img('create', '-f', iotests.imgfmt,
+                 '-o', 'backing_file=%s' % backing_img, '-F', 'raw', test_img)
         qemu_io('-c', 'write -P0x41 0 512', test_img)
         qemu_io('-c', 'write -P0xd5 1M 32k', test_img)
         qemu_io('-c', 'write -P0xdc 32M 124k', test_img)
diff --git a/tests/qemu-iotests/060 b/tests/qemu-iotests/060
index 043f12904aab..2f0894e255ea 100755
--- a/tests/qemu-iotests/060
+++ b/tests/qemu-iotests/060
@@ -163,7 +163,7 @@ $QEMU_IO -c 'write 0k 64k' "$BACKING_IMG" | _filter_qemu_io
 # compat=0.10 is required in order to make the following discard actually
 # unallocate the sector rather than make it a zero sector - we want COW, after
 # all.
-_make_test_img -o 'compat=0.10' -b "$BACKING_IMG" 1G
+_make_test_img -o 'compat=0.10' -b "$BACKING_IMG" -F $IMGFMT 1G
 # Write two clusters, the second one enforces creation of an L2 table after
 # the first data cluster.
 $QEMU_IO -c 'write 0k 64k' -c 'write 512M 64k' "$TEST_IMG" | _filter_qemu_io
diff --git a/tests/qemu-iotests/060.out b/tests/qemu-iotests/060.out
index d27692a33c0d..6b0a3b360d41 100644
--- a/tests/qemu-iotests/060.out
+++ b/tests/qemu-iotests/060.out
@@ -100,7 +100,7 @@ read 512/512 bytes at offset 0
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=1073741824
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1073741824 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 536870912
diff --git a/tests/qemu-iotests/061 b/tests/qemu-iotests/061
index 36b040491fef..5d3cbc5083b6 100755
--- a/tests/qemu-iotests/061
+++ b/tests/qemu-iotests/061
@@ -187,7 +187,7 @@ echo "=== Testing zero expansion on backed image ==="
 echo
 TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
-_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 64M
+_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 64M
 $QEMU_IO -c "read -P 0x2a 0 128k" -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
 _check_test_img
@@ -198,7 +198,7 @@ echo "=== Testing zero expansion on backed inactive clusters ==="
 echo
 TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
-_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 64M
+_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 64M
 $QEMU_IO -c "write -z 0 64k" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG snapshot -c foo "$TEST_IMG"
 $QEMU_IO -c "write -P 0x42 0 128k" "$TEST_IMG" | _filter_qemu_io
@@ -214,7 +214,7 @@ echo "=== Testing zero expansion on backed image with shared L2 table ==="
 echo
 TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 64M
 $QEMU_IO -c "write -P 0x2a 0 128k" "$TEST_IMG.base" | _filter_qemu_io
-_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 64M
+_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 64M
 $QEMU_IO -c "write -z 0 128k" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG snapshot -c foo "$TEST_IMG"
 $QEMU_IMG amend -o "compat=0.10" "$TEST_IMG"
@@ -237,7 +237,7 @@ echo
 echo "=== Testing progress report without snapshot ==="
 echo
 TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 4G
-_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 4G
+_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 4G
 $QEMU_IO -c "write -z 0  64k" \
          -c "write -z 1G 64k" \
          -c "write -z 2G 64k" \
@@ -249,7 +249,7 @@ echo
 echo "=== Testing progress report with snapshot ==="
 echo
 TEST_IMG="$TEST_IMG.base" _make_test_img -o "compat=1.1" 4G
-_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" 4G
+_make_test_img -o "compat=1.1" -b "$TEST_IMG.base" -F $IMGFMT 4G
 $QEMU_IO -c "write -z 0  64k" \
          -c "write -z 1G 64k" \
          -c "write -z 2G 64k" \
diff --git a/tests/qemu-iotests/061.out b/tests/qemu-iotests/061.out
index 8b3091a412bc..5963f0f91e95 100644
--- a/tests/qemu-iotests/061.out
+++ b/tests/qemu-iotests/061.out
@@ -395,7 +395,7 @@ read 131072/131072 bytes at offset 0
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 read 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 0
@@ -411,7 +411,7 @@ read 65536/65536 bytes at offset 65536
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 0
@@ -430,7 +430,7 @@ read 65536/65536 bytes at offset 65536
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 131072/131072 bytes at offset 0
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 No errors were found on the image.
@@ -454,7 +454,7 @@ read 67108864/67108864 bytes at offset 0
 === Testing progress report without snapshot ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=4294967296
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294967296 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294967296 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 1073741824
@@ -469,7 +469,7 @@ No errors were found on the image.
 === Testing progress report with snapshot ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=4294967296
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294967296 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294967296 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 65536/65536 bytes at offset 1073741824
diff --git a/tests/qemu-iotests/069 b/tests/qemu-iotests/069
index b997b127f025..a4da83b2d9da 100755
--- a/tests/qemu-iotests/069
+++ b/tests/qemu-iotests/069
@@ -46,7 +46,7 @@ echo
 echo "=== Creating an image with a backing file and deleting that file ==="
 echo
 TEST_IMG="$TEST_IMG.base" _make_test_img $IMG_SIZE
-_make_test_img -b "$TEST_IMG.base" $IMG_SIZE
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $IMG_SIZE
 _rm_test_img "$TEST_IMG.base"
 # Just open the image and close it right again (this should print an error message)
 $QEMU_IO -c quit "$TEST_IMG" 2>&1 | _filter_testdir | _filter_imgfmt
diff --git a/tests/qemu-iotests/069.out b/tests/qemu-iotests/069.out
index c78e8c2b7204..126b4d2d519b 100644
--- a/tests/qemu-iotests/069.out
+++ b/tests/qemu-iotests/069.out
@@ -3,6 +3,6 @@ QA output created by 069
 === Creating an image with a backing file and deleting that file ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=131072
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=131072 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=131072 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 qemu-io: can't open device TEST_DIR/t.IMGFMT: Could not open backing file: Could not open 'TEST_DIR/t.IMGFMT.base': No such file or directory
 *** done
diff --git a/tests/qemu-iotests/073 b/tests/qemu-iotests/073
index 23a1bdf89056..1dce47870914 100755
--- a/tests/qemu-iotests/073
+++ b/tests/qemu-iotests/073
@@ -52,7 +52,7 @@ echo "== creating backing file =="

 TEST_IMG="$TEST_IMG.base" _make_test_img $size

-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT
 $QEMU_IO -c "write -P 0xa5 0 $size" "$TEST_IMG.base" | _filter_qemu_io

 echo
diff --git a/tests/qemu-iotests/073.out b/tests/qemu-iotests/073.out
index de5452492c70..7a718b525e68 100644
--- a/tests/qemu-iotests/073.out
+++ b/tests/qemu-iotests/073.out
@@ -2,7 +2,7 @@ QA output created by 073

 == creating backing file ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

diff --git a/tests/qemu-iotests/082 b/tests/qemu-iotests/082
index 3286c2c6dbb7..5ddd6427d206 100755
--- a/tests/qemu-iotests/082
+++ b/tests/qemu-iotests/082
@@ -83,8 +83,10 @@ run_qemu_img create -f $IMGFMT -o cluster_size=4k -o help "$TEST_IMG" $size
 run_qemu_img create -f $IMGFMT -o cluster_size=4k -o \? "$TEST_IMG" $size

 # Looks like a help option, but is part of the backing file name
-run_qemu_img create -f $IMGFMT -u -o backing_file="$TEST_IMG",,help "$TEST_IMG" $size
-run_qemu_img create -f $IMGFMT -u -o backing_file="$TEST_IMG",,\? "$TEST_IMG" $size
+run_qemu_img create -f $IMGFMT -u -o backing_file="$TEST_IMG",,help \
+    -F $IMGFMT "$TEST_IMG" $size
+run_qemu_img create -f $IMGFMT -u -o backing_file="$TEST_IMG",,\? \
+    -F $IMGFMT "$TEST_IMG" $size

 # Try to trick qemu-img into creating escaped commas
 run_qemu_img create -f $IMGFMT -o backing_file="$TEST_IMG", -o help "$TEST_IMG" $size
@@ -140,8 +142,8 @@ run_qemu_img convert -O $IMGFMT -o cluster_size=4k -o help "$TEST_IMG" "$TEST_IM
 run_qemu_img convert -O $IMGFMT -o cluster_size=4k -o \? "$TEST_IMG" "$TEST_IMG".base

 # Looks like a help option, but is part of the backing file name
-run_qemu_img convert -O $IMGFMT -o backing_file="$TEST_IMG",,help "$TEST_IMG" "$TEST_IMG".base
-run_qemu_img convert -O $IMGFMT -o backing_file="$TEST_IMG",,\? "$TEST_IMG" "$TEST_IMG".base
+run_qemu_img convert -O $IMGFMT -o backing_fmt=$IMGFMT,backing_file="$TEST_IMG",,help "$TEST_IMG" "$TEST_IMG".base
+run_qemu_img convert -O $IMGFMT -o backing_fmt=$IMGFMT,backing_file="$TEST_IMG",,\? "$TEST_IMG" "$TEST_IMG".base

 # Try to trick qemu-img into creating escaped commas
 run_qemu_img convert -O $IMGFMT -o backing_file="$TEST_IMG", -o help "$TEST_IMG" "$TEST_IMG".base
@@ -199,10 +201,12 @@ run_qemu_img amend -f $IMGFMT -o cluster_size=4k -o help "$TEST_IMG"
 run_qemu_img amend -f $IMGFMT -o cluster_size=4k -o \? "$TEST_IMG"

 # Looks like a help option, but is part of the backing file name
-run_qemu_img amend -f $IMGFMT -o backing_file="$TEST_IMG",,help "$TEST_IMG"
+run_qemu_img amend -f $IMGFMT \
+   -o backing_fmt=$IMGFMT,backing_file="$TEST_IMG",,help "$TEST_IMG"
 run_qemu_img rebase -u -b "" -f $IMGFMT "$TEST_IMG"

-run_qemu_img amend -f $IMGFMT -o backing_file="$TEST_IMG",,\? "$TEST_IMG"
+run_qemu_img amend -f $IMGFMT \
+   -o backing_fmt=$IMGFMT,backing_file="$TEST_IMG",,\? "$TEST_IMG"
 run_qemu_img rebase -u -b "" -f $IMGFMT "$TEST_IMG"

 # Try to trick qemu-img into creating escaped commas
diff --git a/tests/qemu-iotests/082.out b/tests/qemu-iotests/082.out
index 9d4ed4dc9d61..6ac32ad2d7b9 100644
--- a/tests/qemu-iotests/082.out
+++ b/tests/qemu-iotests/082.out
@@ -226,11 +226,11 @@ Supported options:
   refcount_bits=<num>    - Width of a reference count entry in bits
   size=<size>            - Virtual disk size

-Testing: create -f qcow2 -u -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2 128M
-Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 backing_file=TEST_DIR/t.qcow2,,help cluster_size=65536 lazy_refcounts=off refcount_bits=16
+Testing: create -f qcow2 -u -o backing_file=TEST_DIR/t.qcow2,,help -F qcow2 TEST_DIR/t.qcow2 128M
+Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 backing_file=TEST_DIR/t.qcow2,,help backing_fmt=qcow2 cluster_size=65536 lazy_refcounts=off refcount_bits=16

-Testing: create -f qcow2 -u -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2 128M
-Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 backing_file=TEST_DIR/t.qcow2,,? cluster_size=65536 lazy_refcounts=off refcount_bits=16
+Testing: create -f qcow2 -u -o backing_file=TEST_DIR/t.qcow2,,? -F qcow2 TEST_DIR/t.qcow2 128M
+Formatting 'TEST_DIR/t.qcow2', fmt=qcow2 size=134217728 backing_file=TEST_DIR/t.qcow2,,? backing_fmt=qcow2 cluster_size=65536 lazy_refcounts=off refcount_bits=16

 Testing: create -f qcow2 -o backing_file=TEST_DIR/t.qcow2, -o help TEST_DIR/t.qcow2 128M
 qemu-img: Invalid option list: backing_file=TEST_DIR/t.qcow2,
@@ -506,10 +506,10 @@ Supported options:
   refcount_bits=<num>    - Width of a reference count entry in bits
   size=<size>            - Virtual disk size

-Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
+Testing: convert -O qcow2 -o backing_fmt=qcow2,backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
 qemu-img: Could not open 'TEST_DIR/t.qcow2.base': Could not open backing file: Could not open 'TEST_DIR/t.qcow2,help': No such file or directory

-Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
+Testing: convert -O qcow2 -o backing_fmt=qcow2,backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
 qemu-img: Could not open 'TEST_DIR/t.qcow2.base': Could not open backing file: Could not open 'TEST_DIR/t.qcow2,?': No such file or directory

 Testing: convert -O qcow2 -o backing_file=TEST_DIR/t.qcow2, -o help TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.base
@@ -805,11 +805,11 @@ Creation options for 'qcow2':

 Note that not all of these options may be amendable.

-Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2
+Testing: amend -f qcow2 -o backing_fmt=qcow2,backing_file=TEST_DIR/t.qcow2,,help TEST_DIR/t.qcow2

 Testing: rebase -u -b  -f qcow2 TEST_DIR/t.qcow2

-Testing: amend -f qcow2 -o backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2
+Testing: amend -f qcow2 -o backing_fmt=qcow2,backing_file=TEST_DIR/t.qcow2,,? TEST_DIR/t.qcow2

 Testing: rebase -u -b  -f qcow2 TEST_DIR/t.qcow2

diff --git a/tests/qemu-iotests/085 b/tests/qemu-iotests/085
index 46981dbb64ae..09137c70474e 100755
--- a/tests/qemu-iotests/085
+++ b/tests/qemu-iotests/085
@@ -105,7 +105,7 @@ add_snapshot_image()
 {
     base_image="${TEST_DIR}/$((${1}-1))-${snapshot_virt0}"
     snapshot_file="${TEST_DIR}/${1}-${snapshot_virt0}"
-    TEST_IMG=$snapshot_file _make_test_img -u -b "${base_image}" "$size"
+    TEST_IMG=$snapshot_file _make_test_img -u -b "${base_image}" -F $IMGFMT "$size"
     do_blockdev_add "$1" "'backing': null, " "${snapshot_file}"
 }

@@ -224,7 +224,7 @@ echo
 SNAPSHOTS=$((${SNAPSHOTS}+1))

 TEST_IMG="$TEST_IMG.base" _make_test_img "$size"
-_make_test_img -b "${TEST_IMG}.base" "$size"
+_make_test_img -b "${TEST_IMG}.base" -F $IMGFMT "$size"
 do_blockdev_add ${SNAPSHOTS} "" "${TEST_IMG}"
 blockdev_snapshot ${SNAPSHOTS} error

diff --git a/tests/qemu-iotests/085.out b/tests/qemu-iotests/085.out
index d94ad22f70ba..d5f482e01582 100644
--- a/tests/qemu-iotests/085.out
+++ b/tests/qemu-iotests/085.out
@@ -68,12 +68,12 @@ Formatting 'TEST_DIR/10-snapshot-v1.qcow2', fmt=qcow2 size=134217728 backing_fil

 === Create a couple of snapshots using blockdev-snapshot ===

-Formatting 'TEST_DIR/11-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/10-snapshot-v0.IMGFMT
+Formatting 'TEST_DIR/11-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/10-snapshot-v0.IMGFMT backing_fmt=IMGFMT
 { 'execute': 'blockdev-add', 'arguments': { 'driver': 'IMGFMT', 'node-name': 'snap_11', 'backing': null, 'file': { 'driver': 'file', 'filename': 'TEST_DIR/11-snapshot-v0.IMGFMT', 'node-name': 'file_11' } } }
 {"return": {}}
 { 'execute': 'blockdev-snapshot', 'arguments': { 'node': 'virtio0', 'overlay':'snap_11' } }
 {"return": {}}
-Formatting 'TEST_DIR/12-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/11-snapshot-v0.IMGFMT
+Formatting 'TEST_DIR/12-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/11-snapshot-v0.IMGFMT backing_fmt=IMGFMT
 { 'execute': 'blockdev-add', 'arguments': { 'driver': 'IMGFMT', 'node-name': 'snap_12', 'backing': null, 'file': { 'driver': 'file', 'filename': 'TEST_DIR/12-snapshot-v0.IMGFMT', 'node-name': 'file_12' } } }
 {"return": {}}
 { 'execute': 'blockdev-snapshot', 'arguments': { 'node': 'virtio0', 'overlay':'snap_12' } }
@@ -101,7 +101,7 @@ Formatting 'TEST_DIR/12-snapshot-v0.IMGFMT', fmt=IMGFMT size=134217728 backing_f
 === Invalid command - snapshot node has a backing image ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 { 'execute': 'blockdev-add', 'arguments': { 'driver': 'IMGFMT', 'node-name': 'snap_13', 'file': { 'driver': 'file', 'filename': 'TEST_DIR/t.IMGFMT', 'node-name': 'file_13' } } }
 {"return": {}}
 { 'execute': 'blockdev-snapshot', 'arguments': { 'node': 'virtio0', 'overlay':'snap_13' } }
diff --git a/tests/qemu-iotests/089 b/tests/qemu-iotests/089
index 059ad75e28d6..66c5415abe8c 100755
--- a/tests/qemu-iotests/089
+++ b/tests/qemu-iotests/089
@@ -84,7 +84,7 @@ echo
 echo "=== Testing correct handling of 'backing':null ==="
 echo

-_make_test_img -b "$TEST_IMG.base" $IMG_SIZE
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $IMG_SIZE

 # This should read 42
 $QEMU_IO -c 'read -P 42 0 512' "$TEST_IMG" | _filter_qemu_io
diff --git a/tests/qemu-iotests/089.out b/tests/qemu-iotests/089.out
index 20c8ce8f0ef4..15682c28862a 100644
--- a/tests/qemu-iotests/089.out
+++ b/tests/qemu-iotests/089.out
@@ -21,7 +21,7 @@ read 512/512 bytes at offset 0

 === Testing correct handling of 'backing':null ===

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 read 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 512/512 bytes at offset 0
diff --git a/tests/qemu-iotests/095 b/tests/qemu-iotests/095
index 155ae86aa780..77a5f0f3f597 100755
--- a/tests/qemu-iotests/095
+++ b/tests/qemu-iotests/095
@@ -51,9 +51,9 @@ size_larger=100M

 TEST_IMG="$TEST_IMG.base" _make_test_img $size_smaller

-TEST_IMG="$TEST_IMG.snp1" _make_test_img -b "$TEST_IMG.base" $size_larger
+TEST_IMG="$TEST_IMG.snp1" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size_larger

-_make_test_img -b "${TEST_IMG}.snp1" $size_larger
+_make_test_img -b "${TEST_IMG}.snp1" -F $IMGFMT $size_larger

 echo
 echo "=== Base image info before commit and resize ==="
diff --git a/tests/qemu-iotests/095.out b/tests/qemu-iotests/095.out
index 614e5ccbbb38..e66ced58f855 100644
--- a/tests/qemu-iotests/095.out
+++ b/tests/qemu-iotests/095.out
@@ -1,7 +1,7 @@
 QA output created by 095
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=5242880
-Formatting 'TEST_DIR/t.IMGFMT.snp1', fmt=IMGFMT size=104857600 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=104857600 backing_file=TEST_DIR/t.IMGFMT.snp1
+Formatting 'TEST_DIR/t.IMGFMT.snp1', fmt=IMGFMT size=104857600 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=104857600 backing_file=TEST_DIR/t.IMGFMT.snp1 backing_fmt=IMGFMT

 === Base image info before commit and resize ===
 image: TEST_DIR/t.IMGFMT.base
diff --git a/tests/qemu-iotests/097 b/tests/qemu-iotests/097
index 690f3d3ce1ed..d910a8b107ea 100755
--- a/tests/qemu-iotests/097
+++ b/tests/qemu-iotests/097
@@ -67,8 +67,8 @@ echo

 len=$((2100 * 1024 * 1024 + 512)) # larger than 2G, and not cluster aligned
 TEST_IMG="$TEST_IMG.base" _make_test_img $len
-TEST_IMG="$TEST_IMG.itmd" _make_test_img -b "$TEST_IMG.base" $len
-_make_test_img -b "$TEST_IMG.itmd" $len
+TEST_IMG="$TEST_IMG.itmd" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT $len
+_make_test_img -b "$TEST_IMG.itmd" -F $IMGFMT $len

 $QEMU_IO -c "write -P 1 0x7ffd0000 192k" "$TEST_IMG.base" | _filter_qemu_io
 $QEMU_IO -c "write -P 2 0x7ffe0000 128k" "$TEST_IMG.itmd" | _filter_qemu_io
diff --git a/tests/qemu-iotests/097.out b/tests/qemu-iotests/097.out
index f6705a1cc74a..3038ddab3100 100644
--- a/tests/qemu-iotests/097.out
+++ b/tests/qemu-iotests/097.out
@@ -3,8 +3,8 @@ QA output created by 097
 === Test pass 0 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -40,8 +40,8 @@ Offset          Length          File
 === Test pass 1 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -78,8 +78,8 @@ Offset          Length          File
 === Test pass 2 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -116,8 +116,8 @@ Offset          Length          File
 === Test pass 3 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
diff --git a/tests/qemu-iotests/098 b/tests/qemu-iotests/098
index 1e29d96b3d7e..f2ccdd790980 100755
--- a/tests/qemu-iotests/098
+++ b/tests/qemu-iotests/098
@@ -52,7 +52,7 @@ echo "=== $event ==="
 echo

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
-_make_test_img -b "$TEST_IMG.base" 64M
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT 64M

 # Some data that can be leaked when emptying the top image
 $QEMU_IO -c 'write 0 64k' "$TEST_IMG" | _filter_qemu_io
diff --git a/tests/qemu-iotests/098.out b/tests/qemu-iotests/098.out
index 7634d0e8b02b..14d3018ecce7 100644
--- a/tests/qemu-iotests/098.out
+++ b/tests/qemu-iotests/098.out
@@ -3,7 +3,7 @@ QA output created by 098
 === l1_update ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qemu-img: Could not empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
@@ -12,7 +12,7 @@ No errors were found on the image.
 === empty_image_prepare ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qemu-img: Could not empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
@@ -25,7 +25,7 @@ No errors were found on the image.
 === reftable_update ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qemu-img: Could not empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
@@ -39,7 +39,7 @@ No errors were found on the image.
 === refblock_alloc ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 0
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 qemu-img: Could not empty blkdebug:TEST_DIR/blkdebug.conf:TEST_DIR/t.IMGFMT: Input/output error
diff --git a/tests/qemu-iotests/110 b/tests/qemu-iotests/110
index 139c02c2cf6b..f1813d0dfb50 100755
--- a/tests/qemu-iotests/110
+++ b/tests/qemu-iotests/110
@@ -50,7 +50,7 @@ echo '=== Reconstructable filename ==='
 echo

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
-_make_test_img -b "$TEST_IMG_REL.base" 64M
+_make_test_img -b "$TEST_IMG_REL.base" -F $IMGFMT 64M
 # qemu should be able to reconstruct the filename, so relative backing names
 # should work
 # (We have to filter the backing file format because vmdk always
@@ -91,7 +91,7 @@ echo '=== Backing name is always relative to the backed image ==='
 echo

 # omit the image size; it should work anyway
-_make_test_img -b "$TEST_IMG_REL.base"
+_make_test_img -b "$TEST_IMG_REL.base" -F $IMGFMT

 echo
 echo '=== Nodes without a common directory ==='
diff --git a/tests/qemu-iotests/110.out b/tests/qemu-iotests/110.out
index f835553a9930..cf8f6c025d60 100644
--- a/tests/qemu-iotests/110.out
+++ b/tests/qemu-iotests/110.out
@@ -3,7 +3,7 @@ QA output created by 110
 === Reconstructable filename ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=t.IMGFMT.base backing_fmt=IMGFMT
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
 virtual size: 64 MiB (67108864 bytes)
@@ -18,7 +18,7 @@ backing file: t.IMGFMT.base (actual path: TEST_DIR/t.IMGFMT.base)

 === Backing name is always relative to the backed image ===

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=t.IMGFMT.base backing_fmt=IMGFMT

 === Nodes without a common directory ===

diff --git a/tests/qemu-iotests/122 b/tests/qemu-iotests/122
index f7a3ae684a7c..61a0d7aeec2a 100755
--- a/tests/qemu-iotests/122
+++ b/tests/qemu-iotests/122
@@ -52,9 +52,10 @@ echo
 echo "=== Check allocation status regression with -B ==="
 echo

-_make_test_img -b "$TEST_IMG".base
+_make_test_img -b "$TEST_IMG".base -F $IMGFMT
 $QEMU_IO -c "write -P 0x22 0 3M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
-$QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base "$TEST_IMG" "$TEST_IMG".orig
+$QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base \
+    -o backing_fmt=$IMGFMT "$TEST_IMG" "$TEST_IMG".orig
 $QEMU_IMG map "$TEST_IMG".orig | _filter_qemu_img_map


@@ -62,18 +63,22 @@ echo
 echo "=== Check that zero clusters are kept in overlay ==="
 echo

-_make_test_img -b "$TEST_IMG".base
+_make_test_img -b "$TEST_IMG".base -F $IMGFMT

 $QEMU_IO -c "write -P 0 0 3M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
-$QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base "$TEST_IMG" "$TEST_IMG".orig
+$QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base -o backing_fmt=$IMGFMT \
+    "$TEST_IMG" "$TEST_IMG".orig
 $QEMU_IO -c "read -P 0 0 3M" "$TEST_IMG".orig 2>&1 | _filter_qemu_io | _filter_testdir
-$QEMU_IMG convert -O $IMGFMT -c -B "$TEST_IMG".base "$TEST_IMG" "$TEST_IMG".orig
+$QEMU_IMG convert -O $IMGFMT -c -B "$TEST_IMG".base -o backing_fmt=$IMGFMT \
+    "$TEST_IMG" "$TEST_IMG".orig
 $QEMU_IO -c "read -P 0 0 3M" "$TEST_IMG".orig 2>&1 | _filter_qemu_io | _filter_testdir

 $QEMU_IO -c "write -z 0 3M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir
-$QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base "$TEST_IMG" "$TEST_IMG".orig
+$QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base -o backing_fmt=$IMGFMT \
+    "$TEST_IMG" "$TEST_IMG".orig
 $QEMU_IO -c "read -P 0 0 3M" "$TEST_IMG".orig 2>&1 | _filter_qemu_io | _filter_testdir
-$QEMU_IMG convert -O $IMGFMT -c -B "$TEST_IMG".base "$TEST_IMG" "$TEST_IMG".orig
+$QEMU_IMG convert -O $IMGFMT -c -B "$TEST_IMG".base -o backing_fmt=$IMGFMT \
+    "$TEST_IMG" "$TEST_IMG".orig
 $QEMU_IO -c "read -P 0 0 3M" "$TEST_IMG".orig 2>&1 | _filter_qemu_io | _filter_testdir


@@ -94,11 +99,11 @@ TEST_IMG="$TEST_IMG".base _make_test_img 256M
 # We do not want such a zero write, however, because we are past the
 # end of the backing file on the target as well, so we do not need to
 # write anything there.
-_make_test_img -b "$TEST_IMG".base 768M
+_make_test_img -b "$TEST_IMG".base 768M -F $IMGFMT

 # Use compat=0.10 as the output so there is no zero cluster support
 $QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base -o compat=0.10 \
-    "$TEST_IMG" "$TEST_IMG".orig
+    -o backing_fmt=$IMGFMT "$TEST_IMG" "$TEST_IMG".orig
 # See that nothing has been allocated past 64M
 $QEMU_IMG map "$TEST_IMG".orig | _filter_qemu_img_map

@@ -110,7 +115,7 @@ $QEMU_IO -c 'write -P 0x11 255M 1M' "$TEST_IMG".base 2>&1 | _filter_qemu_io
 $QEMU_IO -c 'write -P 0x22 600M 1M' "$TEST_IMG" 2>&1 | _filter_qemu_io

 $QEMU_IMG convert -O $IMGFMT -B "$TEST_IMG".base -o compat=0.10 \
-    "$TEST_IMG" "$TEST_IMG".orig
+    -o backing_fmt=$IMGFMT "$TEST_IMG" "$TEST_IMG".orig

 $QEMU_IMG map "$TEST_IMG".orig | _filter_qemu_img_map
 $QEMU_IO -c 'read -P 0x11 255M 1M' \
@@ -199,7 +204,7 @@ $QEMU_IMG map --output=json "$TEST_IMG".orig | _filter_qemu_img_map
 TEST_IMG="$TEST_IMG".base _make_test_img 64M
 $QEMU_IO -c "write -P 0x11 0 32M" "$TEST_IMG".base 2>&1 | _filter_qemu_io | _filter_testdir

-_make_test_img -b "$TEST_IMG".base 64M
+_make_test_img -b "$TEST_IMG".base 64M -F $IMGFMT
 $QEMU_IO -c "write -P 0x22 0 3M" "$TEST_IMG" 2>&1 | _filter_qemu_io | _filter_testdir

 echo
diff --git a/tests/qemu-iotests/122.out b/tests/qemu-iotests/122.out
index 1a35951a80a8..513c34ef3b9d 100644
--- a/tests/qemu-iotests/122.out
+++ b/tests/qemu-iotests/122.out
@@ -5,7 +5,7 @@ wrote 67108864/67108864 bytes at offset 0

 === Check allocation status regression with -B ===

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 3145728/3145728 bytes at offset 0
 3 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 Offset          Length          File
@@ -14,7 +14,7 @@ Offset          Length          File

 === Check that zero clusters are kept in overlay ===

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 3145728/3145728 bytes at offset 0
 3 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 read 3145728/3145728 bytes at offset 0
@@ -31,7 +31,7 @@ read 3145728/3145728 bytes at offset 0
 === Converting to an overlay larger than its backing file ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=268435456
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=805306368 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=805306368 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Offset          Length          File

 wrote 1048576/1048576 bytes at offset 267386880
@@ -141,7 +141,7 @@ read 63963136/63963136 bytes at offset 3145728
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
 wrote 33554432/33554432 bytes at offset 0
 32 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 3145728/3145728 bytes at offset 0
 3 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

diff --git a/tests/qemu-iotests/126 b/tests/qemu-iotests/126
index b7fce1e59dd3..dd5a2112278d 100755
--- a/tests/qemu-iotests/126
+++ b/tests/qemu-iotests/126
@@ -61,7 +61,7 @@ BASE_IMG="$TEST_DIR/image:base.$IMGFMT"
 TOP_IMG="$TEST_DIR/image:top.$IMGFMT"

 TEST_IMG=$BASE_IMG _make_test_img 64M
-TEST_IMG=$TOP_IMG _make_test_img -b ./image:base.$IMGFMT
+TEST_IMG=$TOP_IMG _make_test_img -b ./image:base.$IMGFMT -F $IMGFMT

 # (1) The default cluster size depends on the image format
 # (2) vmdk only supports vmdk backing files, so it always reports the
@@ -82,7 +82,7 @@ BASE_IMG="base.$IMGFMT"
 TOP_IMG="file:image:top.$IMGFMT"

 TEST_IMG=$BASE_IMG _make_test_img 64M
-TEST_IMG=$TOP_IMG _make_test_img -b "$BASE_IMG"
+TEST_IMG=$TOP_IMG _make_test_img -b "$BASE_IMG" -F $IMGFMT

 TEST_IMG=$TOP_IMG _img_info | grep -ve 'cluster_size' -e 'backing file format'

diff --git a/tests/qemu-iotests/126.out b/tests/qemu-iotests/126.out
index e3c4d619162d..7d6634685eb5 100644
--- a/tests/qemu-iotests/126.out
+++ b/tests/qemu-iotests/126.out
@@ -8,14 +8,14 @@ Formatting 'file:TEST_DIR/a:b.IMGFMT', fmt=IMGFMT size=67108864
 === Testing relative backing filename resolution ===

 Formatting 'TEST_DIR/image:base.IMGFMT', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/image:top.IMGFMT', fmt=IMGFMT size=67108864 backing_file=./image:base.IMGFMT
+Formatting 'TEST_DIR/image:top.IMGFMT', fmt=IMGFMT size=67108864 backing_file=./image:base.IMGFMT backing_fmt=IMGFMT
 image: TEST_DIR/image:top.IMGFMT
 file format: IMGFMT
 virtual size: 64 MiB (67108864 bytes)
 backing file: ./image:base.IMGFMT (actual path: TEST_DIR/./image:base.IMGFMT)

 Formatting 'base.IMGFMT', fmt=IMGFMT size=67108864
-Formatting 'file:image:top.IMGFMT', fmt=IMGFMT size=67108864 backing_file=base.IMGFMT
+Formatting 'file:image:top.IMGFMT', fmt=IMGFMT size=67108864 backing_file=base.IMGFMT backing_fmt=IMGFMT
 image: ./image:top.IMGFMT
 file format: IMGFMT
 virtual size: 64 MiB (67108864 bytes)
diff --git a/tests/qemu-iotests/127 b/tests/qemu-iotests/127
index a4fc8660381b..e2ac2f55364d 100755
--- a/tests/qemu-iotests/127
+++ b/tests/qemu-iotests/127
@@ -48,8 +48,8 @@ _require_devices virtio-scsi scsi-hd
 IMG_SIZE=64K

 _make_test_img $IMG_SIZE
-TEST_IMG="$TEST_IMG.overlay0" _make_test_img -b "$TEST_IMG" $IMG_SIZE
-TEST_IMG="$TEST_IMG.overlay1" _make_test_img -b "$TEST_IMG" $IMG_SIZE
+TEST_IMG="$TEST_IMG.overlay0" _make_test_img -b "$TEST_IMG" -F $IMGFMT $IMG_SIZE
+TEST_IMG="$TEST_IMG.overlay1" _make_test_img -b "$TEST_IMG" -F $IMGFMT $IMG_SIZE

 # So that we actually have something to mirror and the job does not return
 # immediately (which may be bad because then we cannot know whether the
diff --git a/tests/qemu-iotests/127.out b/tests/qemu-iotests/127.out
index 623d52bbd150..efd6cb327fe5 100644
--- a/tests/qemu-iotests/127.out
+++ b/tests/qemu-iotests/127.out
@@ -1,7 +1,7 @@
 QA output created by 127
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=65536
-Formatting 'TEST_DIR/t.IMGFMT.overlay0', fmt=IMGFMT size=65536 backing_file=TEST_DIR/t.IMGFMT
-Formatting 'TEST_DIR/t.IMGFMT.overlay1', fmt=IMGFMT size=65536 backing_file=TEST_DIR/t.IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.overlay0', fmt=IMGFMT size=65536 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.overlay1', fmt=IMGFMT size=65536 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
 wrote 42/42 bytes at offset 0
 42 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 { 'execute': 'qmp_capabilities' }
diff --git a/tests/qemu-iotests/129 b/tests/qemu-iotests/129
index b0da4a5541ab..0e13244d850e 100755
--- a/tests/qemu-iotests/129
+++ b/tests/qemu-iotests/129
@@ -29,7 +29,8 @@ class TestStopWithBlockJob(iotests.QMPTestCase):

     def setUp(self):
         iotests.qemu_img('create', '-f', iotests.imgfmt, self.base_img, "1G")
-        iotests.qemu_img('create', '-f', iotests.imgfmt, self.test_img, "-b", self.base_img)
+        iotests.qemu_img('create', '-f', iotests.imgfmt, self.test_img,
+                         "-b", self.base_img, '-F', iotests.imgfmt)
         iotests.qemu_io('-f', iotests.imgfmt, '-c', 'write -P0x5d 1M 128M', self.test_img)
         self.vm = iotests.VM().add_drive(self.test_img)
         self.vm.launch()
diff --git a/tests/qemu-iotests/133 b/tests/qemu-iotests/133
index 6f7cacc0910b..4070fd9457b2 100755
--- a/tests/qemu-iotests/133
+++ b/tests/qemu-iotests/133
@@ -40,7 +40,7 @@ _supported_fmt qcow2
 _supported_proto file

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 echo
 echo "=== Check that node-name can't be changed ==="
diff --git a/tests/qemu-iotests/133.out b/tests/qemu-iotests/133.out
index 1491ef45a984..d70c2e8041ce 100644
--- a/tests/qemu-iotests/133.out
+++ b/tests/qemu-iotests/133.out
@@ -1,6 +1,6 @@
 QA output created by 133
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 === Check that node-name can't be changed ===

diff --git a/tests/qemu-iotests/139 b/tests/qemu-iotests/139
index 7120d3142b77..1452fd24b335 100755
--- a/tests/qemu-iotests/139
+++ b/tests/qemu-iotests/139
@@ -71,7 +71,7 @@ class TestBlockdevDel(iotests.QMPTestCase):
     def addBlockDriverStateOverlay(self, node):
         self.checkBlockDriverState(node, False)
         iotests.qemu_img('create', '-u', '-f', iotests.imgfmt,
-                         '-b', base_img, new_img, '1M')
+                         '-b', base_img, '-F', iotests.imgfmt, new_img, '1M')
         opts = {'driver': iotests.imgfmt,
                 'node-name': node,
                 'backing': None,
diff --git a/tests/qemu-iotests/141 b/tests/qemu-iotests/141
index 5192d256e314..21aa0b42d813 100755
--- a/tests/qemu-iotests/141
+++ b/tests/qemu-iotests/141
@@ -89,8 +89,8 @@ test_blockjob()


 TEST_IMG="$TEST_DIR/b.$IMGFMT" _make_test_img 1M
-TEST_IMG="$TEST_DIR/m.$IMGFMT" _make_test_img -b "$TEST_DIR/b.$IMGFMT" 1M
-_make_test_img -b "$TEST_DIR/m.$IMGFMT" 1M
+TEST_IMG="$TEST_DIR/m.$IMGFMT" _make_test_img -b "$TEST_DIR/b.$IMGFMT" -F $IMGFMT 1M
+_make_test_img -b "$TEST_DIR/m.$IMGFMT" 1M -F $IMGFMT

 _launch_qemu -nodefaults

diff --git a/tests/qemu-iotests/141.out b/tests/qemu-iotests/141.out
index 263b680bdfb3..08e0aecd65f4 100644
--- a/tests/qemu-iotests/141.out
+++ b/tests/qemu-iotests/141.out
@@ -1,7 +1,7 @@
 QA output created by 141
 Formatting 'TEST_DIR/b.IMGFMT', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/m.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/b.IMGFMT
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/m.IMGFMT
+Formatting 'TEST_DIR/m.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/b.IMGFMT backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/m.IMGFMT backing_fmt=IMGFMT
 {'execute': 'qmp_capabilities'}
 {"return": {}}

diff --git a/tests/qemu-iotests/142 b/tests/qemu-iotests/142
index daefcbaa5878..69fd10ef5103 100755
--- a/tests/qemu-iotests/142
+++ b/tests/qemu-iotests/142
@@ -67,7 +67,7 @@ size=128M

 TEST_IMG="$TEST_IMG.base" _make_test_img $size
 TEST_IMG="$TEST_IMG.snap" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base" $size
+_make_test_img -b "$TEST_IMG.base" $size -F $IMGFMT

 echo
 echo === Simple test for all cache modes ===
diff --git a/tests/qemu-iotests/142.out b/tests/qemu-iotests/142.out
index 3667e38def8a..a92b948edd95 100644
--- a/tests/qemu-iotests/142.out
+++ b/tests/qemu-iotests/142.out
@@ -1,7 +1,7 @@
 QA output created by 142
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
 Formatting 'TEST_DIR/t.IMGFMT.snap', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 === Simple test for all cache modes ===

diff --git a/tests/qemu-iotests/153 b/tests/qemu-iotests/153
index 2b1311176801..4d41f25e2ced 100755
--- a/tests/qemu-iotests/153
+++ b/tests/qemu-iotests/153
@@ -94,7 +94,7 @@ for opts1 in "" "read-only=on" "read-only=on,force-share=on"; do

     echo
     echo "== Creating test image =="
-    _make_test_img -b "${TEST_IMG}.base"
+    _make_test_img -b "${TEST_IMG}.base" -F $IMGFMT

     echo
     echo "== Launching QEMU, opts: '$opts1' =="
@@ -125,7 +125,7 @@ for opts1 in "" "read-only=on" "read-only=on,force-share=on"; do
         _run_cmd $QEMU_IMG amend -o "" $L "${TEST_IMG}"
         _run_cmd $QEMU_IMG commit      $L "${TEST_IMG}"
         _run_cmd $QEMU_IMG resize      $L "${TEST_IMG}" $size
-        _run_cmd $QEMU_IMG rebase      $L "${TEST_IMG}" -b "${TEST_IMG}.base"
+        _run_cmd $QEMU_IMG rebase      $L "${TEST_IMG}" -b "${TEST_IMG}.base" -F $IMGFMT
         _run_cmd $QEMU_IMG snapshot -l $L "${TEST_IMG}"
         _run_cmd $QEMU_IMG convert     $L "${TEST_IMG}" "${TEST_IMG}.convert"
         _run_cmd $QEMU_IMG dd          $L if="${TEST_IMG}" of="${TEST_IMG}.convert" bs=512 count=1
@@ -135,7 +135,7 @@ for opts1 in "" "read-only=on" "read-only=on,force-share=on"; do
         # qemu-img create does not support -U
         if [ -z "$L" ]; then
             _run_cmd $QEMU_IMG create -f $IMGFMT "${TEST_IMG}" \
-                                      -b ${TEST_IMG}.base
+                                      -b ${TEST_IMG}.base -F $IMGFMT
             # Read the file format.  It used to be the case that
             # file-posix simply truncated the file, but the qcow2
             # driver then failed to format it because it was unable
@@ -168,9 +168,9 @@ done
 echo
 echo "== Creating ${TEST_IMG}.[abc] ==" | _filter_testdir
 (
-    $QEMU_IMG create -f qcow2 "${TEST_IMG}.a" -b "${TEST_IMG}"
-    $QEMU_IMG create -f qcow2 "${TEST_IMG}.b" -b "${TEST_IMG}"
-    $QEMU_IMG create -f qcow2 "${TEST_IMG}.c" -b "${TEST_IMG}.b"
+    $QEMU_IMG create -f qcow2 "${TEST_IMG}.a" -b "${TEST_IMG}" -F $IMGFMT
+    $QEMU_IMG create -f qcow2 "${TEST_IMG}.b" -b "${TEST_IMG}" -F $IMGFMT
+    $QEMU_IMG create -f qcow2 "${TEST_IMG}.c" -b "${TEST_IMG}.b" -F $IMGFMT
 ) | _filter_img_create

 echo
@@ -219,7 +219,7 @@ _send_qemu_cmd $QEMU_HANDLE \
 _run_cmd $QEMU_IO "${TEST_IMG}" -c 'write 0 512'

 echo "Creating overlay with qemu-img when the guest is running should be allowed"
-_run_cmd $QEMU_IMG create -f $IMGFMT -b "${TEST_IMG}" "${TEST_IMG}.overlay"
+_run_cmd $QEMU_IMG create -f $IMGFMT -b "${TEST_IMG}" -F $IMGFMT "${TEST_IMG}.overlay"

 echo "== Closing an image should unlock it =="
 _send_qemu_cmd $QEMU_HANDLE \
diff --git a/tests/qemu-iotests/153.out b/tests/qemu-iotests/153.out
index f7464dd8d345..24fcf78d63b2 100644
--- a/tests/qemu-iotests/153.out
+++ b/tests/qemu-iotests/153.out
@@ -6,7 +6,7 @@ QEMU_PROG: -drive if=none,file=null-co://,readonly=off,force-share=on: force-sha
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432

 == Creating test image ==
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == Launching QEMU, opts: '' ==

@@ -68,7 +68,7 @@ _qemu_img_wrapper resize TEST_DIR/t.qcow2 32M
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

-_qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

@@ -92,10 +92,11 @@ _qemu_img_wrapper bench -w -c 1 TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

-_qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: TEST_DIR/t.qcow2: Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?
 file format: IMGFMT
+backing file format: IMGFMT

 == Running utility commands -U ==

@@ -130,7 +131,7 @@ _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
 qemu-img: unrecognized option '-U'
 Try 'qemu-img --help' for more information

-_qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

@@ -152,7 +153,7 @@ Round done
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432

 == Creating test image ==
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == Launching QEMU, opts: 'read-only=on' ==

@@ -199,7 +200,7 @@ _qemu_img_wrapper resize TEST_DIR/t.qcow2 32M
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

-_qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

@@ -215,10 +216,11 @@ _qemu_img_wrapper bench -w -c 1 TEST_DIR/t.qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

-_qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: TEST_DIR/t.qcow2: Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?
 file format: IMGFMT
+backing file format: IMGFMT

 == Running utility commands -U ==

@@ -253,7 +255,7 @@ _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
 qemu-img: unrecognized option '-U'
 Try 'qemu-img --help' for more information

-_qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 qemu-img: Could not open 'TEST_DIR/t.qcow2': Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?

@@ -275,7 +277,7 @@ Round done
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=33554432

 == Creating test image ==
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 == Launching QEMU, opts: 'read-only=on,force-share=on' ==

@@ -309,7 +311,7 @@ _qemu_img_wrapper commit TEST_DIR/t.qcow2

 _qemu_img_wrapper resize TEST_DIR/t.qcow2 32M

-_qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper rebase TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2

 _qemu_img_wrapper snapshot -l TEST_DIR/t.qcow2

@@ -321,8 +323,9 @@ _qemu_img_wrapper bench -c 1 TEST_DIR/t.qcow2

 _qemu_img_wrapper bench -w -c 1 TEST_DIR/t.qcow2

-_qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper create -f qcow2 TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2
 file format: IMGFMT
+backing file format: IMGFMT

 == Running utility commands -U ==

@@ -357,7 +360,7 @@ _qemu_img_wrapper resize -U TEST_DIR/t.qcow2 32M
 qemu-img: unrecognized option '-U'
 Try 'qemu-img --help' for more information

-_qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base
+_qemu_img_wrapper rebase -U TEST_DIR/t.qcow2 -b TEST_DIR/t.qcow2.base -F qcow2

 _qemu_img_wrapper snapshot -l -U TEST_DIR/t.qcow2

@@ -398,9 +401,9 @@ Is another process using the image [TEST_DIR/t.qcow2]?
 == Two devices with the same image (read-only=on,force-share=on - read-only=on,force-share=on) ==

 == Creating TEST_DIR/t.qcow2.[abc] ==
-Formatting 'TEST_DIR/t.IMGFMT.a', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT
-Formatting 'TEST_DIR/t.IMGFMT.b', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT
-Formatting 'TEST_DIR/t.IMGFMT.c', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.b
+Formatting 'TEST_DIR/t.IMGFMT.a', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.b', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.c', fmt=IMGFMT size=33554432 backing_file=TEST_DIR/t.IMGFMT.b backing_fmt=IMGFMT

 == Two devices sharing the same file in backing chain ==

@@ -430,7 +433,7 @@ qemu-io: can't open device TEST_DIR/t.qcow2: Failed to get "write" lock
 Is another process using the image [TEST_DIR/t.qcow2]?
 Creating overlay with qemu-img when the guest is running should be allowed

-_qemu_img_wrapper create -f qcow2 -b TEST_DIR/t.qcow2 TEST_DIR/t.qcow2.overlay
+_qemu_img_wrapper create -f qcow2 -b TEST_DIR/t.qcow2 -F qcow2 TEST_DIR/t.qcow2.overlay
 == Closing an image should unlock it ==
 { 'execute': 'human-monitor-command', 'arguments': { 'command-line': 'drive_del d0' } }
 {"return": ""}
diff --git a/tests/qemu-iotests/154 b/tests/qemu-iotests/154
index d68f66b9e058..7f1c0d9bd981 100755
--- a/tests/qemu-iotests/154
+++ b/tests/qemu-iotests/154
@@ -50,7 +50,7 @@ echo
 echo == backing file contains zeros ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Make sure that the whole cluster is allocated even for partial write_zeroes
 # when the backing file contains zeros
@@ -74,7 +74,7 @@ echo
 echo == backing file contains non-zero data before write_zeroes ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Single cluster; non-zero data at the cluster start
 # ... | XX -- 00 -- | ...
@@ -97,7 +97,7 @@ echo
 echo == backing file contains non-zero data after write_zeroes ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Single cluster; non-zero data directly after request
 # ... | -- 00 XX -- | ...
@@ -120,7 +120,7 @@ echo
 echo == write_zeroes covers non-zero data ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # non-zero data at front of request
 # Backing file: -- XX -- --
@@ -160,7 +160,7 @@ echo
 echo == spanning two clusters, non-zero before request ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Two clusters; non-zero data before request:
 # 1. At cluster start:          32k: XX -- -- 00 | 00 -- -- --
@@ -190,7 +190,7 @@ echo
 echo == spanning two clusters, non-zero after request ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Two clusters; non-zero data after request:
 # 1. Directly after request:    32k: -- -- -- 00 | 00 XX -- --
@@ -220,7 +220,7 @@ echo
 echo == spanning two clusters, partially overwriting backing file ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Backing file: -- -- XX XX | XX XX -- --
 # Active layer: -- -- XX 00 | 00 XX -- --
@@ -239,7 +239,7 @@ echo
 echo == spanning multiple clusters, non-zero in first cluster ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Backing file: 64k: XX XX -- -- | -- -- -- -- | -- -- -- --
 # Active layer: 64k: XX XX 00 00 | 00 00 00 00 | 00 -- -- --
@@ -255,7 +255,7 @@ echo
 echo == spanning multiple clusters, non-zero in intermediate cluster ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Backing file: 64k: -- -- -- -- | -- XX XX -- | -- -- -- --
 # Active layer: 64k: -- -- 00 00 | 00 00 00 00 | 00 -- -- --
@@ -270,7 +270,7 @@ echo
 echo == spanning multiple clusters, non-zero in final cluster ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Backing file: 64k: -- -- -- -- | -- -- -- -- | -- -- XX XX
 # Active layer: 64k: -- -- 00 00 | 00 00 00 00 | 00 -- XX XX
@@ -286,7 +286,7 @@ echo
 echo == spanning multiple clusters, partially overwriting backing file ==

 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Backing file: 64k: -- XX XX XX | XX XX XX XX | XX XX XX --
 # Active layer: 64k: -- XX 00 00 | 00 00 00 00 | 00 XX XX --
@@ -338,7 +338,7 @@ CLUSTER_SIZE=2048 TEST_IMG="$TEST_IMG.base" _make_test_img $((size + 1024))
 # Write at the front: sector-wise, the request is:
 # backing: 128m... | -- --
 # active:  128m... | 00 -- -- --
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $size 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -346,7 +346,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Write at the back: sector-wise, the request is:
 # backing: 128m... | -- --
 # active:  128m... | -- -- -- 00
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $((size + 1536)) 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -354,7 +354,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Write at middle: sector-wise, the request is:
 # backing: 128m... | -- --
 # active:  128m... | -- 00 00 --
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $((size + 512)) 1024" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -362,7 +362,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Write entire cluster: sector-wise, the request is:
 # backing: 128m... | -- --
 # active:  128m... | 00 00 00 00
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -373,7 +373,7 @@ $QEMU_IO -c "write -z $size 512" "$TEST_IMG.base" | _filter_qemu_io
 # Write at the front: sector-wise, the request is:
 # backing: 128m... | 00 00
 # active:  128m... | 00 -- -- --
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $size 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -381,7 +381,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Write at the back: sector-wise, the request is:
 # backing: 128m... | 00 00
 # active:  128m... | -- -- -- 00
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $((size + 1536)) 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -389,7 +389,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Write at middle: sector-wise, the request is:
 # backing: 128m... | 00 00
 # active:  128m... | -- 00 00 --
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $((size + 512)) 1024" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -397,7 +397,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Write entire cluster: sector-wise, the request is:
 # backing: 128m... | 00 00
 # active:  128m... | 00 00 00 00
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -z $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "alloc $size 2048" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
@@ -427,7 +427,7 @@ echo == unaligned image tail cluster, allocation required ==
 # Backing file: 128m... | XX --
 # Active layer: 128m... | -- -- 00 --
 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $((size + 1024))
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -P 1 $((size)) 512" "$TEST_IMG.base" | _filter_qemu_io
 $QEMU_IO -c "write -z $((size + 1024)) 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "read -P 1 $((size)) 512" "$TEST_IMG" | _filter_qemu_io
@@ -438,7 +438,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map
 # Backing file: 128m: ... | -- XX
 # Active layer: 128m: ... | 00 -- -- 00
 CLUSTER_SIZE=512 TEST_IMG="$TEST_IMG.base" _make_test_img $((size + 1024))
-_make_test_img -b "$TEST_IMG.base" $((size + 2048))
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $((size + 2048))
 $QEMU_IO -c "write -P 1 $((size + 512)) 512" "$TEST_IMG.base" | _filter_qemu_io
 $QEMU_IO -c "write -z $((size)) 512" "$TEST_IMG" | _filter_qemu_io
 $QEMU_IO -c "read -P 0 $((size)) 512" "$TEST_IMG" | _filter_qemu_io
diff --git a/tests/qemu-iotests/154.out b/tests/qemu-iotests/154.out
index fa3673317fd8..4863e2483864 100644
--- a/tests/qemu-iotests/154.out
+++ b/tests/qemu-iotests/154.out
@@ -2,7 +2,7 @@ QA output created by 154

 == backing file contains zeros ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2048/2048 bytes at offset 0
 2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 2048/2048 bytes at offset 10240
@@ -22,7 +22,7 @@ wrote 2048/2048 bytes at offset 27648

 == backing file contains non-zero data before write_zeroes ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 32768
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 1024/1024 bytes at offset 34816
@@ -49,7 +49,7 @@ read 2048/2048 bytes at offset 67584

 == backing file contains non-zero data after write_zeroes ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 34816
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 1024/1024 bytes at offset 33792
@@ -76,7 +76,7 @@ read 3072/3072 bytes at offset 40960

 == write_zeroes covers non-zero data ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 5120
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 2048/2048 bytes at offset 5120
@@ -113,7 +113,7 @@ read 4096/4096 bytes at offset 28672

 == spanning two clusters, non-zero before request ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 32768
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 2048/2048 bytes at offset 35840
@@ -155,7 +155,7 @@ read 5120/5120 bytes at offset 68608

 == spanning two clusters, non-zero after request ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 37888
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 2048/2048 bytes at offset 35840
@@ -197,7 +197,7 @@ read 1024/1024 bytes at offset 72704

 == spanning two clusters, partially overwriting backing file ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 4096/4096 bytes at offset 2048
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 2048/2048 bytes at offset 3072
@@ -217,7 +217,7 @@ read 2048/2048 bytes at offset 6144

 == spanning multiple clusters, non-zero in first cluster ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2048/2048 bytes at offset 65536
 2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 7168/7168 bytes at offset 67584
@@ -233,7 +233,7 @@ read 10240/10240 bytes at offset 67584

 == spanning multiple clusters, non-zero in intermediate cluster ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2048/2048 bytes at offset 70656
 2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 7168/7168 bytes at offset 67584
@@ -246,7 +246,7 @@ read 12288/12288 bytes at offset 65536

 == spanning multiple clusters, non-zero in final cluster ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2048/2048 bytes at offset 75776
 2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 7168/7168 bytes at offset 67584
@@ -262,7 +262,7 @@ read 2048/2048 bytes at offset 75776

 == spanning multiple clusters, partially overwriting backing file ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 10240/10240 bytes at offset 66560
 10 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 7168/7168 bytes at offset 67584
@@ -305,25 +305,25 @@ wrote 2048/2048 bytes at offset 134217728
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134219776, "depth": 0, "zero": true, "data": false}]
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134218752
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 134217728
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 134219264
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 134218240
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2048/2048 bytes at offset 134217728
 2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
@@ -331,25 +331,25 @@ wrote 2048/2048 bytes at offset 134217728
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
 wrote 512/512 bytes at offset 134217728
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 134217728
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 134219264
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 1024/1024 bytes at offset 134218240
 1 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": true, "data": false}]
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2048/2048 bytes at offset 134217728
 2 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 2048/2048 bytes allocated at offset 128 MiB
@@ -377,7 +377,7 @@ read 1024/1024 bytes at offset 134217728

 == unaligned image tail cluster, allocation required ==
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134218752
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 134217728
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 512/512 bytes at offset 134218752
@@ -389,7 +389,7 @@ read 1536/1536 bytes at offset 134218240
 [{ "start": 0, "length": 134217728, "depth": 1, "zero": true, "data": false},
 { "start": 134217728, "length": 2048, "depth": 0, "zero": false, "data": true, "offset": OFFSET}]
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134218752
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134219776 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 512/512 bytes at offset 134218240
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 512/512 bytes at offset 134217728
diff --git a/tests/qemu-iotests/155 b/tests/qemu-iotests/155
index f237868710e0..c62029189267 100755
--- a/tests/qemu-iotests/155
+++ b/tests/qemu-iotests/155
@@ -52,9 +52,12 @@ class BaseClass(iotests.QMPTestCase):

     def setUp(self):
         qemu_img('create', '-f', iotests.imgfmt, back0_img, '1440K')
-        qemu_img('create', '-f', iotests.imgfmt, '-b', back0_img, back1_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-b', back1_img, back2_img)
-        qemu_img('create', '-f', iotests.imgfmt, '-b', back2_img, source_img)
+        qemu_img('create', '-f', iotests.imgfmt, '-b', back0_img,
+                 '-F', iotests.imgfmt, back1_img)
+        qemu_img('create', '-f', iotests.imgfmt, '-b', back1_img,
+                 '-F', iotests.imgfmt, back2_img)
+        qemu_img('create', '-f', iotests.imgfmt, '-b', back2_img,
+                 '-F', iotests.imgfmt, source_img)

         self.vm = iotests.VM()
         # Add the BDS via blockdev-add so it stays around after the mirror block
@@ -72,7 +75,8 @@ class BaseClass(iotests.QMPTestCase):
         if self.existing:
             if self.target_backing:
                 qemu_img('create', '-f', iotests.imgfmt,
-                         '-b', self.target_backing, target_img, '1440K')
+                         '-b', self.target_backing, '-F', 'raw',
+                         target_img, '1440K')
             else:
                 qemu_img('create', '-f', iotests.imgfmt, target_img, '1440K')

diff --git a/tests/qemu-iotests/156 b/tests/qemu-iotests/156
index 5559df63a53e..7c69a6c3fa32 100755
--- a/tests/qemu-iotests/156
+++ b/tests/qemu-iotests/156
@@ -56,7 +56,7 @@ _unsupported_imgopts data_file

 # Create source disk
 TEST_IMG="$TEST_IMG.backing" _make_test_img 1M
-_make_test_img -b "$TEST_IMG.backing" 1M
+_make_test_img -b "$TEST_IMG.backing" -F $IMGFMT 1M

 $QEMU_IO -c 'write -P 1 0 256k' "$TEST_IMG.backing" | _filter_qemu_io
 $QEMU_IO -c 'write -P 2 64k 192k' "$TEST_IMG" | _filter_qemu_io
@@ -68,7 +68,7 @@ _send_qemu_cmd $QEMU_HANDLE \
     'return'

 # Create snapshot
-TEST_IMG="$TEST_IMG.overlay" _make_test_img -u -b "$TEST_IMG" 1M
+TEST_IMG="$TEST_IMG.overlay" _make_test_img -u -b "$TEST_IMG" -F $IMGFMT 1M
 _send_qemu_cmd $QEMU_HANDLE \
     "{ 'execute': 'blockdev-snapshot-sync',
        'arguments': { 'device': 'source',
@@ -85,7 +85,8 @@ _send_qemu_cmd $QEMU_HANDLE \
     'return'

 # Create target image
-TEST_IMG="$TEST_IMG.target.overlay" _make_test_img -u -b "$TEST_IMG.target" 1M
+TEST_IMG="$TEST_IMG.target.overlay" _make_test_img -u -b "$TEST_IMG.target" \
+    -F $IMGFMT 1M

 # Mirror snapshot
 _send_qemu_cmd $QEMU_HANDLE \
@@ -111,7 +112,7 @@ _send_qemu_cmd $QEMU_HANDLE \
 # Copy source backing chain to the target before completing the job
 cp "$TEST_IMG.backing" "$TEST_IMG.target.backing"
 cp "$TEST_IMG" "$TEST_IMG.target"
-$QEMU_IMG rebase -u -b "$TEST_IMG.target.backing" "$TEST_IMG.target"
+$QEMU_IMG rebase -u -b "$TEST_IMG.target.backing" -F $IMGFMT "$TEST_IMG.target"

 # Complete block job
 _send_qemu_cmd $QEMU_HANDLE \
diff --git a/tests/qemu-iotests/156.out b/tests/qemu-iotests/156.out
index 084be5ad7151..cce167b63fe3 100644
--- a/tests/qemu-iotests/156.out
+++ b/tests/qemu-iotests/156.out
@@ -1,20 +1,20 @@
 QA output created by 156
 Formatting 'TEST_DIR/t.IMGFMT.backing', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.backing
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.backing backing_fmt=IMGFMT
 wrote 262144/262144 bytes at offset 0
 256 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 196608/196608 bytes at offset 65536
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 { 'execute': 'qmp_capabilities' }
 {"return": {}}
-Formatting 'TEST_DIR/t.IMGFMT.overlay', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.overlay', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT backing_fmt=IMGFMT
 { 'execute': 'blockdev-snapshot-sync', 'arguments': { 'device': 'source', 'snapshot-file': 'TEST_DIR/t.IMGFMT.overlay', 'format': 'IMGFMT', 'mode': 'existing' } }
 {"return": {}}
 { 'execute': 'human-monitor-command', 'arguments': { 'command-line': 'qemu-io source "write -P 3 128k 128k"' } }
 wrote 131072/131072 bytes at offset 131072
 128 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 {"return": ""}
-Formatting 'TEST_DIR/t.IMGFMT.target.overlay', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.target
+Formatting 'TEST_DIR/t.IMGFMT.target.overlay', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.target backing_fmt=IMGFMT
 { 'execute': 'drive-mirror', 'arguments': { 'device': 'source', 'target': 'TEST_DIR/t.IMGFMT.target.overlay', 'mode': 'existing', 'sync': 'top' } }
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "created", "id": "source"}}
 {"timestamp": {"seconds":  TIMESTAMP, "microseconds":  TIMESTAMP}, "event": "JOB_STATUS_CHANGE", "data": {"status": "running", "id": "source"}}
diff --git a/tests/qemu-iotests/158 b/tests/qemu-iotests/158
index ba4db6116ac3..3175968e2b6a 100755
--- a/tests/qemu-iotests/158
+++ b/tests/qemu-iotests/158
@@ -64,7 +64,7 @@ echo "== verify pattern =="
 $QEMU_IO --object $SECRET -c "read -P 0xa 0 $size" --image-opts $IMGSPECBASE | _filter_qemu_io | _filter_testdir

 echo "== create overlay =="
-_make_test_img -u --object $SECRET -o "encryption=on,encrypt.key-secret=sec0" -b "$TEST_IMG_BASE" $size
+_make_test_img -u --object $SECRET -o "encryption=on,encrypt.key-secret=sec0" -b "$TEST_IMG_BASE" -F $IMGFMT $size

 echo
 echo "== writing part of a cluster =="
diff --git a/tests/qemu-iotests/158.out b/tests/qemu-iotests/158.out
index 6def216e5574..d999f51ec0c0 100644
--- a/tests/qemu-iotests/158.out
+++ b/tests/qemu-iotests/158.out
@@ -10,7 +10,7 @@ wrote 134217728/134217728 bytes at offset 0
 read 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 == create overlay ==
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base encryption=on encrypt.key-secret=sec0
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT encryption=on encrypt.key-secret=sec0

 == writing part of a cluster ==
 wrote 1024/1024 bytes at offset 0
diff --git a/tests/qemu-iotests/161 b/tests/qemu-iotests/161
index f572a19af28c..e270976d8783 100755
--- a/tests/qemu-iotests/161
+++ b/tests/qemu-iotests/161
@@ -49,8 +49,8 @@ IMG_SIZE=1M

 # Create the images
 TEST_IMG="$TEST_IMG.base" _make_test_img $IMG_SIZE | _filter_imgfmt
-TEST_IMG="$TEST_IMG.int" _make_test_img -b "$TEST_IMG.base" | _filter_imgfmt
-_make_test_img -b "$TEST_IMG.int" | _filter_imgfmt
+TEST_IMG="$TEST_IMG.int" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT | _filter_imgfmt
+_make_test_img -b "$TEST_IMG.int" -F $IMGFMT -F $IMGFMT | _filter_imgfmt

 # First test: reopen $TEST.IMG changing the detect-zeroes option on
 # its backing file ($TEST_IMG.int).
@@ -106,8 +106,8 @@ echo "*** Commit and then change an option on the backing file"
 echo
 # Create the images again
 TEST_IMG="$TEST_IMG.base" _make_test_img $IMG_SIZE | _filter_imgfmt
-TEST_IMG="$TEST_IMG.int" _make_test_img -b "$TEST_IMG.base" | _filter_imgfmt
-_make_test_img -b "$TEST_IMG.int" | _filter_imgfmt
+TEST_IMG="$TEST_IMG.int" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT| _filter_imgfmt
+_make_test_img -b "$TEST_IMG.int" -F $IMGFMT | _filter_imgfmt

 _launch_qemu -drive if=none,file="${TEST_IMG}"
 _send_qemu_cmd $QEMU_HANDLE \
diff --git a/tests/qemu-iotests/161.out b/tests/qemu-iotests/161.out
index aef9741ed31c..3d8d89a9da3f 100644
--- a/tests/qemu-iotests/161.out
+++ b/tests/qemu-iotests/161.out
@@ -1,7 +1,7 @@
 QA output created by 161
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/t.IMGFMT.int', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.int
+Formatting 'TEST_DIR/t.IMGFMT.int', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.int backing_fmt=IMGFMT

 *** Change an option on the backing file

@@ -29,8 +29,8 @@ Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.
 *** Commit and then change an option on the backing file

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/t.IMGFMT.int', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.int
+Formatting 'TEST_DIR/t.IMGFMT.int', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.int backing_fmt=IMGFMT
 { 'execute': 'qmp_capabilities' }
 {"return": {}}
 { 'execute': 'block-commit', 'arguments': { 'device': 'none0', 'top': 'TEST_DIR/t.IMGFMT.int' } }
diff --git a/tests/qemu-iotests/176 b/tests/qemu-iotests/176
index 117c8b695490..2565ff12eef8 100755
--- a/tests/qemu-iotests/176
+++ b/tests/qemu-iotests/176
@@ -84,8 +84,8 @@ echo

 len=$((2100 * 1024 * 1024 + 512)) # larger than 2G, and not cluster aligned
 TEST_IMG="$TEST_IMG.base" _make_test_img $len
-TEST_IMG="$TEST_IMG.itmd" _make_test_img -b "$TEST_IMG.base" $len
-_make_test_img -b "$TEST_IMG.itmd" $len
+TEST_IMG="$TEST_IMG.itmd" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT $len
+_make_test_img -b "$TEST_IMG.itmd" -F $IMGFMT $len
 # Update the top image to use a feature that is incompatible with fast path
 case $reason in
     snapshot) $QEMU_IMG snapshot -c snap "$TEST_IMG" ;;
diff --git a/tests/qemu-iotests/176.out b/tests/qemu-iotests/176.out
index cc33def96b25..9d09b6045202 100644
--- a/tests/qemu-iotests/176.out
+++ b/tests/qemu-iotests/176.out
@@ -3,8 +3,8 @@ QA output created by 176
 === Test pass snapshot.0 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -43,8 +43,8 @@ ID        TAG
 === Test pass snapshot.1 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -84,8 +84,8 @@ ID        TAG
 === Test pass snapshot.2 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -125,8 +125,8 @@ ID        TAG
 === Test pass snapshot.3 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 wrote 196608/196608 bytes at offset 2147287040
 192 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 131072/131072 bytes at offset 2147352576
@@ -163,8 +163,8 @@ ID        TAG
 === Test pass bitmap.0 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 QMP_VERSION
 {"return": {}}
 {"return": {}}
@@ -212,8 +212,8 @@ QMP_VERSION
 === Test pass bitmap.1 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 QMP_VERSION
 {"return": {}}
 {"return": {}}
@@ -262,8 +262,8 @@ QMP_VERSION
 === Test pass bitmap.2 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 QMP_VERSION
 {"return": {}}
 {"return": {}}
@@ -312,8 +312,8 @@ QMP_VERSION
 === Test pass bitmap.3 ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=2202010112
-Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd
+Formatting 'TEST_DIR/t.IMGFMT.itmd', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=2202010112 backing_file=TEST_DIR/t.IMGFMT.itmd backing_fmt=IMGFMT
 QMP_VERSION
 {"return": {}}
 {"return": {}}
diff --git a/tests/qemu-iotests/177 b/tests/qemu-iotests/177
index 752d29f8ad50..c201a9d6c64a 100755
--- a/tests/qemu-iotests/177
+++ b/tests/qemu-iotests/177
@@ -51,7 +51,7 @@ echo "== setting up files =="

 TEST_IMG="$TEST_IMG.base" _make_test_img $size
 $QEMU_IO -c "write -P 11 0 $size" "$TEST_IMG.base" | _filter_qemu_io
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT
 $QEMU_IO -c "write -P 22 0 $size" "$TEST_IMG" | _filter_qemu_io

 # Limited to 64k max-transfer
diff --git a/tests/qemu-iotests/177.out b/tests/qemu-iotests/177.out
index e887542678ba..ba1e1e212e47 100644
--- a/tests/qemu-iotests/177.out
+++ b/tests/qemu-iotests/177.out
@@ -4,7 +4,7 @@ QA output created by 177
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
 wrote 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

diff --git a/tests/qemu-iotests/179 b/tests/qemu-iotests/179
index 9372dc30ef77..11a20cb1bfa8 100755
--- a/tests/qemu-iotests/179
+++ b/tests/qemu-iotests/179
@@ -49,7 +49,7 @@ echo '=== Testing write zeroes with unmap ==='
 echo

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 # Offsets chosen at or near 2M boundaries so test works at all cluster sizes
 # 8k and larger (smaller clusters fail due to non-contiguous allocations)
diff --git a/tests/qemu-iotests/179.out b/tests/qemu-iotests/179.out
index 80722b22891d..1f7680002ca6 100644
--- a/tests/qemu-iotests/179.out
+++ b/tests/qemu-iotests/179.out
@@ -3,7 +3,7 @@ QA output created by 179
 === Testing write zeroes with unmap ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 2097152/2097152 bytes at offset 2097152
 2 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 wrote 2097152/2097152 bytes at offset 6291456
diff --git a/tests/qemu-iotests/189 b/tests/qemu-iotests/189
index c9ce9d3bede3..99a900c998c2 100755
--- a/tests/qemu-iotests/189
+++ b/tests/qemu-iotests/189
@@ -65,7 +65,7 @@ echo "== verify pattern =="
 $QEMU_IO --object $SECRET0 -c "read -P 0xa 0 $size" --image-opts $IMGSPECBASE | _filter_qemu_io | _filter_testdir

 echo "== create overlay =="
-_make_test_img --object $SECRET1 -o "encrypt.format=luks,encrypt.key-secret=sec1,encrypt.iter-time=10" -u -b "$TEST_IMG_BASE" $size
+_make_test_img --object $SECRET1 -o "encrypt.format=luks,encrypt.key-secret=sec1,encrypt.iter-time=10" -u -b "$TEST_IMG_BASE" -F $IMGFMT $size

 echo
 echo "== writing part of a cluster =="
diff --git a/tests/qemu-iotests/189.out b/tests/qemu-iotests/189.out
index a0b7c9c24c24..035068764f73 100644
--- a/tests/qemu-iotests/189.out
+++ b/tests/qemu-iotests/189.out
@@ -10,7 +10,7 @@ wrote 16777216/16777216 bytes at offset 0
 read 16777216/16777216 bytes at offset 0
 16 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 == create overlay ==
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=16777216 backing_file=TEST_DIR/t.IMGFMT.base encrypt.format=luks encrypt.key-secret=sec1 encrypt.iter-time=10
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=16777216 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT encrypt.format=luks encrypt.key-secret=sec1 encrypt.iter-time=10

 == writing part of a cluster ==
 wrote 1024/1024 bytes at offset 0
diff --git a/tests/qemu-iotests/191 b/tests/qemu-iotests/191
index b05db6814157..d17462e1e42b 100755
--- a/tests/qemu-iotests/191
+++ b/tests/qemu-iotests/191
@@ -54,8 +54,8 @@ echo

 TEST_IMG="${TEST_IMG}.base" _make_test_img $size
 TEST_IMG="${TEST_IMG}.mid" _make_test_img -o "backing_fmt=$IMGFMT" -b "${TEST_IMG}.base"
-_make_test_img -b "${TEST_IMG}.mid"
-TEST_IMG="${TEST_IMG}.ovl2" _make_test_img -b "${TEST_IMG}.mid"
+_make_test_img -b "${TEST_IMG}.mid" -F $IMGFMT
+TEST_IMG="${TEST_IMG}.ovl2" _make_test_img -b "${TEST_IMG}.mid" -F $IMGFMT

 $QEMU_IO -c 'write -P 0x55 1M 64k' "${TEST_IMG}.mid" | _filter_qemu_io

@@ -102,10 +102,10 @@ echo === Preparing and starting VM with -drive ===
 echo

 TEST_IMG="${TEST_IMG}.base" _make_test_img $size
-TEST_IMG="${TEST_IMG}.mid" _make_test_img -b "${TEST_IMG}.base"
-_make_test_img -b "${TEST_IMG}.mid"
-TEST_IMG="${TEST_IMG}.ovl2" _make_test_img -b "${TEST_IMG}.mid"
-TEST_IMG="${TEST_IMG}.ovl3" _make_test_img -b "${TEST_IMG}.ovl2"
+TEST_IMG="${TEST_IMG}.mid" _make_test_img -b "${TEST_IMG}.base" -F $IMGFMT
+_make_test_img -b "${TEST_IMG}.mid" -F $IMGFMT
+TEST_IMG="${TEST_IMG}.ovl2" _make_test_img -b "${TEST_IMG}.mid" -F $IMGFMT
+TEST_IMG="${TEST_IMG}.ovl3" _make_test_img -b "${TEST_IMG}.ovl2" -F $IMGFMT

 $QEMU_IO -c 'write -P 0x55 1M 64k' "${TEST_IMG}.mid" | _filter_qemu_io

diff --git a/tests/qemu-iotests/191.out b/tests/qemu-iotests/191.out
index 34cec7b9ecf3..11aaf3b691fd 100644
--- a/tests/qemu-iotests/191.out
+++ b/tests/qemu-iotests/191.out
@@ -4,8 +4,8 @@ QA output created by 191

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
 Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
-Formatting 'TEST_DIR/t.IMGFMT.ovl2', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.ovl2', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 1048576
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 { 'execute': 'qmp_capabilities' }
@@ -413,10 +413,10 @@ backing file format: IMGFMT
 === Preparing and starting VM with -drive ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
-Formatting 'TEST_DIR/t.IMGFMT.ovl2', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
-Formatting 'TEST_DIR/t.IMGFMT.ovl3', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.ovl2
+Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.ovl2', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT.ovl3', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.ovl2 backing_fmt=IMGFMT
 wrote 65536/65536 bytes at offset 1048576
 64 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 { 'execute': 'qmp_capabilities' }
diff --git a/tests/qemu-iotests/195 b/tests/qemu-iotests/195
index 48984b7ac1ed..2351d55fe1f1 100755
--- a/tests/qemu-iotests/195
+++ b/tests/qemu-iotests/195
@@ -56,8 +56,8 @@ run_qemu()

 size=64M
 TEST_IMG="$TEST_IMG.base" _make_test_img $size
-TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base"
-_make_test_img -b "$TEST_IMG.mid"
+TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT
+_make_test_img -b "$TEST_IMG.mid" -F $IMGFMT

 echo
 echo "Change backing file of mid (opened read-only)"
@@ -75,7 +75,7 @@ echo
 echo "Change backing file of top (opened writable)"
 echo

-TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base"
+TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 run_qemu -drive if=none,file="$TEST_IMG",node-name=top <<EOF
 {"execute":"qmp_capabilities"}
diff --git a/tests/qemu-iotests/195.out b/tests/qemu-iotests/195.out
index e6df0d6781ba..ec84df5012a3 100644
--- a/tests/qemu-iotests/195.out
+++ b/tests/qemu-iotests/195.out
@@ -1,7 +1,7 @@
 QA output created by 195
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
+Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT

 Change backing file of mid (opened read-only)

@@ -42,7 +42,7 @@ backing file format: IMGFMT

 Change backing file of top (opened writable)

-Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Testing: -drive if=none,file=TEST_DIR/t.IMGFMT,node-name=top
 {
     QMP_VERSION
diff --git a/tests/qemu-iotests/198 b/tests/qemu-iotests/198
index fb0d5a29d357..33853df1c8bd 100755
--- a/tests/qemu-iotests/198
+++ b/tests/qemu-iotests/198
@@ -62,7 +62,7 @@ echo "== writing whole image base =="
 $QEMU_IO --object $SECRET0 -c "write -P 0xa 0 $size" --image-opts $IMGSPECBASE | _filter_qemu_io | _filter_testdir

 echo "== create overlay =="
-_make_test_img --object $SECRET1 -o "encrypt.format=luks,encrypt.key-secret=sec1,encrypt.iter-time=10" -u -b "$TEST_IMG_BASE" $size
+_make_test_img --object $SECRET1 -o "encrypt.format=luks,encrypt.key-secret=sec1,encrypt.iter-time=10" -u -b "$TEST_IMG_BASE" -F $IMGFMT $size

 echo
 echo "== writing whole image layer =="
diff --git a/tests/qemu-iotests/198.out b/tests/qemu-iotests/198.out
index 831ce3a289d3..8bc39dd0d5ee 100644
--- a/tests/qemu-iotests/198.out
+++ b/tests/qemu-iotests/198.out
@@ -6,7 +6,7 @@ Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=16777216 encrypt.format=luk
 wrote 16777216/16777216 bytes at offset 0
 16 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 == create overlay ==
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=16777216 backing_file=TEST_DIR/t.IMGFMT.base encrypt.format=luks encrypt.key-secret=sec1 encrypt.iter-time=10
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=16777216 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT encrypt.format=luks encrypt.key-secret=sec1 encrypt.iter-time=10

 == writing whole image layer ==
 wrote 16777216/16777216 bytes at offset 0
@@ -78,6 +78,7 @@ image: json:{ /* filtered */ }
 file format: IMGFMT
 virtual size: 16 MiB (16777216 bytes)
 backing file: TEST_DIR/t.IMGFMT.base
+backing file format: IMGFMT
 Format specific information:
     encrypt:
         ivgen alg: plain64
diff --git a/tests/qemu-iotests/204 b/tests/qemu-iotests/204
index abb73dc381c9..6770fa9b9636 100755
--- a/tests/qemu-iotests/204
+++ b/tests/qemu-iotests/204
@@ -52,7 +52,7 @@ echo "== setting up files =="

 TEST_IMG="$TEST_IMG.base" _make_test_img $size
 $QEMU_IO -c "write -P 11 0 $size" "$TEST_IMG.base" | _filter_qemu_io
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT
 $QEMU_IO -c "write -P 22 0 110M" "$TEST_IMG" | _filter_qemu_io

 # Limited to 64k max-transfer
diff --git a/tests/qemu-iotests/204.out b/tests/qemu-iotests/204.out
index f3a10fbe9035..457f72df8f88 100644
--- a/tests/qemu-iotests/204.out
+++ b/tests/qemu-iotests/204.out
@@ -4,7 +4,7 @@ QA output created by 204
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
 wrote 134217728/134217728 bytes at offset 0
 128 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 wrote 115343360/115343360 bytes at offset 0
 110 MiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)

diff --git a/tests/qemu-iotests/216 b/tests/qemu-iotests/216
index 372f042d3ebf..088b318a3755 100755
--- a/tests/qemu-iotests/216
+++ b/tests/qemu-iotests/216
@@ -53,7 +53,7 @@ with iotests.FilePath('base.img') as base_img_path, \
     assert qemu_img('create', '-f', iotests.imgfmt, base_img_path, '64M') == 0
     assert qemu_io_silent(base_img_path, '-c', 'write -P 1 0M 1M') == 0
     assert qemu_img('create', '-f', iotests.imgfmt, '-b', base_img_path,
-                    top_img_path) == 0
+                    '-F', iotests.imgfmt, top_img_path) == 0
     assert qemu_io_silent(top_img_path,  '-c', 'write -P 2 1M 1M') == 0

     log('Done')
diff --git a/tests/qemu-iotests/224 b/tests/qemu-iotests/224
index e91fb26fd8eb..94e412a680df 100755
--- a/tests/qemu-iotests/224
+++ b/tests/qemu-iotests/224
@@ -49,9 +49,9 @@ for filter_node_name in False, True:
         assert qemu_img('create', '-f', iotests.imgfmt,
                         base_img_path, '64M') == 0
         assert qemu_img('create', '-f', iotests.imgfmt, '-b', base_img_path,
-                        mid_img_path) == 0
+                        '-F', iotests.imgfmt, mid_img_path) == 0
         assert qemu_img('create', '-f', iotests.imgfmt, '-b', mid_img_path,
-                        top_img_path) == 0
+                        '-F', iotests.imgfmt, top_img_path) == 0

         # Something to commit
         assert qemu_io_silent(mid_img_path, '-c', 'write -P 1 0 1M') == 0
diff --git a/tests/qemu-iotests/225 b/tests/qemu-iotests/225
index c9a334c7e998..0186ec815660 100755
--- a/tests/qemu-iotests/225
+++ b/tests/qemu-iotests/225
@@ -48,7 +48,7 @@ _unsupported_imgopts "subformat=monolithicFlat" \

 TEST_IMG="$TEST_IMG.base" _make_test_img 1M
 TEST_IMG="$TEST_IMG.not_base" _make_test_img 1M
-_make_test_img -b "$TEST_IMG.base"
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT

 make_opts()
 {
diff --git a/tests/qemu-iotests/225.out b/tests/qemu-iotests/225.out
index 4dc8ee282fad..0998ae094c2b 100644
--- a/tests/qemu-iotests/225.out
+++ b/tests/qemu-iotests/225.out
@@ -1,7 +1,7 @@
 QA output created by 225
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=1048576
 Formatting 'TEST_DIR/t.IMGFMT.not_base', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT

 === Testing fitting VMDK backing image ===

diff --git a/tests/qemu-iotests/228 b/tests/qemu-iotests/228
index 64bc82ee2346..98e92f750249 100755
--- a/tests/qemu-iotests/228
+++ b/tests/qemu-iotests/228
@@ -54,7 +54,8 @@ with iotests.FilePath('base.img') as base_img_path, \
     assert qemu_img('create', '-f', iotests.imgfmt, base_img_path, '64M') == 0
     # Choose a funny way to describe the backing filename
     assert qemu_img('create', '-f', iotests.imgfmt, '-b',
-                    'file:' + base_img_path, top_img_path) == 0
+                    'file:' + base_img_path, '-F', iotests.imgfmt,
+                    top_img_path) == 0

     vm.launch()

@@ -169,7 +170,7 @@ with iotests.FilePath('base.img') as base_img_path, \
     # filename unless the backing file is opened implicitly with the
     # overlay)
     assert qemu_img('create', '-f', iotests.imgfmt, '-b', base_img_path,
-                    top_img_path) == 0
+                    '-F', iotests.imgfmt, top_img_path) == 0

     # You can only reliably override backing options by using a node
     # reference (or by specifying file.filename, but, well...)
diff --git a/tests/qemu-iotests/245 b/tests/qemu-iotests/245
index 1001275a4451..a3badee77043 100755
--- a/tests/qemu-iotests/245
+++ b/tests/qemu-iotests/245
@@ -44,7 +44,8 @@ class TestBlockdevReopen(iotests.QMPTestCase):

     def setUp(self):
         qemu_img('create', '-f', iotests.imgfmt, hd_path[0], '3M')
-        qemu_img('create', '-f', iotests.imgfmt, '-b', hd_path[0], hd_path[1])
+        qemu_img('create', '-f', iotests.imgfmt, '-b', hd_path[0],
+                 '-F', iotests.imgfmt, hd_path[1])
         qemu_img('create', '-f', iotests.imgfmt, hd_path[2], '3M')
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xa0  0 1M', hd_path[0])
         qemu_io('-f', iotests.imgfmt, '-c', 'write -P 0xa1 1M 1M', hd_path[1])
diff --git a/tests/qemu-iotests/249 b/tests/qemu-iotests/249
index 2b99c9789ed2..68f13ed32896 100755
--- a/tests/qemu-iotests/249
+++ b/tests/qemu-iotests/249
@@ -49,8 +49,8 @@ IMG_SIZE=1M

 # Create the images: base <- int <- active
 TEST_IMG="$TEST_IMG.base" _make_test_img $IMG_SIZE | _filter_imgfmt
-TEST_IMG="$TEST_IMG.int" _make_test_img -b "$TEST_IMG.base" | _filter_imgfmt
-_make_test_img -b "$TEST_IMG.int" | _filter_imgfmt
+TEST_IMG="$TEST_IMG.int" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT | _filter_imgfmt
+_make_test_img -b "$TEST_IMG.int" -F $IMGFMT | _filter_imgfmt

 # Launch QEMU with these two drives:
 # none0: base (read-only)
diff --git a/tests/qemu-iotests/249.out b/tests/qemu-iotests/249.out
index 51307ed0f795..85acda4635b3 100644
--- a/tests/qemu-iotests/249.out
+++ b/tests/qemu-iotests/249.out
@@ -1,7 +1,7 @@
 QA output created by 249
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=1048576
-Formatting 'TEST_DIR/t.IMGFMT.int', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.int
+Formatting 'TEST_DIR/t.IMGFMT.int', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=1048576 backing_file=TEST_DIR/t.IMGFMT.int backing_fmt=IMGFMT
 { 'execute': 'qmp_capabilities' }
 {"return": {}}

diff --git a/tests/qemu-iotests/252 b/tests/qemu-iotests/252
index 83280c1715dc..6662f4c9dec7 100755
--- a/tests/qemu-iotests/252
+++ b/tests/qemu-iotests/252
@@ -101,7 +101,7 @@ $QEMU_IMG map --output=json "$TEST_IMG" | _filter_qemu_img_map

 echo

-$QEMU_IMG rebase -b "$TEST_IMG.base_new" "$TEST_IMG"
+$QEMU_IMG rebase -b "$TEST_IMG.base_new" -F $IMGFMT "$TEST_IMG"

 # Verify the data is correct
 $QEMU_IO "$TEST_IMG" \
diff --git a/tests/qemu-iotests/257 b/tests/qemu-iotests/257
index 004a433b8be2..e1e60772195e 100755
--- a/tests/qemu-iotests/257
+++ b/tests/qemu-iotests/257
@@ -238,7 +238,8 @@ def compare_images(image, reference, baseimg=None, expected_match=True):
     """
     expected_ret = 0 if expected_match else 1
     if baseimg:
-        assert qemu_img("rebase", "-u", "-b", baseimg, image) == 0
+        assert qemu_img("rebase", "-u", "-b", baseimg, '-F', iotests.imgfmt,
+                        image) == 0
     ret = qemu_img("compare", image, reference)
     log('qemu_img compare "{:s}" "{:s}" ==> {:s}, {:s}'.format(
         image, reference,
diff --git a/tests/qemu-iotests/267 b/tests/qemu-iotests/267
index 3146273eef33..e44be49c771d 100755
--- a/tests/qemu-iotests/267
+++ b/tests/qemu-iotests/267
@@ -73,7 +73,7 @@ size=128M
 run_test()
 {
     if [ -n "$BACKING_FILE" ]; then
-        _make_test_img -b "$BACKING_FILE" $size
+        _make_test_img -b "$BACKING_FILE" -F $IMGFMT $size
     else
         _make_test_img $size
     fi
@@ -149,7 +149,7 @@ echo
 echo "=== -blockdev with NBD server on the backing file ==="
 echo

-_make_test_img -b "$TEST_IMG.base" $size
+_make_test_img -b "$TEST_IMG.base" -F $IMGFMT $size
 cat <<EOF |
 nbd_server_start unix:$SOCK_DIR/nbd
 nbd_server_add -w backing-fmt
diff --git a/tests/qemu-iotests/267.out b/tests/qemu-iotests/267.out
index 8dddb4baa443..d6d80c099f94 100644
--- a/tests/qemu-iotests/267.out
+++ b/tests/qemu-iotests/267.out
@@ -128,7 +128,7 @@ ID        TAG                 VM SIZE                DATE       VM CLOCK
 === -blockdev with a backing file ===

 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=134217728
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Testing: -blockdev driver=file,filename=TEST_DIR/t.IMGFMT.base,node-name=backing-file -blockdev driver=file,filename=TEST_DIR/t.IMGFMT,node-name=file -blockdev driver=IMGFMT,file=file,backing=backing-file,node-name=fmt
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm snap0
@@ -139,7 +139,7 @@ ID        TAG                 VM SIZE                DATE       VM CLOCK
 (qemu) loadvm snap0
 (qemu) quit

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Testing: -blockdev driver=file,filename=TEST_DIR/t.IMGFMT.base,node-name=backing-file -blockdev driver=IMGFMT,file=backing-file,node-name=backing-fmt -blockdev driver=file,filename=TEST_DIR/t.IMGFMT,node-name=file -blockdev driver=IMGFMT,file=file,backing=backing-fmt,node-name=fmt
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) savevm snap0
@@ -158,7 +158,7 @@ Internal snapshots on backing file:

 === -blockdev with NBD server on the backing file ===

-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=134217728 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
 Testing: -blockdev driver=file,filename=TEST_DIR/t.IMGFMT.base,node-name=backing-file -blockdev driver=IMGFMT,file=backing-file,node-name=backing-fmt -blockdev driver=file,filename=TEST_DIR/t.IMGFMT,node-name=file -blockdev driver=IMGFMT,file=file,backing=backing-fmt,node-name=fmt
 QEMU X.Y.Z monitor - type 'help' for more information
 (qemu) nbd_server_start unix:SOCK_DIR/nbd
diff --git a/tests/qemu-iotests/270 b/tests/qemu-iotests/270
index b9a12b908c3e..00339c0f7833 100755
--- a/tests/qemu-iotests/270
+++ b/tests/qemu-iotests/270
@@ -53,7 +53,7 @@ $QEMU_IO -c 'write 0 512' "$TEST_IMG.base" | _filter_qemu_io
 # We need a large cluster size, see below for why (above the $QEMU_IO
 # invocation)
 _make_test_img -o cluster_size=2M,data_file="$TEST_IMG.orig" \
-    -b "$TEST_IMG.base" 4G
+    -b "$TEST_IMG.base" -F $IMGFMT 4G

 # We want a null-co as the data file, because it allows us to quickly
 # "write" 2G of data without using any space.
diff --git a/tests/qemu-iotests/270.out b/tests/qemu-iotests/270.out
index c7be1110142f..6dc3b23d5bfa 100644
--- a/tests/qemu-iotests/270.out
+++ b/tests/qemu-iotests/270.out
@@ -2,7 +2,7 @@ QA output created by 270
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=4294967296
 wrote 512/512 bytes at offset 0
 512 bytes, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294967296 backing_file=TEST_DIR/t.IMGFMT.base data_file=TEST_DIR/t.IMGFMT.orig
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=4294967296 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT data_file=TEST_DIR/t.IMGFMT.orig
 wrote 2147483136/2147483136 bytes at offset 768
 2 GiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 No errors were found on the image.
diff --git a/tests/qemu-iotests/273 b/tests/qemu-iotests/273
index 00ff79bcf8f8..41ffbf39c4ef 100755
--- a/tests/qemu-iotests/273
+++ b/tests/qemu-iotests/273
@@ -56,8 +56,8 @@ run_qemu()
 }

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
-TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base"
-_make_test_img -b "$TEST_IMG.mid"
+TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT
+_make_test_img -b "$TEST_IMG.mid" -F $IMGFMT

 run_qemu \
     -blockdev file,node-name=base,filename="$TEST_IMG.base" \
diff --git a/tests/qemu-iotests/273.out b/tests/qemu-iotests/273.out
index 684b8d6f777e..87d475850387 100644
--- a/tests/qemu-iotests/273.out
+++ b/tests/qemu-iotests/273.out
@@ -1,7 +1,7 @@
 QA output created by 273
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
+Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT
 Testing: -blockdev file,node-name=base,filename=TEST_DIR/t.IMGFMT.base -blockdev file,node-name=midf,filename=TEST_DIR/t.IMGFMT.mid -blockdev {"driver":"IMGFMT","node-name":"mid","file":"midf","backing":null} -blockdev file,node-name=topf,filename=TEST_DIR/t.IMGFMT -blockdev {"driver":"IMGFMT","file":"topf","node-name":"top","backing":null}
 {
     QMP_VERSION
diff --git a/tests/qemu-iotests/279 b/tests/qemu-iotests/279
index 30d29b1cb2aa..5272c8fcfe0d 100755
--- a/tests/qemu-iotests/279
+++ b/tests/qemu-iotests/279
@@ -42,8 +42,8 @@ _unsupported_imgopts "subformat=monolithicFlat" \
                      "subformat=twoGbMaxExtentFlat" \

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
-TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base"
-_make_test_img -b "$TEST_IMG.mid"
+TEST_IMG="$TEST_IMG.mid" _make_test_img -b "$TEST_IMG.base" -F $IMGFMT
+_make_test_img -b "$TEST_IMG.mid" -F $IMGFMT

 echo
 echo '== qemu-img info --backing-chain =='
diff --git a/tests/qemu-iotests/279.out b/tests/qemu-iotests/279.out
index f4dc6c69cbb3..adb2e47a1a9c 100644
--- a/tests/qemu-iotests/279.out
+++ b/tests/qemu-iotests/279.out
@@ -1,7 +1,7 @@
 QA output created by 279
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
-Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
-Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid
+Formatting 'TEST_DIR/t.IMGFMT.mid', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base backing_fmt=IMGFMT
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.mid backing_fmt=IMGFMT

 == qemu-img info --backing-chain ==
 image: TEST_DIR/t.IMGFMT
-- 
2.25.1

[PATCH v3 3/4] block: Add support to warn on backing file change without format

[Eric Blake]

For now, this is a mechanical addition; all callers pass false. But
the next patch will use it to improve 'qemu-img rebase -u' when
selecting a backing file with no format.

Signed-off-by: Eric Blake <eblake@redhat.com>
Reviewed-by: Peter Krempa <pkrempa@redhat.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
---
 include/block/block.h |  4 ++--
 block.c               | 13 ++++++++++---
 block/qcow2.c         |  2 +-
 block/stream.c        |  2 +-
 blockdev.c            |  3 ++-
 qemu-img.c            |  4 ++--
 6 files changed, 18 insertions(+), 10 deletions(-)

diff --git a/include/block/block.h b/include/block/block.h
index cd6b5b95aad2..8b1dd94f7629 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -350,8 +350,8 @@ BlockMeasureInfo *bdrv_measure(BlockDriver *drv, QemuOpts *opts,
 void bdrv_get_geometry(BlockDriverState *bs, uint64_t *nb_sectors_ptr);
 void bdrv_refresh_limits(BlockDriverState *bs, Error **errp);
 int bdrv_commit(BlockDriverState *bs);
-int bdrv_change_backing_file(BlockDriverState *bs,
-    const char *backing_file, const char *backing_fmt);
+int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
+                             const char *backing_fmt, bool warn);
 void bdrv_register(BlockDriver *bdrv);
 int bdrv_drop_intermediate(BlockDriverState *top, BlockDriverState *base,
                            const char *backing_file_str);
diff --git a/block.c b/block.c
index 957630b1c5d5..43452976acdc 100644
--- a/block.c
+++ b/block.c
@@ -1291,7 +1291,8 @@ static int bdrv_backing_update_filename(BdrvChild *c, BlockDriverState *base,
     }

     ret = bdrv_change_backing_file(parent, filename,
-                                   base->drv ? base->drv->format_name : "");
+                                   base->drv ? base->drv->format_name : "",
+                                   false);
     if (ret < 0) {
         error_setg_errno(errp, -ret, "Could not update backing file link");
     }
@@ -4535,8 +4536,8 @@ int bdrv_check(BlockDriverState *bs,
  *            image file header
  * -ENOTSUP - format driver doesn't support changing the backing file
  */
-int bdrv_change_backing_file(BlockDriverState *bs,
-    const char *backing_file, const char *backing_fmt)
+int bdrv_change_backing_file(BlockDriverState *bs, const char *backing_file,
+                             const char *backing_fmt, bool warn)
 {
     BlockDriver *drv = bs->drv;
     int ret;
@@ -4550,6 +4551,12 @@ int bdrv_change_backing_file(BlockDriverState *bs,
         return -EINVAL;
     }

+    if (warn && backing_file && !backing_fmt) {
+        warn_report("Deprecated use of backing file without explicit "
+                    "backing format, use of this image requires "
+                    "potentially unsafe format probing");
+    }
+
     if (drv->bdrv_change_backing_file != NULL) {
         ret = drv->bdrv_change_backing_file(bs, backing_file, backing_fmt);
     } else {
diff --git a/block/qcow2.c b/block/qcow2.c
index 3640e8c07d0a..0abd6073fc34 100644
--- a/block/qcow2.c
+++ b/block/qcow2.c
@@ -3506,7 +3506,7 @@ qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
         }

         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
-                                       backing_format);
+                                       backing_format, false);
         if (ret < 0) {
             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
                              "with format '%s'", qcow2_opts->backing_file,
diff --git a/block/stream.c b/block/stream.c
index 5562ccbf577a..7c4d8ee0bcf1 100644
--- a/block/stream.c
+++ b/block/stream.c
@@ -78,7 +78,7 @@ static int stream_prepare(Job *job)
             }
         }
         bdrv_set_backing_hd(bs, base, &local_err);
-        ret = bdrv_change_backing_file(bs, base_id, base_fmt);
+        ret = bdrv_change_backing_file(bs, base_id, base_fmt, false);
         if (local_err) {
             error_report_err(local_err);
             return -EPERM;
diff --git a/blockdev.c b/blockdev.c
index 3e44fa766b8f..c961df4c76b9 100644
--- a/blockdev.c
+++ b/blockdev.c
@@ -3796,7 +3796,8 @@ void qmp_change_backing_file(const char *device,
     }

     ret = bdrv_change_backing_file(image_bs, backing_file,
-                               image_bs->drv ? image_bs->drv->format_name : "");
+                                   image_bs->drv ? image_bs->drv->format_name : "",
+                                   false);

     if (ret < 0) {
         error_setg_errno(errp, -ret, "Could not change backing file to '%s'",
diff --git a/qemu-img.c b/qemu-img.c
index 804630a368d6..b9375427404d 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3637,9 +3637,9 @@ static int img_rebase(int argc, char **argv)
      * doesn't change when we switch the backing file.
      */
     if (out_baseimg && *out_baseimg) {
-        ret = bdrv_change_backing_file(bs, out_baseimg, out_basefmt);
+        ret = bdrv_change_backing_file(bs, out_baseimg, out_basefmt, false);
     } else {
-        ret = bdrv_change_backing_file(bs, NULL, NULL);
+        ret = bdrv_change_backing_file(bs, NULL, NULL, false);
     }

     if (ret == -ENOSPC) {
-- 
2.25.1

[PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Eric Blake]

Creating an image that requires format probing of the backing image is
inherently unsafe (we've had several CVEs over the years based on
probes leaking information to the guest on a subsequent boot, although
these days tools like libvirt are aware of the issue enough to prevent
the worst effects).  However, if our probing algorithm ever changes,
or if other tools like libvirt determine a different probe result than
we do, then subsequent use of that backing file under a different
format will present corrupted data to the guest.  Start a deprecation
clock so that future qemu-img can refuse to create unsafe backing
chains that would rely on probing.  The warnings are intentionally
emitted from the block layer rather than qemu-img (thus, all paths
into image creation or rewriting perform the check).

However, there is one time where probing is safe: if we probe raw,
then it is safe to record that implicitly in the image (but we still
warn, as it's better to teach the user to supply -F always than to
make them guess when it is safe).

iotest 114 specifically wants to create an unsafe image for later
amendment rather than defaulting to our new default of recording a
probed format, so it needs an update.  While touching it, expand it to
cover all of the various warnings enabled by this patch.

Signed-off-by: Eric Blake <eblake@redhat.com>
---
 docs/system/deprecated.rst | 19 +++++++++++++++++++
 block.c                    | 21 ++++++++++++++++++++-
 qemu-img.c                 |  2 +-
 tests/qemu-iotests/114     | 11 +++++++++++
 tests/qemu-iotests/114.out |  8 ++++++++
 5 files changed, 59 insertions(+), 2 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index 6c1d9034d9e3..a8ffacf54a52 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -376,6 +376,25 @@ The above, converted to the current supported format::
 Related binaries
 ----------------

+qemu-img backing file without format (since 5.0.0)
+''''''''''''''''''''''''''''''''''''''''''''''''''
+
+The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
+convert``, or ``qemu-img amend`` to create or modify an image that
+depends on a backing file now recommends that an explicit backing
+format be provided.  This is for safety: if qemu probes a different
+format than what you thought, the data presented to the guest will be
+corrupt; similarly, presenting a raw image to a guest allows a
+potential security exploit if a future probe sees a non-raw image
+based on guest writes.  To avoid the warning message, or even future
+refusal to create an unsafe image, you must pass ``-o backing_fmt=``
+(or the shorthand ``-F`` during create) to specify the intended
+backing format.  You may use ``qemu-img rebase -u`` to retroactively
+add a backing format to an existing image.  However, be aware that
+there are already potential security risks to blindly using ``qemu-img
+info`` to probe the format of an untrusted backing image, when
+deciding what format to add into an existing image.
+
 ``qemu-img convert -n -o`` (since 4.2.0)
 ''''''''''''''''''''''''''''''''''''''''

diff --git a/block.c b/block.c
index 43452976acdc..ad49d515809c 100644
--- a/block.c
+++ b/block.c
@@ -6039,6 +6039,20 @@ void bdrv_img_create(const char *filename, const char *fmt,
                               "Could not open backing image to determine size.\n");
             goto out;
         } else {
+            if (!backing_fmt) {
+                warn_report("Deprecated use of backing file without explicit "
+                            "backing format (detected format of %s)",
+                            bs->drv->format_name);
+                if (bs->drv == &bdrv_raw) {
+                    /*
+                     * A probe of raw is always correct, so in this one
+                     * case, we can write that into the image.
+                     */
+                    backing_fmt = bs->drv->format_name;
+                    qemu_opt_set(opts, BLOCK_OPT_BACKING_FMT, backing_fmt,
+                                 NULL);
+                }
+            }
             if (size == -1) {
                 /* Opened BS, have no size */
                 size = bdrv_getlength(bs);
@@ -6052,7 +6066,12 @@ void bdrv_img_create(const char *filename, const char *fmt,
             }
             bdrv_unref(bs);
         }
-    } /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
+        /* (backing_file && !(flags & BDRV_O_NO_BACKING)) */
+    } else if (backing_file && !backing_fmt) {
+        warn_report("Deprecated use of unopened backing file without "
+                    "explicit backing format, use of this image requires "
+                    "potentially unsafe format probing");
+    }

     if (size == -1) {
         error_setg(errp, "Image creation needs a size parameter");
diff --git a/qemu-img.c b/qemu-img.c
index b9375427404d..48424f8dbcd4 100644
--- a/qemu-img.c
+++ b/qemu-img.c
@@ -3637,7 +3637,7 @@ static int img_rebase(int argc, char **argv)
      * doesn't change when we switch the backing file.
      */
     if (out_baseimg && *out_baseimg) {
-        ret = bdrv_change_backing_file(bs, out_baseimg, out_basefmt, false);
+        ret = bdrv_change_backing_file(bs, out_baseimg, out_basefmt, true);
     } else {
         ret = bdrv_change_backing_file(bs, NULL, NULL, false);
     }
diff --git a/tests/qemu-iotests/114 b/tests/qemu-iotests/114
index 26104fff6c67..5b06eab0ceee 100755
--- a/tests/qemu-iotests/114
+++ b/tests/qemu-iotests/114
@@ -42,9 +42,15 @@ _unsupported_proto vxhs
 # qcow2.py does not work too well with external data files
 _unsupported_imgopts data_file

+# Intentionally specify backing file without backing format; demonstrate
+# the difference in warning messages when backing file could be probed.
+# Note that only a raw probe result will affect the resulting image.
+truncate --size=64M "$TEST_IMG.orig"
+_make_test_img -b "$TEST_IMG.orig" 64M

 TEST_IMG="$TEST_IMG.base" _make_test_img 64M
 _make_test_img -b "$TEST_IMG.base" 64M
+_make_test_img -u -b "$TEST_IMG.base" 64M

 # Set an invalid backing file format
 $PYTHON qcow2.py "$TEST_IMG" add-header-ext 0xE2792ACA "foo"
@@ -55,6 +61,11 @@ _img_info
 $QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
 $QEMU_IO -c "open -o backing.driver=$IMGFMT $TEST_IMG" -c "read 0 4k" | _filter_qemu_io

+# Rebase the image, to show that omitting backing format triggers a warning,
+# but probing now lets us use the backing file.
+$QEMU_IMG rebase -u -b "$TEST_IMG.base" "$TEST_IMG"
+$QEMU_IO -c "open $TEST_IMG" -c "read 0 4k" 2>&1 | _filter_qemu_io | _filter_testdir
+
 # success, all done
 echo '*** done'
 rm -f $seq.full
diff --git a/tests/qemu-iotests/114.out b/tests/qemu-iotests/114.out
index 67adef37a4f6..59673abcd5e3 100644
--- a/tests/qemu-iotests/114.out
+++ b/tests/qemu-iotests/114.out
@@ -1,5 +1,10 @@
 QA output created by 114
+qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.orig backing_fmt=raw
 Formatting 'TEST_DIR/t.IMGFMT.base', fmt=IMGFMT size=67108864
+qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of IMGFMT)
+Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
+qemu-img: warning: Deprecated use of unopened backing file without explicit backing format, use of this image requires potentially unsafe format probing
 Formatting 'TEST_DIR/t.IMGFMT', fmt=IMGFMT size=67108864 backing_file=TEST_DIR/t.IMGFMT.base
 image: TEST_DIR/t.IMGFMT
 file format: IMGFMT
@@ -11,4 +16,7 @@ qemu-io: can't open device TEST_DIR/t.qcow2: Could not open backing file: Unknow
 no file open, try 'help open'
 read 4096/4096 bytes at offset 0
 4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
+qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing
+read 4096/4096 bytes at offset 0
+4 KiB, X ops; XX:XX:XX.X (XXX YYY/sec and XXX ops/sec)
 *** done
-- 
2.25.1

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Kashyap Chamarthy]

On Fri, Mar 06, 2020 at 04:51:21PM -0600, Eric Blake wrote:
> Creating an image that requires format probing of the backing image is
> inherently unsafe (we've had several CVEs over the years based on
> probes leaking information to the guest on a subsequent boot, although
> these days tools like libvirt are aware of the issue enough to prevent
> the worst effects).  However, if our probing algorithm ever changes,
> or if other tools like libvirt determine a different probe result than
> we do, then subsequent use of that backing file under a different
> format will present corrupted data to the guest.  Start a deprecation
> clock so that future qemu-img can refuse to create unsafe backing
> chains that would rely on probing.  The warnings are intentionally
> emitted from the block layer rather than qemu-img (thus, all paths
> into image creation or rewriting perform the check).

I happily welcome this change.  I'm going around and fixing various docs
of differnt projects that create overlays without explicitly spelling
out backing files.  (FWIW, I also make sure to mention this, in context,
in all QEMU-related talks I give publicliy.)

This proactive action from QEMU will definitely help.

> However, there is one time where probing is safe: if we probe raw,
> then it is safe to record that implicitly in the image (but we still
> warn, as it's better to teach the user to supply -F always than to
> make them guess when it is safe).
> 
> iotest 114 specifically wants to create an unsafe image for later
> amendment rather than defaulting to our new default of recording a
> probed format, so it needs an update.  While touching it, expand it to
> cover all of the various warnings enabled by this patch.
> 
> Signed-off-by: Eric Blake <eblake@redhat.com>
> ---
>  docs/system/deprecated.rst | 19 +++++++++++++++++++
>  block.c                    | 21 ++++++++++++++++++++-
>  qemu-img.c                 |  2 +-
>  tests/qemu-iotests/114     | 11 +++++++++++
>  tests/qemu-iotests/114.out |  8 ++++++++
>  5 files changed, 59 insertions(+), 2 deletions(-)

Before (with: qemu-4.2.0-2.fc30):

    $> qemu-img create -f qcow2 -b ./base.raw ./overlay1.qcow2
    Formatting './overlay1.qcow2', fmt=qcow2 size=4294967296 backing_file=./base.raw cluster_size=65536 lazy_refcounts=off refcount_bits=16

After (with the patch series applied to QEMU Git):

    $> git describe
    v4.2.0-2204-gd6c7830114

    # Create; *without* specifying "-F raw"
    $> ~/build/qemu/qemu-img create -f qcow2 -b ./base.raw ./overlay2.qcow2
    qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
    Formatting './overlay2.qcow2', fmt=qcow2 size=4294967296 backing_file=./base.raw backing_fmt=raw cluster_size=65536 lazy_refcounts=off refcount_bits=16

    # Rebase; *without* specifying "-F raw"
    $> ~/build/qemu/qemu-img rebase -b base.raw overlay1.qcow2
    qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing


However, for the "Convert" case, is it correct that no warning is thrown
for the below?

    $> ~/build/qemu/qemu-img info overlay1.qcow2 
    image: overlay1.qcow2
    file format: qcow2
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 196 KiB
    cluster_size: 65536
    backing file: base.raw
    Format specific information:
        compat: 1.1
        lazy refcounts: false
        refcount bits: 16
        corrupt: false
    
    
    $> ~/build/qemu/qemu-img convert -f qcow2 -O qcow2 overlay1.qcow2 flattened.raw

    $> echo $?
    0

> diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
> index 6c1d9034d9e3..a8ffacf54a52 100644
> --- a/docs/system/deprecated.rst
> +++ b/docs/system/deprecated.rst
> @@ -376,6 +376,25 @@ The above, converted to the current supported format::
>  Related binaries
>  ----------------
> 
> +qemu-img backing file without format (since 5.0.0)
> +''''''''''''''''''''''''''''''''''''''''''''''''''
> +
> +The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
> +convert``, or ``qemu-img amend`` to create or modify an image that
> +depends on a backing file now recommends that an explicit backing
> +format be provided.  This is for safety: if qemu probes a different
> +format than what you thought, the data presented to the guest will be
> +corrupt; similarly, presenting a raw image to a guest allows a
> +potential security exploit if a future probe sees a non-raw image
> +based on guest writes.  To avoid the warning message, or even future
> +refusal to create an unsafe image, you must pass ``-o backing_fmt=``
> +(or the shorthand ``-F`` during create) to specify the intended
> +backing format.  You may use ``qemu-img rebase -u`` to retroactively
> +add a backing format to an existing image.  However, be aware that
> +there are already potential security risks to blindly using ``qemu-img
> +info`` to probe the format of an untrusted backing image, when
> +deciding what format to add into an existing image.

Nit: s/qemu/QEMU/g/

Ultra Nit: should this paragraph be broken down into two?  Experience
tells people usually feel deterred read "substantial paragraphs" :-)

I'll report back the Amend case.  (And once I get clarification on the
Convert scenario, I'll be happy to give Tested-by.)

[...]

-- 
/kashyap

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Eric Blake]

On 3/9/20 10:31 AM, Kashyap Chamarthy wrote:

> After (with the patch series applied to QEMU Git):
> 
>      $> git describe
>      v4.2.0-2204-gd6c7830114
> 
>      # Create; *without* specifying "-F raw"
>      $> ~/build/qemu/qemu-img create -f qcow2 -b ./base.raw ./overlay2.qcow2
>      qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
>      Formatting './overlay2.qcow2', fmt=qcow2 size=4294967296 backing_file=./base.raw backing_fmt=raw cluster_size=65536 lazy_refcounts=off refcount_bits=16

If you'll note, this case _did_ write an implied backing_fmt=raw into 
the image.  Constrast that with creating an image on a qcow2 backing 
file, which tells you it detected a format of qcow2, but does NOT write 
backing_fmt=qcow2 into the image (this was a change from v2, at Peter's 
request).  Thus, when the backing is raw, we warn but future use of the 
image is now safe where it previously was not; when the backing file is 
non-raw, we warn but do not change our behavior, but because the backing 
file is non-raw any future probes will not be any less safe than before.

> 
>      # Rebase; *without* specifying "-F raw"
>      $> ~/build/qemu/qemu-img rebase -b base.raw overlay1.qcow2
>      qemu-img: warning: Deprecated use of backing file without explicit backing format, use of this image requires potentially unsafe format probing
> 
> 
> However, for the "Convert" case, is it correct that no warning is thrown
> for the below?
> 
>      $> ~/build/qemu/qemu-img info overlay1.qcow2
>      image: overlay1.qcow2
>      file format: qcow2
>      virtual size: 4 GiB (4294967296 bytes)
>      disk size: 196 KiB
>      cluster_size: 65536
>      backing file: base.raw
>      Format specific information:
>          compat: 1.1
>          lazy refcounts: false
>          refcount bits: 16
>          corrupt: false

We have an image with no backing format, so we had to probe.  This patch 
series did not change the behavior of opening an existing image, only 
for creating a new image (or amending an image in-place).  So the lack 
of a warning on opening the unsafe image may be desirable, but it would 
be via even more patches.

>      
>      
>      $> ~/build/qemu/qemu-img convert -f qcow2 -O qcow2 overlay1.qcow2 flattened.raw

Ouch - you are creating a qcow2 destination file named 'flattened.raw', 
which is rather confusing on your part.

However, as your destination file is being created without a backing 
image, it is to be expected that there is no warning (when there is no 
backing file, -F makes no sense).  To provoke the warning during 
convert, you'll have to also pass -B (or -o backing_file), without -o 
backing_fmt (since convert lacks the -F shorthand).

> 
>      $> echo $?
>      0
> 
>> diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
>> index 6c1d9034d9e3..a8ffacf54a52 100644
>> --- a/docs/system/deprecated.rst
>> +++ b/docs/system/deprecated.rst
>> @@ -376,6 +376,25 @@ The above, converted to the current supported format::
>>   Related binaries
>>   ----------------
>>
>> +qemu-img backing file without format (since 5.0.0)
>> +''''''''''''''''''''''''''''''''''''''''''''''''''
>> +
>> +The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
>> +convert``, or ``qemu-img amend`` to create or modify an image that
>> +depends on a backing file now recommends that an explicit backing
>> +format be provided.  This is for safety: if qemu probes a different
>> +format than what you thought, the data presented to the guest will be
>> +corrupt; similarly, presenting a raw image to a guest allows a
>> +potential security exploit if a future probe sees a non-raw image
>> +based on guest writes.  To avoid the warning message, or even future
>> +refusal to create an unsafe image, you must pass ``-o backing_fmt=``
>> +(or the shorthand ``-F`` during create) to specify the intended
>> +backing format.  You may use ``qemu-img rebase -u`` to retroactively
>> +add a backing format to an existing image.  However, be aware that
>> +there are already potential security risks to blindly using ``qemu-img
>> +info`` to probe the format of an untrusted backing image, when
>> +deciding what format to add into an existing image.
> 
> Nit: s/qemu/QEMU/g/
> 
> Ultra Nit: should this paragraph be broken down into two?  Experience
> tells people usually feel deterred read "substantial paragraphs" :-)

Could do, right before 'To avoid the warning'.

> 
> I'll report back the Amend case.  (And once I get clarification on the
> Convert scenario, I'll be happy to give Tested-by.)
> 
> [...]
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Kashyap Chamarthy]

On Mon, Mar 09, 2020 at 10:42:25AM -0500, Eric Blake wrote:
> On 3/9/20 10:31 AM, Kashyap Chamarthy wrote:
> 
> > After (with the patch series applied to QEMU Git):
> > 
> >      $> git describe
> >      v4.2.0-2204-gd6c7830114
> > 
> >      # Create; *without* specifying "-F raw"
> >      $> ~/build/qemu/qemu-img create -f qcow2 -b ./base.raw ./overlay2.qcow2
> >      qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of raw)
> >      Formatting './overlay2.qcow2', fmt=qcow2 size=4294967296 backing_file=./base.raw backing_fmt=raw cluster_size=65536 lazy_refcounts=off refcount_bits=16
> 
> If you'll note, this case _did_ write an implied backing_fmt=raw into the
> image.  

Ah, I missed to notice that.  Interesting.

> Constrast that with creating an image on a qcow2 backing file, which
> tells you it detected a format of qcow2, but does NOT write
> backing_fmt=qcow2 into the image (this was a change from v2, at Peter's
> request).  

Indeed, here we go, confirming the overlay of a QCOW2 backing file _not_
having the 'backing_fmt' written into the image:

    $> ~/build/qemu/qemu-img create -f qcow2 -b ./another_base.qcow2 ./overlay1_of_ab.qcow2
    qemu-img: warning: Deprecated use of backing file without explicit backing format (detected format of qcow2)
    Formatting './overlay1_of_ab.qcow2', fmt=qcow2 size=4294967296 backing_file=./another_base.qcow2 cluster_size=65536 lazy_refcounts=off refcount_bits=16

That's neat.

(I wonder if this bit should also be documented.)

> Thus, when the backing is raw, we warn but future use of the
> image is now safe where it previously was not; when the backing file is
> non-raw, we warn but do not change our behavior, but because the backing
> file is non-raw any future probes will not be any less safe than before.

Understood.  Easy to miss when not paying attention; thanks for pointing
it out.

[...]

> > However, for the "Convert" case, is it correct that no warning is thrown
> > for the below?
> > 
> >      $> ~/build/qemu/qemu-img info overlay1.qcow2
> >      image: overlay1.qcow2
> >      file format: qcow2
> >      virtual size: 4 GiB (4294967296 bytes)
> >      disk size: 196 KiB
> >      cluster_size: 65536
> >      backing file: base.raw
> >      Format specific information:
> >          compat: 1.1
> >          lazy refcounts: false
> >          refcount bits: 16
> >          corrupt: false
> 
> We have an image with no backing format, so we had to probe.  This patch
> series did not change the behavior of opening an existing image, only for
> creating a new image (or amending an image in-place).  So the lack of a
> warning on opening the unsafe image may be desirable, but it would be via
> even more patches.

Fair enough; it's an understandable compromise.

And your series is a strict improvement as-is; it should not be held up.

> 
> >      $> ~/build/qemu/qemu-img convert -f qcow2 -O qcow2 overlay1.qcow2 flattened.raw
> 
> Ouch - you are creating a qcow2 destination file named 'flattened.raw',
> which is rather confusing on your part.

Oops, yes it is; bad me.  Sorry for the mix-up.  I meant to amend the
format to 'raw'.

> However, as your destination file is being created without a backing image,
> it is to be expected that there is no warning (when there is no backing
> file, -F makes no sense).  

Yeah, fair enough.

> To provoke the warning during convert, you'll
> have to also pass -B (or -o backing_file), without -o backing_fmt (since
> convert lacks the -F shorthand).

Hmm, I tried the following way, but it doesn't provoke the warning:

    $> ~/build/qemu/qemu-img convert -B ./base.raw -O qcow2 overlay1.qcow2 flattened.qcow2

    $> ~/build/qemu/qemu-img info flattened.qcow2 
    image: flattened.qcow2
    file format: qcow2
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 196 KiB
    cluster_size: 65536
    backing file: ./base.raw
    Format specific information:
        compat: 1.1
        lazy refcounts: false
        refcount bits: 16
        corrupt: false

What am I missing?


            - - -

<digression>

Ah, didn't realize the inconsistency of 'convert' lacking the '-F'
shorthand ... which reminds me, there are at least _three_ ways that I
know of, to specify backing file format with 'create':

    $ qemu-img create -f qcow2 -o 'backing_file=./base.raw,backing_fmt=raw' ./overlay1.qcow2
    $ qemu-img create -f qcow2 -b ./base.raw -o backing_fmt=raw overlay1.qcow2
    $ qemu-img create -f qcow2 -b ./base.raw -F raw ./overlay1.qcow2

I'm wondering about the consistency of having all the above three
supported for other operations too.  Now I at least know 'convert' lacks
the "-F".

Not sure how much people care about this :-)

</digression>


[...]

-- 
/kashyap

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Eric Blake]

On 3/10/20 4:47 AM, Kashyap Chamarthy wrote:

>> To provoke the warning during convert, you'll
>> have to also pass -B (or -o backing_file), without -o backing_fmt (since
>> convert lacks the -F shorthand).
> 
> Hmm, I tried the following way, but it doesn't provoke the warning:
> 
>      $> ~/build/qemu/qemu-img convert -B ./base.raw -O qcow2 overlay1.qcow2 flattened.qcow2
> 
>      $> ~/build/qemu/qemu-img info flattened.qcow2
>      image: flattened.qcow2
>      file format: qcow2
>      virtual size: 4 GiB (4294967296 bytes)
>      disk size: 196 KiB
>      cluster_size: 65536
>      backing file: ./base.raw
>      Format specific information:
>          compat: 1.1
>          lazy refcounts: false
>          refcount bits: 16
>          corrupt: false
> 
> What am I missing?

Rather, it looks like my patch is missing a warning on that path.  I'll 
have to investigate, for v4.

> 
> 
>              - - -
> 
> <digression>
> 
> Ah, didn't realize the inconsistency of 'convert' lacking the '-F'
> shorthand ... which reminds me, there are at least _three_ ways that I
> know of, to specify backing file format with 'create':
> 
>      $ qemu-img create -f qcow2 -o 'backing_file=./base.raw,backing_fmt=raw' ./overlay1.qcow2
>      $ qemu-img create -f qcow2 -b ./base.raw -o backing_fmt=raw overlay1.qcow2
>      $ qemu-img create -f qcow2 -b ./base.raw -F raw ./overlay1.qcow2
> 
> I'm wondering about the consistency of having all the above three
> supported for other operations too.  Now I at least know 'convert' lacks
> the "-F".

The -o forms (backing_file= and backing_fmt=) always work.  Various 
commands then have additional shorthand: -b/-F for create, -B for 
convert.  You're right that we aren't very consistent, but I'm reluctant 
to change the inconsistencies in this patch (at one point in the past, 
we tried to get rid of the shorthand and force all users to go through 
-o, but that broke too many clients that were depending on the 
undocumented shorthand, so we documented the existing shorthand instead).

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Kashyap Chamarthy]

On Tue, Mar 10, 2020 at 07:15:29AM -0500, Eric Blake wrote:
> On 3/10/20 4:47 AM, Kashyap Chamarthy wrote:
 
[...]

> > <digression>
> > 
> > Ah, didn't realize the inconsistency of 'convert' lacking the '-F'
> > shorthand ... which reminds me, there are at least _three_ ways that I
> > know of, to specify backing file format with 'create':
> > 
> >      $ qemu-img create -f qcow2 -o 'backing_file=./base.raw,backing_fmt=raw' ./overlay1.qcow2
> >      $ qemu-img create -f qcow2 -b ./base.raw -o backing_fmt=raw overlay1.qcow2
> >      $ qemu-img create -f qcow2 -b ./base.raw -F raw ./overlay1.qcow2
> > 
> > I'm wondering about the consistency of having all the above three
> > supported for other operations too.  Now I at least know 'convert' lacks
> > the "-F".
> 
> The -o forms (backing_file= and backing_fmt=) always work.  Various commands
> then have additional shorthand: -b/-F for create, -B for convert.  You're
> right that we aren't very consistent, but I'm reluctant to change the
> inconsistencies in this patch 

Oh, I wasn't implying to tackle the inconsistency as part of this
patch, or series.  Hence the 'digression' :-)  Was just wondering out
loud.

> (at one point in the past, we tried to get rid
> of the shorthand and force all users to go through -o, but that broke too
> many clients that were depending on the undocumented shorthand, so we
> documented the existing shorthand instead).

Fair enough; let's not touch these things for now.

-- 
/kashyap

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Kashyap Chamarthy]

On Mon, Mar 09, 2020 at 10:42:25AM -0500, Eric Blake wrote:

[...]

> > > +qemu-img backing file without format (since 5.0.0)
> > > +''''''''''''''''''''''''''''''''''''''''''''''''''
> > > +
> > > +The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
> > > +convert``, or ``qemu-img amend`` to create or modify an image that
> > > +depends on a backing file now recommends that an explicit backing
> > > +format be provided.

Also for the `qemu-img amend` case, I'm not clear if the following scenario
ought to throw the warning:

    $> ~/build/qemu/qemu-img info --backing-chain overlay1.qcow2 
    image: overlay1.qcow2
    file format: qcow2
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 196 KiB
    cluster_size: 65536
    backing file: base.raw
    Format specific information:
        compat: 1.1
        lazy refcounts: false
        refcount bits: 16
        corrupt: false
    
    image: base.raw
    file format: raw
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 778 MiB

    $> ~/build/qemu/qemu-img amend -o compat=v3 overlay1.qcow2 

    $> echo $?
    0

I'm just trying to work out the scenarios where the warnings ought to
show up (for all the four cases: create, rebase, convert, amend).

[...]

-- 
/kashyap

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Eric Blake]

On 3/10/20 5:57 AM, Kashyap Chamarthy wrote:
> On Mon, Mar 09, 2020 at 10:42:25AM -0500, Eric Blake wrote:
> 
> [...]
> 
>>>> +qemu-img backing file without format (since 5.0.0)
>>>> +''''''''''''''''''''''''''''''''''''''''''''''''''
>>>> +
>>>> +The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
>>>> +convert``, or ``qemu-img amend`` to create or modify an image that
>>>> +depends on a backing file now recommends that an explicit backing
>>>> +format be provided.
> 
> Also for the `qemu-img amend` case, I'm not clear if the following scenario
> ought to throw the warning:
> 
>      $> ~/build/qemu/qemu-img info --backing-chain overlay1.qcow2
>      image: overlay1.qcow2
>      file format: qcow2
>      virtual size: 4 GiB (4294967296 bytes)
>      disk size: 196 KiB
>      cluster_size: 65536
>      backing file: base.raw
>      Format specific information:
>          compat: 1.1
>          lazy refcounts: false
>          refcount bits: 16
>          corrupt: false
>      
>      image: base.raw
>      file format: raw
>      virtual size: 4 GiB (4294967296 bytes)
>      disk size: 778 MiB
> 
>      $> ~/build/qemu/qemu-img amend -o compat=v3 overlay1.qcow2

This particular amend is not changing the backing file, and since I did 
not add warnings on the opening of an existing unsafe image, it is 
silent.  Instead, you need to test a case where amend provokes a path 
that would change the backing file (perhaps as simple as '-o 
backing_file=./base.raw'), while omitting a format for the new backing 
file string.

> 
>      $> echo $?
>      0
> 
> I'm just trying to work out the scenarios where the warnings ought to
> show up (for all the four cases: create, rebase, convert, amend).
> 
> [...]
> 

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Eric Blake]

On 3/10/20 5:57 AM, Kashyap Chamarthy wrote:
> On Mon, Mar 09, 2020 at 10:42:25AM -0500, Eric Blake wrote:
> 
> [...]
> 
>>>> +qemu-img backing file without format (since 5.0.0)
>>>> +''''''''''''''''''''''''''''''''''''''''''''''''''
>>>> +
>>>> +The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
>>>> +convert``, or ``qemu-img amend`` to create or modify an image that
>>>> +depends on a backing file now recommends that an explicit backing
>>>> +format be provided.
> 
> Also for the `qemu-img amend` case, I'm not clear if the following scenario
> ought to throw the warning:
> 
>      $> ~/build/qemu/qemu-img info --backing-chain overlay1.qcow2
>      image: overlay1.qcow2
>      file format: qcow2
>      virtual size: 4 GiB (4294967296 bytes)
>      disk size: 196 KiB
>      cluster_size: 65536
>      backing file: base.raw
>      Format specific information:
>          compat: 1.1
>          lazy refcounts: false
>          refcount bits: 16
>          corrupt: false
>      
>      image: base.raw
>      file format: raw
>      virtual size: 4 GiB (4294967296 bytes)
>      disk size: 778 MiB
> 
>      $> ~/build/qemu/qemu-img amend -o compat=v3 overlay1.qcow2

This particular amend is not changing the backing file, and since I did 
not add warnings on the opening of an existing unsafe image, it is 
silent.  Instead, you need to test a case where amend provokes a path 
that would change the backing file (perhaps as simple as '-o 
backing_file=./base.raw'), while omitting a format for the new backing 
file string.

> 
>      $> echo $?
>      0
> 
> I'm just trying to work out the scenarios where the warnings ought to
> show up (for all the four cases: create, rebase, convert, amend).

Look at patch 2/4 - that patch was written AFTER this patch in order to 
silence every warning that was introduced because of this patch, then 
rebased to occur first.  My experience in writing 2/4 was that I indeed 
hit warnings through all four sub-commands.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Kashyap Chamarthy]

On Tue, Mar 10, 2020 at 07:19:25AM -0500, Eric Blake wrote:
> On 3/10/20 5:57 AM, Kashyap Chamarthy wrote:

(Slightly long e-mail, as it contains a bunch of tests and their
results; please bear with me.)

[...]

> >      $> ~/build/qemu/qemu-img amend -o compat=v3 overlay1.qcow2
> 
> This particular amend is not changing the backing file, and since I did not
> add warnings on the opening of an existing unsafe image, it is silent.

I see; okay, that's expected.

> Instead, you need to test a case where amend provokes a path that would
> change the backing file (perhaps as simple as '-o backing_file=./base.raw'),
> while omitting a format for the new backing file string.

I couldn't work out the black magic to change the backing file via
'qemu-img amend'.  

It is surely not this:

    $> ~/build/qemu/qemu-img amend -o 'backing_file=./bar.qcow2' -o another_base.qcow2 
    qemu-img: Expecting one image file name

Let's try something else: give a *non-existent* "bar.qcow2" to '-o':

    $> ~/build/qemu/qemu-img amend -o 'backing_file=./bar.qcow2' another_base.qcow2 
    qemu-img: Could not open 'another_base.qcow2': Could not open backing file: Failed to get shared "write" lock
    Is another process using the image [./another_base.qcow2]?

That's strange; there is no live QEMU process on this host (let alone
one that is using another_base.qcow2):

    $> pgrep qemu-system-x86
    $> echo $?
    1

Probably it is just complaning about the non-existent bar.qcow2 file?
Then I'd expect it to say as much.


On IRC you pointed out iotest 082 to look for help.  There I don't see a
way to change the backing file.  But only a combination of 'amend' +
'rebase':

    run_qemu_img amend -f $IMGFMT \
        -o backing_fmt=$IMGFMT,backing_file="$TEST_IMG",,\? "$TEST_IMG"
    run_qemu_img rebase -u -b "" -f $IMGFMT "$TEST_IMG"

(I know you can use 'rebase' alone to change the backing file format.)

Note to self: we really need to document 'amend' much better, in which
scenarios it is useful, and contrast it with 'rebase'.

            - - -

Meanwhile, I've done a bunch of tests with 'amend'.  Here are the
results.

Scenario: base.raw <-- overlay1.qcow2
-------------------------------------

Without "-f raw", the warning is provoked when trying to amend the
backing file (let's ignore for a moment that you can't seem to amend a
raw file):

    $> ~/build/qemu/qemu-img amend -o compat=v3 base.raw
    WARNING: Image format was not specified for 'base.raw' and probing guessed raw.
             Automatically detecting the format is dangerous for raw images, write operations on block 0 will be restricted.
             Specify the 'raw' format explicitly to remove the restrictions.
    qemu-img: Format driver 'raw' does not support option amendment

With "-f raw", the warning is not triggerred (correctly so?):

    $> ~/build/qemu/qemu-img amend -o compat=v3 -f raw base.raw
    qemu-img: Format driver 'raw' does not support option amendment


And these two tests (one with relative path; the other with absolute
path) don't trigger the warning either (on IRC you said the following is
_supposed_ to trigger a warning):


    $> ~/build/qemu/qemu-img amend \
            -o 'backing_file=base.raw' -f qcow2 overlay1.qcow2

    $> ~/build/qemu/qemu-img amend \
            -o 'backing_file=./base.raw' -f qcow2 overlay1.qcow2


'qemu-img info' of the above disk image chain:

    $> ~/build/qemu/qemu-img info --backing-chain overlay1.qcow2
    image: overlay1.qcow2
    file format: qcow2
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 196 KiB
    cluster_size: 65536
    backing file: ./base.raw
    backing file format: raw
    Format specific information:
        compat: 1.1
        lazy refcounts: false
        refcount bits: 16
        corrupt: false
    
    image: ./base.raw
    file format: raw
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 778 MiB


Scenario: another_base.qcow2 <-- overlay1_of_ab.qcow2
-----------------------------------------------------

With and w/o specifying the aAmend the backing file (none of these
provoke the warning -- expected?):

    $> ~/build/qemu/qemu-img amend another_base.qcow2

    $> ~/build/qemu/qemu-img amend -f qcow2 another_base.qcow2

Tests to amend the overlay file (none of these provoke the warning --
expected, per your previous reply):

    $> ~/build/qemu/qemu-img amend overlay1_of_ab.qcow2  

    $> ~/build/qemu/qemu-img amend -f qcow2 overlay1_of_ab.qcow2  


'qemu-img info' of the above disk image chain:

    $> ~/build/qemu/qemu-img info --backing-chain overlay1_of_ab.qcow2 
    image: overlay1_of_ab.qcow2
    file format: qcow2
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 196 KiB
    cluster_size: 65536
    backing file: ./another_base.qcow2
    Format specific information:
        compat: 1.1
        lazy refcounts: false
        refcount bits: 16
        corrupt: false
    
    image: ./another_base.qcow2
    file format: qcow2
    virtual size: 4 GiB (4294967296 bytes)
    disk size: 293 MiB
    cluster_size: 65536
    Format specific information:
        compat: 1.1
        lazy refcounts: false
        refcount bits: 16
        corrupt: false


Strange command-line
--------------------

Does this make sense?  What is this even trying to do ...

    $> ~/build/qemu/qemu-img amend \
            -o 'backing_file=./another_base.qcow2' another_base.qcow2 
    
    $> echo $?
    0

> Look at patch 2/4 - that patch was written AFTER this patch in order to
> silence every warning that was introduced because of this patch, then
> rebased to occur first.  My experience in writing 2/4 was that I indeed hit
> warnings through all four sub-commands. 

Will look.

Thanks.

-- 
/kashyap

Re: [PATCH v3 4/4] qemu-img: Deprecate use of -b without -F

[Eric Blake]

On 3/9/20 10:31 AM, Kashyap Chamarthy wrote:
> On Fri, Mar 06, 2020 at 04:51:21PM -0600, Eric Blake wrote:
>> Creating an image that requires format probing of the backing image is
>> inherently unsafe (we've had several CVEs over the years based on

>>
>> +qemu-img backing file without format (since 5.0.0)
>> +''''''''''''''''''''''''''''''''''''''''''''''''''
>> +
>> +The use of ``qemu-img create``, ``qemu-img rebase``, ``qemu-img
>> +convert``, or ``qemu-img amend`` to create or modify an image that
>> +depends on a backing file now recommends that an explicit backing
>> +format be provided.  This is for safety: if qemu probes a different
>> +format than what you thought, the data presented to the guest will be
>> +corrupt; similarly, presenting a raw image to a guest allows a
>> +potential security exploit if a future probe sees a non-raw image
>> +based on guest writes.  To avoid the warning message, or even future
>> +refusal to create an unsafe image, you must pass ``-o backing_fmt=``
>> +(or the shorthand ``-F`` during create) to specify the intended
>> +backing format.  You may use ``qemu-img rebase -u`` to retroactively
>> +add a backing format to an existing image.  However, be aware that
>> +there are already potential security risks to blindly using ``qemu-img
>> +info`` to probe the format of an untrusted backing image, when
>> +deciding what format to add into an existing image.
> 
> Nit: s/qemu/QEMU/g/
> 
> Ultra Nit: should this paragraph be broken down into two?  Experience
> tells people usually feel deterred read "substantial paragraphs" :-)

Shoot, I missed incorporating this comment during my v4 posting. It's 
now changed in my local tree, but I'll hold off on a v5 unless other 
review warrants it.

-- 
Eric Blake, Principal Software Engineer
Red Hat, Inc.           +1-919-301-3226
Virtualization:  qemu.org | libvirt.org