diff --git a/block.c b/block.c
index 1e00e313c3..c8e6de29f0 100644
--- a/block.c
+++ b/block.c
@@ -3949,7 +3949,7 @@ void bdrv_init_with_whitelist(void)
 
 void bdrv_invalidate_cache(BlockDriverState *bs, Error **errp)
 {
-    BdrvChild *child;
+    BdrvChild *child, *parent;
     Error *local_err = NULL;
     int ret;
 
@@ -3985,6 +3985,16 @@ void bdrv_invalidate_cache(BlockDriverState *bs, Error **errp)
         error_setg_errno(errp, -ret, "Could not refresh total sector count");
         return;
     }
+
+    QLIST_FOREACH(parent, &bs->parents, next_parent) {
+        if (parent->role->activate) {
+            parent->role->activate(parent, &local_err);
+            if (local_err) {
+                error_propagate(errp, local_err);
+                return;
+            }
+        }
+    }
 }
 
 void bdrv_invalidate_cache_all(Error **errp)
diff --git a/block/block-backend.c b/block/block-backend.c
index f5bf13eec9..a7ce72b325 100644
--- a/block/block-backend.c
+++ b/block/block-backend.c
@@ -130,6 +130,32 @@ static const char *blk_root_get_name(BdrvChild *child)
     return blk_name(child->opaque);
 }
 
+/*
+ * Notifies the user of the BlockBackend that migration has completed. qdev
+ * devices can tighten their permissions in response (specifically revoke
+ * shared write permissions that we needed for storage migration).
+ *
+ * If an error is returned, the VM cannot be allowed to be resumed.
+ */
+static void blk_root_activate(BdrvChild *child, Error **errp)
+{
+    BlockBackend *blk = child->opaque;
+    Error *local_err = NULL;
+
+    if (!blk->disable_perm) {
+        return;
+    }
+
+    blk->disable_perm = false;
+
+    blk_set_perm(blk, blk->perm, blk->shared_perm, &local_err);
+    if (local_err) {
+        error_propagate(errp, local_err);
+        blk->disable_perm = true;
+        return;
+    }
+}
+
 static const BdrvChildRole child_root = {
     .inherit_options    = blk_root_inherit_options,
 
@@ -140,6 +166,8 @@ static const BdrvChildRole child_root = {
 
     .drained_begin      = blk_root_drained_begin,
     .drained_end        = blk_root_drained_end,
+
+    .activate           = blk_root_activate,
 };
 
 /*
@@ -601,34 +629,6 @@ void blk_get_perm(BlockBackend *blk, uint64_t *perm, uint64_t *shared_perm)
     *shared_perm = blk->shared_perm;
 }
 
-/*
- * Notifies the user of all BlockBackends that migration has completed. qdev
- * devices can tighten their permissions in response (specifically revoke
- * shared write permissions that we needed for storage migration).
- *
- * If an error is returned, the VM cannot be allowed to be resumed.
- */
-void blk_resume_after_migration(Error **errp)
-{
-    BlockBackend *blk;
-    Error *local_err = NULL;
-
-    for (blk = blk_all_next(NULL); blk; blk = blk_all_next(blk)) {
-        if (!blk->disable_perm) {
-            continue;
-        }
-
-        blk->disable_perm = false;
-
-        blk_set_perm(blk, blk->perm, blk->shared_perm, &local_err);
-        if (local_err) {
-            error_propagate(errp, local_err);
-            blk->disable_perm = true;
-            return;
-        }
-    }
-}
-
 static int blk_do_attach_dev(BlockBackend *blk, void *dev)
 {
     if (blk->dev) {
diff --git a/include/block/block.h b/include/block/block.h
index 877fbb0d9a..80d51d8f12 100644
--- a/include/block/block.h
+++ b/include/block/block.h
@@ -369,8 +369,6 @@ void bdrv_invalidate_cache(BlockDriverState *bs, Error **errp);
 void bdrv_invalidate_cache_all(Error **errp);
 int bdrv_inactivate_all(void);
 
-void blk_resume_after_migration(Error **errp);
-
 /* Ensure contents are flushed to disk.  */
 int bdrv_flush(BlockDriverState *bs);
 int coroutine_fn bdrv_co_flush(BlockDriverState *bs);
diff --git a/include/block/block_int.h b/include/block/block_int.h
index 1b4d08e8df..563792580c 100644
--- a/include/block/block_int.h
+++ b/include/block/block_int.h
@@ -473,6 +473,11 @@ struct BdrvChildRole {
     void (*drained_begin)(BdrvChild *child);
     void (*drained_end)(BdrvChild *child);
 
+    /* Notifies the parent that the child has been activated (e.g. when
+     * migration is completing) and it can start requesting permissions and
+     * doing I/O on it. */
+    void (*activate)(BdrvChild *child, Error **errp);
+
     void (*attach)(BdrvChild *child);
     void (*detach)(BdrvChild *child);
 };
diff --git a/migration/migration.c b/migration/migration.c
index 04af71988d..a5ade23e24 100644
--- a/migration/migration.c
+++ b/migration/migration.c
@@ -341,9 +341,6 @@ static void process_incoming_migration_bh(void *opaque)
     /* Make sure all file formats flush their mutable metadata.
      * If we get an error here, just don't restart the VM yet. */
     bdrv_invalidate_cache_all(&local_err);
-    if (!local_err) {
-        blk_resume_after_migration(&local_err);
-    }
     if (local_err) {
         error_report_err(local_err);
         local_err = NULL;
diff --git a/migration/savevm.c b/migration/savevm.c
index 3ca8d11704..7f66d58a7e 100644
--- a/migration/savevm.c
+++ b/migration/savevm.c
@@ -1615,9 +1615,6 @@ static void loadvm_postcopy_handle_run_bh(void *opaque)
     /* Make sure all file formats flush their mutable metadata.
      * If we get an error here, just don't restart the VM yet. */
     bdrv_invalidate_cache_all(&local_err);
-    if (!local_err) {
-        blk_resume_after_migration(&local_err);
-    }
     if (local_err) {
         error_report_err(local_err);
         local_err = NULL;
diff --git a/qmp.c b/qmp.c
index 25b5050f9f..f656940769 100644
--- a/qmp.c
+++ b/qmp.c
@@ -207,12 +207,6 @@ void qmp_cont(Error **errp)
         return;
     }
 
-    blk_resume_after_migration(&local_err);
-    if (local_err) {
-        error_propagate(errp, local_err);
-        return;
-    }
-
     if (runstate_check(RUN_STATE_INMIGRATE)) {
         autostart = 1;
     } else {