block/qcow2.c

   1 /*
   2  * Block driver for the QCOW version 2 format
   3  *
   4  * Copyright (c) 2004-2006 Fabrice Bellard
   5  *
   6  * Permission is hereby granted, free of charge, to any person obtaining a copy
   7  * of this software and associated documentation files (the "Software"), to deal
   8  * in the Software without restriction, including without limitation the rights
   9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  10  * copies of the Software, and to permit persons to whom the Software is
  11  * furnished to do so, subject to the following conditions:
  12  *
  13  * The above copyright notice and this permission notice shall be included in
  14  * all copies or substantial portions of the Software.
  15  *
  16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  22  * THE SOFTWARE.
  23  */
  24
  25 #include "qemu/osdep.h"
  26
  27 #include "block/qdict.h"
  28 #include "sysemu/block-backend.h"
  29 #include "qemu/main-loop.h"
  30 #include "qemu/module.h"
  31 #include "qcow2.h"
  32 #include "qemu/error-report.h"
  33 #include "qapi/error.h"
  34 #include "qapi/qapi-events-block-core.h"
  35 #include "qapi/qmp/qdict.h"
  36 #include "qapi/qmp/qstring.h"
  37 #include "trace.h"
  38 #include "qemu/option_int.h"
  39 #include "qemu/cutils.h"
  40 #include "qemu/bswap.h"
  41 #include "qapi/qobject-input-visitor.h"
  42 #include "qapi/qapi-visit-block-core.h"
  43 #include "crypto.h"
  44 #include "block/aio_task.h"
  45
  46 /*
  47   Differences with QCOW:
  48
  49   - Support for multiple incremental snapshots.
  50   - Memory management by reference counts.
  51   - Clusters which have a reference count of one have the bit
  52     QCOW_OFLAG_COPIED to optimize write performance.
  53   - Size of compressed clusters is stored in sectors to reduce bit usage
  54     in the cluster offsets.
  55   - Support for storing additional data (such as the VM state) in the
  56     snapshots.
  57   - If a backing store is used, the cluster size is not constrained
  58     (could be backported to QCOW).
  59   - L2 tables have always a size of one cluster.
  60 */
  61
  62
  63 typedef struct {
  64     uint32_t magic;
  65     uint32_t len;
  66 } QEMU_PACKED QCowExtension;
  67
  68 #define  QCOW2_EXT_MAGIC_END 0
  69 #define  QCOW2_EXT_MAGIC_BACKING_FORMAT 0xe2792aca
  70 #define  QCOW2_EXT_MAGIC_FEATURE_TABLE 0x6803f857
  71 #define  QCOW2_EXT_MAGIC_CRYPTO_HEADER 0x0537be77
  72 #define  QCOW2_EXT_MAGIC_BITMAPS 0x23852875
  73 #define  QCOW2_EXT_MAGIC_DATA_FILE 0x44415441
  74
  75 static int coroutine_fn
  76 qcow2_co_preadv_compressed(BlockDriverState *bs,
  77                            uint64_t cluster_descriptor,
  78                            uint64_t offset,
  79                            uint64_t bytes,
  80                            QEMUIOVector *qiov,
  81                            size_t qiov_offset);
  82
  83 static int qcow2_probe(const uint8_t *buf, int buf_size, const char *filename)
  84 {
  85     const QCowHeader *cow_header = (const void *)buf;
  86
  87     if (buf_size >= sizeof(QCowHeader) &&
  88         be32_to_cpu(cow_header->magic) == QCOW_MAGIC &&
  89         be32_to_cpu(cow_header->version) >= 2)
  90         return 100;
  91     else
  92         return 0;
  93 }
  94
  95
  96 static ssize_t qcow2_crypto_hdr_read_func(QCryptoBlock *block, size_t offset,
  97                                           uint8_t *buf, size_t buflen,
  98                                           void *opaque, Error **errp)
  99 {
 100     BlockDriverState *bs = opaque;
 101     BDRVQcow2State *s = bs->opaque;
 102     ssize_t ret;
 103
 104     if ((offset + buflen) > s->crypto_header.length) {
 105         error_setg(errp, "Request for data outside of extension header");
 106         return -1;
 107     }
 108
 109     ret = bdrv_pread(bs->file,
 110                      s->crypto_header.offset + offset, buf, buflen);
 111     if (ret < 0) {
 112         error_setg_errno(errp, -ret, "Could not read encryption header");
 113         return -1;
 114     }
 115     return ret;
 116 }
 117
 118
 119 static ssize_t qcow2_crypto_hdr_init_func(QCryptoBlock *block, size_t headerlen,
 120                                           void *opaque, Error **errp)
 121 {
 122     BlockDriverState *bs = opaque;
 123     BDRVQcow2State *s = bs->opaque;
 124     int64_t ret;
 125     int64_t clusterlen;
 126
 127     ret = qcow2_alloc_clusters(bs, headerlen);
 128     if (ret < 0) {
 129         error_setg_errno(errp, -ret,
 130                          "Cannot allocate cluster for LUKS header size %zu",
 131                          headerlen);
 132         return -1;
 133     }
 134
 135     s->crypto_header.length = headerlen;
 136     s->crypto_header.offset = ret;
 137
 138     /*
 139      * Zero fill all space in cluster so it has predictable
 140      * content, as we may not initialize some regions of the
 141      * header (eg only 1 out of 8 key slots will be initialized)
 142      */
 143     clusterlen = size_to_clusters(s, headerlen) * s->cluster_size;
 144     assert(qcow2_pre_write_overlap_check(bs, 0, ret, clusterlen, false) == 0);
 145     ret = bdrv_pwrite_zeroes(bs->file,
 146                              ret,
 147                              clusterlen, 0);
 148     if (ret < 0) {
 149         error_setg_errno(errp, -ret, "Could not zero fill encryption header");
 150         return -1;
 151     }
 152
 153     return ret;
 154 }
 155
 156
 157 static ssize_t qcow2_crypto_hdr_write_func(QCryptoBlock *block, size_t offset,
 158                                            const uint8_t *buf, size_t buflen,
 159                                            void *opaque, Error **errp)
 160 {
 161     BlockDriverState *bs = opaque;
 162     BDRVQcow2State *s = bs->opaque;
 163     ssize_t ret;
 164
 165     if ((offset + buflen) > s->crypto_header.length) {
 166         error_setg(errp, "Request for data outside of extension header");
 167         return -1;
 168     }
 169
 170     ret = bdrv_pwrite(bs->file,
 171                       s->crypto_header.offset + offset, buf, buflen);
 172     if (ret < 0) {
 173         error_setg_errno(errp, -ret, "Could not read encryption header");
 174         return -1;
 175     }
 176     return ret;
 177 }
 178
 179 static QDict*
 180 qcow2_extract_crypto_opts(QemuOpts *opts, const char *fmt, Error **errp)
 181 {
 182     QDict *cryptoopts_qdict;
 183     QDict *opts_qdict;
 184
 185     /* Extract "encrypt." options into a qdict */
 186     opts_qdict = qemu_opts_to_qdict(opts, NULL);
 187     qdict_extract_subqdict(opts_qdict, &cryptoopts_qdict, "encrypt.");
 188     qobject_unref(opts_qdict);
 189     qdict_put_str(cryptoopts_qdict, "format", fmt);
 190     return cryptoopts_qdict;
 191 }
 192
 193 /*
 194  * read qcow2 extension and fill bs
 195  * start reading from start_offset
 196  * finish reading upon magic of value 0 or when end_offset reached
 197  * unknown magic is skipped (future extension this version knows nothing about)
 198  * return 0 upon success, non-0 otherwise
 199  */
 200 static int qcow2_read_extensions(BlockDriverState *bs, uint64_t start_offset,
 201                                  uint64_t end_offset, void **p_feature_table,
 202                                  int flags, bool *need_update_header,
 203                                  Error **errp)
 204 {
 205     BDRVQcow2State *s = bs->opaque;
 206     QCowExtension ext;
 207     uint64_t offset;
 208     int ret;
 209     Qcow2BitmapHeaderExt bitmaps_ext;
 210
 211     if (need_update_header != NULL) {
 212         *need_update_header = false;
 213     }
 214
 215 #ifdef DEBUG_EXT
 216     printf("qcow2_read_extensions: start=%ld end=%ld\n", start_offset, end_offset);
 217 #endif
 218     offset = start_offset;
 219     while (offset < end_offset) {
 220
 221 #ifdef DEBUG_EXT
 222         /* Sanity check */
 223         if (offset > s->cluster_size)
 224             printf("qcow2_read_extension: suspicious offset %lu\n", offset);
 225
 226         printf("attempting to read extended header in offset %lu\n", offset);
 227 #endif
 228
 229         ret = bdrv_pread(bs->file, offset, &ext, sizeof(ext));
 230         if (ret < 0) {
 231             error_setg_errno(errp, -ret, "qcow2_read_extension: ERROR: "
 232                              "pread fail from offset %" PRIu64, offset);
 233             return 1;
 234         }
 235         ext.magic = be32_to_cpu(ext.magic);
 236         ext.len = be32_to_cpu(ext.len);
 237         offset += sizeof(ext);
 238 #ifdef DEBUG_EXT
 239         printf("ext.magic = 0x%x\n", ext.magic);
 240 #endif
 241         if (offset > end_offset || ext.len > end_offset - offset) {
 242             error_setg(errp, "Header extension too large");
 243             return -EINVAL;
 244         }
 245
 246         switch (ext.magic) {
 247         case QCOW2_EXT_MAGIC_END:
 248             return 0;
 249
 250         case QCOW2_EXT_MAGIC_BACKING_FORMAT:
 251             if (ext.len >= sizeof(bs->backing_format)) {
 252                 error_setg(errp, "ERROR: ext_backing_format: len=%" PRIu32
 253                            " too large (>=%zu)", ext.len,
 254                            sizeof(bs->backing_format));
 255                 return 2;
 256             }
 257             ret = bdrv_pread(bs->file, offset, bs->backing_format, ext.len);
 258             if (ret < 0) {
 259                 error_setg_errno(errp, -ret, "ERROR: ext_backing_format: "
 260                                  "Could not read format name");
 261                 return 3;
 262             }
 263             bs->backing_format[ext.len] = '\0';
 264             s->image_backing_format = g_strdup(bs->backing_format);
 265 #ifdef DEBUG_EXT
 266             printf("Qcow2: Got format extension %s\n", bs->backing_format);
 267 #endif
 268             break;
 269
 270         case QCOW2_EXT_MAGIC_FEATURE_TABLE:
 271             if (p_feature_table != NULL) {
 272                 void* feature_table = g_malloc0(ext.len + 2 * sizeof(Qcow2Feature));
 273                 ret = bdrv_pread(bs->file, offset , feature_table, ext.len);
 274                 if (ret < 0) {
 275                     error_setg_errno(errp, -ret, "ERROR: ext_feature_table: "
 276                                      "Could not read table");
 277                     return ret;
 278                 }
 279
 280                 *p_feature_table = feature_table;
 281             }
 282             break;
 283
 284         case QCOW2_EXT_MAGIC_CRYPTO_HEADER: {
 285             unsigned int cflags = 0;
 286             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
 287                 error_setg(errp, "CRYPTO header extension only "
 288                            "expected with LUKS encryption method");
 289                 return -EINVAL;
 290             }
 291             if (ext.len != sizeof(Qcow2CryptoHeaderExtension)) {
 292                 error_setg(errp, "CRYPTO header extension size %u, "
 293                            "but expected size %zu", ext.len,
 294                            sizeof(Qcow2CryptoHeaderExtension));
 295                 return -EINVAL;
 296             }
 297
 298             ret = bdrv_pread(bs->file, offset, &s->crypto_header, ext.len);
 299             if (ret < 0) {
 300                 error_setg_errno(errp, -ret,
 301                                  "Unable to read CRYPTO header extension");
 302                 return ret;
 303             }
 304             s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
 305             s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
 306
 307             if ((s->crypto_header.offset % s->cluster_size) != 0) {
 308                 error_setg(errp, "Encryption header offset '%" PRIu64 "' is "
 309                            "not a multiple of cluster size '%u'",
 310                            s->crypto_header.offset, s->cluster_size);
 311                 return -EINVAL;
 312             }
 313
 314             if (flags & BDRV_O_NO_IO) {
 315                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
 316             }
 317             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
 318                                            qcow2_crypto_hdr_read_func,
 319                                            bs, cflags, QCOW2_MAX_THREADS, errp);
 320             if (!s->crypto) {
 321                 return -EINVAL;
 322             }
 323         }   break;
 324
 325         case QCOW2_EXT_MAGIC_BITMAPS:
 326             if (ext.len != sizeof(bitmaps_ext)) {
 327                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 328                                  "Invalid extension length");
 329                 return -EINVAL;
 330             }
 331
 332             if (!(s->autoclear_features & QCOW2_AUTOCLEAR_BITMAPS)) {
 333                 if (s->qcow_version < 3) {
 334                     /* Let's be a bit more specific */
 335                     warn_report("This qcow2 v2 image contains bitmaps, but "
 336                                 "they may have been modified by a program "
 337                                 "without persistent bitmap support; so now "
 338                                 "they must all be considered inconsistent");
 339                 } else {
 340                     warn_report("a program lacking bitmap support "
 341                                 "modified this file, so all bitmaps are now "
 342                                 "considered inconsistent");
 343                 }
 344                 error_printf("Some clusters may be leaked, "
 345                              "run 'qemu-img check -r' on the image "
 346                              "file to fix.");
 347                 if (need_update_header != NULL) {
 348                     /* Updating is needed to drop invalid bitmap extension. */
 349                     *need_update_header = true;
 350                 }
 351                 break;
 352             }
 353
 354             ret = bdrv_pread(bs->file, offset, &bitmaps_ext, ext.len);
 355             if (ret < 0) {
 356                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 357                                  "Could not read ext header");
 358                 return ret;
 359             }
 360
 361             if (bitmaps_ext.reserved32 != 0) {
 362                 error_setg_errno(errp, -ret, "bitmaps_ext: "
 363                                  "Reserved field is not zero");
 364                 return -EINVAL;
 365             }
 366
 367             bitmaps_ext.nb_bitmaps = be32_to_cpu(bitmaps_ext.nb_bitmaps);
 368             bitmaps_ext.bitmap_directory_size =
 369                 be64_to_cpu(bitmaps_ext.bitmap_directory_size);
 370             bitmaps_ext.bitmap_directory_offset =
 371                 be64_to_cpu(bitmaps_ext.bitmap_directory_offset);
 372
 373             if (bitmaps_ext.nb_bitmaps > QCOW2_MAX_BITMAPS) {
 374                 error_setg(errp,
 375                            "bitmaps_ext: Image has %" PRIu32 " bitmaps, "
 376                            "exceeding the QEMU supported maximum of %d",
 377                            bitmaps_ext.nb_bitmaps, QCOW2_MAX_BITMAPS);
 378                 return -EINVAL;
 379             }
 380
 381             if (bitmaps_ext.nb_bitmaps == 0) {
 382                 error_setg(errp, "found bitmaps extension with zero bitmaps");
 383                 return -EINVAL;
 384             }
 385
 386             if (offset_into_cluster(s, bitmaps_ext.bitmap_directory_offset)) {
 387                 error_setg(errp, "bitmaps_ext: "
 388                                  "invalid bitmap directory offset");
 389                 return -EINVAL;
 390             }
 391
 392             if (bitmaps_ext.bitmap_directory_size >
 393                 QCOW2_MAX_BITMAP_DIRECTORY_SIZE) {
 394                 error_setg(errp, "bitmaps_ext: "
 395                                  "bitmap directory size (%" PRIu64 ") exceeds "
 396                                  "the maximum supported size (%d)",
 397                                  bitmaps_ext.bitmap_directory_size,
 398                                  QCOW2_MAX_BITMAP_DIRECTORY_SIZE);
 399                 return -EINVAL;
 400             }
 401
 402             s->nb_bitmaps = bitmaps_ext.nb_bitmaps;
 403             s->bitmap_directory_offset =
 404                     bitmaps_ext.bitmap_directory_offset;
 405             s->bitmap_directory_size =
 406                     bitmaps_ext.bitmap_directory_size;
 407
 408 #ifdef DEBUG_EXT
 409             printf("Qcow2: Got bitmaps extension: "
 410                    "offset=%" PRIu64 " nb_bitmaps=%" PRIu32 "\n",
 411                    s->bitmap_directory_offset, s->nb_bitmaps);
 412 #endif
 413             break;
 414
 415         case QCOW2_EXT_MAGIC_DATA_FILE:
 416         {
 417             s->image_data_file = g_malloc0(ext.len + 1);
 418             ret = bdrv_pread(bs->file, offset, s->image_data_file, ext.len);
 419             if (ret < 0) {
 420                 error_setg_errno(errp, -ret,
 421                                  "ERROR: Could not read data file name");
 422                 return ret;
 423             }
 424 #ifdef DEBUG_EXT
 425             printf("Qcow2: Got external data file %s\n", s->image_data_file);
 426 #endif
 427             break;
 428         }
 429
 430         default:
 431             /* unknown magic - save it in case we need to rewrite the header */
 432             /* If you add a new feature, make sure to also update the fast
 433              * path of qcow2_make_empty() to deal with it. */
 434             {
 435                 Qcow2UnknownHeaderExtension *uext;
 436
 437                 uext = g_malloc0(sizeof(*uext)  + ext.len);
 438                 uext->magic = ext.magic;
 439                 uext->len = ext.len;
 440                 QLIST_INSERT_HEAD(&s->unknown_header_ext, uext, next);
 441
 442                 ret = bdrv_pread(bs->file, offset , uext->data, uext->len);
 443                 if (ret < 0) {
 444                     error_setg_errno(errp, -ret, "ERROR: unknown extension: "
 445                                      "Could not read data");
 446                     return ret;
 447                 }
 448             }
 449             break;
 450         }
 451
 452         offset += ((ext.len + 7) & ~7);
 453     }
 454
 455     return 0;
 456 }
 457
 458 static void cleanup_unknown_header_ext(BlockDriverState *bs)
 459 {
 460     BDRVQcow2State *s = bs->opaque;
 461     Qcow2UnknownHeaderExtension *uext, *next;
 462
 463     QLIST_FOREACH_SAFE(uext, &s->unknown_header_ext, next, next) {
 464         QLIST_REMOVE(uext, next);
 465         g_free(uext);
 466     }
 467 }
 468
 469 static void report_unsupported_feature(Error **errp, Qcow2Feature *table,
 470                                        uint64_t mask)
 471 {
 472     g_autoptr(GString) features = g_string_sized_new(60);
 473
 474     while (table && table->name[0] != '\0') {
 475         if (table->type == QCOW2_FEAT_TYPE_INCOMPATIBLE) {
 476             if (mask & (1ULL << table->bit)) {
 477                 if (features->len > 0) {
 478                     g_string_append(features, ", ");
 479                 }
 480                 g_string_append_printf(features, "%.46s", table->name);
 481                 mask &= ~(1ULL << table->bit);
 482             }
 483         }
 484         table++;
 485     }
 486
 487     if (mask) {
 488         if (features->len > 0) {
 489             g_string_append(features, ", ");
 490         }
 491         g_string_append_printf(features,
 492                                "Unknown incompatible feature: %" PRIx64, mask);
 493     }
 494
 495     error_setg(errp, "Unsupported qcow2 feature(s): %s", features->str);
 496 }
 497
 498 /*
 499  * Sets the dirty bit and flushes afterwards if necessary.
 500  *
 501  * The incompatible_features bit is only set if the image file header was
 502  * updated successfully.  Therefore it is not required to check the return
 503  * value of this function.
 504  */
 505 int qcow2_mark_dirty(BlockDriverState *bs)
 506 {
 507     BDRVQcow2State *s = bs->opaque;
 508     uint64_t val;
 509     int ret;
 510
 511     assert(s->qcow_version >= 3);
 512
 513     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
 514         return 0; /* already dirty */
 515     }
 516
 517     val = cpu_to_be64(s->incompatible_features | QCOW2_INCOMPAT_DIRTY);
 518     ret = bdrv_pwrite(bs->file, offsetof(QCowHeader, incompatible_features),
 519                       &val, sizeof(val));
 520     if (ret < 0) {
 521         return ret;
 522     }
 523     ret = bdrv_flush(bs->file->bs);
 524     if (ret < 0) {
 525         return ret;
 526     }
 527
 528     /* Only treat image as dirty if the header was updated successfully */
 529     s->incompatible_features |= QCOW2_INCOMPAT_DIRTY;
 530     return 0;
 531 }
 532
 533 /*
 534  * Clears the dirty bit and flushes before if necessary.  Only call this
 535  * function when there are no pending requests, it does not guard against
 536  * concurrent requests dirtying the image.
 537  */
 538 static int qcow2_mark_clean(BlockDriverState *bs)
 539 {
 540     BDRVQcow2State *s = bs->opaque;
 541
 542     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
 543         int ret;
 544
 545         s->incompatible_features &= ~QCOW2_INCOMPAT_DIRTY;
 546
 547         ret = qcow2_flush_caches(bs);
 548         if (ret < 0) {
 549             return ret;
 550         }
 551
 552         return qcow2_update_header(bs);
 553     }
 554     return 0;
 555 }
 556
 557 /*
 558  * Marks the image as corrupt.
 559  */
 560 int qcow2_mark_corrupt(BlockDriverState *bs)
 561 {
 562     BDRVQcow2State *s = bs->opaque;
 563
 564     s->incompatible_features |= QCOW2_INCOMPAT_CORRUPT;
 565     return qcow2_update_header(bs);
 566 }
 567
 568 /*
 569  * Marks the image as consistent, i.e., unsets the corrupt bit, and flushes
 570  * before if necessary.
 571  */
 572 int qcow2_mark_consistent(BlockDriverState *bs)
 573 {
 574     BDRVQcow2State *s = bs->opaque;
 575
 576     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
 577         int ret = qcow2_flush_caches(bs);
 578         if (ret < 0) {
 579             return ret;
 580         }
 581
 582         s->incompatible_features &= ~QCOW2_INCOMPAT_CORRUPT;
 583         return qcow2_update_header(bs);
 584     }
 585     return 0;
 586 }
 587
 588 static void qcow2_add_check_result(BdrvCheckResult *out,
 589                                    const BdrvCheckResult *src,
 590                                    bool set_allocation_info)
 591 {
 592     out->corruptions += src->corruptions;
 593     out->leaks += src->leaks;
 594     out->check_errors += src->check_errors;
 595     out->corruptions_fixed += src->corruptions_fixed;
 596     out->leaks_fixed += src->leaks_fixed;
 597
 598     if (set_allocation_info) {
 599         out->image_end_offset = src->image_end_offset;
 600         out->bfi = src->bfi;
 601     }
 602 }
 603
 604 static int coroutine_fn qcow2_co_check_locked(BlockDriverState *bs,
 605                                               BdrvCheckResult *result,
 606                                               BdrvCheckMode fix)
 607 {
 608     BdrvCheckResult snapshot_res = {};
 609     BdrvCheckResult refcount_res = {};
 610     int ret;
 611
 612     memset(result, 0, sizeof(*result));
 613
 614     ret = qcow2_check_read_snapshot_table(bs, &snapshot_res, fix);
 615     if (ret < 0) {
 616         qcow2_add_check_result(result, &snapshot_res, false);
 617         return ret;
 618     }
 619
 620     ret = qcow2_check_refcounts(bs, &refcount_res, fix);
 621     qcow2_add_check_result(result, &refcount_res, true);
 622     if (ret < 0) {
 623         qcow2_add_check_result(result, &snapshot_res, false);
 624         return ret;
 625     }
 626
 627     ret = qcow2_check_fix_snapshot_table(bs, &snapshot_res, fix);
 628     qcow2_add_check_result(result, &snapshot_res, false);
 629     if (ret < 0) {
 630         return ret;
 631     }
 632
 633     if (fix && result->check_errors == 0 && result->corruptions == 0) {
 634         ret = qcow2_mark_clean(bs);
 635         if (ret < 0) {
 636             return ret;
 637         }
 638         return qcow2_mark_consistent(bs);
 639     }
 640     return ret;
 641 }
 642
 643 static int coroutine_fn qcow2_co_check(BlockDriverState *bs,
 644                                        BdrvCheckResult *result,
 645                                        BdrvCheckMode fix)
 646 {
 647     BDRVQcow2State *s = bs->opaque;
 648     int ret;
 649
 650     qemu_co_mutex_lock(&s->lock);
 651     ret = qcow2_co_check_locked(bs, result, fix);
 652     qemu_co_mutex_unlock(&s->lock);
 653     return ret;
 654 }
 655
 656 int qcow2_validate_table(BlockDriverState *bs, uint64_t offset,
 657                          uint64_t entries, size_t entry_len,
 658                          int64_t max_size_bytes, const char *table_name,
 659                          Error **errp)
 660 {
 661     BDRVQcow2State *s = bs->opaque;
 662
 663     if (entries > max_size_bytes / entry_len) {
 664         error_setg(errp, "%s too large", table_name);
 665         return -EFBIG;
 666     }
 667
 668     /* Use signed INT64_MAX as the maximum even for uint64_t header fields,
 669      * because values will be passed to qemu functions taking int64_t. */
 670     if ((INT64_MAX - entries * entry_len < offset) ||
 671         (offset_into_cluster(s, offset) != 0)) {
 672         error_setg(errp, "%s offset invalid", table_name);
 673         return -EINVAL;
 674     }
 675
 676     return 0;
 677 }
 678
 679 static const char *const mutable_opts[] = {
 680     QCOW2_OPT_LAZY_REFCOUNTS,
 681     QCOW2_OPT_DISCARD_REQUEST,
 682     QCOW2_OPT_DISCARD_SNAPSHOT,
 683     QCOW2_OPT_DISCARD_OTHER,
 684     QCOW2_OPT_OVERLAP,
 685     QCOW2_OPT_OVERLAP_TEMPLATE,
 686     QCOW2_OPT_OVERLAP_MAIN_HEADER,
 687     QCOW2_OPT_OVERLAP_ACTIVE_L1,
 688     QCOW2_OPT_OVERLAP_ACTIVE_L2,
 689     QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 690     QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 691     QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 692     QCOW2_OPT_OVERLAP_INACTIVE_L1,
 693     QCOW2_OPT_OVERLAP_INACTIVE_L2,
 694     QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
 695     QCOW2_OPT_CACHE_SIZE,
 696     QCOW2_OPT_L2_CACHE_SIZE,
 697     QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
 698     QCOW2_OPT_REFCOUNT_CACHE_SIZE,
 699     QCOW2_OPT_CACHE_CLEAN_INTERVAL,
 700     NULL
 701 };
 702
 703 static QemuOptsList qcow2_runtime_opts = {
 704     .name = "qcow2",
 705     .head = QTAILQ_HEAD_INITIALIZER(qcow2_runtime_opts.head),
 706     .desc = {
 707         {
 708             .name = QCOW2_OPT_LAZY_REFCOUNTS,
 709             .type = QEMU_OPT_BOOL,
 710             .help = "Postpone refcount updates",
 711         },
 712         {
 713             .name = QCOW2_OPT_DISCARD_REQUEST,
 714             .type = QEMU_OPT_BOOL,
 715             .help = "Pass guest discard requests to the layer below",
 716         },
 717         {
 718             .name = QCOW2_OPT_DISCARD_SNAPSHOT,
 719             .type = QEMU_OPT_BOOL,
 720             .help = "Generate discard requests when snapshot related space "
 721                     "is freed",
 722         },
 723         {
 724             .name = QCOW2_OPT_DISCARD_OTHER,
 725             .type = QEMU_OPT_BOOL,
 726             .help = "Generate discard requests when other clusters are freed",
 727         },
 728         {
 729             .name = QCOW2_OPT_OVERLAP,
 730             .type = QEMU_OPT_STRING,
 731             .help = "Selects which overlap checks to perform from a range of "
 732                     "templates (none, constant, cached, all)",
 733         },
 734         {
 735             .name = QCOW2_OPT_OVERLAP_TEMPLATE,
 736             .type = QEMU_OPT_STRING,
 737             .help = "Selects which overlap checks to perform from a range of "
 738                     "templates (none, constant, cached, all)",
 739         },
 740         {
 741             .name = QCOW2_OPT_OVERLAP_MAIN_HEADER,
 742             .type = QEMU_OPT_BOOL,
 743             .help = "Check for unintended writes into the main qcow2 header",
 744         },
 745         {
 746             .name = QCOW2_OPT_OVERLAP_ACTIVE_L1,
 747             .type = QEMU_OPT_BOOL,
 748             .help = "Check for unintended writes into the active L1 table",
 749         },
 750         {
 751             .name = QCOW2_OPT_OVERLAP_ACTIVE_L2,
 752             .type = QEMU_OPT_BOOL,
 753             .help = "Check for unintended writes into an active L2 table",
 754         },
 755         {
 756             .name = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 757             .type = QEMU_OPT_BOOL,
 758             .help = "Check for unintended writes into the refcount table",
 759         },
 760         {
 761             .name = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 762             .type = QEMU_OPT_BOOL,
 763             .help = "Check for unintended writes into a refcount block",
 764         },
 765         {
 766             .name = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 767             .type = QEMU_OPT_BOOL,
 768             .help = "Check for unintended writes into the snapshot table",
 769         },
 770         {
 771             .name = QCOW2_OPT_OVERLAP_INACTIVE_L1,
 772             .type = QEMU_OPT_BOOL,
 773             .help = "Check for unintended writes into an inactive L1 table",
 774         },
 775         {
 776             .name = QCOW2_OPT_OVERLAP_INACTIVE_L2,
 777             .type = QEMU_OPT_BOOL,
 778             .help = "Check for unintended writes into an inactive L2 table",
 779         },
 780         {
 781             .name = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
 782             .type = QEMU_OPT_BOOL,
 783             .help = "Check for unintended writes into the bitmap directory",
 784         },
 785         {
 786             .name = QCOW2_OPT_CACHE_SIZE,
 787             .type = QEMU_OPT_SIZE,
 788             .help = "Maximum combined metadata (L2 tables and refcount blocks) "
 789                     "cache size",
 790         },
 791         {
 792             .name = QCOW2_OPT_L2_CACHE_SIZE,
 793             .type = QEMU_OPT_SIZE,
 794             .help = "Maximum L2 table cache size",
 795         },
 796         {
 797             .name = QCOW2_OPT_L2_CACHE_ENTRY_SIZE,
 798             .type = QEMU_OPT_SIZE,
 799             .help = "Size of each entry in the L2 cache",
 800         },
 801         {
 802             .name = QCOW2_OPT_REFCOUNT_CACHE_SIZE,
 803             .type = QEMU_OPT_SIZE,
 804             .help = "Maximum refcount block cache size",
 805         },
 806         {
 807             .name = QCOW2_OPT_CACHE_CLEAN_INTERVAL,
 808             .type = QEMU_OPT_NUMBER,
 809             .help = "Clean unused cache entries after this time (in seconds)",
 810         },
 811         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",
 812             "ID of secret providing qcow2 AES key or LUKS passphrase"),
 813         { /* end of list */ }
 814     },
 815 };
 816
 817 static const char *overlap_bool_option_names[QCOW2_OL_MAX_BITNR] = {
 818     [QCOW2_OL_MAIN_HEADER_BITNR]      = QCOW2_OPT_OVERLAP_MAIN_HEADER,
 819     [QCOW2_OL_ACTIVE_L1_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L1,
 820     [QCOW2_OL_ACTIVE_L2_BITNR]        = QCOW2_OPT_OVERLAP_ACTIVE_L2,
 821     [QCOW2_OL_REFCOUNT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_TABLE,
 822     [QCOW2_OL_REFCOUNT_BLOCK_BITNR]   = QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK,
 823     [QCOW2_OL_SNAPSHOT_TABLE_BITNR]   = QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE,
 824     [QCOW2_OL_INACTIVE_L1_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L1,
 825     [QCOW2_OL_INACTIVE_L2_BITNR]      = QCOW2_OPT_OVERLAP_INACTIVE_L2,
 826     [QCOW2_OL_BITMAP_DIRECTORY_BITNR] = QCOW2_OPT_OVERLAP_BITMAP_DIRECTORY,
 827 };
 828
 829 static void cache_clean_timer_cb(void *opaque)
 830 {
 831     BlockDriverState *bs = opaque;
 832     BDRVQcow2State *s = bs->opaque;
 833     qcow2_cache_clean_unused(s->l2_table_cache);
 834     qcow2_cache_clean_unused(s->refcount_block_cache);
 835     timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 836               (int64_t) s->cache_clean_interval * 1000);
 837 }
 838
 839 static void cache_clean_timer_init(BlockDriverState *bs, AioContext *context)
 840 {
 841     BDRVQcow2State *s = bs->opaque;
 842     if (s->cache_clean_interval > 0) {
 843         s->cache_clean_timer = aio_timer_new(context, QEMU_CLOCK_VIRTUAL,
 844                                              SCALE_MS, cache_clean_timer_cb,
 845                                              bs);
 846         timer_mod(s->cache_clean_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 847                   (int64_t) s->cache_clean_interval * 1000);
 848     }
 849 }
 850
 851 static void cache_clean_timer_del(BlockDriverState *bs)
 852 {
 853     BDRVQcow2State *s = bs->opaque;
 854     if (s->cache_clean_timer) {
 855         timer_del(s->cache_clean_timer);
 856         timer_free(s->cache_clean_timer);
 857         s->cache_clean_timer = NULL;
 858     }
 859 }
 860
 861 static void qcow2_detach_aio_context(BlockDriverState *bs)
 862 {
 863     cache_clean_timer_del(bs);
 864 }
 865
 866 static void qcow2_attach_aio_context(BlockDriverState *bs,
 867                                      AioContext *new_context)
 868 {
 869     cache_clean_timer_init(bs, new_context);
 870 }
 871
 872 static void read_cache_sizes(BlockDriverState *bs, QemuOpts *opts,
 873                              uint64_t *l2_cache_size,
 874                              uint64_t *l2_cache_entry_size,
 875                              uint64_t *refcount_cache_size, Error **errp)
 876 {
 877     BDRVQcow2State *s = bs->opaque;
 878     uint64_t combined_cache_size, l2_cache_max_setting;
 879     bool l2_cache_size_set, refcount_cache_size_set, combined_cache_size_set;
 880     bool l2_cache_entry_size_set;
 881     int min_refcount_cache = MIN_REFCOUNT_CACHE_SIZE * s->cluster_size;
 882     uint64_t virtual_disk_size = bs->total_sectors * BDRV_SECTOR_SIZE;
 883     uint64_t max_l2_entries = DIV_ROUND_UP(virtual_disk_size, s->cluster_size);
 884     /* An L2 table is always one cluster in size so the max cache size
 885      * should be a multiple of the cluster size. */
 886     uint64_t max_l2_cache = ROUND_UP(max_l2_entries * sizeof(uint64_t),
 887                                      s->cluster_size);
 888
 889     combined_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_CACHE_SIZE);
 890     l2_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_SIZE);
 891     refcount_cache_size_set = qemu_opt_get(opts, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
 892     l2_cache_entry_size_set = qemu_opt_get(opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE);
 893
 894     combined_cache_size = qemu_opt_get_size(opts, QCOW2_OPT_CACHE_SIZE, 0);
 895     l2_cache_max_setting = qemu_opt_get_size(opts, QCOW2_OPT_L2_CACHE_SIZE,
 896                                              DEFAULT_L2_CACHE_MAX_SIZE);
 897     *refcount_cache_size = qemu_opt_get_size(opts,
 898                                              QCOW2_OPT_REFCOUNT_CACHE_SIZE, 0);
 899
 900     *l2_cache_entry_size = qemu_opt_get_size(
 901         opts, QCOW2_OPT_L2_CACHE_ENTRY_SIZE, s->cluster_size);
 902
 903     *l2_cache_size = MIN(max_l2_cache, l2_cache_max_setting);
 904
 905     if (combined_cache_size_set) {
 906         if (l2_cache_size_set && refcount_cache_size_set) {
 907             error_setg(errp, QCOW2_OPT_CACHE_SIZE ", " QCOW2_OPT_L2_CACHE_SIZE
 908                        " and " QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not be set "
 909                        "at the same time");
 910             return;
 911         } else if (l2_cache_size_set &&
 912                    (l2_cache_max_setting > combined_cache_size)) {
 913             error_setg(errp, QCOW2_OPT_L2_CACHE_SIZE " may not exceed "
 914                        QCOW2_OPT_CACHE_SIZE);
 915             return;
 916         } else if (*refcount_cache_size > combined_cache_size) {
 917             error_setg(errp, QCOW2_OPT_REFCOUNT_CACHE_SIZE " may not exceed "
 918                        QCOW2_OPT_CACHE_SIZE);
 919             return;
 920         }
 921
 922         if (l2_cache_size_set) {
 923             *refcount_cache_size = combined_cache_size - *l2_cache_size;
 924         } else if (refcount_cache_size_set) {
 925             *l2_cache_size = combined_cache_size - *refcount_cache_size;
 926         } else {
 927             /* Assign as much memory as possible to the L2 cache, and
 928              * use the remainder for the refcount cache */
 929             if (combined_cache_size >= max_l2_cache + min_refcount_cache) {
 930                 *l2_cache_size = max_l2_cache;
 931                 *refcount_cache_size = combined_cache_size - *l2_cache_size;
 932             } else {
 933                 *refcount_cache_size =
 934                     MIN(combined_cache_size, min_refcount_cache);
 935                 *l2_cache_size = combined_cache_size - *refcount_cache_size;
 936             }
 937         }
 938     }
 939
 940     /*
 941      * If the L2 cache is not enough to cover the whole disk then
 942      * default to 4KB entries. Smaller entries reduce the cost of
 943      * loads and evictions and increase I/O performance.
 944      */
 945     if (*l2_cache_size < max_l2_cache && !l2_cache_entry_size_set) {
 946         *l2_cache_entry_size = MIN(s->cluster_size, 4096);
 947     }
 948
 949     /* l2_cache_size and refcount_cache_size are ensured to have at least
 950      * their minimum values in qcow2_update_options_prepare() */
 951
 952     if (*l2_cache_entry_size < (1 << MIN_CLUSTER_BITS) ||
 953         *l2_cache_entry_size > s->cluster_size ||
 954         !is_power_of_2(*l2_cache_entry_size)) {
 955         error_setg(errp, "L2 cache entry size must be a power of two "
 956                    "between %d and the cluster size (%d)",
 957                    1 << MIN_CLUSTER_BITS, s->cluster_size);
 958         return;
 959     }
 960 }
 961
 962 typedef struct Qcow2ReopenState {
 963     Qcow2Cache *l2_table_cache;
 964     Qcow2Cache *refcount_block_cache;
 965     int l2_slice_size; /* Number of entries in a slice of the L2 table */
 966     bool use_lazy_refcounts;
 967     int overlap_check;
 968     bool discard_passthrough[QCOW2_DISCARD_MAX];
 969     uint64_t cache_clean_interval;
 970     QCryptoBlockOpenOptions *crypto_opts; /* Disk encryption runtime options */
 971 } Qcow2ReopenState;
 972
 973 static int qcow2_update_options_prepare(BlockDriverState *bs,
 974                                         Qcow2ReopenState *r,
 975                                         QDict *options, int flags,
 976                                         Error **errp)
 977 {
 978     BDRVQcow2State *s = bs->opaque;
 979     QemuOpts *opts = NULL;
 980     const char *opt_overlap_check, *opt_overlap_check_template;
 981     int overlap_check_template = 0;
 982     uint64_t l2_cache_size, l2_cache_entry_size, refcount_cache_size;
 983     int i;
 984     const char *encryptfmt;
 985     QDict *encryptopts = NULL;
 986     Error *local_err = NULL;
 987     int ret;
 988
 989     qdict_extract_subqdict(options, &encryptopts, "encrypt.");
 990     encryptfmt = qdict_get_try_str(encryptopts, "format");
 991
 992     opts = qemu_opts_create(&qcow2_runtime_opts, NULL, 0, &error_abort);
 993     if (!qemu_opts_absorb_qdict(opts, options, errp)) {
 994         ret = -EINVAL;
 995         goto fail;
 996     }
 997
 998     /* get L2 table/refcount block cache size from command line options */
 999     read_cache_sizes(bs, opts, &l2_cache_size, &l2_cache_entry_size,
1000                      &refcount_cache_size, &local_err);
1001     if (local_err) {
1002         error_propagate(errp, local_err);
1003         ret = -EINVAL;
1004         goto fail;
1005     }
1006
1007     l2_cache_size /= l2_cache_entry_size;
1008     if (l2_cache_size < MIN_L2_CACHE_SIZE) {
1009         l2_cache_size = MIN_L2_CACHE_SIZE;
1010     }
1011     if (l2_cache_size > INT_MAX) {
1012         error_setg(errp, "L2 cache size too big");
1013         ret = -EINVAL;
1014         goto fail;
1015     }
1016
1017     refcount_cache_size /= s->cluster_size;
1018     if (refcount_cache_size < MIN_REFCOUNT_CACHE_SIZE) {
1019         refcount_cache_size = MIN_REFCOUNT_CACHE_SIZE;
1020     }
1021     if (refcount_cache_size > INT_MAX) {
1022         error_setg(errp, "Refcount cache size too big");
1023         ret = -EINVAL;
1024         goto fail;
1025     }
1026
1027     /* alloc new L2 table/refcount block cache, flush old one */
1028     if (s->l2_table_cache) {
1029         ret = qcow2_cache_flush(bs, s->l2_table_cache);
1030         if (ret) {
1031             error_setg_errno(errp, -ret, "Failed to flush the L2 table cache");
1032             goto fail;
1033         }
1034     }
1035
1036     if (s->refcount_block_cache) {
1037         ret = qcow2_cache_flush(bs, s->refcount_block_cache);
1038         if (ret) {
1039             error_setg_errno(errp, -ret,
1040                              "Failed to flush the refcount block cache");
1041             goto fail;
1042         }
1043     }
1044
1045     r->l2_slice_size = l2_cache_entry_size / sizeof(uint64_t);
1046     r->l2_table_cache = qcow2_cache_create(bs, l2_cache_size,
1047                                            l2_cache_entry_size);
1048     r->refcount_block_cache = qcow2_cache_create(bs, refcount_cache_size,
1049                                                  s->cluster_size);
1050     if (r->l2_table_cache == NULL || r->refcount_block_cache == NULL) {
1051         error_setg(errp, "Could not allocate metadata caches");
1052         ret = -ENOMEM;
1053         goto fail;
1054     }
1055
1056     /* New interval for cache cleanup timer */
1057     r->cache_clean_interval =
1058         qemu_opt_get_number(opts, QCOW2_OPT_CACHE_CLEAN_INTERVAL,
1059                             DEFAULT_CACHE_CLEAN_INTERVAL);
1060 #ifndef CONFIG_LINUX
1061     if (r->cache_clean_interval != 0) {
1062         error_setg(errp, QCOW2_OPT_CACHE_CLEAN_INTERVAL
1063                    " not supported on this host");
1064         ret = -EINVAL;
1065         goto fail;
1066     }
1067 #endif
1068     if (r->cache_clean_interval > UINT_MAX) {
1069         error_setg(errp, "Cache clean interval too big");
1070         ret = -EINVAL;
1071         goto fail;
1072     }
1073
1074     /* lazy-refcounts; flush if going from enabled to disabled */
1075     r->use_lazy_refcounts = qemu_opt_get_bool(opts, QCOW2_OPT_LAZY_REFCOUNTS,
1076         (s->compatible_features & QCOW2_COMPAT_LAZY_REFCOUNTS));
1077     if (r->use_lazy_refcounts && s->qcow_version < 3) {
1078         error_setg(errp, "Lazy refcounts require a qcow2 image with at least "
1079                    "qemu 1.1 compatibility level");
1080         ret = -EINVAL;
1081         goto fail;
1082     }
1083
1084     if (s->use_lazy_refcounts && !r->use_lazy_refcounts) {
1085         ret = qcow2_mark_clean(bs);
1086         if (ret < 0) {
1087             error_setg_errno(errp, -ret, "Failed to disable lazy refcounts");
1088             goto fail;
1089         }
1090     }
1091
1092     /* Overlap check options */
1093     opt_overlap_check = qemu_opt_get(opts, QCOW2_OPT_OVERLAP);
1094     opt_overlap_check_template = qemu_opt_get(opts, QCOW2_OPT_OVERLAP_TEMPLATE);
1095     if (opt_overlap_check_template && opt_overlap_check &&
1096         strcmp(opt_overlap_check_template, opt_overlap_check))
1097     {
1098         error_setg(errp, "Conflicting values for qcow2 options '"
1099                    QCOW2_OPT_OVERLAP "' ('%s') and '" QCOW2_OPT_OVERLAP_TEMPLATE
1100                    "' ('%s')", opt_overlap_check, opt_overlap_check_template);
1101         ret = -EINVAL;
1102         goto fail;
1103     }
1104     if (!opt_overlap_check) {
1105         opt_overlap_check = opt_overlap_check_template ?: "cached";
1106     }
1107
1108     if (!strcmp(opt_overlap_check, "none")) {
1109         overlap_check_template = 0;
1110     } else if (!strcmp(opt_overlap_check, "constant")) {
1111         overlap_check_template = QCOW2_OL_CONSTANT;
1112     } else if (!strcmp(opt_overlap_check, "cached")) {
1113         overlap_check_template = QCOW2_OL_CACHED;
1114     } else if (!strcmp(opt_overlap_check, "all")) {
1115         overlap_check_template = QCOW2_OL_ALL;
1116     } else {
1117         error_setg(errp, "Unsupported value '%s' for qcow2 option "
1118                    "'overlap-check'. Allowed are any of the following: "
1119                    "none, constant, cached, all", opt_overlap_check);
1120         ret = -EINVAL;
1121         goto fail;
1122     }
1123
1124     r->overlap_check = 0;
1125     for (i = 0; i < QCOW2_OL_MAX_BITNR; i++) {
1126         /* overlap-check defines a template bitmask, but every flag may be
1127          * overwritten through the associated boolean option */
1128         r->overlap_check |=
1129             qemu_opt_get_bool(opts, overlap_bool_option_names[i],
1130                               overlap_check_template & (1 << i)) << i;
1131     }
1132
1133     r->discard_passthrough[QCOW2_DISCARD_NEVER] = false;
1134     r->discard_passthrough[QCOW2_DISCARD_ALWAYS] = true;
1135     r->discard_passthrough[QCOW2_DISCARD_REQUEST] =
1136         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_REQUEST,
1137                           flags & BDRV_O_UNMAP);
1138     r->discard_passthrough[QCOW2_DISCARD_SNAPSHOT] =
1139         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_SNAPSHOT, true);
1140     r->discard_passthrough[QCOW2_DISCARD_OTHER] =
1141         qemu_opt_get_bool(opts, QCOW2_OPT_DISCARD_OTHER, false);
1142
1143     switch (s->crypt_method_header) {
1144     case QCOW_CRYPT_NONE:
1145         if (encryptfmt) {
1146             error_setg(errp, "No encryption in image header, but options "
1147                        "specified format '%s'", encryptfmt);
1148             ret = -EINVAL;
1149             goto fail;
1150         }
1151         break;
1152
1153     case QCOW_CRYPT_AES:
1154         if (encryptfmt && !g_str_equal(encryptfmt, "aes")) {
1155             error_setg(errp,
1156                        "Header reported 'aes' encryption format but "
1157                        "options specify '%s'", encryptfmt);
1158             ret = -EINVAL;
1159             goto fail;
1160         }
1161         qdict_put_str(encryptopts, "format", "qcow");
1162         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1163         break;
1164
1165     case QCOW_CRYPT_LUKS:
1166         if (encryptfmt && !g_str_equal(encryptfmt, "luks")) {
1167             error_setg(errp,
1168                        "Header reported 'luks' encryption format but "
1169                        "options specify '%s'", encryptfmt);
1170             ret = -EINVAL;
1171             goto fail;
1172         }
1173         qdict_put_str(encryptopts, "format", "luks");
1174         r->crypto_opts = block_crypto_open_opts_init(encryptopts, errp);
1175         break;
1176
1177     default:
1178         error_setg(errp, "Unsupported encryption method %d",
1179                    s->crypt_method_header);
1180         break;
1181     }
1182     if (s->crypt_method_header != QCOW_CRYPT_NONE && !r->crypto_opts) {
1183         ret = -EINVAL;
1184         goto fail;
1185     }
1186
1187     ret = 0;
1188 fail:
1189     qobject_unref(encryptopts);
1190     qemu_opts_del(opts);
1191     opts = NULL;
1192     return ret;
1193 }
1194
1195 static void qcow2_update_options_commit(BlockDriverState *bs,
1196                                         Qcow2ReopenState *r)
1197 {
1198     BDRVQcow2State *s = bs->opaque;
1199     int i;
1200
1201     if (s->l2_table_cache) {
1202         qcow2_cache_destroy(s->l2_table_cache);
1203     }
1204     if (s->refcount_block_cache) {
1205         qcow2_cache_destroy(s->refcount_block_cache);
1206     }
1207     s->l2_table_cache = r->l2_table_cache;
1208     s->refcount_block_cache = r->refcount_block_cache;
1209     s->l2_slice_size = r->l2_slice_size;
1210
1211     s->overlap_check = r->overlap_check;
1212     s->use_lazy_refcounts = r->use_lazy_refcounts;
1213
1214     for (i = 0; i < QCOW2_DISCARD_MAX; i++) {
1215         s->discard_passthrough[i] = r->discard_passthrough[i];
1216     }
1217
1218     if (s->cache_clean_interval != r->cache_clean_interval) {
1219         cache_clean_timer_del(bs);
1220         s->cache_clean_interval = r->cache_clean_interval;
1221         cache_clean_timer_init(bs, bdrv_get_aio_context(bs));
1222     }
1223
1224     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1225     s->crypto_opts = r->crypto_opts;
1226 }
1227
1228 static void qcow2_update_options_abort(BlockDriverState *bs,
1229                                        Qcow2ReopenState *r)
1230 {
1231     if (r->l2_table_cache) {
1232         qcow2_cache_destroy(r->l2_table_cache);
1233     }
1234     if (r->refcount_block_cache) {
1235         qcow2_cache_destroy(r->refcount_block_cache);
1236     }
1237     qapi_free_QCryptoBlockOpenOptions(r->crypto_opts);
1238 }
1239
1240 static int qcow2_update_options(BlockDriverState *bs, QDict *options,
1241                                 int flags, Error **errp)
1242 {
1243     Qcow2ReopenState r = {};
1244     int ret;
1245
1246     ret = qcow2_update_options_prepare(bs, &r, options, flags, errp);
1247     if (ret >= 0) {
1248         qcow2_update_options_commit(bs, &r);
1249     } else {
1250         qcow2_update_options_abort(bs, &r);
1251     }
1252
1253     return ret;
1254 }
1255
1256 static int validate_compression_type(BDRVQcow2State *s, Error **errp)
1257 {
1258     switch (s->compression_type) {
1259     case QCOW2_COMPRESSION_TYPE_ZLIB:
1260 #ifdef CONFIG_ZSTD
1261     case QCOW2_COMPRESSION_TYPE_ZSTD:
1262 #endif
1263         break;
1264
1265     default:
1266         error_setg(errp, "qcow2: unknown compression type: %u",
1267                    s->compression_type);
1268         return -ENOTSUP;
1269     }
1270
1271     /*
1272      * if the compression type differs from QCOW2_COMPRESSION_TYPE_ZLIB
1273      * the incompatible feature flag must be set
1274      */
1275     if (s->compression_type == QCOW2_COMPRESSION_TYPE_ZLIB) {
1276         if (s->incompatible_features & QCOW2_INCOMPAT_COMPRESSION) {
1277             error_setg(errp, "qcow2: Compression type incompatible feature "
1278                              "bit must not be set");
1279             return -EINVAL;
1280         }
1281     } else {
1282         if (!(s->incompatible_features & QCOW2_INCOMPAT_COMPRESSION)) {
1283             error_setg(errp, "qcow2: Compression type incompatible feature "
1284                              "bit must be set");
1285             return -EINVAL;
1286         }
1287     }
1288
1289     return 0;
1290 }
1291
1292 /* Called with s->lock held.  */
1293 static int coroutine_fn qcow2_do_open(BlockDriverState *bs, QDict *options,
1294                                       int flags, Error **errp)
1295 {
1296     BDRVQcow2State *s = bs->opaque;
1297     unsigned int len, i;
1298     int ret = 0;
1299     QCowHeader header;
1300     Error *local_err = NULL;
1301     uint64_t ext_end;
1302     uint64_t l1_vm_state_index;
1303     bool update_header = false;
1304
1305     ret = bdrv_pread(bs->file, 0, &header, sizeof(header));
1306     if (ret < 0) {
1307         error_setg_errno(errp, -ret, "Could not read qcow2 header");
1308         goto fail;
1309     }
1310     header.magic = be32_to_cpu(header.magic);
1311     header.version = be32_to_cpu(header.version);
1312     header.backing_file_offset = be64_to_cpu(header.backing_file_offset);
1313     header.backing_file_size = be32_to_cpu(header.backing_file_size);
1314     header.size = be64_to_cpu(header.size);
1315     header.cluster_bits = be32_to_cpu(header.cluster_bits);
1316     header.crypt_method = be32_to_cpu(header.crypt_method);
1317     header.l1_table_offset = be64_to_cpu(header.l1_table_offset);
1318     header.l1_size = be32_to_cpu(header.l1_size);
1319     header.refcount_table_offset = be64_to_cpu(header.refcount_table_offset);
1320     header.refcount_table_clusters =
1321         be32_to_cpu(header.refcount_table_clusters);
1322     header.snapshots_offset = be64_to_cpu(header.snapshots_offset);
1323     header.nb_snapshots = be32_to_cpu(header.nb_snapshots);
1324
1325     if (header.magic != QCOW_MAGIC) {
1326         error_setg(errp, "Image is not in qcow2 format");
1327         ret = -EINVAL;
1328         goto fail;
1329     }
1330     if (header.version < 2 || header.version > 3) {
1331         error_setg(errp, "Unsupported qcow2 version %" PRIu32, header.version);
1332         ret = -ENOTSUP;
1333         goto fail;
1334     }
1335
1336     s->qcow_version = header.version;
1337
1338     /* Initialise cluster size */
1339     if (header.cluster_bits < MIN_CLUSTER_BITS ||
1340         header.cluster_bits > MAX_CLUSTER_BITS) {
1341         error_setg(errp, "Unsupported cluster size: 2^%" PRIu32,
1342                    header.cluster_bits);
1343         ret = -EINVAL;
1344         goto fail;
1345     }
1346
1347     s->cluster_bits = header.cluster_bits;
1348     s->cluster_size = 1 << s->cluster_bits;
1349
1350     /* Initialise version 3 header fields */
1351     if (header.version == 2) {
1352         header.incompatible_features    = 0;
1353         header.compatible_features      = 0;
1354         header.autoclear_features       = 0;
1355         header.refcount_order           = 4;
1356         header.header_length            = 72;
1357     } else {
1358         header.incompatible_features =
1359             be64_to_cpu(header.incompatible_features);
1360         header.compatible_features = be64_to_cpu(header.compatible_features);
1361         header.autoclear_features = be64_to_cpu(header.autoclear_features);
1362         header.refcount_order = be32_to_cpu(header.refcount_order);
1363         header.header_length = be32_to_cpu(header.header_length);
1364
1365         if (header.header_length < 104) {
1366             error_setg(errp, "qcow2 header too short");
1367             ret = -EINVAL;
1368             goto fail;
1369         }
1370     }
1371
1372     if (header.header_length > s->cluster_size) {
1373         error_setg(errp, "qcow2 header exceeds cluster size");
1374         ret = -EINVAL;
1375         goto fail;
1376     }
1377
1378     if (header.header_length > sizeof(header)) {
1379         s->unknown_header_fields_size = header.header_length - sizeof(header);
1380         s->unknown_header_fields = g_malloc(s->unknown_header_fields_size);
1381         ret = bdrv_pread(bs->file, sizeof(header), s->unknown_header_fields,
1382                          s->unknown_header_fields_size);
1383         if (ret < 0) {
1384             error_setg_errno(errp, -ret, "Could not read unknown qcow2 header "
1385                              "fields");
1386             goto fail;
1387         }
1388     }
1389
1390     if (header.backing_file_offset > s->cluster_size) {
1391         error_setg(errp, "Invalid backing file offset");
1392         ret = -EINVAL;
1393         goto fail;
1394     }
1395
1396     if (header.backing_file_offset) {
1397         ext_end = header.backing_file_offset;
1398     } else {
1399         ext_end = 1 << header.cluster_bits;
1400     }
1401
1402     /* Handle feature bits */
1403     s->incompatible_features    = header.incompatible_features;
1404     s->compatible_features      = header.compatible_features;
1405     s->autoclear_features       = header.autoclear_features;
1406
1407     /*
1408      * Handle compression type
1409      * Older qcow2 images don't contain the compression type header.
1410      * Distinguish them by the header length and use
1411      * the only valid (default) compression type in that case
1412      */
1413     if (header.header_length > offsetof(QCowHeader, compression_type)) {
1414         s->compression_type = header.compression_type;
1415     } else {
1416         s->compression_type = QCOW2_COMPRESSION_TYPE_ZLIB;
1417     }
1418
1419     ret = validate_compression_type(s, errp);
1420     if (ret) {
1421         goto fail;
1422     }
1423
1424     if (s->incompatible_features & ~QCOW2_INCOMPAT_MASK) {
1425         void *feature_table = NULL;
1426         qcow2_read_extensions(bs, header.header_length, ext_end,
1427                               &feature_table, flags, NULL, NULL);
1428         report_unsupported_feature(errp, feature_table,
1429                                    s->incompatible_features &
1430                                    ~QCOW2_INCOMPAT_MASK);
1431         ret = -ENOTSUP;
1432         g_free(feature_table);
1433         goto fail;
1434     }
1435
1436     if (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT) {
1437         /* Corrupt images may not be written to unless they are being repaired
1438          */
1439         if ((flags & BDRV_O_RDWR) && !(flags & BDRV_O_CHECK)) {
1440             error_setg(errp, "qcow2: Image is corrupt; cannot be opened "
1441                        "read/write");
1442             ret = -EACCES;
1443             goto fail;
1444         }
1445     }
1446
1447     /* Check support for various header values */
1448     if (header.refcount_order > 6) {
1449         error_setg(errp, "Reference count entry width too large; may not "
1450                    "exceed 64 bits");
1451         ret = -EINVAL;
1452         goto fail;
1453     }
1454     s->refcount_order = header.refcount_order;
1455     s->refcount_bits = 1 << s->refcount_order;
1456     s->refcount_max = UINT64_C(1) << (s->refcount_bits - 1);
1457     s->refcount_max += s->refcount_max - 1;
1458
1459     s->crypt_method_header = header.crypt_method;
1460     if (s->crypt_method_header) {
1461         if (bdrv_uses_whitelist() &&
1462             s->crypt_method_header == QCOW_CRYPT_AES) {
1463             error_setg(errp,
1464                        "Use of AES-CBC encrypted qcow2 images is no longer "
1465                        "supported in system emulators");
1466             error_append_hint(errp,
1467                               "You can use 'qemu-img convert' to convert your "
1468                               "image to an alternative supported format, such "
1469                               "as unencrypted qcow2, or raw with the LUKS "
1470                               "format instead.\n");
1471             ret = -ENOSYS;
1472             goto fail;
1473         }
1474
1475         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1476             s->crypt_physical_offset = false;
1477         } else {
1478             /* Assuming LUKS and any future crypt methods we
1479              * add will all use physical offsets, due to the
1480              * fact that the alternative is insecure...  */
1481             s->crypt_physical_offset = true;
1482         }
1483
1484         bs->encrypted = true;
1485     }
1486
1487     s->l2_bits = s->cluster_bits - 3; /* L2 is always one cluster */
1488     s->l2_size = 1 << s->l2_bits;
1489     /* 2^(s->refcount_order - 3) is the refcount width in bytes */
1490     s->refcount_block_bits = s->cluster_bits - (s->refcount_order - 3);
1491     s->refcount_block_size = 1 << s->refcount_block_bits;
1492     bs->total_sectors = header.size / BDRV_SECTOR_SIZE;
1493     s->csize_shift = (62 - (s->cluster_bits - 8));
1494     s->csize_mask = (1 << (s->cluster_bits - 8)) - 1;
1495     s->cluster_offset_mask = (1LL << s->csize_shift) - 1;
1496
1497     s->refcount_table_offset = header.refcount_table_offset;
1498     s->refcount_table_size =
1499         header.refcount_table_clusters << (s->cluster_bits - 3);
1500
1501     if (header.refcount_table_clusters == 0 && !(flags & BDRV_O_CHECK)) {
1502         error_setg(errp, "Image does not contain a reference count table");
1503         ret = -EINVAL;
1504         goto fail;
1505     }
1506
1507     ret = qcow2_validate_table(bs, s->refcount_table_offset,
1508                                header.refcount_table_clusters,
1509                                s->cluster_size, QCOW_MAX_REFTABLE_SIZE,
1510                                "Reference count table", errp);
1511     if (ret < 0) {
1512         goto fail;
1513     }
1514
1515     if (!(flags & BDRV_O_CHECK)) {
1516         /*
1517          * The total size in bytes of the snapshot table is checked in
1518          * qcow2_read_snapshots() because the size of each snapshot is
1519          * variable and we don't know it yet.
1520          * Here we only check the offset and number of snapshots.
1521          */
1522         ret = qcow2_validate_table(bs, header.snapshots_offset,
1523                                    header.nb_snapshots,
1524                                    sizeof(QCowSnapshotHeader),
1525                                    sizeof(QCowSnapshotHeader) *
1526                                        QCOW_MAX_SNAPSHOTS,
1527                                    "Snapshot table", errp);
1528         if (ret < 0) {
1529             goto fail;
1530         }
1531     }
1532
1533     /* read the level 1 table */
1534     ret = qcow2_validate_table(bs, header.l1_table_offset,
1535                                header.l1_size, sizeof(uint64_t),
1536                                QCOW_MAX_L1_SIZE, "Active L1 table", errp);
1537     if (ret < 0) {
1538         goto fail;
1539     }
1540     s->l1_size = header.l1_size;
1541     s->l1_table_offset = header.l1_table_offset;
1542
1543     l1_vm_state_index = size_to_l1(s, header.size);
1544     if (l1_vm_state_index > INT_MAX) {
1545         error_setg(errp, "Image is too big");
1546         ret = -EFBIG;
1547         goto fail;
1548     }
1549     s->l1_vm_state_index = l1_vm_state_index;
1550
1551     /* the L1 table must contain at least enough entries to put
1552        header.size bytes */
1553     if (s->l1_size < s->l1_vm_state_index) {
1554         error_setg(errp, "L1 table is too small");
1555         ret = -EINVAL;
1556         goto fail;
1557     }
1558
1559     if (s->l1_size > 0) {
1560         s->l1_table = qemu_try_blockalign(bs->file->bs,
1561                                           s->l1_size * sizeof(uint64_t));
1562         if (s->l1_table == NULL) {
1563             error_setg(errp, "Could not allocate L1 table");
1564             ret = -ENOMEM;
1565             goto fail;
1566         }
1567         ret = bdrv_pread(bs->file, s->l1_table_offset, s->l1_table,
1568                          s->l1_size * sizeof(uint64_t));
1569         if (ret < 0) {
1570             error_setg_errno(errp, -ret, "Could not read L1 table");
1571             goto fail;
1572         }
1573         for(i = 0;i < s->l1_size; i++) {
1574             s->l1_table[i] = be64_to_cpu(s->l1_table[i]);
1575         }
1576     }
1577
1578     /* Parse driver-specific options */
1579     ret = qcow2_update_options(bs, options, flags, errp);
1580     if (ret < 0) {
1581         goto fail;
1582     }
1583
1584     s->flags = flags;
1585
1586     ret = qcow2_refcount_init(bs);
1587     if (ret != 0) {
1588         error_setg_errno(errp, -ret, "Could not initialize refcount handling");
1589         goto fail;
1590     }
1591
1592     QLIST_INIT(&s->cluster_allocs);
1593     QTAILQ_INIT(&s->discards);
1594
1595     /* read qcow2 extensions */
1596     if (qcow2_read_extensions(bs, header.header_length, ext_end, NULL,
1597                               flags, &update_header, errp)) {
1598         ret = -EINVAL;
1599         goto fail;
1600     }
1601
1602     /* Open external data file */
1603     s->data_file = bdrv_open_child(NULL, options, "data-file", bs,
1604                                    &child_of_bds, BDRV_CHILD_DATA,
1605                                    true, &local_err);
1606     if (local_err) {
1607         error_propagate(errp, local_err);
1608         ret = -EINVAL;
1609         goto fail;
1610     }
1611
1612     if (s->incompatible_features & QCOW2_INCOMPAT_DATA_FILE) {
1613         if (!s->data_file && s->image_data_file) {
1614             s->data_file = bdrv_open_child(s->image_data_file, options,
1615                                            "data-file", bs, &child_of_bds,
1616                                            BDRV_CHILD_DATA, false, errp);
1617             if (!s->data_file) {
1618                 ret = -EINVAL;
1619                 goto fail;
1620             }
1621         }
1622         if (!s->data_file) {
1623             error_setg(errp, "'data-file' is required for this image");
1624             ret = -EINVAL;
1625             goto fail;
1626         }
1627
1628         /* No data here */
1629         bs->file->role &= ~BDRV_CHILD_DATA;
1630
1631         /* Must succeed because we have given up permissions if anything */
1632         bdrv_child_refresh_perms(bs, bs->file, &error_abort);
1633     } else {
1634         if (s->data_file) {
1635             error_setg(errp, "'data-file' can only be set for images with an "
1636                              "external data file");
1637             ret = -EINVAL;
1638             goto fail;
1639         }
1640
1641         s->data_file = bs->file;
1642
1643         if (data_file_is_raw(bs)) {
1644             error_setg(errp, "data-file-raw requires a data file");
1645             ret = -EINVAL;
1646             goto fail;
1647         }
1648     }
1649
1650     /* qcow2_read_extension may have set up the crypto context
1651      * if the crypt method needs a header region, some methods
1652      * don't need header extensions, so must check here
1653      */
1654     if (s->crypt_method_header && !s->crypto) {
1655         if (s->crypt_method_header == QCOW_CRYPT_AES) {
1656             unsigned int cflags = 0;
1657             if (flags & BDRV_O_NO_IO) {
1658                 cflags |= QCRYPTO_BLOCK_OPEN_NO_IO;
1659             }
1660             s->crypto = qcrypto_block_open(s->crypto_opts, "encrypt.",
1661                                            NULL, NULL, cflags,
1662                                            QCOW2_MAX_THREADS, errp);
1663             if (!s->crypto) {
1664                 ret = -EINVAL;
1665                 goto fail;
1666             }
1667         } else if (!(flags & BDRV_O_NO_IO)) {
1668             error_setg(errp, "Missing CRYPTO header for crypt method %d",
1669                        s->crypt_method_header);
1670             ret = -EINVAL;
1671             goto fail;
1672         }
1673     }
1674
1675     /* read the backing file name */
1676     if (header.backing_file_offset != 0) {
1677         len = header.backing_file_size;
1678         if (len > MIN(1023, s->cluster_size - header.backing_file_offset) ||
1679             len >= sizeof(bs->backing_file)) {
1680             error_setg(errp, "Backing file name too long");
1681             ret = -EINVAL;
1682             goto fail;
1683         }
1684         ret = bdrv_pread(bs->file, header.backing_file_offset,
1685                          bs->auto_backing_file, len);
1686         if (ret < 0) {
1687             error_setg_errno(errp, -ret, "Could not read backing file name");
1688             goto fail;
1689         }
1690         bs->auto_backing_file[len] = '\0';
1691         pstrcpy(bs->backing_file, sizeof(bs->backing_file),
1692                 bs->auto_backing_file);
1693         s->image_backing_file = g_strdup(bs->auto_backing_file);
1694     }
1695
1696     /*
1697      * Internal snapshots; skip reading them in check mode, because
1698      * we do not need them then, and we do not want to abort because
1699      * of a broken table.
1700      */
1701     if (!(flags & BDRV_O_CHECK)) {
1702         s->snapshots_offset = header.snapshots_offset;
1703         s->nb_snapshots = header.nb_snapshots;
1704
1705         ret = qcow2_read_snapshots(bs, errp);
1706         if (ret < 0) {
1707             goto fail;
1708         }
1709     }
1710
1711     /* Clear unknown autoclear feature bits */
1712     update_header |= s->autoclear_features & ~QCOW2_AUTOCLEAR_MASK;
1713     update_header =
1714         update_header && !bs->read_only && !(flags & BDRV_O_INACTIVE);
1715     if (update_header) {
1716         s->autoclear_features &= QCOW2_AUTOCLEAR_MASK;
1717     }
1718
1719     /* == Handle persistent dirty bitmaps ==
1720      *
1721      * We want load dirty bitmaps in three cases:
1722      *
1723      * 1. Normal open of the disk in active mode, not related to invalidation
1724      *    after migration.
1725      *
1726      * 2. Invalidation of the target vm after pre-copy phase of migration, if
1727      *    bitmaps are _not_ migrating through migration channel, i.e.
1728      *    'dirty-bitmaps' capability is disabled.
1729      *
1730      * 3. Invalidation of source vm after failed or canceled migration.
1731      *    This is a very interesting case. There are two possible types of
1732      *    bitmaps:
1733      *
1734      *    A. Stored on inactivation and removed. They should be loaded from the
1735      *       image.
1736      *
1737      *    B. Not stored: not-persistent bitmaps and bitmaps, migrated through
1738      *       the migration channel (with dirty-bitmaps capability).
1739      *
1740      *    On the other hand, there are two possible sub-cases:
1741      *
1742      *    3.1 disk was changed by somebody else while were inactive. In this
1743      *        case all in-RAM dirty bitmaps (both persistent and not) are
1744      *        definitely invalid. And we don't have any method to determine
1745      *        this.
1746      *
1747      *        Simple and safe thing is to just drop all the bitmaps of type B on
1748      *        inactivation. But in this case we lose bitmaps in valid 4.2 case.
1749      *
1750      *        On the other hand, resuming source vm, if disk was already changed
1751      *        is a bad thing anyway: not only bitmaps, the whole vm state is
1752      *        out of sync with disk.
1753      *
1754      *        This means, that user or management tool, who for some reason
1755      *        decided to resume source vm, after disk was already changed by
1756      *        target vm, should at least drop all dirty bitmaps by hand.
1757      *
1758      *        So, we can ignore this case for now, but TODO: "generation"
1759      *        extension for qcow2, to determine, that image was changed after
1760      *        last inactivation. And if it is changed, we will drop (or at least
1761      *        mark as 'invalid' all the bitmaps of type B, both persistent
1762      *        and not).
1763      *
1764      *    3.2 disk was _not_ changed while were inactive. Bitmaps may be saved
1765      *        to disk ('dirty-bitmaps' capability disabled), or not saved
1766      *        ('dirty-bitmaps' capability enabled), but we don't need to care
1767      *        of: let's load bitmaps as always: stored bitmaps will be loaded,
1768      *        and not stored has flag IN_USE=1 in the image and will be skipped
1769      *        on loading.
1770      *
1771      * One remaining possible case when we don't want load bitmaps:
1772      *
1773      * 4. Open disk in inactive mode in target vm (bitmaps are migrating or
1774      *    will be loaded on invalidation, no needs try loading them before)
1775      */
1776
1777     if (!(bdrv_get_flags(bs) & BDRV_O_INACTIVE)) {
1778         /* It's case 1, 2 or 3.2. Or 3.1 which is BUG in management layer. */
1779         bool header_updated = qcow2_load_dirty_bitmaps(bs, &local_err);
1780         if (local_err != NULL) {
1781             error_propagate(errp, local_err);
1782             ret = -EINVAL;
1783             goto fail;
1784         }
1785
1786         update_header = update_header && !header_updated;
1787     }
1788
1789     if (update_header) {
1790         ret = qcow2_update_header(bs);
1791         if (ret < 0) {
1792             error_setg_errno(errp, -ret, "Could not update qcow2 header");
1793             goto fail;
1794         }
1795     }
1796
1797     bs->supported_zero_flags = header.version >= 3 ?
1798                                BDRV_REQ_MAY_UNMAP | BDRV_REQ_NO_FALLBACK : 0;
1799     bs->supported_truncate_flags = BDRV_REQ_ZERO_WRITE;
1800
1801     /* Repair image if dirty */
1802     if (!(flags & (BDRV_O_CHECK | BDRV_O_INACTIVE)) && !bs->read_only &&
1803         (s->incompatible_features & QCOW2_INCOMPAT_DIRTY)) {
1804         BdrvCheckResult result = {0};
1805
1806         ret = qcow2_co_check_locked(bs, &result,
1807                                     BDRV_FIX_ERRORS | BDRV_FIX_LEAKS);
1808         if (ret < 0 || result.check_errors) {
1809             if (ret >= 0) {
1810                 ret = -EIO;
1811             }
1812             error_setg_errno(errp, -ret, "Could not repair dirty image");
1813             goto fail;
1814         }
1815     }
1816
1817 #ifdef DEBUG_ALLOC
1818     {
1819         BdrvCheckResult result = {0};
1820         qcow2_check_refcounts(bs, &result, 0);
1821     }
1822 #endif
1823
1824     qemu_co_queue_init(&s->thread_task_queue);
1825
1826     return ret;
1827
1828  fail:
1829     g_free(s->image_data_file);
1830     if (has_data_file(bs)) {
1831         bdrv_unref_child(bs, s->data_file);
1832         s->data_file = NULL;
1833     }
1834     g_free(s->unknown_header_fields);
1835     cleanup_unknown_header_ext(bs);
1836     qcow2_free_snapshots(bs);
1837     qcow2_refcount_close(bs);
1838     qemu_vfree(s->l1_table);
1839     /* else pre-write overlap checks in cache_destroy may crash */
1840     s->l1_table = NULL;
1841     cache_clean_timer_del(bs);
1842     if (s->l2_table_cache) {
1843         qcow2_cache_destroy(s->l2_table_cache);
1844     }
1845     if (s->refcount_block_cache) {
1846         qcow2_cache_destroy(s->refcount_block_cache);
1847     }
1848     qcrypto_block_free(s->crypto);
1849     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
1850     return ret;
1851 }
1852
1853 typedef struct QCow2OpenCo {
1854     BlockDriverState *bs;
1855     QDict *options;
1856     int flags;
1857     Error **errp;
1858     int ret;
1859 } QCow2OpenCo;
1860
1861 static void coroutine_fn qcow2_open_entry(void *opaque)
1862 {
1863     QCow2OpenCo *qoc = opaque;
1864     BDRVQcow2State *s = qoc->bs->opaque;
1865
1866     qemu_co_mutex_lock(&s->lock);
1867     qoc->ret = qcow2_do_open(qoc->bs, qoc->options, qoc->flags, qoc->errp);
1868     qemu_co_mutex_unlock(&s->lock);
1869 }
1870
1871 static int qcow2_open(BlockDriverState *bs, QDict *options, int flags,
1872                       Error **errp)
1873 {
1874     BDRVQcow2State *s = bs->opaque;
1875     QCow2OpenCo qoc = {
1876         .bs = bs,
1877         .options = options,
1878         .flags = flags,
1879         .errp = errp,
1880         .ret = -EINPROGRESS
1881     };
1882
1883     bs->file = bdrv_open_child(NULL, options, "file", bs, &child_of_bds,
1884                                BDRV_CHILD_IMAGE, false, errp);
1885     if (!bs->file) {
1886         return -EINVAL;
1887     }
1888
1889     /* Initialise locks */
1890     qemu_co_mutex_init(&s->lock);
1891
1892     if (qemu_in_coroutine()) {
1893         /* From bdrv_co_create.  */
1894         qcow2_open_entry(&qoc);
1895     } else {
1896         assert(qemu_get_current_aio_context() == qemu_get_aio_context());
1897         qemu_coroutine_enter(qemu_coroutine_create(qcow2_open_entry, &qoc));
1898         BDRV_POLL_WHILE(bs, qoc.ret == -EINPROGRESS);
1899     }
1900     return qoc.ret;
1901 }
1902
1903 static void qcow2_refresh_limits(BlockDriverState *bs, Error **errp)
1904 {
1905     BDRVQcow2State *s = bs->opaque;
1906
1907     if (bs->encrypted) {
1908         /* Encryption works on a sector granularity */
1909         bs->bl.request_alignment = qcrypto_block_get_sector_size(s->crypto);
1910     }
1911     bs->bl.pwrite_zeroes_alignment = s->cluster_size;
1912     bs->bl.pdiscard_alignment = s->cluster_size;
1913 }
1914
1915 static int qcow2_reopen_prepare(BDRVReopenState *state,
1916                                 BlockReopenQueue *queue, Error **errp)
1917 {
1918     Qcow2ReopenState *r;
1919     int ret;
1920
1921     r = g_new0(Qcow2ReopenState, 1);
1922     state->opaque = r;
1923
1924     ret = qcow2_update_options_prepare(state->bs, r, state->options,
1925                                        state->flags, errp);
1926     if (ret < 0) {
1927         goto fail;
1928     }
1929
1930     /* We need to write out any unwritten data if we reopen read-only. */
1931     if ((state->flags & BDRV_O_RDWR) == 0) {
1932         ret = qcow2_reopen_bitmaps_ro(state->bs, errp);
1933         if (ret < 0) {
1934             goto fail;
1935         }
1936
1937         ret = bdrv_flush(state->bs);
1938         if (ret < 0) {
1939             goto fail;
1940         }
1941
1942         ret = qcow2_mark_clean(state->bs);
1943         if (ret < 0) {
1944             goto fail;
1945         }
1946     }
1947
1948     return 0;
1949
1950 fail:
1951     qcow2_update_options_abort(state->bs, r);
1952     g_free(r);
1953     return ret;
1954 }
1955
1956 static void qcow2_reopen_commit(BDRVReopenState *state)
1957 {
1958     qcow2_update_options_commit(state->bs, state->opaque);
1959     g_free(state->opaque);
1960 }
1961
1962 static void qcow2_reopen_commit_post(BDRVReopenState *state)
1963 {
1964     if (state->flags & BDRV_O_RDWR) {
1965         Error *local_err = NULL;
1966
1967         if (qcow2_reopen_bitmaps_rw(state->bs, &local_err) < 0) {
1968             /*
1969              * This is not fatal, bitmaps just left read-only, so all following
1970              * writes will fail. User can remove read-only bitmaps to unblock
1971              * writes or retry reopen.
1972              */
1973             error_reportf_err(local_err,
1974                               "%s: Failed to make dirty bitmaps writable: ",
1975                               bdrv_get_node_name(state->bs));
1976         }
1977     }
1978 }
1979
1980 static void qcow2_reopen_abort(BDRVReopenState *state)
1981 {
1982     qcow2_update_options_abort(state->bs, state->opaque);
1983     g_free(state->opaque);
1984 }
1985
1986 static void qcow2_join_options(QDict *options, QDict *old_options)
1987 {
1988     bool has_new_overlap_template =
1989         qdict_haskey(options, QCOW2_OPT_OVERLAP) ||
1990         qdict_haskey(options, QCOW2_OPT_OVERLAP_TEMPLATE);
1991     bool has_new_total_cache_size =
1992         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE);
1993     bool has_all_cache_options;
1994
1995     /* New overlap template overrides all old overlap options */
1996     if (has_new_overlap_template) {
1997         qdict_del(old_options, QCOW2_OPT_OVERLAP);
1998         qdict_del(old_options, QCOW2_OPT_OVERLAP_TEMPLATE);
1999         qdict_del(old_options, QCOW2_OPT_OVERLAP_MAIN_HEADER);
2000         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L1);
2001         qdict_del(old_options, QCOW2_OPT_OVERLAP_ACTIVE_L2);
2002         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_TABLE);
2003         qdict_del(old_options, QCOW2_OPT_OVERLAP_REFCOUNT_BLOCK);
2004         qdict_del(old_options, QCOW2_OPT_OVERLAP_SNAPSHOT_TABLE);
2005         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L1);
2006         qdict_del(old_options, QCOW2_OPT_OVERLAP_INACTIVE_L2);
2007     }
2008
2009     /* New total cache size overrides all old options */
2010     if (qdict_haskey(options, QCOW2_OPT_CACHE_SIZE)) {
2011         qdict_del(old_options, QCOW2_OPT_L2_CACHE_SIZE);
2012         qdict_del(old_options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
2013     }
2014
2015     qdict_join(options, old_options, false);
2016
2017     /*
2018      * If after merging all cache size options are set, an old total size is
2019      * overwritten. Do keep all options, however, if all three are new. The
2020      * resulting error message is what we want to happen.
2021      */
2022     has_all_cache_options =
2023         qdict_haskey(options, QCOW2_OPT_CACHE_SIZE) ||
2024         qdict_haskey(options, QCOW2_OPT_L2_CACHE_SIZE) ||
2025         qdict_haskey(options, QCOW2_OPT_REFCOUNT_CACHE_SIZE);
2026
2027     if (has_all_cache_options && !has_new_total_cache_size) {
2028         qdict_del(options, QCOW2_OPT_CACHE_SIZE);
2029     }
2030 }
2031
2032 static int coroutine_fn qcow2_co_block_status(BlockDriverState *bs,
2033                                               bool want_zero,
2034                                               int64_t offset, int64_t count,
2035                                               int64_t *pnum, int64_t *map,
2036                                               BlockDriverState **file)
2037 {
2038     BDRVQcow2State *s = bs->opaque;
2039     uint64_t host_offset;
2040     unsigned int bytes;
2041     int ret, status = 0;
2042
2043     qemu_co_mutex_lock(&s->lock);
2044
2045     if (!s->metadata_preallocation_checked) {
2046         ret = qcow2_detect_metadata_preallocation(bs);
2047         s->metadata_preallocation = (ret == 1);
2048         s->metadata_preallocation_checked = true;
2049     }
2050
2051     bytes = MIN(INT_MAX, count);
2052     ret = qcow2_get_host_offset(bs, offset, &bytes, &host_offset);
2053     qemu_co_mutex_unlock(&s->lock);
2054     if (ret < 0) {
2055         return ret;
2056     }
2057
2058     *pnum = bytes;
2059
2060     if ((ret == QCOW2_CLUSTER_NORMAL || ret == QCOW2_CLUSTER_ZERO_ALLOC) &&
2061         !s->crypto) {
2062         *map = host_offset;
2063         *file = s->data_file->bs;
2064         status |= BDRV_BLOCK_OFFSET_VALID;
2065     }
2066     if (ret == QCOW2_CLUSTER_ZERO_PLAIN || ret == QCOW2_CLUSTER_ZERO_ALLOC) {
2067         status |= BDRV_BLOCK_ZERO;
2068     } else if (ret != QCOW2_CLUSTER_UNALLOCATED) {
2069         status |= BDRV_BLOCK_DATA;
2070     }
2071     if (s->metadata_preallocation && (status & BDRV_BLOCK_DATA) &&
2072         (status & BDRV_BLOCK_OFFSET_VALID))
2073     {
2074         status |= BDRV_BLOCK_RECURSE;
2075     }
2076     return status;
2077 }
2078
2079 static coroutine_fn int qcow2_handle_l2meta(BlockDriverState *bs,
2080                                             QCowL2Meta **pl2meta,
2081                                             bool link_l2)
2082 {
2083     int ret = 0;
2084     QCowL2Meta *l2meta = *pl2meta;
2085
2086     while (l2meta != NULL) {
2087         QCowL2Meta *next;
2088
2089         if (link_l2) {
2090             ret = qcow2_alloc_cluster_link_l2(bs, l2meta);
2091             if (ret) {
2092                 goto out;
2093             }
2094         } else {
2095             qcow2_alloc_cluster_abort(bs, l2meta);
2096         }
2097
2098         /* Take the request off the list of running requests */
2099         if (l2meta->nb_clusters != 0) {
2100             QLIST_REMOVE(l2meta, next_in_flight);
2101         }
2102
2103         qemu_co_queue_restart_all(&l2meta->dependent_requests);
2104
2105         next = l2meta->next;
2106         g_free(l2meta);
2107         l2meta = next;
2108     }
2109 out:
2110     *pl2meta = l2meta;
2111     return ret;
2112 }
2113
2114 static coroutine_fn int
2115 qcow2_co_preadv_encrypted(BlockDriverState *bs,
2116                            uint64_t host_offset,
2117                            uint64_t offset,
2118                            uint64_t bytes,
2119                            QEMUIOVector *qiov,
2120                            uint64_t qiov_offset)
2121 {
2122     int ret;
2123     BDRVQcow2State *s = bs->opaque;
2124     uint8_t *buf;
2125
2126     assert(bs->encrypted && s->crypto);
2127     assert(bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2128
2129     /*
2130      * For encrypted images, read everything into a temporary
2131      * contiguous buffer on which the AES functions can work.
2132      * Also, decryption in a separate buffer is better as it
2133      * prevents the guest from learning information about the
2134      * encrypted nature of the virtual disk.
2135      */
2136
2137     buf = qemu_try_blockalign(s->data_file->bs, bytes);
2138     if (buf == NULL) {
2139         return -ENOMEM;
2140     }
2141
2142     BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2143     ret = bdrv_co_pread(s->data_file, host_offset, bytes, buf, 0);
2144     if (ret < 0) {
2145         goto fail;
2146     }
2147
2148     if (qcow2_co_decrypt(bs, host_offset, offset, buf, bytes) < 0)
2149     {
2150         ret = -EIO;
2151         goto fail;
2152     }
2153     qemu_iovec_from_buf(qiov, qiov_offset, buf, bytes);
2154
2155 fail:
2156     qemu_vfree(buf);
2157
2158     return ret;
2159 }
2160
2161 typedef struct Qcow2AioTask {
2162     AioTask task;
2163
2164     BlockDriverState *bs;
2165     QCow2ClusterType cluster_type; /* only for read */
2166     uint64_t host_offset; /* or full descriptor in compressed clusters */
2167     uint64_t offset;
2168     uint64_t bytes;
2169     QEMUIOVector *qiov;
2170     uint64_t qiov_offset;
2171     QCowL2Meta *l2meta; /* only for write */
2172 } Qcow2AioTask;
2173
2174 static coroutine_fn int qcow2_co_preadv_task_entry(AioTask *task);
2175 static coroutine_fn int qcow2_add_task(BlockDriverState *bs,
2176                                        AioTaskPool *pool,
2177                                        AioTaskFunc func,
2178                                        QCow2ClusterType cluster_type,
2179                                        uint64_t host_offset,
2180                                        uint64_t offset,
2181                                        uint64_t bytes,
2182                                        QEMUIOVector *qiov,
2183                                        size_t qiov_offset,
2184                                        QCowL2Meta *l2meta)
2185 {
2186     Qcow2AioTask local_task;
2187     Qcow2AioTask *task = pool ? g_new(Qcow2AioTask, 1) : &local_task;
2188
2189     *task = (Qcow2AioTask) {
2190         .task.func = func,
2191         .bs = bs,
2192         .cluster_type = cluster_type,
2193         .qiov = qiov,
2194         .host_offset = host_offset,
2195         .offset = offset,
2196         .bytes = bytes,
2197         .qiov_offset = qiov_offset,
2198         .l2meta = l2meta,
2199     };
2200
2201     trace_qcow2_add_task(qemu_coroutine_self(), bs, pool,
2202                          func == qcow2_co_preadv_task_entry ? "read" : "write",
2203                          cluster_type, host_offset, offset, bytes,
2204                          qiov, qiov_offset);
2205
2206     if (!pool) {
2207         return func(&task->task);
2208     }
2209
2210     aio_task_pool_start_task(pool, &task->task);
2211
2212     return 0;
2213 }
2214
2215 static coroutine_fn int qcow2_co_preadv_task(BlockDriverState *bs,
2216                                              QCow2ClusterType cluster_type,
2217                                              uint64_t host_offset,
2218                                              uint64_t offset, uint64_t bytes,
2219                                              QEMUIOVector *qiov,
2220                                              size_t qiov_offset)
2221 {
2222     BDRVQcow2State *s = bs->opaque;
2223
2224     switch (cluster_type) {
2225     case QCOW2_CLUSTER_ZERO_PLAIN:
2226     case QCOW2_CLUSTER_ZERO_ALLOC:
2227         /* Both zero types are handled in qcow2_co_preadv_part */
2228         g_assert_not_reached();
2229
2230     case QCOW2_CLUSTER_UNALLOCATED:
2231         assert(bs->backing); /* otherwise handled in qcow2_co_preadv_part */
2232
2233         BLKDBG_EVENT(bs->file, BLKDBG_READ_BACKING_AIO);
2234         return bdrv_co_preadv_part(bs->backing, offset, bytes,
2235                                    qiov, qiov_offset, 0);
2236
2237     case QCOW2_CLUSTER_COMPRESSED:
2238         return qcow2_co_preadv_compressed(bs, host_offset,
2239                                           offset, bytes, qiov, qiov_offset);
2240
2241     case QCOW2_CLUSTER_NORMAL:
2242         if (bs->encrypted) {
2243             return qcow2_co_preadv_encrypted(bs, host_offset,
2244                                              offset, bytes, qiov, qiov_offset);
2245         }
2246
2247         BLKDBG_EVENT(bs->file, BLKDBG_READ_AIO);
2248         return bdrv_co_preadv_part(s->data_file, host_offset,
2249                                    bytes, qiov, qiov_offset, 0);
2250
2251     default:
2252         g_assert_not_reached();
2253     }
2254
2255     g_assert_not_reached();
2256 }
2257
2258 static coroutine_fn int qcow2_co_preadv_task_entry(AioTask *task)
2259 {
2260     Qcow2AioTask *t = container_of(task, Qcow2AioTask, task);
2261
2262     assert(!t->l2meta);
2263
2264     return qcow2_co_preadv_task(t->bs, t->cluster_type, t->host_offset,
2265                                 t->offset, t->bytes, t->qiov, t->qiov_offset);
2266 }
2267
2268 static coroutine_fn int qcow2_co_preadv_part(BlockDriverState *bs,
2269                                              uint64_t offset, uint64_t bytes,
2270                                              QEMUIOVector *qiov,
2271                                              size_t qiov_offset, int flags)
2272 {
2273     BDRVQcow2State *s = bs->opaque;
2274     int ret = 0;
2275     unsigned int cur_bytes; /* number of bytes in current iteration */
2276     uint64_t host_offset = 0;
2277     AioTaskPool *aio = NULL;
2278
2279     while (bytes != 0 && aio_task_pool_status(aio) == 0) {
2280         /* prepare next request */
2281         cur_bytes = MIN(bytes, INT_MAX);
2282         if (s->crypto) {
2283             cur_bytes = MIN(cur_bytes,
2284                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2285         }
2286
2287         qemu_co_mutex_lock(&s->lock);
2288         ret = qcow2_get_host_offset(bs, offset, &cur_bytes, &host_offset);
2289         qemu_co_mutex_unlock(&s->lock);
2290         if (ret < 0) {
2291             goto out;
2292         }
2293
2294         if (ret == QCOW2_CLUSTER_ZERO_PLAIN ||
2295             ret == QCOW2_CLUSTER_ZERO_ALLOC ||
2296             (ret == QCOW2_CLUSTER_UNALLOCATED && !bs->backing))
2297         {
2298             qemu_iovec_memset(qiov, qiov_offset, 0, cur_bytes);
2299         } else {
2300             if (!aio && cur_bytes != bytes) {
2301                 aio = aio_task_pool_new(QCOW2_MAX_WORKERS);
2302             }
2303             ret = qcow2_add_task(bs, aio, qcow2_co_preadv_task_entry, ret,
2304                                  host_offset, offset, cur_bytes,
2305                                  qiov, qiov_offset, NULL);
2306             if (ret < 0) {
2307                 goto out;
2308             }
2309         }
2310
2311         bytes -= cur_bytes;
2312         offset += cur_bytes;
2313         qiov_offset += cur_bytes;
2314     }
2315
2316 out:
2317     if (aio) {
2318         aio_task_pool_wait_all(aio);
2319         if (ret == 0) {
2320             ret = aio_task_pool_status(aio);
2321         }
2322         g_free(aio);
2323     }
2324
2325     return ret;
2326 }
2327
2328 /* Check if it's possible to merge a write request with the writing of
2329  * the data from the COW regions */
2330 static bool merge_cow(uint64_t offset, unsigned bytes,
2331                       QEMUIOVector *qiov, size_t qiov_offset,
2332                       QCowL2Meta *l2meta)
2333 {
2334     QCowL2Meta *m;
2335
2336     for (m = l2meta; m != NULL; m = m->next) {
2337         /* If both COW regions are empty then there's nothing to merge */
2338         if (m->cow_start.nb_bytes == 0 && m->cow_end.nb_bytes == 0) {
2339             continue;
2340         }
2341
2342         /* If COW regions are handled already, skip this too */
2343         if (m->skip_cow) {
2344             continue;
2345         }
2346
2347         /* The data (middle) region must be immediately after the
2348          * start region */
2349         if (l2meta_cow_start(m) + m->cow_start.nb_bytes != offset) {
2350             continue;
2351         }
2352
2353         /* The end region must be immediately after the data (middle)
2354          * region */
2355         if (m->offset + m->cow_end.offset != offset + bytes) {
2356             continue;
2357         }
2358
2359         /* Make sure that adding both COW regions to the QEMUIOVector
2360          * does not exceed IOV_MAX */
2361         if (qemu_iovec_subvec_niov(qiov, qiov_offset, bytes) > IOV_MAX - 2) {
2362             continue;
2363         }
2364
2365         m->data_qiov = qiov;
2366         m->data_qiov_offset = qiov_offset;
2367         return true;
2368     }
2369
2370     return false;
2371 }
2372
2373 static bool is_unallocated(BlockDriverState *bs, int64_t offset, int64_t bytes)
2374 {
2375     int64_t nr;
2376     return !bytes ||
2377         (!bdrv_is_allocated_above(bs, NULL, false, offset, bytes, &nr) &&
2378          nr == bytes);
2379 }
2380
2381 static bool is_zero_cow(BlockDriverState *bs, QCowL2Meta *m)
2382 {
2383     /*
2384      * This check is designed for optimization shortcut so it must be
2385      * efficient.
2386      * Instead of is_zero(), use is_unallocated() as it is faster (but not
2387      * as accurate and can result in false negatives).
2388      */
2389     return is_unallocated(bs, m->offset + m->cow_start.offset,
2390                           m->cow_start.nb_bytes) &&
2391            is_unallocated(bs, m->offset + m->cow_end.offset,
2392                           m->cow_end.nb_bytes);
2393 }
2394
2395 static int handle_alloc_space(BlockDriverState *bs, QCowL2Meta *l2meta)
2396 {
2397     BDRVQcow2State *s = bs->opaque;
2398     QCowL2Meta *m;
2399
2400     if (!(s->data_file->bs->supported_zero_flags & BDRV_REQ_NO_FALLBACK)) {
2401         return 0;
2402     }
2403
2404     if (bs->encrypted) {
2405         return 0;
2406     }
2407
2408     for (m = l2meta; m != NULL; m = m->next) {
2409         int ret;
2410
2411         if (!m->cow_start.nb_bytes && !m->cow_end.nb_bytes) {
2412             continue;
2413         }
2414
2415         if (!is_zero_cow(bs, m)) {
2416             continue;
2417         }
2418
2419         /*
2420          * instead of writing zero COW buffers,
2421          * efficiently zero out the whole clusters
2422          */
2423
2424         ret = qcow2_pre_write_overlap_check(bs, 0, m->alloc_offset,
2425                                             m->nb_clusters * s->cluster_size,
2426                                             true);
2427         if (ret < 0) {
2428             return ret;
2429         }
2430
2431         BLKDBG_EVENT(bs->file, BLKDBG_CLUSTER_ALLOC_SPACE);
2432         ret = bdrv_co_pwrite_zeroes(s->data_file, m->alloc_offset,
2433                                     m->nb_clusters * s->cluster_size,
2434                                     BDRV_REQ_NO_FALLBACK);
2435         if (ret < 0) {
2436             if (ret != -ENOTSUP && ret != -EAGAIN) {
2437                 return ret;
2438             }
2439             continue;
2440         }
2441
2442         trace_qcow2_skip_cow(qemu_coroutine_self(), m->offset, m->nb_clusters);
2443         m->skip_cow = true;
2444     }
2445     return 0;
2446 }
2447
2448 /*
2449  * qcow2_co_pwritev_task
2450  * Called with s->lock unlocked
2451  * l2meta  - if not NULL, qcow2_co_pwritev_task() will consume it. Caller must
2452  *           not use it somehow after qcow2_co_pwritev_task() call
2453  */
2454 static coroutine_fn int qcow2_co_pwritev_task(BlockDriverState *bs,
2455                                               uint64_t host_offset,
2456                                               uint64_t offset, uint64_t bytes,
2457                                               QEMUIOVector *qiov,
2458                                               uint64_t qiov_offset,
2459                                               QCowL2Meta *l2meta)
2460 {
2461     int ret;
2462     BDRVQcow2State *s = bs->opaque;
2463     void *crypt_buf = NULL;
2464     QEMUIOVector encrypted_qiov;
2465
2466     if (bs->encrypted) {
2467         assert(s->crypto);
2468         assert(bytes <= QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size);
2469         crypt_buf = qemu_try_blockalign(bs->file->bs, bytes);
2470         if (crypt_buf == NULL) {
2471             ret = -ENOMEM;
2472             goto out_unlocked;
2473         }
2474         qemu_iovec_to_buf(qiov, qiov_offset, crypt_buf, bytes);
2475
2476         if (qcow2_co_encrypt(bs, host_offset, offset, crypt_buf, bytes) < 0) {
2477             ret = -EIO;
2478             goto out_unlocked;
2479         }
2480
2481         qemu_iovec_init_buf(&encrypted_qiov, crypt_buf, bytes);
2482         qiov = &encrypted_qiov;
2483         qiov_offset = 0;
2484     }
2485
2486     /* Try to efficiently initialize the physical space with zeroes */
2487     ret = handle_alloc_space(bs, l2meta);
2488     if (ret < 0) {
2489         goto out_unlocked;
2490     }
2491
2492     /*
2493      * If we need to do COW, check if it's possible to merge the
2494      * writing of the guest data together with that of the COW regions.
2495      * If it's not possible (or not necessary) then write the
2496      * guest data now.
2497      */
2498     if (!merge_cow(offset, bytes, qiov, qiov_offset, l2meta)) {
2499         BLKDBG_EVENT(bs->file, BLKDBG_WRITE_AIO);
2500         trace_qcow2_writev_data(qemu_coroutine_self(), host_offset);
2501         ret = bdrv_co_pwritev_part(s->data_file, host_offset,
2502                                    bytes, qiov, qiov_offset, 0);
2503         if (ret < 0) {
2504             goto out_unlocked;
2505         }
2506     }
2507
2508     qemu_co_mutex_lock(&s->lock);
2509
2510     ret = qcow2_handle_l2meta(bs, &l2meta, true);
2511     goto out_locked;
2512
2513 out_unlocked:
2514     qemu_co_mutex_lock(&s->lock);
2515
2516 out_locked:
2517     qcow2_handle_l2meta(bs, &l2meta, false);
2518     qemu_co_mutex_unlock(&s->lock);
2519
2520     qemu_vfree(crypt_buf);
2521
2522     return ret;
2523 }
2524
2525 static coroutine_fn int qcow2_co_pwritev_task_entry(AioTask *task)
2526 {
2527     Qcow2AioTask *t = container_of(task, Qcow2AioTask, task);
2528
2529     assert(!t->cluster_type);
2530
2531     return qcow2_co_pwritev_task(t->bs, t->host_offset,
2532                                  t->offset, t->bytes, t->qiov, t->qiov_offset,
2533                                  t->l2meta);
2534 }
2535
2536 static coroutine_fn int qcow2_co_pwritev_part(
2537         BlockDriverState *bs, uint64_t offset, uint64_t bytes,
2538         QEMUIOVector *qiov, size_t qiov_offset, int flags)
2539 {
2540     BDRVQcow2State *s = bs->opaque;
2541     int offset_in_cluster;
2542     int ret;
2543     unsigned int cur_bytes; /* number of sectors in current iteration */
2544     uint64_t cluster_offset;
2545     QCowL2Meta *l2meta = NULL;
2546     AioTaskPool *aio = NULL;
2547
2548     trace_qcow2_writev_start_req(qemu_coroutine_self(), offset, bytes);
2549
2550     while (bytes != 0 && aio_task_pool_status(aio) == 0) {
2551
2552         l2meta = NULL;
2553
2554         trace_qcow2_writev_start_part(qemu_coroutine_self());
2555         offset_in_cluster = offset_into_cluster(s, offset);
2556         cur_bytes = MIN(bytes, INT_MAX);
2557         if (bs->encrypted) {
2558             cur_bytes = MIN(cur_bytes,
2559                             QCOW_MAX_CRYPT_CLUSTERS * s->cluster_size
2560                             - offset_in_cluster);
2561         }
2562
2563         qemu_co_mutex_lock(&s->lock);
2564
2565         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
2566                                          &cluster_offset, &l2meta);
2567         if (ret < 0) {
2568             goto out_locked;
2569         }
2570
2571         assert(offset_into_cluster(s, cluster_offset) == 0);
2572
2573         ret = qcow2_pre_write_overlap_check(bs, 0,
2574                                             cluster_offset + offset_in_cluster,
2575                                             cur_bytes, true);
2576         if (ret < 0) {
2577             goto out_locked;
2578         }
2579
2580         qemu_co_mutex_unlock(&s->lock);
2581
2582         if (!aio && cur_bytes != bytes) {
2583             aio = aio_task_pool_new(QCOW2_MAX_WORKERS);
2584         }
2585         ret = qcow2_add_task(bs, aio, qcow2_co_pwritev_task_entry, 0,
2586                              cluster_offset + offset_in_cluster, offset,
2587                              cur_bytes, qiov, qiov_offset, l2meta);
2588         l2meta = NULL; /* l2meta is consumed by qcow2_co_pwritev_task() */
2589         if (ret < 0) {
2590             goto fail_nometa;
2591         }
2592
2593         bytes -= cur_bytes;
2594         offset += cur_bytes;
2595         qiov_offset += cur_bytes;
2596         trace_qcow2_writev_done_part(qemu_coroutine_self(), cur_bytes);
2597     }
2598     ret = 0;
2599
2600     qemu_co_mutex_lock(&s->lock);
2601
2602 out_locked:
2603     qcow2_handle_l2meta(bs, &l2meta, false);
2604
2605     qemu_co_mutex_unlock(&s->lock);
2606
2607 fail_nometa:
2608     if (aio) {
2609         aio_task_pool_wait_all(aio);
2610         if (ret == 0) {
2611             ret = aio_task_pool_status(aio);
2612         }
2613         g_free(aio);
2614     }
2615
2616     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
2617
2618     return ret;
2619 }
2620
2621 static int qcow2_inactivate(BlockDriverState *bs)
2622 {
2623     BDRVQcow2State *s = bs->opaque;
2624     int ret, result = 0;
2625     Error *local_err = NULL;
2626
2627     qcow2_store_persistent_dirty_bitmaps(bs, true, &local_err);
2628     if (local_err != NULL) {
2629         result = -EINVAL;
2630         error_reportf_err(local_err, "Lost persistent bitmaps during "
2631                           "inactivation of node '%s': ",
2632                           bdrv_get_device_or_node_name(bs));
2633     }
2634
2635     ret = qcow2_cache_flush(bs, s->l2_table_cache);
2636     if (ret) {
2637         result = ret;
2638         error_report("Failed to flush the L2 table cache: %s",
2639                      strerror(-ret));
2640     }
2641
2642     ret = qcow2_cache_flush(bs, s->refcount_block_cache);
2643     if (ret) {
2644         result = ret;
2645         error_report("Failed to flush the refcount block cache: %s",
2646                      strerror(-ret));
2647     }
2648
2649     if (result == 0) {
2650         qcow2_mark_clean(bs);
2651     }
2652
2653     return result;
2654 }
2655
2656 static void qcow2_close(BlockDriverState *bs)
2657 {
2658     BDRVQcow2State *s = bs->opaque;
2659     qemu_vfree(s->l1_table);
2660     /* else pre-write overlap checks in cache_destroy may crash */
2661     s->l1_table = NULL;
2662
2663     if (!(s->flags & BDRV_O_INACTIVE)) {
2664         qcow2_inactivate(bs);
2665     }
2666
2667     cache_clean_timer_del(bs);
2668     qcow2_cache_destroy(s->l2_table_cache);
2669     qcow2_cache_destroy(s->refcount_block_cache);
2670
2671     qcrypto_block_free(s->crypto);
2672     s->crypto = NULL;
2673     qapi_free_QCryptoBlockOpenOptions(s->crypto_opts);
2674
2675     g_free(s->unknown_header_fields);
2676     cleanup_unknown_header_ext(bs);
2677
2678     g_free(s->image_data_file);
2679     g_free(s->image_backing_file);
2680     g_free(s->image_backing_format);
2681
2682     if (has_data_file(bs)) {
2683         bdrv_unref_child(bs, s->data_file);
2684         s->data_file = NULL;
2685     }
2686
2687     qcow2_refcount_close(bs);
2688     qcow2_free_snapshots(bs);
2689 }
2690
2691 static void coroutine_fn qcow2_co_invalidate_cache(BlockDriverState *bs,
2692                                                    Error **errp)
2693 {
2694     BDRVQcow2State *s = bs->opaque;
2695     int flags = s->flags;
2696     QCryptoBlock *crypto = NULL;
2697     QDict *options;
2698     Error *local_err = NULL;
2699     int ret;
2700
2701     /*
2702      * Backing files are read-only which makes all of their metadata immutable,
2703      * that means we don't have to worry about reopening them here.
2704      */
2705
2706     crypto = s->crypto;
2707     s->crypto = NULL;
2708
2709     qcow2_close(bs);
2710
2711     memset(s, 0, sizeof(BDRVQcow2State));
2712     options = qdict_clone_shallow(bs->options);
2713
2714     flags &= ~BDRV_O_INACTIVE;
2715     qemu_co_mutex_lock(&s->lock);
2716     ret = qcow2_do_open(bs, options, flags, &local_err);
2717     qemu_co_mutex_unlock(&s->lock);
2718     qobject_unref(options);
2719     if (local_err) {
2720         error_propagate_prepend(errp, local_err,
2721                                 "Could not reopen qcow2 layer: ");
2722         bs->drv = NULL;
2723         return;
2724     } else if (ret < 0) {
2725         error_setg_errno(errp, -ret, "Could not reopen qcow2 layer");
2726         bs->drv = NULL;
2727         return;
2728     }
2729
2730     s->crypto = crypto;
2731 }
2732
2733 static size_t header_ext_add(char *buf, uint32_t magic, const void *s,
2734     size_t len, size_t buflen)
2735 {
2736     QCowExtension *ext_backing_fmt = (QCowExtension*) buf;
2737     size_t ext_len = sizeof(QCowExtension) + ((len + 7) & ~7);
2738
2739     if (buflen < ext_len) {
2740         return -ENOSPC;
2741     }
2742
2743     *ext_backing_fmt = (QCowExtension) {
2744         .magic  = cpu_to_be32(magic),
2745         .len    = cpu_to_be32(len),
2746     };
2747
2748     if (len) {
2749         memcpy(buf + sizeof(QCowExtension), s, len);
2750     }
2751
2752     return ext_len;
2753 }
2754
2755 /*
2756  * Updates the qcow2 header, including the variable length parts of it, i.e.
2757  * the backing file name and all extensions. qcow2 was not designed to allow
2758  * such changes, so if we run out of space (we can only use the first cluster)
2759  * this function may fail.
2760  *
2761  * Returns 0 on success, -errno in error cases.
2762  */
2763 int qcow2_update_header(BlockDriverState *bs)
2764 {
2765     BDRVQcow2State *s = bs->opaque;
2766     QCowHeader *header;
2767     char *buf;
2768     size_t buflen = s->cluster_size;
2769     int ret;
2770     uint64_t total_size;
2771     uint32_t refcount_table_clusters;
2772     size_t header_length;
2773     Qcow2UnknownHeaderExtension *uext;
2774
2775     buf = qemu_blockalign(bs, buflen);
2776
2777     /* Header structure */
2778     header = (QCowHeader*) buf;
2779
2780     if (buflen < sizeof(*header)) {
2781         ret = -ENOSPC;
2782         goto fail;
2783     }
2784
2785     header_length = sizeof(*header) + s->unknown_header_fields_size;
2786     total_size = bs->total_sectors * BDRV_SECTOR_SIZE;
2787     refcount_table_clusters = s->refcount_table_size >> (s->cluster_bits - 3);
2788
2789     ret = validate_compression_type(s, NULL);
2790     if (ret) {
2791         goto fail;
2792     }
2793
2794     *header = (QCowHeader) {
2795         /* Version 2 fields */
2796         .magic                  = cpu_to_be32(QCOW_MAGIC),
2797         .version                = cpu_to_be32(s->qcow_version),
2798         .backing_file_offset    = 0,
2799         .backing_file_size      = 0,
2800         .cluster_bits           = cpu_to_be32(s->cluster_bits),
2801         .size                   = cpu_to_be64(total_size),
2802         .crypt_method           = cpu_to_be32(s->crypt_method_header),
2803         .l1_size                = cpu_to_be32(s->l1_size),
2804         .l1_table_offset        = cpu_to_be64(s->l1_table_offset),
2805         .refcount_table_offset  = cpu_to_be64(s->refcount_table_offset),
2806         .refcount_table_clusters = cpu_to_be32(refcount_table_clusters),
2807         .nb_snapshots           = cpu_to_be32(s->nb_snapshots),
2808         .snapshots_offset       = cpu_to_be64(s->snapshots_offset),
2809
2810         /* Version 3 fields */
2811         .incompatible_features  = cpu_to_be64(s->incompatible_features),
2812         .compatible_features    = cpu_to_be64(s->compatible_features),
2813         .autoclear_features     = cpu_to_be64(s->autoclear_features),
2814         .refcount_order         = cpu_to_be32(s->refcount_order),
2815         .header_length          = cpu_to_be32(header_length),
2816         .compression_type       = s->compression_type,
2817     };
2818
2819     /* For older versions, write a shorter header */
2820     switch (s->qcow_version) {
2821     case 2:
2822         ret = offsetof(QCowHeader, incompatible_features);
2823         break;
2824     case 3:
2825         ret = sizeof(*header);
2826         break;
2827     default:
2828         ret = -EINVAL;
2829         goto fail;
2830     }
2831
2832     buf += ret;
2833     buflen -= ret;
2834     memset(buf, 0, buflen);
2835
2836     /* Preserve any unknown field in the header */
2837     if (s->unknown_header_fields_size) {
2838         if (buflen < s->unknown_header_fields_size) {
2839             ret = -ENOSPC;
2840             goto fail;
2841         }
2842
2843         memcpy(buf, s->unknown_header_fields, s->unknown_header_fields_size);
2844         buf += s->unknown_header_fields_size;
2845         buflen -= s->unknown_header_fields_size;
2846     }
2847
2848     /* Backing file format header extension */
2849     if (s->image_backing_format) {
2850         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BACKING_FORMAT,
2851                              s->image_backing_format,
2852                              strlen(s->image_backing_format),
2853                              buflen);
2854         if (ret < 0) {
2855             goto fail;
2856         }
2857
2858         buf += ret;
2859         buflen -= ret;
2860     }
2861
2862     /* External data file header extension */
2863     if (has_data_file(bs) && s->image_data_file) {
2864         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_DATA_FILE,
2865                              s->image_data_file, strlen(s->image_data_file),
2866                              buflen);
2867         if (ret < 0) {
2868             goto fail;
2869         }
2870
2871         buf += ret;
2872         buflen -= ret;
2873     }
2874
2875     /* Full disk encryption header pointer extension */
2876     if (s->crypto_header.offset != 0) {
2877         s->crypto_header.offset = cpu_to_be64(s->crypto_header.offset);
2878         s->crypto_header.length = cpu_to_be64(s->crypto_header.length);
2879         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_CRYPTO_HEADER,
2880                              &s->crypto_header, sizeof(s->crypto_header),
2881                              buflen);
2882         s->crypto_header.offset = be64_to_cpu(s->crypto_header.offset);
2883         s->crypto_header.length = be64_to_cpu(s->crypto_header.length);
2884         if (ret < 0) {
2885             goto fail;
2886         }
2887         buf += ret;
2888         buflen -= ret;
2889     }
2890
2891     /*
2892      * Feature table.  A mere 8 feature names occupies 392 bytes, and
2893      * when coupled with the v3 minimum header of 104 bytes plus the
2894      * 8-byte end-of-extension marker, that would leave only 8 bytes
2895      * for a backing file name in an image with 512-byte clusters.
2896      * Thus, we choose to omit this header for cluster sizes 4k and
2897      * smaller.
2898      */
2899     if (s->qcow_version >= 3 && s->cluster_size > 4096) {
2900         static const Qcow2Feature features[] = {
2901             {
2902                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2903                 .bit  = QCOW2_INCOMPAT_DIRTY_BITNR,
2904                 .name = "dirty bit",
2905             },
2906             {
2907                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2908                 .bit  = QCOW2_INCOMPAT_CORRUPT_BITNR,
2909                 .name = "corrupt bit",
2910             },
2911             {
2912                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2913                 .bit  = QCOW2_INCOMPAT_DATA_FILE_BITNR,
2914                 .name = "external data file",
2915             },
2916             {
2917                 .type = QCOW2_FEAT_TYPE_INCOMPATIBLE,
2918                 .bit  = QCOW2_INCOMPAT_COMPRESSION_BITNR,
2919                 .name = "compression type",
2920             },
2921             {
2922                 .type = QCOW2_FEAT_TYPE_COMPATIBLE,
2923                 .bit  = QCOW2_COMPAT_LAZY_REFCOUNTS_BITNR,
2924                 .name = "lazy refcounts",
2925             },
2926             {
2927                 .type = QCOW2_FEAT_TYPE_AUTOCLEAR,
2928                 .bit  = QCOW2_AUTOCLEAR_BITMAPS_BITNR,
2929                 .name = "bitmaps",
2930             },
2931             {
2932                 .type = QCOW2_FEAT_TYPE_AUTOCLEAR,
2933                 .bit  = QCOW2_AUTOCLEAR_DATA_FILE_RAW_BITNR,
2934                 .name = "raw external data",
2935             },
2936         };
2937
2938         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_FEATURE_TABLE,
2939                              features, sizeof(features), buflen);
2940         if (ret < 0) {
2941             goto fail;
2942         }
2943         buf += ret;
2944         buflen -= ret;
2945     }
2946
2947     /* Bitmap extension */
2948     if (s->nb_bitmaps > 0) {
2949         Qcow2BitmapHeaderExt bitmaps_header = {
2950             .nb_bitmaps = cpu_to_be32(s->nb_bitmaps),
2951             .bitmap_directory_size =
2952                     cpu_to_be64(s->bitmap_directory_size),
2953             .bitmap_directory_offset =
2954                     cpu_to_be64(s->bitmap_directory_offset)
2955         };
2956         ret = header_ext_add(buf, QCOW2_EXT_MAGIC_BITMAPS,
2957                              &bitmaps_header, sizeof(bitmaps_header),
2958                              buflen);
2959         if (ret < 0) {
2960             goto fail;
2961         }
2962         buf += ret;
2963         buflen -= ret;
2964     }
2965
2966     /* Keep unknown header extensions */
2967     QLIST_FOREACH(uext, &s->unknown_header_ext, next) {
2968         ret = header_ext_add(buf, uext->magic, uext->data, uext->len, buflen);
2969         if (ret < 0) {
2970             goto fail;
2971         }
2972
2973         buf += ret;
2974         buflen -= ret;
2975     }
2976
2977     /* End of header extensions */
2978     ret = header_ext_add(buf, QCOW2_EXT_MAGIC_END, NULL, 0, buflen);
2979     if (ret < 0) {
2980         goto fail;
2981     }
2982
2983     buf += ret;
2984     buflen -= ret;
2985
2986     /* Backing file name */
2987     if (s->image_backing_file) {
2988         size_t backing_file_len = strlen(s->image_backing_file);
2989
2990         if (buflen < backing_file_len) {
2991             ret = -ENOSPC;
2992             goto fail;
2993         }
2994
2995         /* Using strncpy is ok here, since buf is not NUL-terminated. */
2996         strncpy(buf, s->image_backing_file, buflen);
2997
2998         header->backing_file_offset = cpu_to_be64(buf - ((char*) header));
2999         header->backing_file_size   = cpu_to_be32(backing_file_len);
3000     }
3001
3002     /* Write the new header */
3003     ret = bdrv_pwrite(bs->file, 0, header, s->cluster_size);
3004     if (ret < 0) {
3005         goto fail;
3006     }
3007
3008     ret = 0;
3009 fail:
3010     qemu_vfree(header);
3011     return ret;
3012 }
3013
3014 static int qcow2_change_backing_file(BlockDriverState *bs,
3015     const char *backing_file, const char *backing_fmt)
3016 {
3017     BDRVQcow2State *s = bs->opaque;
3018
3019     /* Adding a backing file means that the external data file alone won't be
3020      * enough to make sense of the content */
3021     if (backing_file && data_file_is_raw(bs)) {
3022         return -EINVAL;
3023     }
3024
3025     if (backing_file && strlen(backing_file) > 1023) {
3026         return -EINVAL;
3027     }
3028
3029     pstrcpy(bs->auto_backing_file, sizeof(bs->auto_backing_file),
3030             backing_file ?: "");
3031     pstrcpy(bs->backing_file, sizeof(bs->backing_file), backing_file ?: "");
3032     pstrcpy(bs->backing_format, sizeof(bs->backing_format), backing_fmt ?: "");
3033
3034     g_free(s->image_backing_file);
3035     g_free(s->image_backing_format);
3036
3037     s->image_backing_file = backing_file ? g_strdup(bs->backing_file) : NULL;
3038     s->image_backing_format = backing_fmt ? g_strdup(bs->backing_format) : NULL;
3039
3040     return qcow2_update_header(bs);
3041 }
3042
3043 static int qcow2_set_up_encryption(BlockDriverState *bs,
3044                                    QCryptoBlockCreateOptions *cryptoopts,
3045                                    Error **errp)
3046 {
3047     BDRVQcow2State *s = bs->opaque;
3048     QCryptoBlock *crypto = NULL;
3049     int fmt, ret;
3050
3051     switch (cryptoopts->format) {
3052     case Q_CRYPTO_BLOCK_FORMAT_LUKS:
3053         fmt = QCOW_CRYPT_LUKS;
3054         break;
3055     case Q_CRYPTO_BLOCK_FORMAT_QCOW:
3056         fmt = QCOW_CRYPT_AES;
3057         break;
3058     default:
3059         error_setg(errp, "Crypto format not supported in qcow2");
3060         return -EINVAL;
3061     }
3062
3063     s->crypt_method_header = fmt;
3064
3065     crypto = qcrypto_block_create(cryptoopts, "encrypt.",
3066                                   qcow2_crypto_hdr_init_func,
3067                                   qcow2_crypto_hdr_write_func,
3068                                   bs, errp);
3069     if (!crypto) {
3070         return -EINVAL;
3071     }
3072
3073     ret = qcow2_update_header(bs);
3074     if (ret < 0) {
3075         error_setg_errno(errp, -ret, "Could not write encryption header");
3076         goto out;
3077     }
3078
3079     ret = 0;
3080  out:
3081     qcrypto_block_free(crypto);
3082     return ret;
3083 }
3084
3085 /**
3086  * Preallocates metadata structures for data clusters between @offset (in the
3087  * guest disk) and @new_length (which is thus generally the new guest disk
3088  * size).
3089  *
3090  * Returns: 0 on success, -errno on failure.
3091  */
3092 static int coroutine_fn preallocate_co(BlockDriverState *bs, uint64_t offset,
3093                                        uint64_t new_length, PreallocMode mode,
3094                                        Error **errp)
3095 {
3096     BDRVQcow2State *s = bs->opaque;
3097     uint64_t bytes;
3098     uint64_t host_offset = 0;
3099     int64_t file_length;
3100     unsigned int cur_bytes;
3101     int ret;
3102     QCowL2Meta *meta;
3103
3104     assert(offset <= new_length);
3105     bytes = new_length - offset;
3106
3107     while (bytes) {
3108         cur_bytes = MIN(bytes, QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size));
3109         ret = qcow2_alloc_cluster_offset(bs, offset, &cur_bytes,
3110                                          &host_offset, &meta);
3111         if (ret < 0) {
3112             error_setg_errno(errp, -ret, "Allocating clusters failed");
3113             return ret;
3114         }
3115
3116         while (meta) {
3117             QCowL2Meta *next = meta->next;
3118
3119             ret = qcow2_alloc_cluster_link_l2(bs, meta);
3120             if (ret < 0) {
3121                 error_setg_errno(errp, -ret, "Mapping clusters failed");
3122                 qcow2_free_any_clusters(bs, meta->alloc_offset,
3123                                         meta->nb_clusters, QCOW2_DISCARD_NEVER);
3124                 return ret;
3125             }
3126
3127             /* There are no dependent requests, but we need to remove our
3128              * request from the list of in-flight requests */
3129             QLIST_REMOVE(meta, next_in_flight);
3130
3131             g_free(meta);
3132             meta = next;
3133         }
3134
3135         /* TODO Preallocate data if requested */
3136
3137         bytes -= cur_bytes;
3138         offset += cur_bytes;
3139     }
3140
3141     /*
3142      * It is expected that the image file is large enough to actually contain
3143      * all of the allocated clusters (otherwise we get failing reads after
3144      * EOF). Extend the image to the last allocated sector.
3145      */
3146     file_length = bdrv_getlength(s->data_file->bs);
3147     if (file_length < 0) {
3148         error_setg_errno(errp, -file_length, "Could not get file size");
3149         return file_length;
3150     }
3151
3152     if (host_offset + cur_bytes > file_length) {
3153         if (mode == PREALLOC_MODE_METADATA) {
3154             mode = PREALLOC_MODE_OFF;
3155         }
3156         ret = bdrv_co_truncate(s->data_file, host_offset + cur_bytes, false,
3157                                mode, 0, errp);
3158         if (ret < 0) {
3159             return ret;
3160         }
3161     }
3162
3163     return 0;
3164 }
3165
3166 /* qcow2_refcount_metadata_size:
3167  * @clusters: number of clusters to refcount (including data and L1/L2 tables)
3168  * @cluster_size: size of a cluster, in bytes
3169  * @refcount_order: refcount bits power-of-2 exponent
3170  * @generous_increase: allow for the refcount table to be 1.5x as large as it
3171  *                     needs to be
3172  *
3173  * Returns: Number of bytes required for refcount blocks and table metadata.
3174  */
3175 int64_t qcow2_refcount_metadata_size(int64_t clusters, size_t cluster_size,
3176                                      int refcount_order, bool generous_increase,
3177                                      uint64_t *refblock_count)
3178 {
3179     /*
3180      * Every host cluster is reference-counted, including metadata (even
3181      * refcount metadata is recursively included).
3182      *
3183      * An accurate formula for the size of refcount metadata size is difficult
3184      * to derive.  An easier method of calculation is finding the fixed point
3185      * where no further refcount blocks or table clusters are required to
3186      * reference count every cluster.
3187      */
3188     int64_t blocks_per_table_cluster = cluster_size / sizeof(uint64_t);
3189     int64_t refcounts_per_block = cluster_size * 8 / (1 << refcount_order);
3190     int64_t table = 0;  /* number of refcount table clusters */
3191     int64_t blocks = 0; /* number of refcount block clusters */
3192     int64_t last;
3193     int64_t n = 0;
3194
3195     do {
3196         last = n;
3197         blocks = DIV_ROUND_UP(clusters + table + blocks, refcounts_per_block);
3198         table = DIV_ROUND_UP(blocks, blocks_per_table_cluster);
3199         n = clusters + blocks + table;
3200
3201         if (n == last && generous_increase) {
3202             clusters += DIV_ROUND_UP(table, 2);
3203             n = 0; /* force another loop */
3204             generous_increase = false;
3205         }
3206     } while (n != last);
3207
3208     if (refblock_count) {
3209         *refblock_count = blocks;
3210     }
3211
3212     return (blocks + table) * cluster_size;
3213 }
3214
3215 /**
3216  * qcow2_calc_prealloc_size:
3217  * @total_size: virtual disk size in bytes
3218  * @cluster_size: cluster size in bytes
3219  * @refcount_order: refcount bits power-of-2 exponent
3220  *
3221  * Returns: Total number of bytes required for the fully allocated image
3222  * (including metadata).
3223  */
3224 static int64_t qcow2_calc_prealloc_size(int64_t total_size,
3225                                         size_t cluster_size,
3226                                         int refcount_order)
3227 {
3228     int64_t meta_size = 0;
3229     uint64_t nl1e, nl2e;
3230     int64_t aligned_total_size = ROUND_UP(total_size, cluster_size);
3231
3232     /* header: 1 cluster */
3233     meta_size += cluster_size;
3234
3235     /* total size of L2 tables */
3236     nl2e = aligned_total_size / cluster_size;
3237     nl2e = ROUND_UP(nl2e, cluster_size / sizeof(uint64_t));
3238     meta_size += nl2e * sizeof(uint64_t);
3239
3240     /* total size of L1 tables */
3241     nl1e = nl2e * sizeof(uint64_t) / cluster_size;
3242     nl1e = ROUND_UP(nl1e, cluster_size / sizeof(uint64_t));
3243     meta_size += nl1e * sizeof(uint64_t);
3244
3245     /* total size of refcount table and blocks */
3246     meta_size += qcow2_refcount_metadata_size(
3247             (meta_size + aligned_total_size) / cluster_size,
3248             cluster_size, refcount_order, false, NULL);
3249
3250     return meta_size + aligned_total_size;
3251 }
3252
3253 static bool validate_cluster_size(size_t cluster_size, Error **errp)
3254 {
3255     int cluster_bits = ctz32(cluster_size);
3256     if (cluster_bits < MIN_CLUSTER_BITS || cluster_bits > MAX_CLUSTER_BITS ||
3257         (1 << cluster_bits) != cluster_size)
3258     {
3259         error_setg(errp, "Cluster size must be a power of two between %d and "
3260                    "%dk", 1 << MIN_CLUSTER_BITS, 1 << (MAX_CLUSTER_BITS - 10));
3261         return false;
3262     }
3263     return true;
3264 }
3265
3266 static size_t qcow2_opt_get_cluster_size_del(QemuOpts *opts, Error **errp)
3267 {
3268     size_t cluster_size;
3269
3270     cluster_size = qemu_opt_get_size_del(opts, BLOCK_OPT_CLUSTER_SIZE,
3271                                          DEFAULT_CLUSTER_SIZE);
3272     if (!validate_cluster_size(cluster_size, errp)) {
3273         return 0;
3274     }
3275     return cluster_size;
3276 }
3277
3278 static int qcow2_opt_get_version_del(QemuOpts *opts, Error **errp)
3279 {
3280     char *buf;
3281     int ret;
3282
3283     buf = qemu_opt_get_del(opts, BLOCK_OPT_COMPAT_LEVEL);
3284     if (!buf) {
3285         ret = 3; /* default */
3286     } else if (!strcmp(buf, "0.10")) {
3287         ret = 2;
3288     } else if (!strcmp(buf, "1.1")) {
3289         ret = 3;
3290     } else {
3291         error_setg(errp, "Invalid compatibility level: '%s'", buf);
3292         ret = -EINVAL;
3293     }
3294     g_free(buf);
3295     return ret;
3296 }
3297
3298 static uint64_t qcow2_opt_get_refcount_bits_del(QemuOpts *opts, int version,
3299                                                 Error **errp)
3300 {
3301     uint64_t refcount_bits;
3302
3303     refcount_bits = qemu_opt_get_number_del(opts, BLOCK_OPT_REFCOUNT_BITS, 16);
3304     if (refcount_bits > 64 || !is_power_of_2(refcount_bits)) {
3305         error_setg(errp, "Refcount width must be a power of two and may not "
3306                    "exceed 64 bits");
3307         return 0;
3308     }
3309
3310     if (version < 3 && refcount_bits != 16) {
3311         error_setg(errp, "Different refcount widths than 16 bits require "
3312                    "compatibility level 1.1 or above (use compat=1.1 or "
3313                    "greater)");
3314         return 0;
3315     }
3316
3317     return refcount_bits;
3318 }
3319
3320 static int coroutine_fn
3321 qcow2_co_create(BlockdevCreateOptions *create_options, Error **errp)
3322 {
3323     BlockdevCreateOptionsQcow2 *qcow2_opts;
3324     QDict *options;
3325
3326     /*
3327      * Open the image file and write a minimal qcow2 header.
3328      *
3329      * We keep things simple and start with a zero-sized image. We also
3330      * do without refcount blocks or a L1 table for now. We'll fix the
3331      * inconsistency later.
3332      *
3333      * We do need a refcount table because growing the refcount table means
3334      * allocating two new refcount blocks - the second of which would be at
3335      * 2 GB for 64k clusters, and we don't want to have a 2 GB initial file
3336      * size for any qcow2 image.
3337      */
3338     BlockBackend *blk = NULL;
3339     BlockDriverState *bs = NULL;
3340     BlockDriverState *data_bs = NULL;
3341     QCowHeader *header;
3342     size_t cluster_size;
3343     int version;
3344     int refcount_order;
3345     uint64_t* refcount_table;
3346     int ret;
3347     uint8_t compression_type = QCOW2_COMPRESSION_TYPE_ZLIB;
3348
3349     assert(create_options->driver == BLOCKDEV_DRIVER_QCOW2);
3350     qcow2_opts = &create_options->u.qcow2;
3351
3352     bs = bdrv_open_blockdev_ref(qcow2_opts->file, errp);
3353     if (bs == NULL) {
3354         return -EIO;
3355     }
3356
3357     /* Validate options and set default values */
3358     if (!QEMU_IS_ALIGNED(qcow2_opts->size, BDRV_SECTOR_SIZE)) {
3359         error_setg(errp, "Image size must be a multiple of %u bytes",
3360                    (unsigned) BDRV_SECTOR_SIZE);
3361         ret = -EINVAL;
3362         goto out;
3363     }
3364
3365     if (qcow2_opts->has_version) {
3366         switch (qcow2_opts->version) {
3367         case BLOCKDEV_QCOW2_VERSION_V2:
3368             version = 2;
3369             break;
3370         case BLOCKDEV_QCOW2_VERSION_V3:
3371             version = 3;
3372             break;
3373         default:
3374             g_assert_not_reached();
3375         }
3376     } else {
3377         version = 3;
3378     }
3379
3380     if (qcow2_opts->has_cluster_size) {
3381         cluster_size = qcow2_opts->cluster_size;
3382     } else {
3383         cluster_size = DEFAULT_CLUSTER_SIZE;
3384     }
3385
3386     if (!validate_cluster_size(cluster_size, errp)) {
3387         ret = -EINVAL;
3388         goto out;
3389     }
3390
3391     if (!qcow2_opts->has_preallocation) {
3392         qcow2_opts->preallocation = PREALLOC_MODE_OFF;
3393     }
3394     if (qcow2_opts->has_backing_file &&
3395         qcow2_opts->preallocation != PREALLOC_MODE_OFF)
3396     {
3397         error_setg(errp, "Backing file and preallocation cannot be used at "
3398                    "the same time");
3399         ret = -EINVAL;
3400         goto out;
3401     }
3402     if (qcow2_opts->has_backing_fmt && !qcow2_opts->has_backing_file) {
3403         error_setg(errp, "Backing format cannot be used without backing file");
3404         ret = -EINVAL;
3405         goto out;
3406     }
3407
3408     if (!qcow2_opts->has_lazy_refcounts) {
3409         qcow2_opts->lazy_refcounts = false;
3410     }
3411     if (version < 3 && qcow2_opts->lazy_refcounts) {
3412         error_setg(errp, "Lazy refcounts only supported with compatibility "
3413                    "level 1.1 and above (use version=v3 or greater)");
3414         ret = -EINVAL;
3415         goto out;
3416     }
3417
3418     if (!qcow2_opts->has_refcount_bits) {
3419         qcow2_opts->refcount_bits = 16;
3420     }
3421     if (qcow2_opts->refcount_bits > 64 ||
3422         !is_power_of_2(qcow2_opts->refcount_bits))
3423     {
3424         error_setg(errp, "Refcount width must be a power of two and may not "
3425                    "exceed 64 bits");
3426         ret = -EINVAL;
3427         goto out;
3428     }
3429     if (version < 3 && qcow2_opts->refcount_bits != 16) {
3430         error_setg(errp, "Different refcount widths than 16 bits require "
3431                    "compatibility level 1.1 or above (use version=v3 or "
3432                    "greater)");
3433         ret = -EINVAL;
3434         goto out;
3435     }
3436     refcount_order = ctz32(qcow2_opts->refcount_bits);
3437
3438     if (qcow2_opts->data_file_raw && !qcow2_opts->data_file) {
3439         error_setg(errp, "data-file-raw requires data-file");
3440         ret = -EINVAL;
3441         goto out;
3442     }
3443     if (qcow2_opts->data_file_raw && qcow2_opts->has_backing_file) {
3444         error_setg(errp, "Backing file and data-file-raw cannot be used at "
3445                    "the same time");
3446         ret = -EINVAL;
3447         goto out;
3448     }
3449
3450     if (qcow2_opts->data_file) {
3451         if (version < 3) {
3452             error_setg(errp, "External data files are only supported with "
3453                        "compatibility level 1.1 and above (use version=v3 or "
3454                        "greater)");
3455             ret = -EINVAL;
3456             goto out;
3457         }
3458         data_bs = bdrv_open_blockdev_ref(qcow2_opts->data_file, errp);
3459         if (data_bs == NULL) {
3460             ret = -EIO;
3461             goto out;
3462         }
3463     }
3464
3465     if (qcow2_opts->has_compression_type &&
3466         qcow2_opts->compression_type != QCOW2_COMPRESSION_TYPE_ZLIB) {
3467
3468         ret = -EINVAL;
3469
3470         if (version < 3) {
3471             error_setg(errp, "Non-zlib compression type is only supported with "
3472                        "compatibility level 1.1 and above (use version=v3 or "
3473                        "greater)");
3474             goto out;
3475         }
3476
3477         switch (qcow2_opts->compression_type) {
3478 #ifdef CONFIG_ZSTD
3479         case QCOW2_COMPRESSION_TYPE_ZSTD:
3480             break;
3481 #endif
3482         default:
3483             error_setg(errp, "Unknown compression type");
3484             goto out;
3485         }
3486
3487         compression_type = qcow2_opts->compression_type;
3488     }
3489
3490     /* Create BlockBackend to write to the image */
3491     blk = blk_new_with_bs(bs, BLK_PERM_WRITE | BLK_PERM_RESIZE, BLK_PERM_ALL,
3492                           errp);
3493     if (!blk) {
3494         ret = -EPERM;
3495         goto out;
3496     }
3497     blk_set_allow_write_beyond_eof(blk, true);
3498
3499     /* Write the header */
3500     QEMU_BUILD_BUG_ON((1 << MIN_CLUSTER_BITS) < sizeof(*header));
3501     header = g_malloc0(cluster_size);
3502     *header = (QCowHeader) {
3503         .magic                      = cpu_to_be32(QCOW_MAGIC),
3504         .version                    = cpu_to_be32(version),
3505         .cluster_bits               = cpu_to_be32(ctz32(cluster_size)),
3506         .size                       = cpu_to_be64(0),
3507         .l1_table_offset            = cpu_to_be64(0),
3508         .l1_size                    = cpu_to_be32(0),
3509         .refcount_table_offset      = cpu_to_be64(cluster_size),
3510         .refcount_table_clusters    = cpu_to_be32(1),
3511         .refcount_order             = cpu_to_be32(refcount_order),
3512         /* don't deal with endianness since compression_type is 1 byte long */
3513         .compression_type           = compression_type,
3514         .header_length              = cpu_to_be32(sizeof(*header)),
3515     };
3516
3517     /* We'll update this to correct value later */
3518     header->crypt_method = cpu_to_be32(QCOW_CRYPT_NONE);
3519
3520     if (qcow2_opts->lazy_refcounts) {
3521         header->compatible_features |=
3522             cpu_to_be64(QCOW2_COMPAT_LAZY_REFCOUNTS);
3523     }
3524     if (data_bs) {
3525         header->incompatible_features |=
3526             cpu_to_be64(QCOW2_INCOMPAT_DATA_FILE);
3527     }
3528     if (qcow2_opts->data_file_raw) {
3529         header->autoclear_features |=
3530             cpu_to_be64(QCOW2_AUTOCLEAR_DATA_FILE_RAW);
3531     }
3532     if (compression_type != QCOW2_COMPRESSION_TYPE_ZLIB) {
3533         header->incompatible_features |=
3534             cpu_to_be64(QCOW2_INCOMPAT_COMPRESSION);
3535     }
3536
3537     ret = blk_pwrite(blk, 0, header, cluster_size, 0);
3538     g_free(header);
3539     if (ret < 0) {
3540         error_setg_errno(errp, -ret, "Could not write qcow2 header");
3541         goto out;
3542     }
3543
3544     /* Write a refcount table with one refcount block */
3545     refcount_table = g_malloc0(2 * cluster_size);
3546     refcount_table[0] = cpu_to_be64(2 * cluster_size);
3547     ret = blk_pwrite(blk, cluster_size, refcount_table, 2 * cluster_size, 0);
3548     g_free(refcount_table);
3549
3550     if (ret < 0) {
3551         error_setg_errno(errp, -ret, "Could not write refcount table");
3552         goto out;
3553     }
3554
3555     blk_unref(blk);
3556     blk = NULL;
3557
3558     /*
3559      * And now open the image and make it consistent first (i.e. increase the
3560      * refcount of the cluster that is occupied by the header and the refcount
3561      * table)
3562      */
3563     options = qdict_new();
3564     qdict_put_str(options, "driver", "qcow2");
3565     qdict_put_str(options, "file", bs->node_name);
3566     if (data_bs) {
3567         qdict_put_str(options, "data-file", data_bs->node_name);
3568     }
3569     blk = blk_new_open(NULL, NULL, options,
3570                        BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_NO_FLUSH,
3571                        errp);
3572     if (blk == NULL) {
3573         ret = -EIO;
3574         goto out;
3575     }
3576
3577     ret = qcow2_alloc_clusters(blk_bs(blk), 3 * cluster_size);
3578     if (ret < 0) {
3579         error_setg_errno(errp, -ret, "Could not allocate clusters for qcow2 "
3580                          "header and refcount table");
3581         goto out;
3582
3583     } else if (ret != 0) {
3584         error_report("Huh, first cluster in empty image is already in use?");
3585         abort();
3586     }
3587
3588     /* Set the external data file if necessary */
3589     if (data_bs) {
3590         BDRVQcow2State *s = blk_bs(blk)->opaque;
3591         s->image_data_file = g_strdup(data_bs->filename);
3592     }
3593
3594     /* Create a full header (including things like feature table) */
3595     ret = qcow2_update_header(blk_bs(blk));
3596     if (ret < 0) {
3597         error_setg_errno(errp, -ret, "Could not update qcow2 header");
3598         goto out;
3599     }
3600
3601     /* Okay, now that we have a valid image, let's give it the right size */
3602     ret = blk_truncate(blk, qcow2_opts->size, false, qcow2_opts->preallocation,
3603                        0, errp);
3604     if (ret < 0) {
3605         error_prepend(errp, "Could not resize image: ");
3606         goto out;
3607     }
3608
3609     /* Want a backing file? There you go. */
3610     if (qcow2_opts->has_backing_file) {
3611         const char *backing_format = NULL;
3612
3613         if (qcow2_opts->has_backing_fmt) {
3614             backing_format = BlockdevDriver_str(qcow2_opts->backing_fmt);
3615         }
3616
3617         ret = bdrv_change_backing_file(blk_bs(blk), qcow2_opts->backing_file,
3618                                        backing_format, false);
3619         if (ret < 0) {
3620             error_setg_errno(errp, -ret, "Could not assign backing file '%s' "
3621                              "with format '%s'", qcow2_opts->backing_file,
3622                              backing_format);
3623             goto out;
3624         }
3625     }
3626
3627     /* Want encryption? There you go. */
3628     if (qcow2_opts->has_encrypt) {
3629         ret = qcow2_set_up_encryption(blk_bs(blk), qcow2_opts->encrypt, errp);
3630         if (ret < 0) {
3631             goto out;
3632         }
3633     }
3634
3635     blk_unref(blk);
3636     blk = NULL;
3637
3638     /* Reopen the image without BDRV_O_NO_FLUSH to flush it before returning.
3639      * Using BDRV_O_NO_IO, since encryption is now setup we don't want to
3640      * have to setup decryption context. We're not doing any I/O on the top
3641      * level BlockDriverState, only lower layers, where BDRV_O_NO_IO does
3642      * not have effect.
3643      */
3644     options = qdict_new();
3645     qdict_put_str(options, "driver", "qcow2");
3646     qdict_put_str(options, "file", bs->node_name);
3647     if (data_bs) {
3648         qdict_put_str(options, "data-file", data_bs->node_name);
3649     }
3650     blk = blk_new_open(NULL, NULL, options,
3651                        BDRV_O_RDWR | BDRV_O_NO_BACKING | BDRV_O_NO_IO,
3652                        errp);
3653     if (blk == NULL) {
3654         ret = -EIO;
3655         goto out;
3656     }
3657
3658     ret = 0;
3659 out:
3660     blk_unref(blk);
3661     bdrv_unref(bs);
3662     bdrv_unref(data_bs);
3663     return ret;
3664 }
3665
3666 static int coroutine_fn qcow2_co_create_opts(BlockDriver *drv,
3667                                              const char *filename,
3668                                              QemuOpts *opts,
3669                                              Error **errp)
3670 {
3671     BlockdevCreateOptions *create_options = NULL;
3672     QDict *qdict;
3673     Visitor *v;
3674     BlockDriverState *bs = NULL;
3675     BlockDriverState *data_bs = NULL;
3676     const char *val;
3677     int ret;
3678
3679     /* Only the keyval visitor supports the dotted syntax needed for
3680      * encryption, so go through a QDict before getting a QAPI type. Ignore
3681      * options meant for the protocol layer so that the visitor doesn't
3682      * complain. */
3683     qdict = qemu_opts_to_qdict_filtered(opts, NULL, bdrv_qcow2.create_opts,
3684                                         true);
3685
3686     /* Handle encryption options */
3687     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT);
3688     if (val && !strcmp(val, "on")) {
3689         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT, "qcow");
3690     } else if (val && !strcmp(val, "off")) {
3691         qdict_del(qdict, BLOCK_OPT_ENCRYPT);
3692     }
3693
3694     val = qdict_get_try_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT);
3695     if (val && !strcmp(val, "aes")) {
3696         qdict_put_str(qdict, BLOCK_OPT_ENCRYPT_FORMAT, "qcow");
3697     }
3698
3699     /* Convert compat=0.10/1.1 into compat=v2/v3, to be renamed into
3700      * version=v2/v3 below. */
3701     val = qdict_get_try_str(qdict, BLOCK_OPT_COMPAT_LEVEL);
3702     if (val && !strcmp(val, "0.10")) {
3703         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v2");
3704     } else if (val && !strcmp(val, "1.1")) {
3705         qdict_put_str(qdict, BLOCK_OPT_COMPAT_LEVEL, "v3");
3706     }
3707
3708     /* Change legacy command line options into QMP ones */
3709     static const QDictRenames opt_renames[] = {
3710         { BLOCK_OPT_BACKING_FILE,       "backing-file" },
3711         { BLOCK_OPT_BACKING_FMT,        "backing-fmt" },
3712         { BLOCK_OPT_CLUSTER_SIZE,       "cluster-size" },
3713         { BLOCK_OPT_LAZY_REFCOUNTS,     "lazy-refcounts" },
3714         { BLOCK_OPT_REFCOUNT_BITS,      "refcount-bits" },
3715         { BLOCK_OPT_ENCRYPT,            BLOCK_OPT_ENCRYPT_FORMAT },
3716         { BLOCK_OPT_COMPAT_LEVEL,       "version" },
3717         { BLOCK_OPT_DATA_FILE_RAW,      "data-file-raw" },
3718         { BLOCK_OPT_COMPRESSION_TYPE,   "compression-type" },
3719         { NULL, NULL },
3720     };
3721
3722     if (!qdict_rename_keys(qdict, opt_renames, errp)) {
3723         ret = -EINVAL;
3724         goto finish;
3725     }
3726
3727     /* Create and open the file (protocol layer) */
3728     ret = bdrv_create_file(filename, opts, errp);
3729     if (ret < 0) {
3730         goto finish;
3731     }
3732
3733     bs = bdrv_open(filename, NULL, NULL,
3734                    BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL, errp);
3735     if (bs == NULL) {
3736         ret = -EIO;
3737         goto finish;
3738     }
3739
3740     /* Create and open an external data file (protocol layer) */
3741     val = qdict_get_try_str(qdict, BLOCK_OPT_DATA_FILE);
3742     if (val) {
3743         ret = bdrv_create_file(val, opts, errp);
3744         if (ret < 0) {
3745             goto finish;
3746         }
3747
3748         data_bs = bdrv_open(val, NULL, NULL,
3749                             BDRV_O_RDWR | BDRV_O_RESIZE | BDRV_O_PROTOCOL,
3750                             errp);
3751         if (data_bs == NULL) {
3752             ret = -EIO;
3753             goto finish;
3754         }
3755
3756         qdict_del(qdict, BLOCK_OPT_DATA_FILE);
3757         qdict_put_str(qdict, "data-file", data_bs->node_name);
3758     }
3759
3760     /* Set 'driver' and 'node' options */
3761     qdict_put_str(qdict, "driver", "qcow2");
3762     qdict_put_str(qdict, "file", bs->node_name);
3763
3764     /* Now get the QAPI type BlockdevCreateOptions */
3765     v = qobject_input_visitor_new_flat_confused(qdict, errp);
3766     if (!v) {
3767         ret = -EINVAL;
3768         goto finish;
3769     }
3770
3771     visit_type_BlockdevCreateOptions(v, NULL, &create_options, errp);
3772     visit_free(v);
3773     if (!create_options) {
3774         ret = -EINVAL;
3775         goto finish;
3776     }
3777
3778     /* Silently round up size */
3779     create_options->u.qcow2.size = ROUND_UP(create_options->u.qcow2.size,
3780                                             BDRV_SECTOR_SIZE);
3781
3782     /* Create the qcow2 image (format layer) */
3783     ret = qcow2_co_create(create_options, errp);
3784     if (ret < 0) {
3785         goto finish;
3786     }
3787
3788     ret = 0;
3789 finish:
3790     qobject_unref(qdict);
3791     bdrv_unref(bs);
3792     bdrv_unref(data_bs);
3793     qapi_free_BlockdevCreateOptions(create_options);
3794     return ret;
3795 }
3796
3797
3798 static bool is_zero(BlockDriverState *bs, int64_t offset, int64_t bytes)
3799 {
3800     int64_t nr;
3801     int res;
3802
3803     /* Clamp to image length, before checking status of underlying sectors */
3804     if (offset + bytes > bs->total_sectors * BDRV_SECTOR_SIZE) {
3805         bytes = bs->total_sectors * BDRV_SECTOR_SIZE - offset;
3806     }
3807
3808     if (!bytes) {
3809         return true;
3810     }
3811     res = bdrv_block_status_above(bs, NULL, offset, bytes, &nr, NULL, NULL);
3812     return res >= 0 && (res & BDRV_BLOCK_ZERO) && nr == bytes;
3813 }
3814
3815 static coroutine_fn int qcow2_co_pwrite_zeroes(BlockDriverState *bs,
3816     int64_t offset, int bytes, BdrvRequestFlags flags)
3817 {
3818     int ret;
3819     BDRVQcow2State *s = bs->opaque;
3820
3821     uint32_t head = offset % s->cluster_size;
3822     uint32_t tail = (offset + bytes) % s->cluster_size;
3823
3824     trace_qcow2_pwrite_zeroes_start_req(qemu_coroutine_self(), offset, bytes);
3825     if (offset + bytes == bs->total_sectors * BDRV_SECTOR_SIZE) {
3826         tail = 0;
3827     }
3828
3829     if (head || tail) {
3830         uint64_t off;
3831         unsigned int nr;
3832
3833         assert(head + bytes <= s->cluster_size);
3834
3835         /* check whether remainder of cluster already reads as zero */
3836         if (!(is_zero(bs, offset - head, head) &&
3837               is_zero(bs, offset + bytes,
3838                       tail ? s->cluster_size - tail : 0))) {
3839             return -ENOTSUP;
3840         }
3841
3842         qemu_co_mutex_lock(&s->lock);
3843         /* We can have new write after previous check */
3844         offset = QEMU_ALIGN_DOWN(offset, s->cluster_size);
3845         bytes = s->cluster_size;
3846         nr = s->cluster_size;
3847         ret = qcow2_get_host_offset(bs, offset, &nr, &off);
3848         if (ret != QCOW2_CLUSTER_UNALLOCATED &&
3849             ret != QCOW2_CLUSTER_ZERO_PLAIN &&
3850             ret != QCOW2_CLUSTER_ZERO_ALLOC) {
3851             qemu_co_mutex_unlock(&s->lock);
3852             return -ENOTSUP;
3853         }
3854     } else {
3855         qemu_co_mutex_lock(&s->lock);
3856     }
3857
3858     trace_qcow2_pwrite_zeroes(qemu_coroutine_self(), offset, bytes);
3859
3860     /* Whatever is left can use real zero clusters */
3861     ret = qcow2_cluster_zeroize(bs, offset, bytes, flags);
3862     qemu_co_mutex_unlock(&s->lock);
3863
3864     return ret;
3865 }
3866
3867 static coroutine_fn int qcow2_co_pdiscard(BlockDriverState *bs,
3868                                           int64_t offset, int bytes)
3869 {
3870     int ret;
3871     BDRVQcow2State *s = bs->opaque;
3872
3873     /* If the image does not support QCOW_OFLAG_ZERO then discarding
3874      * clusters could expose stale data from the backing file. */
3875     if (s->qcow_version < 3 && bs->backing) {
3876         return -ENOTSUP;
3877     }
3878
3879     if (!QEMU_IS_ALIGNED(offset | bytes, s->cluster_size)) {
3880         assert(bytes < s->cluster_size);
3881         /* Ignore partial clusters, except for the special case of the
3882          * complete partial cluster at the end of an unaligned file */
3883         if (!QEMU_IS_ALIGNED(offset, s->cluster_size) ||
3884             offset + bytes != bs->total_sectors * BDRV_SECTOR_SIZE) {
3885             return -ENOTSUP;
3886         }
3887     }
3888
3889     qemu_co_mutex_lock(&s->lock);
3890     ret = qcow2_cluster_discard(bs, offset, bytes, QCOW2_DISCARD_REQUEST,
3891                                 false);
3892     qemu_co_mutex_unlock(&s->lock);
3893     return ret;
3894 }
3895
3896 static int coroutine_fn
3897 qcow2_co_copy_range_from(BlockDriverState *bs,
3898                          BdrvChild *src, uint64_t src_offset,
3899                          BdrvChild *dst, uint64_t dst_offset,
3900                          uint64_t bytes, BdrvRequestFlags read_flags,
3901                          BdrvRequestFlags write_flags)
3902 {
3903     BDRVQcow2State *s = bs->opaque;
3904     int ret;
3905     unsigned int cur_bytes; /* number of bytes in current iteration */
3906     BdrvChild *child = NULL;
3907     BdrvRequestFlags cur_write_flags;
3908
3909     assert(!bs->encrypted);
3910     qemu_co_mutex_lock(&s->lock);
3911
3912     while (bytes != 0) {
3913         uint64_t copy_offset = 0;
3914         /* prepare next request */
3915         cur_bytes = MIN(bytes, INT_MAX);
3916         cur_write_flags = write_flags;
3917
3918         ret = qcow2_get_host_offset(bs, src_offset, &cur_bytes, &copy_offset);
3919         if (ret < 0) {
3920             goto out;
3921         }
3922
3923         switch (ret) {
3924         case QCOW2_CLUSTER_UNALLOCATED:
3925             if (bs->backing && bs->backing->bs) {
3926                 int64_t backing_length = bdrv_getlength(bs->backing->bs);
3927                 if (src_offset >= backing_length) {
3928                     cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3929                 } else {
3930                     child = bs->backing;
3931                     cur_bytes = MIN(cur_bytes, backing_length - src_offset);
3932                     copy_offset = src_offset;
3933                 }
3934             } else {
3935                 cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3936             }
3937             break;
3938
3939         case QCOW2_CLUSTER_ZERO_PLAIN:
3940         case QCOW2_CLUSTER_ZERO_ALLOC:
3941             cur_write_flags |= BDRV_REQ_ZERO_WRITE;
3942             break;
3943
3944         case QCOW2_CLUSTER_COMPRESSED:
3945             ret = -ENOTSUP;
3946             goto out;
3947
3948         case QCOW2_CLUSTER_NORMAL:
3949             child = s->data_file;
3950             break;
3951
3952         default:
3953             abort();
3954         }
3955         qemu_co_mutex_unlock(&s->lock);
3956         ret = bdrv_co_copy_range_from(child,
3957                                       copy_offset,
3958                                       dst, dst_offset,
3959                                       cur_bytes, read_flags, cur_write_flags);
3960         qemu_co_mutex_lock(&s->lock);
3961         if (ret < 0) {
3962             goto out;
3963         }
3964
3965         bytes -= cur_bytes;
3966         src_offset += cur_bytes;
3967         dst_offset += cur_bytes;
3968     }
3969     ret = 0;
3970
3971 out:
3972     qemu_co_mutex_unlock(&s->lock);
3973     return ret;
3974 }
3975
3976 static int coroutine_fn
3977 qcow2_co_copy_range_to(BlockDriverState *bs,
3978                        BdrvChild *src, uint64_t src_offset,
3979                        BdrvChild *dst, uint64_t dst_offset,
3980                        uint64_t bytes, BdrvRequestFlags read_flags,
3981                        BdrvRequestFlags write_flags)
3982 {
3983     BDRVQcow2State *s = bs->opaque;
3984     int offset_in_cluster;
3985     int ret;
3986     unsigned int cur_bytes; /* number of sectors in current iteration */
3987     uint64_t cluster_offset;
3988     QCowL2Meta *l2meta = NULL;
3989
3990     assert(!bs->encrypted);
3991
3992     qemu_co_mutex_lock(&s->lock);
3993
3994     while (bytes != 0) {
3995
3996         l2meta = NULL;
3997
3998         offset_in_cluster = offset_into_cluster(s, dst_offset);
3999         cur_bytes = MIN(bytes, INT_MAX);
4000
4001         /* TODO:
4002          * If src->bs == dst->bs, we could simply copy by incrementing
4003          * the refcnt, without copying user data.
4004          * Or if src->bs == dst->bs->backing->bs, we could copy by discarding. */
4005         ret = qcow2_alloc_cluster_offset(bs, dst_offset, &cur_bytes,
4006                                          &cluster_offset, &l2meta);
4007         if (ret < 0) {
4008             goto fail;
4009         }
4010
4011         assert(offset_into_cluster(s, cluster_offset) == 0);
4012
4013         ret = qcow2_pre_write_overlap_check(bs, 0,
4014                 cluster_offset + offset_in_cluster, cur_bytes, true);
4015         if (ret < 0) {
4016             goto fail;
4017         }
4018
4019         qemu_co_mutex_unlock(&s->lock);
4020         ret = bdrv_co_copy_range_to(src, src_offset,
4021                                     s->data_file,
4022                                     cluster_offset + offset_in_cluster,
4023                                     cur_bytes, read_flags, write_flags);
4024         qemu_co_mutex_lock(&s->lock);
4025         if (ret < 0) {
4026             goto fail;
4027         }
4028
4029         ret = qcow2_handle_l2meta(bs, &l2meta, true);
4030         if (ret) {
4031             goto fail;
4032         }
4033
4034         bytes -= cur_bytes;
4035         src_offset += cur_bytes;
4036         dst_offset += cur_bytes;
4037     }
4038     ret = 0;
4039
4040 fail:
4041     qcow2_handle_l2meta(bs, &l2meta, false);
4042
4043     qemu_co_mutex_unlock(&s->lock);
4044
4045     trace_qcow2_writev_done_req(qemu_coroutine_self(), ret);
4046
4047     return ret;
4048 }
4049
4050 static int coroutine_fn qcow2_co_truncate(BlockDriverState *bs, int64_t offset,
4051                                           bool exact, PreallocMode prealloc,
4052                                           BdrvRequestFlags flags, Error **errp)
4053 {
4054     BDRVQcow2State *s = bs->opaque;
4055     uint64_t old_length;
4056     int64_t new_l1_size;
4057     int ret;
4058     QDict *options;
4059
4060     if (prealloc != PREALLOC_MODE_OFF && prealloc != PREALLOC_MODE_METADATA &&
4061         prealloc != PREALLOC_MODE_FALLOC && prealloc != PREALLOC_MODE_FULL)
4062     {
4063         error_setg(errp, "Unsupported preallocation mode '%s'",
4064                    PreallocMode_str(prealloc));
4065         return -ENOTSUP;
4066     }
4067
4068     if (!QEMU_IS_ALIGNED(offset, BDRV_SECTOR_SIZE)) {
4069         error_setg(errp, "The new size must be a multiple of %u",
4070                    (unsigned) BDRV_SECTOR_SIZE);
4071         return -EINVAL;
4072     }
4073
4074     qemu_co_mutex_lock(&s->lock);
4075
4076     /*
4077      * Even though we store snapshot size for all images, it was not
4078      * required until v3, so it is not safe to proceed for v2.
4079      */
4080     if (s->nb_snapshots && s->qcow_version < 3) {
4081         error_setg(errp, "Can't resize a v2 image which has snapshots");
4082         ret = -ENOTSUP;
4083         goto fail;
4084     }
4085
4086     /* See qcow2-bitmap.c for which bitmap scenarios prevent a resize. */
4087     if (qcow2_truncate_bitmaps_check(bs, errp)) {
4088         ret = -ENOTSUP;
4089         goto fail;
4090     }
4091
4092     old_length = bs->total_sectors * BDRV_SECTOR_SIZE;
4093     new_l1_size = size_to_l1(s, offset);
4094
4095     if (offset < old_length) {
4096         int64_t last_cluster, old_file_size;
4097         if (prealloc != PREALLOC_MODE_OFF) {
4098             error_setg(errp,
4099                        "Preallocation can't be used for shrinking an image");
4100             ret = -EINVAL;
4101             goto fail;
4102         }
4103
4104         ret = qcow2_cluster_discard(bs, ROUND_UP(offset, s->cluster_size),
4105                                     old_length - ROUND_UP(offset,
4106                                                           s->cluster_size),
4107                                     QCOW2_DISCARD_ALWAYS, true);
4108         if (ret < 0) {
4109             error_setg_errno(errp, -ret, "Failed to discard cropped clusters");
4110             goto fail;
4111         }
4112
4113         ret = qcow2_shrink_l1_table(bs, new_l1_size);
4114         if (ret < 0) {
4115             error_setg_errno(errp, -ret,
4116                              "Failed to reduce the number of L2 tables");
4117             goto fail;
4118         }
4119
4120         ret = qcow2_shrink_reftable(bs);
4121         if (ret < 0) {
4122             error_setg_errno(errp, -ret,
4123                              "Failed to discard unused refblocks");
4124             goto fail;
4125         }
4126
4127         old_file_size = bdrv_getlength(bs->file->bs);
4128         if (old_file_size < 0) {
4129             error_setg_errno(errp, -old_file_size,
4130                              "Failed to inquire current file length");
4131             ret = old_file_size;
4132             goto fail;
4133         }
4134         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
4135         if (last_cluster < 0) {
4136             error_setg_errno(errp, -last_cluster,
4137                              "Failed to find the last cluster");
4138             ret = last_cluster;
4139             goto fail;
4140         }
4141         if ((last_cluster + 1) * s->cluster_size < old_file_size) {
4142             Error *local_err = NULL;
4143
4144             /*
4145              * Do not pass @exact here: It will not help the user if
4146              * we get an error here just because they wanted to shrink
4147              * their qcow2 image (on a block device) with qemu-img.
4148              * (And on the qcow2 layer, the @exact requirement is
4149              * always fulfilled, so there is no need to pass it on.)
4150              */
4151             bdrv_co_truncate(bs->file, (last_cluster + 1) * s->cluster_size,
4152                              false, PREALLOC_MODE_OFF, 0, &local_err);
4153             if (local_err) {
4154                 warn_reportf_err(local_err,
4155                                  "Failed to truncate the tail of the image: ");
4156             }
4157         }
4158     } else {
4159         ret = qcow2_grow_l1_table(bs, new_l1_size, true);
4160         if (ret < 0) {
4161             error_setg_errno(errp, -ret, "Failed to grow the L1 table");
4162             goto fail;
4163         }
4164     }
4165
4166     switch (prealloc) {
4167     case PREALLOC_MODE_OFF:
4168         if (has_data_file(bs)) {
4169             /*
4170              * If the caller wants an exact resize, the external data
4171              * file should be resized to the exact target size, too,
4172              * so we pass @exact here.
4173              */
4174             ret = bdrv_co_truncate(s->data_file, offset, exact, prealloc, 0,
4175                                    errp);
4176             if (ret < 0) {
4177                 goto fail;
4178             }
4179         }
4180         break;
4181
4182     case PREALLOC_MODE_METADATA:
4183         ret = preallocate_co(bs, old_length, offset, prealloc, errp);
4184         if (ret < 0) {
4185             goto fail;
4186         }
4187         break;
4188
4189     case PREALLOC_MODE_FALLOC:
4190     case PREALLOC_MODE_FULL:
4191     {
4192         int64_t allocation_start, host_offset, guest_offset;
4193         int64_t clusters_allocated;
4194         int64_t old_file_size, last_cluster, new_file_size;
4195         uint64_t nb_new_data_clusters, nb_new_l2_tables;
4196
4197         /* With a data file, preallocation means just allocating the metadata
4198          * and forwarding the truncate request to the data file */
4199         if (has_data_file(bs)) {
4200             ret = preallocate_co(bs, old_length, offset, prealloc, errp);
4201             if (ret < 0) {
4202                 goto fail;
4203             }
4204             break;
4205         }
4206
4207         old_file_size = bdrv_getlength(bs->file->bs);
4208         if (old_file_size < 0) {
4209             error_setg_errno(errp, -old_file_size,
4210                              "Failed to inquire current file length");
4211             ret = old_file_size;
4212             goto fail;
4213         }
4214
4215         last_cluster = qcow2_get_last_cluster(bs, old_file_size);
4216         if (last_cluster >= 0) {
4217             old_file_size = (last_cluster + 1) * s->cluster_size;
4218         } else {
4219             old_file_size = ROUND_UP(old_file_size, s->cluster_size);
4220         }
4221
4222         nb_new_data_clusters = (ROUND_UP(offset, s->cluster_size) -
4223             start_of_cluster(s, old_length)) >> s->cluster_bits;
4224
4225         /* This is an overestimation; we will not actually allocate space for
4226          * these in the file but just make sure the new refcount structures are
4227          * able to cover them so we will not have to allocate new refblocks
4228          * while entering the data blocks in the potentially new L2 tables.
4229          * (We do not actually care where the L2 tables are placed. Maybe they
4230          *  are already allocated or they can be placed somewhere before
4231          *  @old_file_size. It does not matter because they will be fully
4232          *  allocated automatically, so they do not need to be covered by the
4233          *  preallocation. All that matters is that we will not have to allocate
4234          *  new refcount structures for them.) */
4235         nb_new_l2_tables = DIV_ROUND_UP(nb_new_data_clusters,
4236                                         s->cluster_size / sizeof(uint64_t));
4237         /* The cluster range may not be aligned to L2 boundaries, so add one L2
4238          * table for a potential head/tail */
4239         nb_new_l2_tables++;
4240
4241         allocation_start = qcow2_refcount_area(bs, old_file_size,
4242                                                nb_new_data_clusters +
4243                                                nb_new_l2_tables,
4244                                                true, 0, 0);
4245         if (allocation_start < 0) {
4246             error_setg_errno(errp, -allocation_start,
4247                              "Failed to resize refcount structures");
4248             ret = allocation_start;
4249             goto fail;
4250         }
4251
4252         clusters_allocated = qcow2_alloc_clusters_at(bs, allocation_start,
4253                                                      nb_new_data_clusters);
4254         if (clusters_allocated < 0) {
4255             error_setg_errno(errp, -clusters_allocated,
4256                              "Failed to allocate data clusters");
4257             ret = clusters_allocated;
4258             goto fail;
4259         }
4260
4261         assert(clusters_allocated == nb_new_data_clusters);
4262
4263         /* Allocate the data area */
4264         new_file_size = allocation_start +
4265                         nb_new_data_clusters * s->cluster_size;
4266         /*
4267          * Image file grows, so @exact does not matter.
4268          *
4269          * If we need to zero out the new area, try first whether the protocol
4270          * driver can already take care of this.
4271          */
4272         if (flags & BDRV_REQ_ZERO_WRITE) {
4273             ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc,
4274                                    BDRV_REQ_ZERO_WRITE, NULL);
4275             if (ret >= 0) {
4276                 flags &= ~BDRV_REQ_ZERO_WRITE;
4277             }
4278         } else {
4279             ret = -1;
4280         }
4281         if (ret < 0) {
4282             ret = bdrv_co_truncate(bs->file, new_file_size, false, prealloc, 0,
4283                                    errp);
4284         }
4285         if (ret < 0) {
4286             error_prepend(errp, "Failed to resize underlying file: ");
4287             qcow2_free_clusters(bs, allocation_start,
4288                                 nb_new_data_clusters * s->cluster_size,
4289                                 QCOW2_DISCARD_OTHER);
4290             goto fail;
4291         }
4292
4293         /* Create the necessary L2 entries */
4294         host_offset = allocation_start;
4295         guest_offset = old_length;
4296         while (nb_new_data_clusters) {
4297             int64_t nb_clusters = MIN(
4298                 nb_new_data_clusters,
4299                 s->l2_slice_size - offset_to_l2_slice_index(s, guest_offset));
4300             unsigned cow_start_length = offset_into_cluster(s, guest_offset);
4301             QCowL2Meta allocation;
4302             guest_offset = start_of_cluster(s, guest_offset);
4303             allocation = (QCowL2Meta) {
4304                 .offset       = guest_offset,
4305                 .alloc_offset = host_offset,
4306                 .nb_clusters  = nb_clusters,
4307                 .cow_start    = {
4308                     .offset       = 0,
4309                     .nb_bytes     = cow_start_length,
4310                 },
4311                 .cow_end      = {
4312                     .offset       = nb_clusters << s->cluster_bits,
4313                     .nb_bytes     = 0,
4314                 },
4315             };
4316             qemu_co_queue_init(&allocation.dependent_requests);
4317
4318             ret = qcow2_alloc_cluster_link_l2(bs, &allocation);
4319             if (ret < 0) {
4320                 error_setg_errno(errp, -ret, "Failed to update L2 tables");
4321                 qcow2_free_clusters(bs, host_offset,
4322                                     nb_new_data_clusters * s->cluster_size,
4323                                     QCOW2_DISCARD_OTHER);
4324                 goto fail;
4325             }
4326
4327             guest_offset += nb_clusters * s->cluster_size;
4328             host_offset += nb_clusters * s->cluster_size;
4329             nb_new_data_clusters -= nb_clusters;
4330         }
4331         break;
4332     }
4333
4334     default:
4335         g_assert_not_reached();
4336     }
4337
4338     if ((flags & BDRV_REQ_ZERO_WRITE) && offset > old_length) {
4339         uint64_t zero_start = QEMU_ALIGN_UP(old_length, s->cluster_size);
4340
4341         /*
4342          * Use zero clusters as much as we can. qcow2_cluster_zeroize()
4343          * requires a cluster-aligned start. The end may be unaligned if it is
4344          * at the end of the image (which it is here).
4345          */
4346         if (offset > zero_start) {
4347             ret = qcow2_cluster_zeroize(bs, zero_start, offset - zero_start, 0);
4348             if (ret < 0) {
4349                 error_setg_errno(errp, -ret, "Failed to zero out new clusters");
4350                 goto fail;
4351             }
4352         }
4353
4354         /* Write explicit zeros for the unaligned head */
4355         if (zero_start > old_length) {
4356             uint64_t len = MIN(zero_start, offset) - old_length;
4357             uint8_t *buf = qemu_blockalign0(bs, len);
4358             QEMUIOVector qiov;
4359             qemu_iovec_init_buf(&qiov, buf, len);
4360
4361             qemu_co_mutex_unlock(&s->lock);
4362             ret = qcow2_co_pwritev_part(bs, old_length, len, &qiov, 0, 0);
4363             qemu_co_mutex_lock(&s->lock);
4364
4365             qemu_vfree(buf);
4366             if (ret < 0) {
4367                 error_setg_errno(errp, -ret, "Failed to zero out the new area");
4368                 goto fail;
4369             }
4370         }
4371     }
4372
4373     if (prealloc != PREALLOC_MODE_OFF) {
4374         /* Flush metadata before actually changing the image size */
4375         ret = qcow2_write_caches(bs);
4376         if (ret < 0) {
4377             error_setg_errno(errp, -ret,
4378                              "Failed to flush the preallocated area to disk");
4379             goto fail;
4380         }
4381     }
4382
4383     bs->total_sectors = offset / BDRV_SECTOR_SIZE;
4384
4385     /* write updated header.size */
4386     offset = cpu_to_be64(offset);
4387     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, size),
4388                            &offset, sizeof(uint64_t));
4389     if (ret < 0) {
4390         error_setg_errno(errp, -ret, "Failed to update the image size");
4391         goto fail;
4392     }
4393
4394     s->l1_vm_state_index = new_l1_size;
4395
4396     /* Update cache sizes */
4397     options = qdict_clone_shallow(bs->options);
4398     ret = qcow2_update_options(bs, options, s->flags, errp);
4399     qobject_unref(options);
4400     if (ret < 0) {
4401         goto fail;
4402     }
4403     ret = 0;
4404 fail:
4405     qemu_co_mutex_unlock(&s->lock);
4406     return ret;
4407 }
4408
4409 static coroutine_fn int
4410 qcow2_co_pwritev_compressed_task(BlockDriverState *bs,
4411                                  uint64_t offset, uint64_t bytes,
4412                                  QEMUIOVector *qiov, size_t qiov_offset)
4413 {
4414     BDRVQcow2State *s = bs->opaque;
4415     int ret;
4416     ssize_t out_len;
4417     uint8_t *buf, *out_buf;
4418     uint64_t cluster_offset;
4419
4420     assert(bytes == s->cluster_size || (bytes < s->cluster_size &&
4421            (offset + bytes == bs->total_sectors << BDRV_SECTOR_BITS)));
4422
4423     buf = qemu_blockalign(bs, s->cluster_size);
4424     if (bytes < s->cluster_size) {
4425         /* Zero-pad last write if image size is not cluster aligned */
4426         memset(buf + bytes, 0, s->cluster_size - bytes);
4427     }
4428     qemu_iovec_to_buf(qiov, qiov_offset, buf, bytes);
4429
4430     out_buf = g_malloc(s->cluster_size);
4431
4432     out_len = qcow2_co_compress(bs, out_buf, s->cluster_size - 1,
4433                                 buf, s->cluster_size);
4434     if (out_len == -ENOMEM) {
4435         /* could not compress: write normal cluster */
4436         ret = qcow2_co_pwritev_part(bs, offset, bytes, qiov, qiov_offset, 0);
4437         if (ret < 0) {
4438             goto fail;
4439         }
4440         goto success;
4441     } else if (out_len < 0) {
4442         ret = -EINVAL;
4443         goto fail;
4444     }
4445
4446     qemu_co_mutex_lock(&s->lock);
4447     ret = qcow2_alloc_compressed_cluster_offset(bs, offset, out_len,
4448                                                 &cluster_offset);
4449     if (ret < 0) {
4450         qemu_co_mutex_unlock(&s->lock);
4451         goto fail;
4452     }
4453
4454     ret = qcow2_pre_write_overlap_check(bs, 0, cluster_offset, out_len, true);
4455     qemu_co_mutex_unlock(&s->lock);
4456     if (ret < 0) {
4457         goto fail;
4458     }
4459
4460     BLKDBG_EVENT(s->data_file, BLKDBG_WRITE_COMPRESSED);
4461     ret = bdrv_co_pwrite(s->data_file, cluster_offset, out_len, out_buf, 0);
4462     if (ret < 0) {
4463         goto fail;
4464     }
4465 success:
4466     ret = 0;
4467 fail:
4468     qemu_vfree(buf);
4469     g_free(out_buf);
4470     return ret;
4471 }
4472
4473 static coroutine_fn int qcow2_co_pwritev_compressed_task_entry(AioTask *task)
4474 {
4475     Qcow2AioTask *t = container_of(task, Qcow2AioTask, task);
4476
4477     assert(!t->cluster_type && !t->l2meta);
4478
4479     return qcow2_co_pwritev_compressed_task(t->bs, t->offset, t->bytes, t->qiov,
4480                                             t->qiov_offset);
4481 }
4482
4483 /*
4484  * XXX: put compressed sectors first, then all the cluster aligned
4485  * tables to avoid losing bytes in alignment
4486  */
4487 static coroutine_fn int
4488 qcow2_co_pwritev_compressed_part(BlockDriverState *bs,
4489                                  uint64_t offset, uint64_t bytes,
4490                                  QEMUIOVector *qiov, size_t qiov_offset)
4491 {
4492     BDRVQcow2State *s = bs->opaque;
4493     AioTaskPool *aio = NULL;
4494     int ret = 0;
4495
4496     if (has_data_file(bs)) {
4497         return -ENOTSUP;
4498     }
4499
4500     if (bytes == 0) {
4501         /*
4502          * align end of file to a sector boundary to ease reading with
4503          * sector based I/Os
4504          */
4505         int64_t len = bdrv_getlength(bs->file->bs);
4506         if (len < 0) {
4507             return len;
4508         }
4509         return bdrv_co_truncate(bs->file, len, false, PREALLOC_MODE_OFF, 0,
4510                                 NULL);
4511     }
4512
4513     if (offset_into_cluster(s, offset)) {
4514         return -EINVAL;
4515     }
4516
4517     if (offset_into_cluster(s, bytes) &&
4518         (offset + bytes) != (bs->total_sectors << BDRV_SECTOR_BITS)) {
4519         return -EINVAL;
4520     }
4521
4522     while (bytes && aio_task_pool_status(aio) == 0) {
4523         uint64_t chunk_size = MIN(bytes, s->cluster_size);
4524
4525         if (!aio && chunk_size != bytes) {
4526             aio = aio_task_pool_new(QCOW2_MAX_WORKERS);
4527         }
4528
4529         ret = qcow2_add_task(bs, aio, qcow2_co_pwritev_compressed_task_entry,
4530                              0, 0, offset, chunk_size, qiov, qiov_offset, NULL);
4531         if (ret < 0) {
4532             break;
4533         }
4534         qiov_offset += chunk_size;
4535         offset += chunk_size;
4536         bytes -= chunk_size;
4537     }
4538
4539     if (aio) {
4540         aio_task_pool_wait_all(aio);
4541         if (ret == 0) {
4542             ret = aio_task_pool_status(aio);
4543         }
4544         g_free(aio);
4545     }
4546
4547     return ret;
4548 }
4549
4550 static int coroutine_fn
4551 qcow2_co_preadv_compressed(BlockDriverState *bs,
4552                            uint64_t cluster_descriptor,
4553                            uint64_t offset,
4554                            uint64_t bytes,
4555                            QEMUIOVector *qiov,
4556                            size_t qiov_offset)
4557 {
4558     BDRVQcow2State *s = bs->opaque;
4559     int ret = 0, csize, nb_csectors;
4560     uint64_t coffset;
4561     uint8_t *buf, *out_buf;
4562     int offset_in_cluster = offset_into_cluster(s, offset);
4563
4564     coffset = cluster_descriptor & s->cluster_offset_mask;
4565     nb_csectors = ((cluster_descriptor >> s->csize_shift) & s->csize_mask) + 1;
4566     csize = nb_csectors * QCOW2_COMPRESSED_SECTOR_SIZE -
4567         (coffset & ~QCOW2_COMPRESSED_SECTOR_MASK);
4568
4569     buf = g_try_malloc(csize);
4570     if (!buf) {
4571         return -ENOMEM;
4572     }
4573
4574     out_buf = qemu_blockalign(bs, s->cluster_size);
4575
4576     BLKDBG_EVENT(bs->file, BLKDBG_READ_COMPRESSED);
4577     ret = bdrv_co_pread(bs->file, coffset, csize, buf, 0);
4578     if (ret < 0) {
4579         goto fail;
4580     }
4581
4582     if (qcow2_co_decompress(bs, out_buf, s->cluster_size, buf, csize) < 0) {
4583         ret = -EIO;
4584         goto fail;
4585     }
4586
4587     qemu_iovec_from_buf(qiov, qiov_offset, out_buf + offset_in_cluster, bytes);
4588
4589 fail:
4590     qemu_vfree(out_buf);
4591     g_free(buf);
4592
4593     return ret;
4594 }
4595
4596 static int make_completely_empty(BlockDriverState *bs)
4597 {
4598     BDRVQcow2State *s = bs->opaque;
4599     Error *local_err = NULL;
4600     int ret, l1_clusters;
4601     int64_t offset;
4602     uint64_t *new_reftable = NULL;
4603     uint64_t rt_entry, l1_size2;
4604     struct {
4605         uint64_t l1_offset;
4606         uint64_t reftable_offset;
4607         uint32_t reftable_clusters;
4608     } QEMU_PACKED l1_ofs_rt_ofs_cls;
4609
4610     ret = qcow2_cache_empty(bs, s->l2_table_cache);
4611     if (ret < 0) {
4612         goto fail;
4613     }
4614
4615     ret = qcow2_cache_empty(bs, s->refcount_block_cache);
4616     if (ret < 0) {
4617         goto fail;
4618     }
4619
4620     /* Refcounts will be broken utterly */
4621     ret = qcow2_mark_dirty(bs);
4622     if (ret < 0) {
4623         goto fail;
4624     }
4625
4626     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4627
4628     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4629     l1_size2 = (uint64_t)s->l1_size * sizeof(uint64_t);
4630
4631     /* After this call, neither the in-memory nor the on-disk refcount
4632      * information accurately describe the actual references */
4633
4634     ret = bdrv_pwrite_zeroes(bs->file, s->l1_table_offset,
4635                              l1_clusters * s->cluster_size, 0);
4636     if (ret < 0) {
4637         goto fail_broken_refcounts;
4638     }
4639     memset(s->l1_table, 0, l1_size2);
4640
4641     BLKDBG_EVENT(bs->file, BLKDBG_EMPTY_IMAGE_PREPARE);
4642
4643     /* Overwrite enough clusters at the beginning of the sectors to place
4644      * the refcount table, a refcount block and the L1 table in; this may
4645      * overwrite parts of the existing refcount and L1 table, which is not
4646      * an issue because the dirty flag is set, complete data loss is in fact
4647      * desired and partial data loss is consequently fine as well */
4648     ret = bdrv_pwrite_zeroes(bs->file, s->cluster_size,
4649                              (2 + l1_clusters) * s->cluster_size, 0);
4650     /* This call (even if it failed overall) may have overwritten on-disk
4651      * refcount structures; in that case, the in-memory refcount information
4652      * will probably differ from the on-disk information which makes the BDS
4653      * unusable */
4654     if (ret < 0) {
4655         goto fail_broken_refcounts;
4656     }
4657
4658     BLKDBG_EVENT(bs->file, BLKDBG_L1_UPDATE);
4659     BLKDBG_EVENT(bs->file, BLKDBG_REFTABLE_UPDATE);
4660
4661     /* "Create" an empty reftable (one cluster) directly after the image
4662      * header and an empty L1 table three clusters after the image header;
4663      * the cluster between those two will be used as the first refblock */
4664     l1_ofs_rt_ofs_cls.l1_offset = cpu_to_be64(3 * s->cluster_size);
4665     l1_ofs_rt_ofs_cls.reftable_offset = cpu_to_be64(s->cluster_size);
4666     l1_ofs_rt_ofs_cls.reftable_clusters = cpu_to_be32(1);
4667     ret = bdrv_pwrite_sync(bs->file, offsetof(QCowHeader, l1_table_offset),
4668                            &l1_ofs_rt_ofs_cls, sizeof(l1_ofs_rt_ofs_cls));
4669     if (ret < 0) {
4670         goto fail_broken_refcounts;
4671     }
4672
4673     s->l1_table_offset = 3 * s->cluster_size;
4674
4675     new_reftable = g_try_new0(uint64_t, s->cluster_size / sizeof(uint64_t));
4676     if (!new_reftable) {
4677         ret = -ENOMEM;
4678         goto fail_broken_refcounts;
4679     }
4680
4681     s->refcount_table_offset = s->cluster_size;
4682     s->refcount_table_size   = s->cluster_size / sizeof(uint64_t);
4683     s->max_refcount_table_index = 0;
4684
4685     g_free(s->refcount_table);
4686     s->refcount_table = new_reftable;
4687     new_reftable = NULL;
4688
4689     /* Now the in-memory refcount information again corresponds to the on-disk
4690      * information (reftable is empty and no refblocks (the refblock cache is
4691      * empty)); however, this means some clusters (e.g. the image header) are
4692      * referenced, but not refcounted, but the normal qcow2 code assumes that
4693      * the in-memory information is always correct */
4694
4695     BLKDBG_EVENT(bs->file, BLKDBG_REFBLOCK_ALLOC);
4696
4697     /* Enter the first refblock into the reftable */
4698     rt_entry = cpu_to_be64(2 * s->cluster_size);
4699     ret = bdrv_pwrite_sync(bs->file, s->cluster_size,
4700                            &rt_entry, sizeof(rt_entry));
4701     if (ret < 0) {
4702         goto fail_broken_refcounts;
4703     }
4704     s->refcount_table[0] = 2 * s->cluster_size;
4705
4706     s->free_cluster_index = 0;
4707     assert(3 + l1_clusters <= s->refcount_block_size);
4708     offset = qcow2_alloc_clusters(bs, 3 * s->cluster_size + l1_size2);
4709     if (offset < 0) {
4710         ret = offset;
4711         goto fail_broken_refcounts;
4712     } else if (offset > 0) {
4713         error_report("First cluster in emptied image is in use");
4714         abort();
4715     }
4716
4717     /* Now finally the in-memory information corresponds to the on-disk
4718      * structures and is correct */
4719     ret = qcow2_mark_clean(bs);
4720     if (ret < 0) {
4721         goto fail;
4722     }
4723
4724     ret = bdrv_truncate(bs->file, (3 + l1_clusters) * s->cluster_size, false,
4725                         PREALLOC_MODE_OFF, 0, &local_err);
4726     if (ret < 0) {
4727         error_report_err(local_err);
4728         goto fail;
4729     }
4730
4731     return 0;
4732
4733 fail_broken_refcounts:
4734     /* The BDS is unusable at this point. If we wanted to make it usable, we
4735      * would have to call qcow2_refcount_close(), qcow2_refcount_init(),
4736      * qcow2_check_refcounts(), qcow2_refcount_close() and qcow2_refcount_init()
4737      * again. However, because the functions which could have caused this error
4738      * path to be taken are used by those functions as well, it's very likely
4739      * that that sequence will fail as well. Therefore, just eject the BDS. */
4740     bs->drv = NULL;
4741
4742 fail:
4743     g_free(new_reftable);
4744     return ret;
4745 }
4746
4747 static int qcow2_make_empty(BlockDriverState *bs)
4748 {
4749     BDRVQcow2State *s = bs->opaque;
4750     uint64_t offset, end_offset;
4751     int step = QEMU_ALIGN_DOWN(INT_MAX, s->cluster_size);
4752     int l1_clusters, ret = 0;
4753
4754     l1_clusters = DIV_ROUND_UP(s->l1_size, s->cluster_size / sizeof(uint64_t));
4755
4756     if (s->qcow_version >= 3 && !s->snapshots && !s->nb_bitmaps &&
4757         3 + l1_clusters <= s->refcount_block_size &&
4758         s->crypt_method_header != QCOW_CRYPT_LUKS &&
4759         !has_data_file(bs)) {
4760         /* The following function only works for qcow2 v3 images (it
4761          * requires the dirty flag) and only as long as there are no
4762          * features that reserve extra clusters (such as snapshots,
4763          * LUKS header, or persistent bitmaps), because it completely
4764          * empties the image.  Furthermore, the L1 table and three
4765          * additional clusters (image header, refcount table, one
4766          * refcount block) have to fit inside one refcount block. It
4767          * only resets the image file, i.e. does not work with an
4768          * external data file. */
4769         return make_completely_empty(bs);
4770     }
4771
4772     /* This fallback code simply discards every active cluster; this is slow,
4773      * but works in all cases */
4774     end_offset = bs->total_sectors * BDRV_SECTOR_SIZE;
4775     for (offset = 0; offset < end_offset; offset += step) {
4776         /* As this function is generally used after committing an external
4777          * snapshot, QCOW2_DISCARD_SNAPSHOT seems appropriate. Also, the
4778          * default action for this kind of discard is to pass the discard,
4779          * which will ideally result in an actually smaller image file, as
4780          * is probably desired. */
4781         ret = qcow2_cluster_discard(bs, offset, MIN(step, end_offset - offset),
4782                                     QCOW2_DISCARD_SNAPSHOT, true);
4783         if (ret < 0) {
4784             break;
4785         }
4786     }
4787
4788     return ret;
4789 }
4790
4791 static coroutine_fn int qcow2_co_flush_to_os(BlockDriverState *bs)
4792 {
4793     BDRVQcow2State *s = bs->opaque;
4794     int ret;
4795
4796     qemu_co_mutex_lock(&s->lock);
4797     ret = qcow2_write_caches(bs);
4798     qemu_co_mutex_unlock(&s->lock);
4799
4800     return ret;
4801 }
4802
4803 static BlockMeasureInfo *qcow2_measure(QemuOpts *opts, BlockDriverState *in_bs,
4804                                        Error **errp)
4805 {
4806     Error *local_err = NULL;
4807     BlockMeasureInfo *info;
4808     uint64_t required = 0; /* bytes that contribute to required size */
4809     uint64_t virtual_size; /* disk size as seen by guest */
4810     uint64_t refcount_bits;
4811     uint64_t l2_tables;
4812     uint64_t luks_payload_size = 0;
4813     size_t cluster_size;
4814     int version;
4815     char *optstr;
4816     PreallocMode prealloc;
4817     bool has_backing_file;
4818     bool has_luks;
4819
4820     /* Parse image creation options */
4821     cluster_size = qcow2_opt_get_cluster_size_del(opts, &local_err);
4822     if (local_err) {
4823         goto err;
4824     }
4825
4826     version = qcow2_opt_get_version_del(opts, &local_err);
4827     if (local_err) {
4828         goto err;
4829     }
4830
4831     refcount_bits = qcow2_opt_get_refcount_bits_del(opts, version, &local_err);
4832     if (local_err) {
4833         goto err;
4834     }
4835
4836     optstr = qemu_opt_get_del(opts, BLOCK_OPT_PREALLOC);
4837     prealloc = qapi_enum_parse(&PreallocMode_lookup, optstr,
4838                                PREALLOC_MODE_OFF, &local_err);
4839     g_free(optstr);
4840     if (local_err) {
4841         goto err;
4842     }
4843
4844     optstr = qemu_opt_get_del(opts, BLOCK_OPT_BACKING_FILE);
4845     has_backing_file = !!optstr;
4846     g_free(optstr);
4847
4848     optstr = qemu_opt_get_del(opts, BLOCK_OPT_ENCRYPT_FORMAT);
4849     has_luks = optstr && strcmp(optstr, "luks") == 0;
4850     g_free(optstr);
4851
4852     if (has_luks) {
4853         g_autoptr(QCryptoBlockCreateOptions) create_opts = NULL;
4854         QDict *cryptoopts = qcow2_extract_crypto_opts(opts, "luks", errp);
4855         size_t headerlen;
4856
4857         create_opts = block_crypto_create_opts_init(cryptoopts, errp);
4858         qobject_unref(cryptoopts);
4859         if (!create_opts) {
4860             goto err;
4861         }
4862
4863         if (!qcrypto_block_calculate_payload_offset(create_opts,
4864                                                     "encrypt.",
4865                                                     &headerlen,
4866                                                     &local_err)) {
4867             goto err;
4868         }
4869
4870         luks_payload_size = ROUND_UP(headerlen, cluster_size);
4871     }
4872
4873     virtual_size = qemu_opt_get_size_del(opts, BLOCK_OPT_SIZE, 0);
4874     virtual_size = ROUND_UP(virtual_size, cluster_size);
4875
4876     /* Check that virtual disk size is valid */
4877     l2_tables = DIV_ROUND_UP(virtual_size / cluster_size,
4878                              cluster_size / sizeof(uint64_t));
4879     if (l2_tables * sizeof(uint64_t) > QCOW_MAX_L1_SIZE) {
4880         error_setg(&local_err, "The image size is too large "
4881                                "(try using a larger cluster size)");
4882         goto err;
4883     }
4884
4885     /* Account for input image */
4886     if (in_bs) {
4887         int64_t ssize = bdrv_getlength(in_bs);
4888         if (ssize < 0) {
4889             error_setg_errno(&local_err, -ssize,
4890                              "Unable to get image virtual_size");
4891             goto err;
4892         }
4893
4894         virtual_size = ROUND_UP(ssize, cluster_size);
4895
4896         if (has_backing_file) {
4897             /* We don't how much of the backing chain is shared by the input
4898              * image and the new image file.  In the worst case the new image's
4899              * backing file has nothing in common with the input image.  Be
4900              * conservative and assume all clusters need to be written.
4901              */
4902             required = virtual_size;
4903         } else {
4904             int64_t offset;
4905             int64_t pnum = 0;
4906
4907             for (offset = 0; offset < ssize; offset += pnum) {
4908                 int ret;
4909
4910                 ret = bdrv_block_status_above(in_bs, NULL, offset,
4911                                               ssize - offset, &pnum, NULL,
4912                                               NULL);
4913                 if (ret < 0) {
4914                     error_setg_errno(&local_err, -ret,
4915                                      "Unable to get block status");
4916                     goto err;
4917                 }
4918
4919                 if (ret & BDRV_BLOCK_ZERO) {
4920                     /* Skip zero regions (safe with no backing file) */
4921                 } else if ((ret & (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) ==
4922                            (BDRV_BLOCK_DATA | BDRV_BLOCK_ALLOCATED)) {
4923                     /* Extend pnum to end of cluster for next iteration */
4924                     pnum = ROUND_UP(offset + pnum, cluster_size) - offset;
4925
4926                     /* Count clusters we've seen */
4927                     required += offset % cluster_size + pnum;
4928                 }
4929             }
4930         }
4931     }
4932
4933     /* Take into account preallocation.  Nothing special is needed for
4934      * PREALLOC_MODE_METADATA since metadata is always counted.
4935      */
4936     if (prealloc == PREALLOC_MODE_FULL || prealloc == PREALLOC_MODE_FALLOC) {
4937         required = virtual_size;
4938     }
4939
4940     info = g_new0(BlockMeasureInfo, 1);
4941     info->fully_allocated =
4942         qcow2_calc_prealloc_size(virtual_size, cluster_size,
4943                                  ctz32(refcount_bits)) + luks_payload_size;
4944
4945     /*
4946      * Remove data clusters that are not required.  This overestimates the
4947      * required size because metadata needed for the fully allocated file is
4948      * still counted.  Show bitmaps only if both source and destination
4949      * would support them.
4950      */
4951     info->required = info->fully_allocated - virtual_size + required;
4952     info->has_bitmaps = version >= 3 && in_bs &&
4953         bdrv_supports_persistent_dirty_bitmap(in_bs);
4954     if (info->has_bitmaps) {
4955         info->bitmaps = qcow2_get_persistent_dirty_bitmap_size(in_bs,
4956                                                                cluster_size);
4957     }
4958     return info;
4959
4960 err:
4961     error_propagate(errp, local_err);
4962     return NULL;
4963 }
4964
4965 static int qcow2_get_info(BlockDriverState *bs, BlockDriverInfo *bdi)
4966 {
4967     BDRVQcow2State *s = bs->opaque;
4968     bdi->cluster_size = s->cluster_size;
4969     bdi->vm_state_offset = qcow2_vm_state_offset(s);
4970     return 0;
4971 }
4972
4973 static ImageInfoSpecific *qcow2_get_specific_info(BlockDriverState *bs,
4974                                                   Error **errp)
4975 {
4976     BDRVQcow2State *s = bs->opaque;
4977     ImageInfoSpecific *spec_info;
4978     QCryptoBlockInfo *encrypt_info = NULL;
4979     Error *local_err = NULL;
4980
4981     if (s->crypto != NULL) {
4982         encrypt_info = qcrypto_block_get_info(s->crypto, &local_err);
4983         if (local_err) {
4984             error_propagate(errp, local_err);
4985             return NULL;
4986         }
4987     }
4988
4989     spec_info = g_new(ImageInfoSpecific, 1);
4990     *spec_info = (ImageInfoSpecific){
4991         .type  = IMAGE_INFO_SPECIFIC_KIND_QCOW2,
4992         .u.qcow2.data = g_new0(ImageInfoSpecificQCow2, 1),
4993     };
4994     if (s->qcow_version == 2) {
4995         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
4996             .compat             = g_strdup("0.10"),
4997             .refcount_bits      = s->refcount_bits,
4998         };
4999     } else if (s->qcow_version == 3) {
5000         Qcow2BitmapInfoList *bitmaps;
5001         bitmaps = qcow2_get_bitmap_info_list(bs, &local_err);
5002         if (local_err) {
5003             error_propagate(errp, local_err);
5004             qapi_free_ImageInfoSpecific(spec_info);
5005             qapi_free_QCryptoBlockInfo(encrypt_info);
5006             return NULL;
5007         }
5008         *spec_info->u.qcow2.data = (ImageInfoSpecificQCow2){
5009             .compat             = g_strdup("1.1"),
5010             .lazy_refcounts     = s->compatible_features &
5011                                   QCOW2_COMPAT_LAZY_REFCOUNTS,
5012             .has_lazy_refcounts = true,
5013             .corrupt            = s->incompatible_features &
5014                                   QCOW2_INCOMPAT_CORRUPT,
5015             .has_corrupt        = true,
5016             .refcount_bits      = s->refcount_bits,
5017             .has_bitmaps        = !!bitmaps,
5018             .bitmaps            = bitmaps,
5019             .has_data_file      = !!s->image_data_file,
5020             .data_file          = g_strdup(s->image_data_file),
5021             .has_data_file_raw  = has_data_file(bs),
5022             .data_file_raw      = data_file_is_raw(bs),
5023             .compression_type   = s->compression_type,
5024         };
5025     } else {
5026         /* if this assertion fails, this probably means a new version was
5027          * added without having it covered here */
5028         assert(false);
5029     }
5030
5031     if (encrypt_info) {
5032         ImageInfoSpecificQCow2Encryption *qencrypt =
5033             g_new(ImageInfoSpecificQCow2Encryption, 1);
5034         switch (encrypt_info->format) {
5035         case Q_CRYPTO_BLOCK_FORMAT_QCOW:
5036             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_AES;
5037             break;
5038         case Q_CRYPTO_BLOCK_FORMAT_LUKS:
5039             qencrypt->format = BLOCKDEV_QCOW2_ENCRYPTION_FORMAT_LUKS;
5040             qencrypt->u.luks = encrypt_info->u.luks;
5041             break;
5042         default:
5043             abort();
5044         }
5045         /* Since we did shallow copy above, erase any pointers
5046          * in the original info */
5047         memset(&encrypt_info->u, 0, sizeof(encrypt_info->u));
5048         qapi_free_QCryptoBlockInfo(encrypt_info);
5049
5050         spec_info->u.qcow2.data->has_encrypt = true;
5051         spec_info->u.qcow2.data->encrypt = qencrypt;
5052     }
5053
5054     return spec_info;
5055 }
5056
5057 static int qcow2_has_zero_init(BlockDriverState *bs)
5058 {
5059     BDRVQcow2State *s = bs->opaque;
5060     bool preallocated;
5061
5062     if (qemu_in_coroutine()) {
5063         qemu_co_mutex_lock(&s->lock);
5064     }
5065     /*
5066      * Check preallocation status: Preallocated images have all L2
5067      * tables allocated, nonpreallocated images have none.  It is
5068      * therefore enough to check the first one.
5069      */
5070     preallocated = s->l1_size > 0 && s->l1_table[0] != 0;
5071     if (qemu_in_coroutine()) {
5072         qemu_co_mutex_unlock(&s->lock);
5073     }
5074
5075     if (!preallocated) {
5076         return 1;
5077     } else if (bs->encrypted) {
5078         return 0;
5079     } else {
5080         return bdrv_has_zero_init(s->data_file->bs);
5081     }
5082 }
5083
5084 static int qcow2_save_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
5085                               int64_t pos)
5086 {
5087     BDRVQcow2State *s = bs->opaque;
5088
5089     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_SAVE);
5090     return bs->drv->bdrv_co_pwritev_part(bs, qcow2_vm_state_offset(s) + pos,
5091                                          qiov->size, qiov, 0, 0);
5092 }
5093
5094 static int qcow2_load_vmstate(BlockDriverState *bs, QEMUIOVector *qiov,
5095                               int64_t pos)
5096 {
5097     BDRVQcow2State *s = bs->opaque;
5098
5099     BLKDBG_EVENT(bs->file, BLKDBG_VMSTATE_LOAD);
5100     return bs->drv->bdrv_co_preadv_part(bs, qcow2_vm_state_offset(s) + pos,
5101                                         qiov->size, qiov, 0, 0);
5102 }
5103
5104 /*
5105  * Downgrades an image's version. To achieve this, any incompatible features
5106  * have to be removed.
5107  */
5108 static int qcow2_downgrade(BlockDriverState *bs, int target_version,
5109                            BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
5110                            Error **errp)
5111 {
5112     BDRVQcow2State *s = bs->opaque;
5113     int current_version = s->qcow_version;
5114     int ret;
5115     int i;
5116
5117     /* This is qcow2_downgrade(), not qcow2_upgrade() */
5118     assert(target_version < current_version);
5119
5120     /* There are no other versions (now) that you can downgrade to */
5121     assert(target_version == 2);
5122
5123     if (s->refcount_order != 4) {
5124         error_setg(errp, "compat=0.10 requires refcount_bits=16");
5125         return -ENOTSUP;
5126     }
5127
5128     if (has_data_file(bs)) {
5129         error_setg(errp, "Cannot downgrade an image with a data file");
5130         return -ENOTSUP;
5131     }
5132
5133     /*
5134      * If any internal snapshot has a different size than the current
5135      * image size, or VM state size that exceeds 32 bits, downgrading
5136      * is unsafe.  Even though we would still use v3-compliant output
5137      * to preserve that data, other v2 programs might not realize
5138      * those optional fields are important.
5139      */
5140     for (i = 0; i < s->nb_snapshots; i++) {
5141         if (s->snapshots[i].vm_state_size > UINT32_MAX ||
5142             s->snapshots[i].disk_size != bs->total_sectors * BDRV_SECTOR_SIZE) {
5143             error_setg(errp, "Internal snapshots prevent downgrade of image");
5144             return -ENOTSUP;
5145         }
5146     }
5147
5148     /* clear incompatible features */
5149     if (s->incompatible_features & QCOW2_INCOMPAT_DIRTY) {
5150         ret = qcow2_mark_clean(bs);
5151         if (ret < 0) {
5152             error_setg_errno(errp, -ret, "Failed to make the image clean");
5153             return ret;
5154         }
5155     }
5156
5157     /* with QCOW2_INCOMPAT_CORRUPT, it is pretty much impossible to get here in
5158      * the first place; if that happens nonetheless, returning -ENOTSUP is the
5159      * best thing to do anyway */
5160
5161     if (s->incompatible_features) {
5162         error_setg(errp, "Cannot downgrade an image with incompatible features "
5163                    "%#" PRIx64 " set", s->incompatible_features);
5164         return -ENOTSUP;
5165     }
5166
5167     /* since we can ignore compatible features, we can set them to 0 as well */
5168     s->compatible_features = 0;
5169     /* if lazy refcounts have been used, they have already been fixed through
5170      * clearing the dirty flag */
5171
5172     /* clearing autoclear features is trivial */
5173     s->autoclear_features = 0;
5174
5175     ret = qcow2_expand_zero_clusters(bs, status_cb, cb_opaque);
5176     if (ret < 0) {
5177         error_setg_errno(errp, -ret, "Failed to turn zero into data clusters");
5178         return ret;
5179     }
5180
5181     s->qcow_version = target_version;
5182     ret = qcow2_update_header(bs);
5183     if (ret < 0) {
5184         s->qcow_version = current_version;
5185         error_setg_errno(errp, -ret, "Failed to update the image header");
5186         return ret;
5187     }
5188     return 0;
5189 }
5190
5191 /*
5192  * Upgrades an image's version.  While newer versions encompass all
5193  * features of older versions, some things may have to be presented
5194  * differently.
5195  */
5196 static int qcow2_upgrade(BlockDriverState *bs, int target_version,
5197                          BlockDriverAmendStatusCB *status_cb, void *cb_opaque,
5198                          Error **errp)
5199 {
5200     BDRVQcow2State *s = bs->opaque;
5201     bool need_snapshot_update;
5202     int current_version = s->qcow_version;
5203     int i;
5204     int ret;
5205
5206     /* This is qcow2_upgrade(), not qcow2_downgrade() */
5207     assert(target_version > current_version);
5208
5209     /* There are no other versions (yet) that you can upgrade to */
5210     assert(target_version == 3);
5211
5212     status_cb(bs, 0, 2, cb_opaque);
5213
5214     /*
5215      * In v2, snapshots do not need to have extra data.  v3 requires
5216      * the 64-bit VM state size and the virtual disk size to be
5217      * present.
5218      * qcow2_write_snapshots() will always write the list in the
5219      * v3-compliant format.
5220      */
5221     need_snapshot_update = false;
5222     for (i = 0; i < s->nb_snapshots; i++) {
5223         if (s->snapshots[i].extra_data_size <
5224             sizeof_field(QCowSnapshotExtraData, vm_state_size_large) +
5225             sizeof_field(QCowSnapshotExtraData, disk_size))
5226         {
5227             need_snapshot_update = true;
5228             break;
5229         }
5230     }
5231     if (need_snapshot_update) {
5232         ret = qcow2_write_snapshots(bs);
5233         if (ret < 0) {
5234             error_setg_errno(errp, -ret, "Failed to update the snapshot table");
5235             return ret;
5236         }
5237     }
5238     status_cb(bs, 1, 2, cb_opaque);
5239
5240     s->qcow_version = target_version;
5241     ret = qcow2_update_header(bs);
5242     if (ret < 0) {
5243         s->qcow_version = current_version;
5244         error_setg_errno(errp, -ret, "Failed to update the image header");
5245         return ret;
5246     }
5247     status_cb(bs, 2, 2, cb_opaque);
5248
5249     return 0;
5250 }
5251
5252 typedef enum Qcow2AmendOperation {
5253     /* This is the value Qcow2AmendHelperCBInfo::last_operation will be
5254      * statically initialized to so that the helper CB can discern the first
5255      * invocation from an operation change */
5256     QCOW2_NO_OPERATION = 0,
5257
5258     QCOW2_UPGRADING,
5259     QCOW2_UPDATING_ENCRYPTION,
5260     QCOW2_CHANGING_REFCOUNT_ORDER,
5261     QCOW2_DOWNGRADING,
5262 } Qcow2AmendOperation;
5263
5264 typedef struct Qcow2AmendHelperCBInfo {
5265     /* The code coordinating the amend operations should only modify
5266      * these four fields; the rest will be managed by the CB */
5267     BlockDriverAmendStatusCB *original_status_cb;
5268     void *original_cb_opaque;
5269
5270     Qcow2AmendOperation current_operation;
5271
5272     /* Total number of operations to perform (only set once) */
5273     int total_operations;
5274
5275     /* The following fields are managed by the CB */
5276
5277     /* Number of operations completed */
5278     int operations_completed;
5279
5280     /* Cumulative offset of all completed operations */
5281     int64_t offset_completed;
5282
5283     Qcow2AmendOperation last_operation;
5284     int64_t last_work_size;
5285 } Qcow2AmendHelperCBInfo;
5286
5287 static void qcow2_amend_helper_cb(BlockDriverState *bs,
5288                                   int64_t operation_offset,
5289                                   int64_t operation_work_size, void *opaque)
5290 {
5291     Qcow2AmendHelperCBInfo *info = opaque;
5292     int64_t current_work_size;
5293     int64_t projected_work_size;
5294
5295     if (info->current_operation != info->last_operation) {
5296         if (info->last_operation != QCOW2_NO_OPERATION) {
5297             info->offset_completed += info->last_work_size;
5298             info->operations_completed++;
5299         }
5300
5301         info->last_operation = info->current_operation;
5302     }
5303
5304     assert(info->total_operations > 0);
5305     assert(info->operations_completed < info->total_operations);
5306
5307     info->last_work_size = operation_work_size;
5308
5309     current_work_size = info->offset_completed + operation_work_size;
5310
5311     /* current_work_size is the total work size for (operations_completed + 1)
5312      * operations (which includes this one), so multiply it by the number of
5313      * operations not covered and divide it by the number of operations
5314      * covered to get a projection for the operations not covered */
5315     projected_work_size = current_work_size * (info->total_operations -
5316                                                info->operations_completed - 1)
5317                                             / (info->operations_completed + 1);
5318
5319     info->original_status_cb(bs, info->offset_completed + operation_offset,
5320                              current_work_size + projected_work_size,
5321                              info->original_cb_opaque);
5322 }
5323
5324 static int qcow2_amend_options(BlockDriverState *bs, QemuOpts *opts,
5325                                BlockDriverAmendStatusCB *status_cb,
5326                                void *cb_opaque,
5327                                bool force,
5328                                Error **errp)
5329 {
5330     BDRVQcow2State *s = bs->opaque;
5331     int old_version = s->qcow_version, new_version = old_version;
5332     uint64_t new_size = 0;
5333     const char *backing_file = NULL, *backing_format = NULL, *data_file = NULL;
5334     bool lazy_refcounts = s->use_lazy_refcounts;
5335     bool data_file_raw = data_file_is_raw(bs);
5336     const char *compat = NULL;
5337     int refcount_bits = s->refcount_bits;
5338     int ret;
5339     QemuOptDesc *desc = opts->list->desc;
5340     Qcow2AmendHelperCBInfo helper_cb_info;
5341     bool encryption_update = false;
5342
5343     while (desc && desc->name) {
5344         if (!qemu_opt_find(opts, desc->name)) {
5345             /* only change explicitly defined options */
5346             desc++;
5347             continue;
5348         }
5349
5350         if (!strcmp(desc->name, BLOCK_OPT_COMPAT_LEVEL)) {
5351             compat = qemu_opt_get(opts, BLOCK_OPT_COMPAT_LEVEL);
5352             if (!compat) {
5353                 /* preserve default */
5354             } else if (!strcmp(compat, "0.10") || !strcmp(compat, "v2")) {
5355                 new_version = 2;
5356             } else if (!strcmp(compat, "1.1") || !strcmp(compat, "v3")) {
5357                 new_version = 3;
5358             } else {
5359                 error_setg(errp, "Unknown compatibility level %s", compat);
5360                 return -EINVAL;
5361             }
5362         } else if (!strcmp(desc->name, BLOCK_OPT_SIZE)) {
5363             new_size = qemu_opt_get_size(opts, BLOCK_OPT_SIZE, 0);
5364         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FILE)) {
5365             backing_file = qemu_opt_get(opts, BLOCK_OPT_BACKING_FILE);
5366         } else if (!strcmp(desc->name, BLOCK_OPT_BACKING_FMT)) {
5367             backing_format = qemu_opt_get(opts, BLOCK_OPT_BACKING_FMT);
5368         } else if (g_str_has_prefix(desc->name, "encrypt.")) {
5369             if (!s->crypto) {
5370                 error_setg(errp,
5371                            "Can't amend encryption options - encryption not present");
5372                 return -EINVAL;
5373             }
5374             if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
5375                 error_setg(errp,
5376                            "Only LUKS encryption options can be amended");
5377                 return -ENOTSUP;
5378             }
5379             encryption_update = true;
5380         } else if (!strcmp(desc->name, BLOCK_OPT_LAZY_REFCOUNTS)) {
5381             lazy_refcounts = qemu_opt_get_bool(opts, BLOCK_OPT_LAZY_REFCOUNTS,
5382                                                lazy_refcounts);
5383         } else if (!strcmp(desc->name, BLOCK_OPT_REFCOUNT_BITS)) {
5384             refcount_bits = qemu_opt_get_number(opts, BLOCK_OPT_REFCOUNT_BITS,
5385                                                 refcount_bits);
5386
5387             if (refcount_bits <= 0 || refcount_bits > 64 ||
5388                 !is_power_of_2(refcount_bits))
5389             {
5390                 error_setg(errp, "Refcount width must be a power of two and "
5391                            "may not exceed 64 bits");
5392                 return -EINVAL;
5393             }
5394         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE)) {
5395             data_file = qemu_opt_get(opts, BLOCK_OPT_DATA_FILE);
5396             if (data_file && !has_data_file(bs)) {
5397                 error_setg(errp, "data-file can only be set for images that "
5398                                  "use an external data file");
5399                 return -EINVAL;
5400             }
5401         } else if (!strcmp(desc->name, BLOCK_OPT_DATA_FILE_RAW)) {
5402             data_file_raw = qemu_opt_get_bool(opts, BLOCK_OPT_DATA_FILE_RAW,
5403                                               data_file_raw);
5404             if (data_file_raw && !data_file_is_raw(bs)) {
5405                 error_setg(errp, "data-file-raw cannot be set on existing "
5406                                  "images");
5407                 return -EINVAL;
5408             }
5409         } else {
5410             /* if this point is reached, this probably means a new option was
5411              * added without having it covered here */
5412             abort();
5413         }
5414
5415         desc++;
5416     }
5417
5418     helper_cb_info = (Qcow2AmendHelperCBInfo){
5419         .original_status_cb = status_cb,
5420         .original_cb_opaque = cb_opaque,
5421         .total_operations = (new_version != old_version)
5422                           + (s->refcount_bits != refcount_bits) +
5423                             (encryption_update == true)
5424     };
5425
5426     /* Upgrade first (some features may require compat=1.1) */
5427     if (new_version > old_version) {
5428         helper_cb_info.current_operation = QCOW2_UPGRADING;
5429         ret = qcow2_upgrade(bs, new_version, &qcow2_amend_helper_cb,
5430                             &helper_cb_info, errp);
5431         if (ret < 0) {
5432             return ret;
5433         }
5434     }
5435
5436     if (encryption_update) {
5437         QDict *amend_opts_dict;
5438         QCryptoBlockAmendOptions *amend_opts;
5439
5440         helper_cb_info.current_operation = QCOW2_UPDATING_ENCRYPTION;
5441         amend_opts_dict = qcow2_extract_crypto_opts(opts, "luks", errp);
5442         if (!amend_opts_dict) {
5443             return -EINVAL;
5444         }
5445         amend_opts = block_crypto_amend_opts_init(amend_opts_dict, errp);
5446         qobject_unref(amend_opts_dict);
5447         if (!amend_opts) {
5448             return -EINVAL;
5449         }
5450         ret = qcrypto_block_amend_options(s->crypto,
5451                                           qcow2_crypto_hdr_read_func,
5452                                           qcow2_crypto_hdr_write_func,
5453                                           bs,
5454                                           amend_opts,
5455                                           force,
5456                                           errp);
5457         qapi_free_QCryptoBlockAmendOptions(amend_opts);
5458         if (ret < 0) {
5459             return ret;
5460         }
5461     }
5462
5463     if (s->refcount_bits != refcount_bits) {
5464         int refcount_order = ctz32(refcount_bits);
5465
5466         if (new_version < 3 && refcount_bits != 16) {
5467             error_setg(errp, "Refcount widths other than 16 bits require "
5468                        "compatibility level 1.1 or above (use compat=1.1 or "
5469                        "greater)");
5470             return -EINVAL;
5471         }
5472
5473         helper_cb_info.current_operation = QCOW2_CHANGING_REFCOUNT_ORDER;
5474         ret = qcow2_change_refcount_order(bs, refcount_order,
5475                                           &qcow2_amend_helper_cb,
5476                                           &helper_cb_info, errp);
5477         if (ret < 0) {
5478             return ret;
5479         }
5480     }
5481
5482     /* data-file-raw blocks backing files, so clear it first if requested */
5483     if (data_file_raw) {
5484         s->autoclear_features |= QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5485     } else {
5486         s->autoclear_features &= ~QCOW2_AUTOCLEAR_DATA_FILE_RAW;
5487     }
5488
5489     if (data_file) {
5490         g_free(s->image_data_file);
5491         s->image_data_file = *data_file ? g_strdup(data_file) : NULL;
5492     }
5493
5494     ret = qcow2_update_header(bs);
5495     if (ret < 0) {
5496         error_setg_errno(errp, -ret, "Failed to update the image header");
5497         return ret;
5498     }
5499
5500     if (backing_file || backing_format) {
5501         if (g_strcmp0(backing_file, s->image_backing_file) ||
5502             g_strcmp0(backing_format, s->image_backing_format)) {
5503             warn_report("Deprecated use of amend to alter the backing file; "
5504                         "use qemu-img rebase instead");
5505         }
5506         ret = qcow2_change_backing_file(bs,
5507                     backing_file ?: s->image_backing_file,
5508                     backing_format ?: s->image_backing_format);
5509         if (ret < 0) {
5510             error_setg_errno(errp, -ret, "Failed to change the backing file");
5511             return ret;
5512         }
5513     }
5514
5515     if (s->use_lazy_refcounts != lazy_refcounts) {
5516         if (lazy_refcounts) {
5517             if (new_version < 3) {
5518                 error_setg(errp, "Lazy refcounts only supported with "
5519                            "compatibility level 1.1 and above (use compat=1.1 "
5520                            "or greater)");
5521                 return -EINVAL;
5522             }
5523             s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5524             ret = qcow2_update_header(bs);
5525             if (ret < 0) {
5526                 s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5527                 error_setg_errno(errp, -ret, "Failed to update the image header");
5528                 return ret;
5529             }
5530             s->use_lazy_refcounts = true;
5531         } else {
5532             /* make image clean first */
5533             ret = qcow2_mark_clean(bs);
5534             if (ret < 0) {
5535                 error_setg_errno(errp, -ret, "Failed to make the image clean");
5536                 return ret;
5537             }
5538             /* now disallow lazy refcounts */
5539             s->compatible_features &= ~QCOW2_COMPAT_LAZY_REFCOUNTS;
5540             ret = qcow2_update_header(bs);
5541             if (ret < 0) {
5542                 s->compatible_features |= QCOW2_COMPAT_LAZY_REFCOUNTS;
5543                 error_setg_errno(errp, -ret, "Failed to update the image header");
5544                 return ret;
5545             }
5546             s->use_lazy_refcounts = false;
5547         }
5548     }
5549
5550     if (new_size) {
5551         BlockBackend *blk = blk_new_with_bs(bs, BLK_PERM_RESIZE, BLK_PERM_ALL,
5552                                             errp);
5553         if (!blk) {
5554             return -EPERM;
5555         }
5556
5557         /*
5558          * Amending image options should ensure that the image has
5559          * exactly the given new values, so pass exact=true here.
5560          */
5561         ret = blk_truncate(blk, new_size, true, PREALLOC_MODE_OFF, 0, errp);
5562         blk_unref(blk);
5563         if (ret < 0) {
5564             return ret;
5565         }
5566     }
5567
5568     /* Downgrade last (so unsupported features can be removed before) */
5569     if (new_version < old_version) {
5570         helper_cb_info.current_operation = QCOW2_DOWNGRADING;
5571         ret = qcow2_downgrade(bs, new_version, &qcow2_amend_helper_cb,
5572                               &helper_cb_info, errp);
5573         if (ret < 0) {
5574             return ret;
5575         }
5576     }
5577
5578     return 0;
5579 }
5580
5581 static int coroutine_fn qcow2_co_amend(BlockDriverState *bs,
5582                                        BlockdevAmendOptions *opts,
5583                                        bool force,
5584                                        Error **errp)
5585 {
5586     BlockdevAmendOptionsQcow2 *qopts = &opts->u.qcow2;
5587     BDRVQcow2State *s = bs->opaque;
5588     int ret = 0;
5589
5590     if (qopts->has_encrypt) {
5591         if (!s->crypto) {
5592             error_setg(errp, "image is not encrypted, can't amend");
5593             return -EOPNOTSUPP;
5594         }
5595
5596         if (qopts->encrypt->format != Q_CRYPTO_BLOCK_FORMAT_LUKS) {
5597             error_setg(errp,
5598                        "Amend can't be used to change the qcow2 encryption format");
5599             return -EOPNOTSUPP;
5600         }
5601
5602         if (s->crypt_method_header != QCOW_CRYPT_LUKS) {
5603             error_setg(errp,
5604                        "Only LUKS encryption options can be amended for qcow2 with blockdev-amend");
5605             return -EOPNOTSUPP;
5606         }
5607
5608         ret = qcrypto_block_amend_options(s->crypto,
5609                                           qcow2_crypto_hdr_read_func,
5610                                           qcow2_crypto_hdr_write_func,
5611                                           bs,
5612                                           qopts->encrypt,
5613                                           force,
5614                                           errp);
5615     }
5616     return ret;
5617 }
5618
5619 /*
5620  * If offset or size are negative, respectively, they will not be included in
5621  * the BLOCK_IMAGE_CORRUPTED event emitted.
5622  * fatal will be ignored for read-only BDS; corruptions found there will always
5623  * be considered non-fatal.
5624  */
5625 void qcow2_signal_corruption(BlockDriverState *bs, bool fatal, int64_t offset,
5626                              int64_t size, const char *message_format, ...)
5627 {
5628     BDRVQcow2State *s = bs->opaque;
5629     const char *node_name;
5630     char *message;
5631     va_list ap;
5632
5633     fatal = fatal && bdrv_is_writable(bs);
5634
5635     if (s->signaled_corruption &&
5636         (!fatal || (s->incompatible_features & QCOW2_INCOMPAT_CORRUPT)))
5637     {
5638         return;
5639     }
5640
5641     va_start(ap, message_format);
5642     message = g_strdup_vprintf(message_format, ap);
5643     va_end(ap);
5644
5645     if (fatal) {
5646         fprintf(stderr, "qcow2: Marking image as corrupt: %s; further "
5647                 "corruption events will be suppressed\n", message);
5648     } else {
5649         fprintf(stderr, "qcow2: Image is corrupt: %s; further non-fatal "
5650                 "corruption events will be suppressed\n", message);
5651     }
5652
5653     node_name = bdrv_get_node_name(bs);
5654     qapi_event_send_block_image_corrupted(bdrv_get_device_name(bs),
5655                                           *node_name != '\0', node_name,
5656                                           message, offset >= 0, offset,
5657                                           size >= 0, size,
5658                                           fatal);
5659     g_free(message);
5660
5661     if (fatal) {
5662         qcow2_mark_corrupt(bs);
5663         bs->drv = NULL; /* make BDS unusable */
5664     }
5665
5666     s->signaled_corruption = true;
5667 }
5668
5669 #define QCOW_COMMON_OPTIONS                                         \
5670     {                                                               \
5671         .name = BLOCK_OPT_SIZE,                                     \
5672         .type = QEMU_OPT_SIZE,                                      \
5673         .help = "Virtual disk size"                                 \
5674     },                                                              \
5675     {                                                               \
5676         .name = BLOCK_OPT_COMPAT_LEVEL,                             \
5677         .type = QEMU_OPT_STRING,                                    \
5678         .help = "Compatibility level (v2 [0.10] or v3 [1.1])"       \
5679     },                                                              \
5680     {                                                               \
5681         .name = BLOCK_OPT_BACKING_FILE,                             \
5682         .type = QEMU_OPT_STRING,                                    \
5683         .help = "File name of a base image"                         \
5684     },                                                              \
5685     {                                                               \
5686         .name = BLOCK_OPT_BACKING_FMT,                              \
5687         .type = QEMU_OPT_STRING,                                    \
5688         .help = "Image format of the base image"                    \
5689     },                                                              \
5690     {                                                               \
5691         .name = BLOCK_OPT_DATA_FILE,                                \
5692         .type = QEMU_OPT_STRING,                                    \
5693         .help = "File name of an external data file"                \
5694     },                                                              \
5695     {                                                               \
5696         .name = BLOCK_OPT_DATA_FILE_RAW,                            \
5697         .type = QEMU_OPT_BOOL,                                      \
5698         .help = "The external data file must stay valid "           \
5699                 "as a raw image"                                    \
5700     },                                                              \
5701     {                                                               \
5702         .name = BLOCK_OPT_LAZY_REFCOUNTS,                           \
5703         .type = QEMU_OPT_BOOL,                                      \
5704         .help = "Postpone refcount updates",                        \
5705         .def_value_str = "off"                                      \
5706     },                                                              \
5707     {                                                               \
5708         .name = BLOCK_OPT_REFCOUNT_BITS,                            \
5709         .type = QEMU_OPT_NUMBER,                                    \
5710         .help = "Width of a reference count entry in bits",         \
5711         .def_value_str = "16"                                       \
5712     }
5713
5714 static QemuOptsList qcow2_create_opts = {
5715     .name = "qcow2-create-opts",
5716     .head = QTAILQ_HEAD_INITIALIZER(qcow2_create_opts.head),
5717     .desc = {
5718         {                                                               \
5719             .name = BLOCK_OPT_ENCRYPT,                                  \
5720             .type = QEMU_OPT_BOOL,                                      \
5721             .help = "Encrypt the image with format 'aes'. (Deprecated " \
5722                     "in favor of " BLOCK_OPT_ENCRYPT_FORMAT "=aes)",    \
5723         },                                                              \
5724         {                                                               \
5725             .name = BLOCK_OPT_ENCRYPT_FORMAT,                           \
5726             .type = QEMU_OPT_STRING,                                    \
5727             .help = "Encrypt the image, format choices: 'aes', 'luks'", \
5728         },                                                              \
5729         BLOCK_CRYPTO_OPT_DEF_KEY_SECRET("encrypt.",                     \
5730             "ID of secret providing qcow AES key or LUKS passphrase"),  \
5731         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_ALG("encrypt."),               \
5732         BLOCK_CRYPTO_OPT_DEF_LUKS_CIPHER_MODE("encrypt."),              \
5733         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_ALG("encrypt."),                \
5734         BLOCK_CRYPTO_OPT_DEF_LUKS_IVGEN_HASH_ALG("encrypt."),           \
5735         BLOCK_CRYPTO_OPT_DEF_LUKS_HASH_ALG("encrypt."),                 \
5736         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),                \
5737         {                                                               \
5738             .name = BLOCK_OPT_CLUSTER_SIZE,                             \
5739             .type = QEMU_OPT_SIZE,                                      \
5740             .help = "qcow2 cluster size",                               \
5741             .def_value_str = stringify(DEFAULT_CLUSTER_SIZE)            \
5742         },                                                              \
5743         {                                                               \
5744             .name = BLOCK_OPT_PREALLOC,                                 \
5745             .type = QEMU_OPT_STRING,                                    \
5746             .help = "Preallocation mode (allowed values: off, "         \
5747                     "metadata, falloc, full)"                           \
5748         },                                                              \
5749         {                                                               \
5750             .name = BLOCK_OPT_COMPRESSION_TYPE,                         \
5751             .type = QEMU_OPT_STRING,                                    \
5752             .help = "Compression method used for image cluster "        \
5753                     "compression",                                      \
5754             .def_value_str = "zlib"                                     \
5755         },
5756         QCOW_COMMON_OPTIONS,
5757         { /* end of list */ }
5758     }
5759 };
5760
5761 static QemuOptsList qcow2_amend_opts = {
5762     .name = "qcow2-amend-opts",
5763     .head = QTAILQ_HEAD_INITIALIZER(qcow2_amend_opts.head),
5764     .desc = {
5765         BLOCK_CRYPTO_OPT_DEF_LUKS_STATE("encrypt."),
5766         BLOCK_CRYPTO_OPT_DEF_LUKS_KEYSLOT("encrypt."),
5767         BLOCK_CRYPTO_OPT_DEF_LUKS_OLD_SECRET("encrypt."),
5768         BLOCK_CRYPTO_OPT_DEF_LUKS_NEW_SECRET("encrypt."),
5769         BLOCK_CRYPTO_OPT_DEF_LUKS_ITER_TIME("encrypt."),
5770         QCOW_COMMON_OPTIONS,
5771         { /* end of list */ }
5772     }
5773 };
5774
5775 static const char *const qcow2_strong_runtime_opts[] = {
5776     "encrypt." BLOCK_CRYPTO_OPT_QCOW_KEY_SECRET,
5777
5778     NULL
5779 };
5780
5781 BlockDriver bdrv_qcow2 = {
5782     .format_name        = "qcow2",
5783     .instance_size      = sizeof(BDRVQcow2State),
5784     .bdrv_probe         = qcow2_probe,
5785     .bdrv_open          = qcow2_open,
5786     .bdrv_close         = qcow2_close,
5787     .bdrv_reopen_prepare  = qcow2_reopen_prepare,
5788     .bdrv_reopen_commit   = qcow2_reopen_commit,
5789     .bdrv_reopen_commit_post = qcow2_reopen_commit_post,
5790     .bdrv_reopen_abort    = qcow2_reopen_abort,
5791     .bdrv_join_options    = qcow2_join_options,
5792     .bdrv_child_perm      = bdrv_default_perms,
5793     .bdrv_co_create_opts  = qcow2_co_create_opts,
5794     .bdrv_co_create       = qcow2_co_create,
5795     .bdrv_has_zero_init   = qcow2_has_zero_init,
5796     .bdrv_co_block_status = qcow2_co_block_status,
5797
5798     .bdrv_co_preadv_part    = qcow2_co_preadv_part,
5799     .bdrv_co_pwritev_part   = qcow2_co_pwritev_part,
5800     .bdrv_co_flush_to_os    = qcow2_co_flush_to_os,
5801
5802     .bdrv_co_pwrite_zeroes  = qcow2_co_pwrite_zeroes,
5803     .bdrv_co_pdiscard       = qcow2_co_pdiscard,
5804     .bdrv_co_copy_range_from = qcow2_co_copy_range_from,
5805     .bdrv_co_copy_range_to  = qcow2_co_copy_range_to,
5806     .bdrv_co_truncate       = qcow2_co_truncate,
5807     .bdrv_co_pwritev_compressed_part = qcow2_co_pwritev_compressed_part,
5808     .bdrv_make_empty        = qcow2_make_empty,
5809
5810     .bdrv_snapshot_create   = qcow2_snapshot_create,
5811     .bdrv_snapshot_goto     = qcow2_snapshot_goto,
5812     .bdrv_snapshot_delete   = qcow2_snapshot_delete,
5813     .bdrv_snapshot_list     = qcow2_snapshot_list,
5814     .bdrv_snapshot_load_tmp = qcow2_snapshot_load_tmp,
5815     .bdrv_measure           = qcow2_measure,
5816     .bdrv_get_info          = qcow2_get_info,
5817     .bdrv_get_specific_info = qcow2_get_specific_info,
5818
5819     .bdrv_save_vmstate    = qcow2_save_vmstate,
5820     .bdrv_load_vmstate    = qcow2_load_vmstate,
5821
5822     .is_format                  = true,
5823     .supports_backing           = true,
5824     .bdrv_change_backing_file   = qcow2_change_backing_file,
5825
5826     .bdrv_refresh_limits        = qcow2_refresh_limits,
5827     .bdrv_co_invalidate_cache   = qcow2_co_invalidate_cache,
5828     .bdrv_inactivate            = qcow2_inactivate,
5829
5830     .create_opts         = &qcow2_create_opts,
5831     .amend_opts          = &qcow2_amend_opts,
5832     .strong_runtime_opts = qcow2_strong_runtime_opts,
5833     .mutable_opts        = mutable_opts,
5834     .bdrv_co_check       = qcow2_co_check,
5835     .bdrv_amend_options  = qcow2_amend_options,
5836     .bdrv_co_amend       = qcow2_co_amend,
5837
5838     .bdrv_detach_aio_context  = qcow2_detach_aio_context,
5839     .bdrv_attach_aio_context  = qcow2_attach_aio_context,
5840
5841     .bdrv_supports_persistent_dirty_bitmap =
5842             qcow2_supports_persistent_dirty_bitmap,
5843     .bdrv_co_can_store_new_dirty_bitmap = qcow2_co_can_store_new_dirty_bitmap,
5844     .bdrv_co_remove_persistent_dirty_bitmap =
5845             qcow2_co_remove_persistent_dirty_bitmap,
5846 };
5847
5848 static void bdrv_qcow2_init(void)
5849 {
5850     bdrv_register(&bdrv_qcow2);
5851 }
5852
5853 block_init(bdrv_qcow2_init);